A private key contains a series of numbers. Two of these numbers form the “public key”, the others are part of the “private key”. The “public key” bits are included when you generate a CSR, and subsequently form part of the associated Certificate.
To check that the public key in your Certificate matches the public portion of your private key, you simply need to compare these numbers. To view the Certificate and the key run the commands:
$ openssl x509 -noout -text -in server.crt$ openssl rsa -noout -text -in server.key
The `modulus’ and the `public exponent’ portions in the key and the Certificate must match. As the public exponent is usually 65537 and it’s difficult to visually check that the long modulus numbers are the same, you can use the following approach:
$ openssl x509 -noout -modulus -in server.crt | openssl md5
$ openssl rsa -noout -modulus -in server.key | openssl md5
If the output (numeric output) from these two computations match exactly then you can be sure that the private key and certificate are matched properly.
Should you wish to check to which key or certificate a particular CSR belongs you can perform the same calculation on the CSR as follows:
$ openssl req -noout -modulus -in server.csr | openssl md5
Alternatively, you can use the following online tool to verify the key and certificate match.
