Match cert and private key

Equal modulus hashes prove key matches cert; empty diff = match

diff <(openssl x509 -in cert.pem -noout -modulus | md5sum) <(openssl rsa -in key.pem -noout -modulus | md5sum)
tool
openssl27 commands
tags
openssltlssecuritytroubleshooting

More openssl commands

  • CSR + key in one shot
    openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    Generate key+CSR with SAN inline; -addext avoids editing openssl.cnf

  • Self-signed cert with SAN
    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    One-liner self-signed cert valid 1y; SAN required or TLS clients reject it

  • PEM to PKCS12 bundle
    openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca-chain.pem -out bundle.p12 -name <name>

    Bundle cert+key+chain into .p12 for Java keystores / Windows imports

  • STARTTLS protocol probe
    openssl s_client -connect <host>:5432 -starttls postgres -showcerts </dev/null 2>/dev/null

    Inspect TLS on STARTTLS services; swap postgres for smtp/imap/mysql/ldap

  • Generate Ed25519 key
    openssl genpkey -algorithm ed25519 -out ed25519.pem

    Modern: Ed25519 keys are tiny and fast vs RSA; use for signing/mTLS

all 27 openssl commands