OpenSSL: Check If Private Key Matches SSL Certificate & CSR

When you are dealing with lots of different SSL Certificates, it is quite easy to forget which certificate goes with which Private Key.

Or, for example, which CSR has been generated using which Private Key.

From the Linux command line, you can easily check whether an SSL Certificate or a CSR match a Private Key using the OpenSSL utility.

To make sure that the files are compatible, you can print and compare the values of the SSL Certificate modulus, the Private Key modulus and the CSR modulus.

Cool Tip: Check the expiration date of the SSL Certificate from the Linux command line! The fastest way! Read more →

Check Compatibility

 

When you create a Private Key and CSR to obtain an SSL Certificate, OpenSSL generates some internal data called a modulus.

 

OpenSSL stores the modulus in the Private Key, as well as in the CSR and therefore in the SSL Certificate itself.

If you are using either the incorrect Private Key or the SSL Certificate – you will receive an error as follows: [error] Unable to configure RSA server Private Key [error] SSL Library Error: x509 certificate routines:X509_check_private_key:key values mismatch.

So if you got the similar error – it is time to check whatever your Private Key matches the SSL Certificate by comparing their modulus.

[Error] … key values mismatch: Your Private Key and SSL Certificate must contain the same modulus, otherwise the web-server won’t start.

Let’s print the values of the modulus of the Private Key, the SSL Certificate and the CSR with the conversion of them to md5 hashes to make the comparison more convenient.

Print the md5 hash of the SSL Certificate modulus:

$ openssl x509 -noout -modulus -in CERTIFICATE.crt | openssl md5

Print the md5 hash of the CSR modulus:

$ openssl req -noout -modulus -in CSR.csr | openssl md5

Print the md5 hash of the Private Key modulus:

$ openssl rsa -noout -modulus -in PRIVATEKEY.key | openssl md5

Cool Tip: Check the quality of your SSL certificate! Find out its Key length from the Linux command line! Read more →

If the md5 hashes are the same, then the files (SSL Certificate, Private Key and CSR) are compatible.

0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to create stunnel with systemd? stunnel
Viewed 2865 times since Thu, Jan 16, 2020
Fałszujemy rozpoznania skanerów #2
Viewed 1619 times since Mon, May 21, 2018
Turbocharge PuTTY with 12 Powerful Add-Ons – Software for Geeks #3
Viewed 10967 times since Sun, Sep 30, 2018
RHEL: Extending a multipath LUN
Viewed 2276 times since Sun, May 27, 2018
How to enable automatic security updates on CentOS 7 with yum-cron
Viewed 1153 times since Fri, Oct 26, 2018
Automatic YUM Updates with Yum-cron
Viewed 9522 times since Fri, Oct 26, 2018
6 rsync Examples to Exclude Multiple Files and Directories using exclude-from
Viewed 1768 times since Wed, Oct 31, 2018
BIND for the Small LAN
Viewed 2153 times since Sun, May 20, 2018
Netcat shell zabezpieczony hasłem
Viewed 1237 times since Thu, May 24, 2018
Linux - How to perform I/O performance test with dd command
Viewed 4705 times since Fri, Jun 8, 2018