SSL Certificate & Public Key Matcher

Compares SHA-256 digests of a certificate’s public-key SPKI bytes and a supplied PUBLIC KEY PEM. It does not accept or compare a private key.

Ssl Cert Key Matcher · Client runtimeSandboxed

Ssl Cert Key Matcher Input

Ssl Cert Key Matcher Output

Formatted results will render here in real time.

Ssl Cert Key Matcher: JavaScript is required to run this tool in the browser.

About this ssl certificate & public key matcher

Compares SHA-256 digests of a certificate’s public-key SPKI bytes and a supplied PUBLIC KEY PEM. It does not accept or compare a private key Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.

Encoding & cryptographic principles

Parses, inspects, and validates public key infrastructure certificates and requests conforming to RFC 5280 (X.509 v3 Certificates), RFC 2986 (PKCS#10 Certificate Signing Requests - CSR), and RFC 7468 (PEM Encapsulation). Deconstructs ASN.1 DER binary byte streams to extract Subject, Issuer, Validity Period (NotBefore / NotAfter), Public Key Algorithm (RSA, ECDSA, Ed25519), Key Usage, Extended Key Usage, and Subject Alternative Names (SANs). Calculates SHA-256 certificate fingerprints and validates public key matching.

Worked verification example

Scenario: Compare a complete demonstration certificate with its corresponding PUBLIC KEY PEM.

Sample input:

{"certificate":"-----BEGIN CERTIFICATE-----\nMIIC8DCCAdgCCQDe2XKZ6Az5YTANBgkqhkiG9w0BAQsFADA6MRgwFgYDVQQDDA9D\nWk9BIExvY2FsIFRvb2wxETAPBgNVBAoMCENaT0EgT3JnMQswCQYDVQQGEwJVUzAe\nFw0yNjA5MjAxNzIzNDJaFw0yNzA5MjAxNzIzNDJaMDoxGDAWBgNVBAMMD0NaT0Eg\nTG9jYWwgVG9vbDERMA8GA1UECgwIQ1pPQSBPcmcxCzAJBgNVBAYTAlVTMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtVG3kH64Ivvsnv5Wki8XYk3wFR6L\nIiALzPiWmVKKDTYR4adO0stH1rK3pwoqrvcIQLf64RSXrfDOjX/9ojHgIgi7OO4C\nQNzBh52dBtnb9wDLVM1MtyK4EQRlBFLQc2mO+GyV5hKEhdpo9dWvEp09Sjtmzpi4\nrndzL846dmUWABU75+FC5zJZAeTPktvKNuqoSQiJD30AOEd0iZGdxOTTEJ9tra/i\nkY+CEvizcOYYHnlkq+6cv2OKBNFtSyS+4B5xmQxYaybO2AM7tuHmMEbKrmycITl7\ntizsOUYbcjEjWsDosiSqlIhr681B0K+AJFUNynXxSC+KKkZrhCa6fh6uRQIDAQAB\nMA0GCSqGSIb3DQEBCwUAA4IBAQA7S2RwwqXyRswmP2ti0b7aKY+m3ZZdP/Pn828X\n5FXT64xso5DxaJ0BFPVBYqeqyoYEZLvvrvuXZStbp995AOsmHkuw62PIkNfPc31E\nN+yC5IrXI4EcWi0yWnmh8bk7M+adXg7TuJuXeB73xPucgt/U2XiqROEK3US6Nbnw\n0mKxiWONaWcTGO9fMs5UkpCob0z3KvuRSptPj/weBR1wvnJmzKrD2lvH6zjGe/wR\n7Mhp9bWOReRYNI8Cb8BGVcCOL3uFyR/HujU9Wx3EwUkcYEp5luvHvc1O35FIXmKP\nO92LDhHfzP3SLjoE+n4CzdzVOgzQWdA5iKiRZvxMT44Bs0lX\n-----END CERTIFICATE-----","publicKey":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtVG3kH64Ivvsnv5Wki8X\nYk3wFR6LIiALzPiWmVKKDTYR4adO0stH1rK3pwoqrvcIQLf64RSXrfDOjX/9ojHg\nIgi7OO4CQNzBh52dBtnb9wDLVM1MtyK4EQRlBFLQc2mO+GyV5hKEhdpo9dWvEp09\nSjtmzpi4rndzL846dmUWABU75+FC5zJZAeTPktvKNuqoSQiJD30AOEd0iZGdxOTT\nEJ9tra/ikY+CEvizcOYYHnlkq+6cv2OKBNFtSyS+4B5xmQxYaybO2AM7tuHmMEbK\nrmycITl7tizsOUYbcjEjWsDosiSqlIhr681B0K+AJFUNynXxSC+KKkZrhCa6fh6u\nRQIDAQAB\n-----END PUBLIC KEY-----"}

Processing: Hashes both DER SubjectPublicKeyInfo byte strings and compares them. It does not inspect a private key or validate certificate trust.

Illustrative output:

{ "match": true, "certificatePublicKeySha256": "3b99dfee369a1869bfe985b7b4614e27b8522e03296fb04165a61b370fb4dd8e", "suppliedPublicKeySha256": "3b99dfee369a1869bfe985b7b4614e27b8522e03296fb04165a61b370fb4dd8e", "note": "Comparison uses the DER SubjectPublicKeyInfo bytes supplied by the caller." }

Security parameters & input constraints

It compares supplied public-key DER bytes; it does not inspect a private key or prove ownership. Malformed certificate/key input returns match:false with an error. Matching bytes do not establish certificate validity, hostname, trust chain or revocation state.

Cryptographic digests, encoded strings, and signatures generated by SSL Certificate & Public Key Matcher should be verified against target authentication systems before production use.

Client-side Web Crypto boundary

Key derivation, hashing, and encoding in SSL Certificate & Public Key Matcher execute in local memory using Web Crypto APIs without remote socket transmission.

Cryptographic specifications & RFC standards

Technical specifications and cryptographic RFC standards governing algorithms and key representations:

RFC 5280 (Internet X.509 Public Key Infrastructure Certificate and CRL Profile)

SSL Certificate & Public Key Matcher verification · Audit standards

How to use it

Enter JSON containing certificate PEM and publicKey PEM.
Parse the X.509 certificate, hash its DER public-key bytes and the supplied Base64-decoded key bytes with SHA-256.
Compare the two digests and read match plus both hashes in JSON.

Frequently asked questions

Which JSON fields are required by SSL Certificate & Public Key Matcher?+

It requires certificate and publicKey PEM strings. Missing either field returns a structured match false result with the explicit required-fields error.

How does it compare a certificate and public key?+

It reads the certificate with X509Certificate, hashes its raw SubjectPublicKeyInfo bytes with SHA-256, base64-decodes the supplied PEM public key, and compares those digests.

What example can I run locally?+

The complete CZOA demonstration certificate and its matching PUBLIC KEY PEM return match true with the same SHA-256 digest. Missing fields are rejected separately. This does not prove private-key possession or certificate trust.

Does a matching result validate certificate trust?+

No. A match only means the two supplied SPKI byte digests are equal. It does not validate issuer trust, hostname, expiry, revocation, or key usage.