Howto Verify an SSL certificate and it's private key do match ?
In this article I'll show you how can you verify SSL generated certificate match with its private key. This is mostly useful as sometimes installing signed SSL certfificates might mismatch the key and the result is an SSL mismatch that prevents the supposed encryption of the service from end user to the service to work as expected.
I assume you already have properly issued and signed SSL certificate and the private key you used to issue the certificate as well as the entire certificate chain CA and root CA, as well as the certificate.
Requirements
You must have the following item :
- the signed SSL certificate
- the certificate's private key
- the entire certification chain (intermediate CA and root CA)
1. Procedure to verify certificate .crt and .key file match
The following procedures can be used to ensure the given certificate/private key are valid.
Private key verification
- compute the private key modulus
|
|
- compute the certificate modulus
|
|
- the private key and certificate modulus md5 must match
How to verify Private key verification (one liner command)
The following command should return 'OK'
|
|
2. CA (Certificate Authority) chain verification
Execute the following command, The certificate.ca should contains the entire CA chain (intermediate CA + root CA)
|
|
3. Expiry date verification of SSL certificate
|
|
4. Verify the expiry date of a running web service online or in private net
|
|
If the service provide several certificate with SNI you should use this command to get back the good certificate. You have to set the subject certificate you want to get back
|
|
Sum up what learned ?
In this short article we learned how to verify .crt and and .key file does match, how to do a chain verification of SSL cert, how to check the expire date of a certificate, as well as how to use the openssl command to verify whether installed certificate on a web service is set and working.
More helpful Articles
Tags: certificate, chain, command, entire, GMT, Howto Verify, mismatch, modulus, null, openssl, private key, use
