FAQs

How do I verify that a private key matches a certificate? (OpenSSL)

Updated on August 8, 2026

Overview

By the end of this article you will be able to confirm whether an RSA (Rivest–Shamir–Adleman) private key matches its certificate by comparing their modulus values with OpenSSL, and know what to do when they do not match. It covers checking the private key's consistency, generating the modulus hash of both the key and the certificate, comparing the two, and — if they differ — searching for the correct key or requesting a replacement certificate. The modulus is the shared mathematical value that a matching key and certificate must have in common.

What is the modulus?

The modulus is a large number that is part of both the private key and the public key inside the certificate. If a private key and a certificate belong together, their modulus values are identical. Comparing a short hash of each modulus is a quick, reliable way to prove they match without exposing the key itself.

Prerequisites

OpenSSL installed on the server.

Access to the private key file (for example, myserver.key) and the certificate file (for example, myserver.crt).

Command-line access to the server that holds the key.

Steps

Step 1 — Check the private key's consistency

Confirm the key file itself is valid:

openssl rsa -check -noout -in myserver.key

A valid key returns RSA key ok. If it does not say RSA key ok, the key is not valid — stop here and go to Troubleshooting.

Step 2 — Generate the modulus hash of the private key

Produce a short Message-Digest 5 (MD5) hash of the key's modulus:

openssl rsa -modulus -noout -in myserver.key | openssl md5

Note the hash value that is returned.

Step 3 — Generate the modulus hash of the certificate

Produce the MD5 hash of the certificate's modulus:

openssl x509 -modulus -noout -in myserver.crt | openssl md5

Step 4 — Compare the two hashes

Compare the hash from Step 2 with the hash from Step 3. If the two hashes are exactly the same, the private key matches the certificate.

How to verify success

The command in Step 1 returns RSA key ok, and the modulus hashes from Step 2 and Step 3 are identical. When both are true, you are using the correct private key for the certificate.

Troubleshooting

Issue:

Step 1 does not return RSA key ok, or the two modulus hashes do not match.

Cause:

The private key is invalid, or it is not the key that corresponds to this certificate.

Solution: Search the server for any other private keys and re-test each one against the certificate: find / -name *.key

Re-run Steps 2–4 with each key you find.

Issue:

No private key on the server matches the certificate.

Cause:

The matching key is missing or was never present on this host.

Solution: