A certificate contains a public key. The corresponding private key is mathematically paired to it. They match if the public key’s modulus (RSA) or curve point (EC) is the same as what the private key computes, or if a signature created with the private key can be verified with the certificate’s public key.

Mismatches happen frequently after certificate renewals or server migrations. A mismatched pair will cause web servers (NGINX, Apache, IIS) to fail to start or serve HTTPS correctly, leading to connection errors or “key mismatch” warnings.

From your server, they’re usually .crt and .key files. Open them with a text editor – they should contain blocks like -----BEGIN CERTIFICATE----- and -----BEGIN PRIVATE KEY-----. If you only have a PFX/P12 bundle, you can split it using OpenSSL commands.

Yes! Tick the “Key is encrypted” checkbox and enter your passphrase. The tool will decrypt it locally in your browser before verifying. The passphrase is never transmitted anywhere.

Ensure there are no extra whitespaces or missing dashes in the header/footer lines. The content must be pure Base64. Sometimes copy‑pasting from a text editor adds invisible characters – try uploading the file directly.

Absolutely. All cryptographic operations are performed by your browser using JavaScript. No data is ever sent over the network. You can even disconnect your internet after loading the page and it will still work. Your key never leaves your device.