SSL Certificate & Key Pair Checker

Free

Check whether an SSL/TLS private key, certificate, and optional CSR actually belong to the same key pair, decode and view the certificate's subject, issuer, validity, SANs and fingerprints, all running entirely in your browser.

Private key

Passphrase (only if the key above is encrypted)

Certificate

Also check a CSR (optional)

Paste a Certificate Signing Request to also check it against the key and/or certificate above.

Recent Activity

Visible to everyone. Last 20 uses across all visitors, newest first.

Checked a certificate/key pair (0 comparisons)

2 hours ago

Checked a certificate/key pair (0 comparisons)

2 hours ago

Checked a certificate/key pair (0 comparisons)

2 hours ago

Checked a certificate/key pair (1 comparisons)

2 hours ago

Checked a certificate/key pair (3 comparisons)

2 hours ago

Comments (0)

Found this tool useful? Leave a comment, share a tip, or tell us how we can make it better.

No comments yet. Be the first to share your thoughts!

What this tool does

This tool checks whether an SSL/TLS private key, certificate, and (optionally) a Certificate Signing Request actually belong to the same key pair, decodes and displays the certificate's subject, issuer, validity period, Subject Alternative Names, and fingerprints, and flags expired or not-yet-valid certificates, all without uploading any of your key material anywhere.

How It Works

Every RSA key pair shares the same modulus and public exponent between its private and public halves. This tool parses each PEM you paste (decrypting the private key first if you supply a passphrase), extracts the public key's modulus and exponent from each of the private key, certificate, and CSR independently, and compares those values pairwise: an identical modulus and exponent means the two files were generated from the same underlying key pair. It also computes SHA-256 fingerprints of the certificate and its public key, and the legacy MD5-of-modulus hash some sysadmins still cross-check by hand.

Problems it solves

Diagnosing a web server that fails to start or serves the wrong certificate because the configured key file does not actually match the configured certificate file.
Confirming which private key (out of several old backups) actually matches a certificate you still have, before deploying it.
Verifying that a certificate you received from a Certificate Authority corresponds to the CSR you originally submitted, and to the private key you kept.
Quickly reading a certificate's expiry date and Subject Alternative Names without installing OpenSSL or any command-line tools.

Frequently asked questions

›How does this tool know a private key and certificate belong together?

An RSA certificate embeds the public key half of a key pair (its modulus and exponent). This tool extracts that public key from the certificate and compares it to the public key mathematically derived from your private key; if the modulus and exponent are identical, the two files were generated from the same key pair, which is exactly what a web server needs to present that certificate using that key.

›Is it safe to paste my private key into a browser-based tool?

This tool never sends anything over the network: all parsing, decryption, and comparison happens locally in your browser using the node-forge library, and the page works the same with your network connection disabled after it loads. Still, treat any tool handling private keys with appropriate caution and prefer running sensitive checks on a trusted machine.

›My private key is encrypted, what do I enter?

Paste the encrypted key exactly as it appears in the file, including the "ENCRYPTED" header, and enter its passphrase in the field below the key box. This tool supports both the legacy OpenSSL format (Proc-Type: 4,ENCRYPTED) and the modern PKCS#8 encrypted format; an incorrect passphrase is reported clearly rather than silently failing.

›What does the CSR check add?

A Certificate Signing Request (CSR) also embeds a public key, generated at the same time as its matching private key, before a Certificate Authority issues the actual certificate. Checking the CSR lets you confirm the chain end-to-end: that your private key matches the CSR you submitted, and that the certificate you received back actually corresponds to that same CSR, catching cases where the wrong certificate was downloaded or the wrong key was kept.

›Does this work with elliptic curve (EC) certificates?

Not yet: this tool currently parses and compares RSA keys only. If you paste an EC certificate or key, it will tell you the key type is unsupported rather than silently giving a wrong result.

›What is the "Modulus MD5 (legacy)" value for?

It reproduces the classic sysadmin trick of comparing openssl x509 -noout -modulus | openssl md5 against openssl rsa -noout -modulus | openssl md5: if you want to verify this tool's match result independently using your own OpenSSL installation, these two MD5 values should be identical whenever this tool reports a match.

Generates IPv4-mapped, IPv4-compatible, 6to4, and NAT64 IPv6 representations of an IPv4 address, and extracts the IPv4 address back out of any of those IPv6 forms.