← Help  /  Something not working?

Fix "key values mismatch": private key does not match the certificate

When a server refuses to start or load a certificate with key values mismatch, private key does not match the certificate or SSL: key does not match, the private key it was given is not the one that made the CSR for this certificate. Each certificate works with exactly one private key.

Why it happens

• The CSR was made more than once (for example, a second time when the first attempt failed), and the certificate was issued for the first CSR while the server now holds the key from the second.
• The CSR was made on one server and the certificate installed on another that does not have the key.
• An old private key file was picked up from a previous year.

Check which key goes with which

These commands print a fingerprint of the modulus. The certificate and the key match only if the two lines are identical:

openssl x509 -noout -modulus -in example.com.crt | openssl md5
openssl rsa  -noout -modulus -in example.com.key | openssl md5

If you still have the CSR, check it the same way with openssl req -noout -modulus -in example.com.csr | openssl md5. You can also paste the CSR and certificate into our decoder.

Fix it

• If you find the matching key (search other folders, old backups or the control panel's key store), use it.
• If you cannot find it, reissue. Make a new CSR and key on the server, then reissue the certificate from your account with that new CSR. Reissues are free and unlimited, and your new certificate will match the new key. See the guide for OpenSSL, cPanel, Plesk or IIS.

Never share the private key with anyone, including us. A private key can never be recovered from the certificate or the CSR.

More in this section

• My CSR was rejected: what the messages mean
• Fix "unable to get local issuer certificate" and incomplete chain errors
• Fix "certificate name does not match" (ERR_CERT_COMMON_NAME_INVALID)
• I installed the new certificate but the site still shows the old one
• Domain validation is not completing: what to check

Browse certificates →   Free SSL tools →