Using openssl to verify a certificate matches a private key

Time needed: 10 minutes

How to verify if a .key file matches a certificate file?

1. Prerequisite: install OpenSSL

   OpenSSL is a command-line tool you can use to do all kinds of black magic to certificates. But today, we’ll use it to verify your private key matches your certificate.
   
   The first thing to do is to download the tool. They don’t want to make it too easy, but you should be able to find the latest version here.

2. Have .cer and .key in the same folder

   Move all of your certificate files to one folder, open Terminal, and change to that directory.
   
   You’ll need a .cer file (in my example, my.cer) and a .key file (my.key, unsurprisingly). The latter should look somewhat like this:
   
   —–BEGIN RSA PRIVATE KEY—–
   ALOTOFCHARACTERSHEREFORQUITEAFE
   WLINESITSQUITEDIFFICULTTOREADYFRA
   NKLYBUTYOUDONTNEEDTOCAREABOUT
   THAT
   —–END RSA PRIVATE KEY—–
3. Transform your certificate to PEM format

   If your .cer file is not BASE64-encoded when you open it up in VS Code or a similar text editor, you need to transform it.
   
   The easy rule is the certificate needs to be in Latin characters and start with this:
   —–BEGIN CERTIFICATE—–
   
   and end with:
   —–END CERTIFICATE—–
   
   If it’s not, it’s probably a certificate with DER encoding. You can’t actually decipher this from the file format (or extension) because it has almost no relation to the actual contents of the file. Doesn’t seem like standards in the world of certificates are very strict.
   
   Anyway – your certificate, for this tutorial, needs to be not DER encoded. And one way to decode it is this:
   OpenSSL x509 -inform DER -in my.crt -out my.cer
   
   If it already was BASE64-encoded, you can use the certificate as it is. The rest of the tutorial assumes it’s called my.cer, but it could be .crt or .pem, too, and still be according to the standard.
   
   Clear as mud! But you should now either have a usable .cer file, or an error about being unable to read the contents. In both cases, you can proceed.

4. Calculate the modulus from your certificate

   Now we’ll calculate the modulus for your certificate. You don’t need to understand this. I don’t either (not really anyway). But it’ll help us.
   
   If you now have a .cer file (the last step was successful), this should work:
   openssl x509 -noout -modulus -in my.cer
   
   If the last step failed, make sure the file only has the stuff between —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– (and before you comment, I KNOW it can have extra stuff because who cares about standards, but for whatever reason removing extra stuff helps), no extra whitespace, is actually readable, and then retry running it again.
   
   If this fails, too, your certificate was probably rubbish. Get a new one.
   
   If it produced an interesting output and not an error, take note of the output. You’ll need it for comparison.

5. Calculate the modulus for your private key

   Now, for your private key file (my.key in my sample), run this:
   openssl rsa -noout -modulus -in my.key
   
   This is the second output you need to compare.

6. Compare the 2 values

   If the modulus output you get from the 2 commands matches, the private key and your certificate are a pair.
   
   That looks somewhat like the below: