DIGITALTRUST

Tools / Key matcher

Key matcher

Confirm that a certificate, a CSR and a private key belong together.

Fill in at least two of the three fields.
The private key never leaves the browser. From the certificate and the CSR we only read the public key. The private key is read here, on your computer, to compute the matching public key. If you would rather not paste it anywhere, compare the fingerprints with these commands:
openssl x509 -in certificate.pem -noout -pubkey | openssl sha256
openssl req  -in request.csr     -noout -pubkey | openssl sha256
openssl pkey -in private.key     -pubout        | openssl sha256

We read RSA and ECDSA keys in PEM format (PKCS#8 and PKCS#1). For password-protected keys or the EC PRIVATE KEY format, use the commands above. Certificates and CSRs (public data) are read on our server and not stored.

By API or with AI assistants. This check is available in the public API (keys/match) and on the MCP server as match_public_keys. 
curl -X POST https://digitaltrust.pt/api/v1/keys/match -H "Content-Type: application/json" -d @request.json
API and MCP documentation.
Other tools

More checks, no sign-up.

SSL/TLS checker

Test the certificate, chain and protocols of any server: website, mail server or API.

Certificate decoder

See what is inside a certificate: names, validity, issuer, validation type and fingerprints.

CSR decoder

Check your certificate request before you send it: names, organisation, key and signature.

CSR generator

Create the private key and the CSR in your browser, or copy a ready-made OpenSSL command.

SSL converter

Tell us where the certificate is going (Plesk, nginx, Windows, HAProxy, Java) and get the right files. PEM, DER, P7B and PFX, without the key leaving your computer.

Certificate Transparency lookup

Find every valid certificate issued for your domain and its subdomains in the public Certificate Transparency logs.

CAA checker

See which Certification Authorities may issue for your domain, before you order.

Email security check

Check SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT for your domain in one test.
CallOrder SSL