Online Tools › Key – CSR – Cert Matcher

🔗 Key – CSR – Cert Matcher

🔒 Client-side only

Paste any of: Private Key, CSR, and/or Certificate (PEM). We'll check if they belong to the same key pair.

ℹ️ Waiting for input… Paste at least two items to compare.

Private Key (PEM) ⓘ

CSR (PEM) ⓘ

Certificate (PEM) ⓘ

No uploads • Works offline after load

GuideHow to check a match

Paste any two of the three. Private key + certificate is the most common check; key + CSR and CSR + certificate also work.
Run the match. The tool compares the underlying public keys via their modulus without ever sending your files anywhere.
Read the verdict. A match means the files share one key pair and will install cleanly. A mismatch means at least one file belongs to a different pair.
Fix a mismatch. Locate the correct private key, or generate a new CSR and reissue the certificate so all three align.

Why a mismatch happens

A certificate only works with the exact private key that its CSR was built from. If you generate a new CSR (and key) but install an older certificate, or grab the wrong .key file from a server with several, the public keys won't line up and the server refuses to start TLS. Checking before you install turns a confusing production error into a five-second confirmation.

Common causes of a "key does not match certificate" error

Wrong private key. The server has multiple keys and the wrong one was referenced in the config.
Regenerated CSR. A new CSR was created (new key) but the old certificate is still installed.
Reissued certificate. The certificate was reissued against a different CSR than the key on the server.
Copy-paste damage. A truncated or altered PEM block — missing BEGIN/END lines or stray characters.

Need a fresh, matching pair? Generate one with the CSR Generator. Want to read what's inside each file first? Use the SSL Decoder.

Frequently asked questions

Is my private key uploaded anywhere?

No. The matcher runs entirely in your browser and works offline after the page loads. Your private key never leaves your device.

Which two files should I compare?

To debug an install error, compare the private key and the certificate. That's the pair the server actually uses.

It says they don't match — what now?

Find the private key that was generated with the certificate's CSR. If it's lost, generate a new CSR and reissue the certificate so key, CSR and certificate all align.

Does a match guarantee the certificate is valid?

No — it only confirms they share a key pair. Check validity and expiry separately with the SSL Certificate Checker.

Mismatch that won't resolve? Reissue a clean, matching certificate.

Compare SSL plans →