Certificate, Key & CSR Matcher

Certificates, CSRs, public keys, and unencrypted private keys can wrap the same public key in different structures. This matcher extracts each public key, converts it to canonical SubjectPublicKeyInfo (SPKI) DER, and compares the bytes directly. It also reports a SHA-256 fingerprint so you can compare the same public key in another tool. Formatting, PEM line breaks, subjects, serial numbers, and filenames are not used as proof of a match.

• Match: Both inputs contain the same canonical public key.
• Mismatch: The canonical public keys differ, even if the names or PEM labels look similar.
• Unsupported: At least one input could not be safely parsed or normalized.
• CSR self-signature: The request verifies against its embedded key; this is not CA approval.

OpenSSL can produce the same kind of SHA-256 comparison from canonical public-key DER:

# Certificate
openssl x509 -in certificate.pem -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256

# CSR
openssl req -in request.csr -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256

# Private key (may prompt if encrypted)
openssl pkey -in private-key.pem -pubout -outform DER \
  | openssl dgst -sha256

• CSR Decoder - Inspect requested subjects, SANs, key details, and self-signature state.
• X.509 Certificate Parser - Decode certificate fields after confirming the key match.
• Certificate Chain Checker - Verify issuer signatures, order, and bundle gaps.
• Key Inspector - Identify an unfamiliar PEM or DER key container.