Certificate and Key Matcher
Paste a certificate, a CSR and a private key and see whether they belong to the same key pair, by comparing their public keys, without uploading anything.
Free · No sign-up · Your inputs stay in your browser
Input
Check that a certificate, CSR and private key match
Output
Paste PEM blocks
Each block's public key is extracted (the modulus for RSA, the point for EC) and fingerprinted, so a certificate and the key Nginx loads alongside it can be compared without either leaving this page. A mismatch is what makes Nginx refuse to start with key values mismatch. The openssl equivalent compares openssl x509 -noout -pubkey -in cert.pem with openssl pkey -pubout -in key.pem.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The error it explains
Nginx refuses to start with "key values mismatch" and Apache with a similar message when the certificate and key files do not belong together, often after a renewal where the CSR was generated with a new key that was not kept, or when files from two domains were swapped. Comparing fingerprints answers it in seconds.
With OpenSSL
openssl x509 -in cert.pem -noout -pubkey and openssl pkey -in key.pem -pubout print the two public keys; if they are identical, the pair matches. The older modulus comparison only works for RSA.