Certificate, Key & CSR Matcher

Certificates, CSRs, public keys, and unencrypted private keys can wrap the same public key in different structures. This matcher extracts each public key, converts it to canonical SubjectPublicKeyInfo (SPKI) DER, and compares the bytes directly. It also reports a SHA-256 fingerprint so you can compare the same public key in another tool. Formatting, PEM line breaks, subjects, serial numbers, and filenames are not used as proof of a match.

• Match: Both inputs contain the same canonical public key.
• Mismatch: The canonical public keys differ, even if the names or PEM labels look similar.
• Unsupported: At least one input could not be safely parsed or normalized.
• CSR self-signature: The request verifies against its embedded key; this is not CA approval.

OpenSSL can produce the same kind of SHA-256 comparison from canonical public-key DER:

# Certificate
openssl x509 -in certificate.pem -pubkey -noout \ | openssl pkey -pubin -outform DER \ | openssl dgst -sha256 # CSR
openssl req -in request.csr -pubkey -noout \ | openssl pkey -pubin -outform DER \ | openssl dgst -sha256 # Private key (may prompt if encrypted)
openssl pkey -in private-key.pem -pubout -outform DER \ | openssl dgst -sha256

This tool has a versioned public record with three synthetic cases. Each expected result is recomputed from the production diagnostic core during the release check; the record also publishes fixture and source SHA-256 digests.

• PKI-SPKI-MATCH-001valid

  A synthetic certificate and standalone public key contain the same canonical SPKI bytes.
• PKI-SPKI-MISMATCH-002mismatch

  Synthetic RSA and EC public keys have different canonical SPKI bytes.

  Expected code: PUBLIC_KEY_MISMATCH.
• PKI-PEM-MALFORMED-003malformed

  The second PEM block contains invalid padded Base64 DER.

  Expected code: PKI_PEM_MALFORMED.

Open the complete citation evidence record (JSON)

Implementation source-sha256:0111f7b415a343c8; verified 2026-08-05. Read the record's scope before citing a result; structural or cryptographic evidence is not automatically an identity or trust verdict.

• CSR Decoder - Inspect requested subjects, SANs, key details, and self-signature state.
• X.509 Certificate Parser - Decode certificate fields after confirming the key match.
• Certificate Chain Checker - Verify issuer signatures, order, and bundle gaps.
• Key Inspector - Identify an unfamiliar PEM or DER key container.