Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SSL certificate that the former sysadmin was issued (crt file.) Searching the filesystem I found several .key files. How do I match the crt to the key file and confirm that they match? This is Ubuntu Server 11.10 with Apache2 modssl.

share|improve this question
up vote 16 down vote accepted

Compare the modulus of the files.

Check the public key like this:

openssl x509 -in /path/to/cert.crt -noout -text

And check the private keys like this:

openssl rsa -in /path/to/cert.key -noout -text

Compare the "modulus" data (a big block of numbers) between the certificate and the potentially matching keys. If they match, then the key and certificate are a pair.

share|improve this answer
+1; You could also use -modulus instead of -text - which will output just the modulus (same result, but possibly easier to script with uniq, etc). – cyberx86 May 5 '12 at 19:24
And use hashing to make comparisons easy on the eyeball: openssl x509 -in /path/to/cert.crt -noout -modulus | openssl md5 and openssl rsa -in /path/to/cert.key -noout -modulus | openssl md5 – cjc May 5 '12 at 21:39
Well, that's very handy. Too bad I can't find a match. Guess it's time to purchase another cert. At least I can now prove that the purchase is needed. Cheers! – Malocchio May 6 '12 at 3:13
Found the match. It was in a java keystore. I exported to PKC12 format and it was all smooth sailing from there. – Malocchio May 6 '12 at 13:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.