Free SSL tool

Key-CSR-Cert Matcher

Paste your private key, CSR, and SSL certificate to verify they all match. Mismatched keys and certificates are a leading cause of confusing "SSL handshake failed" errors during installation.

How to verify your key, CSR and certificate match

Paste your private key — Copy the private key (-----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----) into the first field.
Paste your CSR — Paste the CSR (-----BEGIN CERTIFICATE REQUEST-----) into the second field.
Paste your certificate — Paste the signed certificate (-----BEGIN CERTIFICATE-----) into the third field.
Click "Match" — The tool derives the public key from each item and checks they share the same modulus. A mismatch means certificate installation will fail.

Frequently asked questions

Why would a key, CSR and certificate not match?

The most common reason is regenerating the CSR after submission — this creates a new key pair. The CA signs the original CSR, so the old certificate won't match the new key. Always keep the original key until the certificate is installed.

Is this check done locally?

Yes. All three inputs are processed in your browser. Your private key never leaves your device.

What happens if they don't match?

Certificate installation will fail or produce an SSL error in browsers. You'll need to either find the correct matching key or reissue the certificate using a new CSR generated from the current key.

Do I need all three fields?

No. You can check any two of the three — for example, just the key and certificate — to verify a partial match.