Key Matcher
Verify that your certificate, CSR, and private key belong together.
Your Private Key Is Protected
This page runs in a hardened security environment. No analytics, tracking, or third-party scripts are loaded. Your private key is never stored, logged, or cached.
Frequently asked questions
What does the key matcher do?
It confirms that a certificate, a CSR and a private key belong to the same key pair by comparing their public-key (SPKI) SHA-256 fingerprints. Provide any two or all three inputs to check they match.
Why would a certificate and private key not match?
Common causes are installing a certificate against the wrong key after regenerating a CSR, mixing up files during renewal, or reusing an old key. A mismatch causes TLS handshake failures, so verify before deploying.
Is it safe to paste my private key here?
This page runs on a hardened, browser-only shell with no analytics, tracking or third-party scripts, and nothing is stored, logged or cached. Even so, only use unencrypted keys you are comfortable pasting, and prefer test keys where possible.
How does the matching actually work?
Each input's public key is derived and hashed to an SPKI SHA-256 fingerprint. If the fingerprints are identical the inputs share the same underlying key pair; if any differ, the tool flags exactly which pair does not match.
How many inputs do I need to provide?
At least two of the three — certificate, CSR or private key. The tool then reports each pairwise match so you can pinpoint which file is the odd one out.