Key ↔ certificate match
Paste a private key and a certificate (or drop files). CertKit compares the RSA modulus and runs a real SHA-256 sign/verify round-trip between the two — not just a fingerprint guess.
Runs locally in your browser — nothing is uploaded
Match result
—Result report
A text summary you can keep with the deployment notes.
Questions
How is the match determined?
Two independent checks: the RSA modulus and public exponent of the key and certificate must be identical, and the certificate’s public key must successfully verify a signature produced by the private key in this tab. Both must pass for a MATCH.
What does NO MATCH look like?
A red NO MATCH badge, plus the detail that failed: modulus differs, or the sign/verify check failed. A NO MATCH means this key and certificate will not work together — find the right pair before deploying.
Can a NO MATCH be a false alarm?
No for RSA: identical keys always pass both checks. Certificate and key from different pairs (for example a renewed certificate with the old key) will always report NO MATCH.
Does my key leave the browser?
No. The key is read in this tab and used only for the local sign/verify calculation. Open DevTools → Network while running the check to confirm there are no requests.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.