OpenSSL • Verification & Inspection
How to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)
In RSA cryptography, the public certificate and private key share the exact same mathematical modulus. By hashing the modulus of both files with MD5, identical hash outputs prove that the key matches the certificate without revealing sensitive private key material.
Verify Key Matches Certificate Command
Safe • Read-Only / File Generation
openssl x509 -noout -modulus -in cert.pem | openssl md5 && openssl rsa -noout -modulus -in key.pem | openssl md5Customize:
Domain:
Cert File:
OpenSSL Flags & Options Explained
-modulusExtracts the RSA public modulus from the key or certificateopenssl md5Computes MD5 checksum of the modulus for easy visual comparisonExecution Steps & Verification
1Check certificate modulus hash
Extract and hash the certificate modulus:
openssl x509 -noout -modulus -in cert.pem | openssl md52Check private key modulus hash
Extract and hash the private key modulus:
openssl rsa -noout -modulus -in key.pem | openssl md53Compare the outputs
If both 32-character hexadecimal hashes are identical, the certificate and key pair match 100%.
Common Security Pitfalls & Solutions
- Mismatch between key and certificate will cause NGINX or Apache to fail starting with errors like: "SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch".
- For CSR validation, run: `openssl req -noout -modulus -in domain.csr | openssl md5`.
Prerequisites & Environment
- Both certificate and private key files on disk.
Frequently Asked Questions About Verify Key Matches Certificate
Frequently Asked Questions
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
No, ECDSA keys do not have an RSA modulus. For ECDSA, compare the public key coordinates: `openssl ec -in key.pem -pubout` vs `openssl x509 -in cert.pem -pubkey -noout`.
Related OpenSSL & Security Commands
View All RecipesGeneration & Keys
How to Generate a Self-Signed SSL Certificate with OpenSSL
reqGuide →
Verification & Inspection
How to Check SSL Certificate Expiration Date from Domain or File
s_clientGuide →
Verification & Inspection
How to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)
x509Guide →
Generation & Keys
How to Generate a Certificate Signing Request (CSR) with SAN
reqGuide →
Format Conversions
How to Convert PFX / PKCS#12 to PEM Certificate and Private Key
pkcs12Guide →
Format Conversions
How to Convert CRT, CER or DER to PEM Format
x509Guide →