Check your Certificate Matches a Private Key or CSR

Frequently asked questions

How do I confirm that a private key matches a CSR and certificate?

To confirm that a private key matches a Certificate Signing Request (CSR) and a certificate, you can compare the modulus of the private key against the modulus of the CSR and the certificate. If the moduli match, it means the private key, CSR, and certificate are a match. This process involves using OpenSSL, a widely used tool for SSL/TLS and cryptographic operations. Here's how you can do it

1. Check Private Key against CSR

• Private Key Modulus: First, get the modulus of the private key with the following command:

  openssl rsa -noout -modulus -in privateKey.key | openssl md5

  Replace privateKey.key with the filename of your private key.
• CSR Modulus: Then, get the modulus of the CSR with this command:

  openssl req -noout -modulus -in csr.csr | openssl md5

  Replace csr.csr with the filename of your CSR.

Compare the MD5 hashes produced by both commands. If they match, the private key and CSR are a pair.

2. Check Private Key against Certificate

• Private Key Modulus: You can use the same command as above to get the modulus of the private key.
• Certificate Modulus: Get the modulus of the certificate with this command:

  openssl x509 -noout -modulus -in certificate.crt | openssl md5

  Replace certificate.crt with the filename of your certificate.

Again, compare the MD5 hashes. If they match, the private key and certificate are a pair.

Tips:

• Make sure you install OpenSSL to use these commands on your system.
• The .key, .csr, and .crt file extensions are common, but your files might have different extensions depending on how they were generated or provided to you.
• If you're working in a Windows environment, you might need to run these commands in a command-line tool that supports OpenSSL, like Git Bash, or use a Windows version.
• The MD5 hash is used here for convenience and brevity. While MD5 is considered cryptographically weak for secure hash functions, it's sufficient for comparing moduli in this context.

How do you check if the certificate has a private key?

Generally, an issued certificate will have a private key, as one would have been created when you created your certificate signing request (CSR) and submitted it to your certificate authority to generate the end certificate. So it comes down to finding the correct Private Key.
To check if a Certificate has a matching private key, you generally verify that the key corresponding to the certificate is present and correctly associated. This process can vary depending on the system or software you're using. Still, a standard method involves using OpenSSL to compare the certificate's modulus against the private key's modulus. View the FAQ above to see the commands for OpenSSL on how to do this. Otherwise, you can use the above free tool in your browser to verify if the private key you have is the correct one that matches your issued certificate.