Key / Certificate / CSR Matcher
Free key matcher — compare a private key, certificate and CSR to confirm they share the same public key, the usual cause of an nginx or Apache "key values mismatch" error. Compared locally in your browser.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Do these belong together?
Installing TLS means holding three artefacts that must agree: a private key, the CSR generated from it, and the certificate the CA issued in return. When a deployment fails with a key mismatch, the fastest diagnosis is to compare the public keys directly rather than to reason about which file came from where.
How the comparison works
Each input is parsed and its SubjectPublicKeyInfo extracted — the structure that identifies a public key, present in a certificate and a CSR, and derivable from a private key. The two are then compared byte for byte. There is no partial match: two artefacts either share a key or they do not.
What it does not check
Only the key. A matched pair may still be expired, revoked, issued for the wrong hostname, or signed by an issuer nobody trusts. This tool answers the one question that is otherwise awkward to answer, and deliberately does not imply the others.
Frequently asked questions
What does this actually compare?
The public key inside each input. A private key, a certificate and a CSR all contain or imply the same SubjectPublicKeyInfo when they belong together, so the check is to extract that from both sides and compare. It is exact — either they are the same key or they are not.
Why does nginx say "key values mismatch"?
Because the certificate you installed was issued for a different key than the private key you pointed it at. It usually happens when a CSR is regenerated and the second private key is discarded, or when two renewals are in flight and the wrong pair ends up in the config. Paste both here and you will know in a second which one is the odd one out.
Do I have to paste the private key?
Only if that is what you are checking. Certificate against CSR, or certificate against certificate, works the same way and involves no secret at all. If you are checking a private key, note that everything happens locally — but that a key which has been in a browser tab is one you should consider rotating if it protects anything important.
Can this tell me if the certificate is valid?
No. This answers one narrow question — do these two artefacts share a public key. It says nothing about expiry, chain of trust, revocation or hostname. A perfectly matched pair can still be an expired certificate from an untrusted issuer.