Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenSSl certificate. I also need the private key. I was told it is located somewhere on the server, and true enough, I found multiple SSL key files.

Before I try them all by brute force: Is there a way I can find out on terminal if a private key was used to create the certificate?

share|improve this question

The classic reference for this is this FAQ in the online Apache docs.

In that document, an md5 of the modulus is used because

As the public exponent is usually 65537 and it's difficult to visually check that the long modulus numbers are the same, you can use the following approach

This gives:

$ openssl rsa -noout -modulus -in key.pem.decrypted | openssl md5
(stdin)= 9fxxfoobar558d9xx0045a89467d2bxx

$ openssl x509 -noout -modulus -in crt.pem | openssl md5
(stdin)= 9fxxfoobar558d9xx0045a89467d2bxx

I'm proposing the use of process substitution to avoid visual comparison of the modulus:

$ diff \ 
    <(openssl x509 -noout -modulus -in cert.pem) \
    <(openssl rsa -noout -modulus -in key.pem.decrypted)

If the output is empty, the private key matches the certificate.

This is just a more convenient way to compare the strings than the one in Andrew Schulman's answer, which is, of course, also valid.

Another reference here.

share|improve this answer
Are you saying that the comparison of the pub key is not enough or is it merely a more convenient way to compare the cert and the key? – k0pernikus May 12 '14 at 9:07
By "comparison of the pub key", do you mean just comparing the two keys themselves? – MadHatter May 12 '14 at 9:11
The modulus is the important part of the public key. So comparing just the modulus should give you the same result as comparing the entire public key. – kasperd May 12 '14 at 9:24

To check that a certificate file certifies the public key associated with a given private key file, compare the public keys associated with each:

openssl rsa -in KEYFILE -pubout
openssl x509 -in CERTFILE -pubkey -noout

The certificate and private key are matched if and only if the public keys are identical.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.