SSL Tools · Match CSR and Private Key with SSL Certificate
Check the key matches before you install anything
Confirm a certificate, its signing request and its private key belong to each other before you install anything.
- Free
- No sign-up
- Nothing you paste is stored
Three files have to agree before a certificate will install: the certificate, the request it came from, and the private key. Paste two of them and we will tell you whether they belong together.
What a mismatch means
- The certificate was issued from a different CSR than the one you kept
- The private key on this server belongs to an older certificate
- Someone regenerated the CSR after ordering, which invalidates the key pair
- In every case the fix is the same: reissue from the CSR whose key you still hold
Why three files have to agree
A private key and its public key are generated together. The CSR carries the public half; the authority signs it and returns a certificate carrying the same public half. A server will only serve a certificate if it holds the private key that matches. If it does not, the install fails - often with a message that says nothing useful about why.
Check before you schedule the change
The worst time to discover a mismatch is during a maintenance window. Comparing the files first takes a moment and turns a failed deployment into a reissue you can request in advance.
Other tools
All seven →- SSL Checker Is the certificate installed, trusted, and served with the right chain?
- Check SSL Read the issuer, expiry date and covered names off any live site.
- Certificate Decoder Paste a certificate and read what is actually inside it.
- CSR Generator Build a certificate signing request without touching OpenSSL.
- CSR Decoder Check the details in a CSR before you send it to the CA.
- Server Checker What software your server runs, and which protocols it accepts.
Found a problem you would rather not fix yourself?
Send us the domain and the error. Our engineers install and troubleshoot certificates on any platform we sell for.