All HowTo's Cyber-Security Web Servers

Check if your SSL certificate and Key match

This article shows how to check if your SSL key and certificate match. Why would you do this? Suppose you’ve just purchased a certificate and in the process mixed up your files OR perhaps the files aren’t named in the way the documentation suggests they are.

Let’s first see what you have. You should have your CSR file (the file that you generated and sent to the SSL vendor), your KEY or PEM file (PEM and KEY are interchangeable terms) and you should have a CRT and possibly a BUNDLE from your SSL vendor.

The CRT and BUNDLE file from your vendor should be obvious. Those files both start with:

-----BEGIN CERTIFICATE-----

If you’re not sure, leave the BUNDLE out of the equation for now. It’s not fully needed but does make things link together nicer.

Your CSR file starts with the following line:

-----BEGIN CERTIFICATE REQUEST-----

And your KEY or PEM file starts with this:

-----BEGIN RSA PRIVATE KEY-----

Now that you know which file is which, you can use the following two commands to see if they match. The output of these two commands should be the same:

openssl rsa -check -noout -modulus -in /my_certificates/www_example_com.key

…and…

openssl x509 -noout -modulus -in /my_certificates/www_example_com.crt

Now let’s see what your web server needs. The following two examples show the CRT and KEY/PEM files for both Apache and NginX.

Apache/HTTPD:

SSLCertificateFile /my_certificates/www_example_com.crt
SSLCertificateKeyFile /my_certificates/www_example_com.key

NginX:

ssl_certificate /my_certificates/www_example_com.crt;
ssl_certificate_key /my_certificates/www_example_com.key;

Remember to test the new configuration before restarting the web server. NginX can be done with the following:

service nginx configtest

Leave a Reply

Your email address will not be published. Required fields are marked *