How to Verify a Certificate, Private Key and CSR Match (OpenSSL)

By /

Updated for 2026: the original post showed the classic modulus trick — still valid for RSA, but it silently fails on modern ECDSA certificates, which have no modulus. The public-key comparison below works for every key type and is the method to reach for first.

The question

You have a certificate, a private key, and maybe a CSR, and you need to know: do these actually belong together? If the key doesn’t match the certificate, your TLS handshake fails with errors that never quite say so. Compare the public keys — if the hashes match, the files match.

The universal method: compare public keys

# From the certificate:
$ openssl x509 -in FILE.crt -pubkey -noout | openssl md5

# From the private key:
$ openssl pkey -in FILE.key -pubout | openssl md5

# From the CSR:
$ openssl req -in FILE.csr -pubkey -noout | openssl md5

Run the ones you have. Identical hashes = the files belong together. Different hashes = they don’t, no matter how convincing the filenames are. (On LibreSSL/macOS, openssl md5 may need to be md5 — the digests are comparable as long as you use the same tool for all files.)

The classic method: compare moduli (RSA only)

The 2017 original, kept because it’s everywhere in older runbooks. For RSA keys, each file embeds the same modulus; display it (piped through a hash, because the raw modulus is a screenful of hex) and compare:

$ openssl x509 -noout -modulus -in FILE.crt | openssl md5
$ openssl rsa  -noout -modulus -in FILE.key | openssl md5
$ openssl req  -noout -modulus -in FILE.csr | openssl md5

On an ECDSA certificate, the first command errors out — there is no modulus. That’s your cue to use the public-key method above.

While you’re there: the 10-second sanity check

$ openssl x509 -in FILE.crt -noout -subject -issuer -dates

Half of all “the key doesn’t match” tickets are actually “this is the old certificate”, “this expired in March”, or “this was issued for the staging hostname”. Subject, issuer, and validity dates catch those before you compare a single hash.

And if you have the CA chain, verify against it directly:

$ openssl verify -CAfile ca-chain.pem FILE.crt
FILE.crt: OK

Running your own server? These guides assume you have a Linux box somewhere — see our guide to choosing a VPS in 2026 for the 7 specs that actually matter before you spin one up.

Scroll to Top