Check that a private key matches a certificate

Drop a certificate and one or more private keys or CSRs. PKIScope pairs them by their public key and shows which key belongs to which certificate, across PEM, DER, PKCS#1, PKCS#8, SEC1, encrypted keys and PFX files. The private key is read only in your browser.

What you can do

• Pairs keys, certificates and CSRs by their public key
• RSA, ECDSA and Ed25519 keys
• PEM, DER, PKCS#1, PKCS#8 and SEC1, encrypted or plain
• Works with keys and certificates inside PFX files
• Gives the OpenSSL commands to confirm a mismatch

Frequently asked questions

How do I check with OpenSSL whether a key matches a certificate?

Compare the public keys: openssl x509 -in cert.pem -noout -pubkey and openssl pkey -in key.pem -pubout should print the same key. PKIScope does this for every key and certificate you load at once.

What does “key values mismatch” mean?

The private key doesn't belong to the certificate, usually because the certificate was issued for a CSR made with another key. Find the key that matches here, or create a new CSR and re-issue the certificate.

Can it match an encrypted private key?

Yes. Enter the key's password when prompted; it is used only in your browser.

Is it safe to load a production private key?

The key is parsed in this tab and never sent anywhere. If your policy forbids private keys leaving a server, compare public-key hashes there with OpenSSL instead.

Related tools

• PFX viewer — Open a PFX/P12 file and see every certificate and key inside
• Certificate decoder — Decode an X.509 certificate from PEM, DER, CRT or CER
• PEM to PFX — Combine certificate, key and chain into a PFX/P12
• CSR generator — Create a certificate signing request and private key