Certificate & Key Workbench
Paste any mix of PEM certificates, CSRs and private keys to decode each one and check they match — everything stays in your browser, nothing is uploaded.
Certificate & Key Workbench
Paste any mix of PEM certificates, CSRs and private keys to decode each one and check they match — everything stays in your browser, nothing is uploaded.
About certificates and key matching
Why it's safe to paste a private key here
Most online SSL tools send your material to their server for processing — for a private key, that's handing over the one secret that must never leave your machines. This workbench parses and verifies everything with your browser's built-in Web Crypto engine: no request carries your material, nothing is stored or logged, and you can confirm it yourself by watching the network tab while you paste.
How key ↔ certificate matching actually works
A certificate embeds the public half of a key pair. If the certificate's public key parameters (the RSA modulus and exponent, or the EC curve point) equal the public parameters derived from your private key, they are the same pair — that's exactly what comparing openssl modulus hashes does, minus the eyeballing. A CSR carries a public key the same way, which is how the workbench also tells whether a certificate was issued from a given CSR.
Why a missing intermediate breaks your site
Browsers only trust a handful of root CAs; your server certificate is usually signed by an intermediate, which is signed by a root. The server must present the full chain (leaf + intermediates) so the browser can walk it up to a trusted root. If an intermediate is missing, some clients fail with chain errors even though your certificate itself is fine. This workbench verifies each issuance signature between the certificates you paste — it checks the links connect, without pretending to be a root store.
FAQ
Common questions and answers about this topic.
Is it safe to paste a private key into this page?
Yes — everything runs in your browser with Web Crypto. Your material is never uploaded, stored, logged or sent to analytics; there is simply no network request that could carry it. Open the network tab while pasting to verify. That said, standard hygiene still applies: prefer a machine you trust.
How do I check that a certificate matches a private key?
Paste both into the box — the workbench derives the public key from your private key and compares it with the certificate's public key parameters. It's the browser-side equivalent of comparing openssl x509 -modulus and openssl rsa -modulus hashes, with an explicit pass / fail verdict instead of eyeballing hex.
My chain is incomplete — how do I fix it?
The verdict names the missing issuer. Your CA usually provides the intermediate certificate in the download bundle (often called chain.pem or ca-bundle); paste it here to confirm the links connect, then deploy the full chain (fullchain.pem = leaf + intermediates) to your server.
Which formats are supported?
PEM blocks: certificates (BEGIN CERTIFICATE), CSRs (BEGIN CERTIFICATE REQUEST), PKCS#8 private keys (BEGIN PRIVATE KEY), legacy PKCS#1 RSA keys (BEGIN RSA PRIVATE KEY) and public keys (BEGIN PUBLIC KEY), for RSA and EC (P-256 / P-384 / P-521) plus Ed25519 where the browser supports it. Encrypted private keys and legacy SEC1 EC keys are declined with the exact openssl command to convert them — binary DER files aren't accepted, convert with openssl x509 -inform der first.