Match a TLS Certificate with Its Private Key

Juggling multiple certificates and private keys? Comparing SHA-256 hashes of the public key extracted from each file is the fastest way to confirm which key belongs to which certificate or CSR. If the hashes match, you have your pair.

How It Works

The comparison is straightforward: extract the public key from the private key, the certificate, or the CSR, then hash it. Matching hashes mean the files belong together.

OpenSSL Commands

Run the following commands on your server and compare the output:

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum
openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum

If the two relevant hashes (for example, the private key hash and the certificate hash) are the same, you have confirmed the match.

• Security
• Technology

• Ssl
• Tls
• SysAdmin