How to Verify a Private Key Matches a Certificate
A certificate only works together with its exact private key. After renewals, migrations or PFX exports it is easy to end up with mismatched files — and the resulting errors ("key values mismatch", failed TLS handshakes) rarely say which file is wrong. This guide shows how to check.
Why mismatches happen
Every renewal usually creates a new key pair. If the new certificate is deployed with last year’s key file — or a key from a different server — the pair no longer matches. The certificate is valid, the key is valid, but they do not belong together.
Check with OpenSSL
Compare the public key of each file: openssl x509 -in cert.pem -noout -pubkey and openssl pkey -in key.pem -pubout must produce identical output. For a CSR, use openssl req -in your.csr -noout -pubkey. If the outputs differ, the files do not belong together.
Check with an online key matcher
A key matcher does the same comparison in one step for certificate, CSR and private key. Use one that handles the key in memory only and never stores it — and treat any tool that logs key material as disqualified.
Upload or paste the certificate (or CSR) and private key — the matcher compares them in memory and never stores your key.
Open the Key Matcher →Frequently asked questions
Is it safe to paste a private key into an online tool?
Only if the tool explicitly processes the key in memory without storing, logging or transmitting it further — as the pkitools.io Key Matcher does. When in doubt, use the OpenSSL commands locally instead.
What does "key values mismatch" mean in IIS?
The certificate you are importing does not correspond to the private key IIS has for it — typically because a renewal created a new key or the wrong PFX was exported. Verify the pair, then re-export a matching PFX.
Does a CSR match my private key?
A CSR is signed by the private key it was generated with, so the pair can be verified the same way — compare public keys, or check both files in a key matcher.
Need help beyond the tools? MI Support IT provides enterprise PKI consulting — ADCS, Venafi automation, key ceremonies and CP/CPS documentation.