How to check whether a certificate matches a private key using OpenSSL

TLS services load a certificate and a private key as separate files, and a mismatch often appears only when a listener, load balancer, appliance, or PFX export refuses the pair. OpenSSL can compare the public key embedded in the certificate with the public half derived from the private key before the files are installed together.

The openssl x509 command can write the certificate's public key to a PEM file, and openssl pkey can write the private key's public half in the same format. Comparing those extracted public key files avoids old RSA-only modulus checks and works with key types that openssl pkey can read and export.

Matching public-key output proves only that the certificate and private key belong to the same key pair. It does not prove hostname coverage, chain trust, revocation status, expiry policy, service configuration, or private-key permissions, so use certificate and chain checks before treating the pair as deployable.

1. Open a terminal in a private directory that contains the certificate and private key.

   Do not paste private keys into shared tickets, chat, untrusted browser sessions, or saved logs unless the environment is approved for secret handling.

2. Extract the public key from the certificate.

   $ openssl x509 -in server.crt -pubkey -noout -out server.crt.pub

   Replace server.crt with the leaf certificate file. The -noout option prevents OpenSSL from printing the whole certificate body.

3. Extract the public half from the private key.

   $ openssl pkey -in server.key -pubout -out server.key.pub

   If server.key is encrypted, OpenSSL prompts for the passphrase. Avoid placing private-key passphrases in shell history or saved transcripts.

   Related: How to extract a public key using OpenSSL

4. Compare the extracted public key files directly.

   $ diff -s server.crt.pub server.key.pub
   Files server.crt.pub and server.key.pub are identical

   identical means the certificate and private key match. differ means the certificate was issued for a different private key.

5. Print SHA-256 digests when the result must be copied into a ticket or change record.

   $ openssl dgst -sha256 server.crt.pub server.key.pub
   SHA2-256(server.crt.pub)= 193abb230aa592abfbcc52354e8b29fbef8362bd4decd3512c2332a686da6c9e
   SHA2-256(server.key.pub)= 193abb230aa592abfbcc52354e8b29fbef8362bd4decd3512c2332a686da6c9e

   Matching digest values give a compact comparison record without exposing the private key.

6. Extract the public key from another candidate private key when a file mix-up is suspected.

   $ openssl pkey -in other.key -pubout -out other.key.pub

7. Compare the certificate public key with the other candidate key.

   $ openssl dgst -sha256 server.crt.pub other.key.pub
   SHA2-256(server.crt.pub)= 193abb230aa592abfbcc52354e8b29fbef8362bd4decd3512c2332a686da6c9e
   SHA2-256(other.key.pub)= 4c1b7d35a8f311e9bb3c47233474271a1fff8bf2fe87c6d43ecfbccf8fcc7c2f

   Different digest values mean other.key does not belong with server.crt. Locate the original private key or request a replacement certificate for the key that will be deployed.

8. Remove the temporary public-key comparison files.

   $ rm -f server.crt.pub server.key.pub other.key.pub

   The generated .pub files contain public key material, but removing them prevents old comparison files from being reused after renewal or key rotation.