SPKI · SHA-256
Certificate key matcher
Paste a certificate, a CSR and a private key (any two, or all three) to see whether they share one key pair. The private key is read in your browser, never uploaded and never stored.
Compare keys
How the comparison works
A certificate, its CSR and its private key all carry the same public key. The matcher extracts it from each input, encodes it the standard way (SubjectPublicKeyInfo) and compares SHA-256 hashes. Equal hashes mean the files belong together.
It reads PEM or DER certificates and CSRs, private keys in PKCS#8 (BEGIN PRIVATE KEY), PKCS#1 (BEGIN RSA PRIVATE KEY) or EC form, and public keys. To check on a server instead, the hash of each of these commands should be the same:
openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256
openssl pkey -in private.key -pubout -outform DER | openssl dgst -sha256
Frequently asked questions
Is it safe to paste my private key?
It is processed by JavaScript in this tab only: nothing is uploaded, logged or stored, and it is gone when you close or reload the page. If your policy forbids pasting keys into any web page, run the OpenSSL commands above instead.
What if my key is encrypted?
Encrypted keys need their passphrase, which this tool does not ask for. Print the public key on your machine with openssl pkey -in key.pem -pubout and paste that in the key box; it compares just as well.
The key matches but the server still fails. Why?
A matching key is only one requirement. Check that the server also sends its intermediate certificates with the chain checker, and that the certificate covers the host name and has not expired.