Certificate and Private Key Matching

Objective

Verify if a private key (key.key) corresponds to the public key embedded within an X.509 certificate (crt.crt).

Logic

A private key contains all necessary parameters to derive its public counterpart. An X.509 certificate is essentially a signed container for a public key. If the pair is valid, the public key derived from the private key must be bit-for-bit identical to the one extracted from the certificate.

Execution

# 1. Derive public key from the private key file
openssl rsa -in key.key -pubout -outform pem > key_pub.pem
# 2. Extract public key from the certificate file
openssl x509 -in crt.crt -pubkey -noout -outform pem > cert_pub.pem
# 3. Compare the resulting files
diff key_pub.pem cert_pub.pem

Analysis (Trade-offs)

• Reliability: High. By using the PEM format, we rely on a standardized text representation, avoiding common hashing pitfalls related to shell formatting or partial output.
• Storage: Low. Requires temporary file creation.
• Risk: Negligible. Public keys are not sensitive data, but temporary files should be purged post-verification to maintain filesystem hygiene.