Certificate Key Matcher — Verify SSL Certificate & Private Key Match

When installing an SSL/TLS certificate, one of the most common configuration errors is mismatched certificate and private key files. Nginx will report SSL_CTX_use_PrivateKey_file failed, Apache returns AH02217: ssl_util_ppopen, and HAProxy simply refuses to start.

This mismatch happens because SSL certificates and their private keys are mathematically linked. The certificate contains the public key. The private key is the only key that corresponds to that public key. Using any other private key — even a valid RSA key of the same size — will not work.

For RSA keys, the link can be verified by comparing the modulus — the large composite number (product of two primes) that defines the RSA key pair. The public key in the certificate and the private key must share the same modulus value. If they do, they are a matching pair.

This is exactly what openssl x509 -noout -modulus and openssl rsa -noout -modulusdo, and what this tool replicates in-browser using node-forge. No data leaves your machine.