[How to] check if a certificate matches its private key


2016-11-16 12:50:20 UTC


2017-08-22 19:42:12 UTC


Was this article helpful?

Have more questions?

Submit a request

[How to] check if a certificate matches its private key

Applicable to:

  • Plesk 12.5 for Linux
  • Plesk Onyx for Linux
  • Plesk Onyx for Windows
  • Plesk 11.x for Linux
  • Plesk 12.0 for Windows
  • Plesk 12.0 for Linux
  • Plesk 12.5 for Windows
  • Plesk 9.x for Windows


I try to upload a certificate in the control panel and get the following error:

    ERROR message: Unable to set the certificate: Incompatible private key/certificate pair.

I encounter the same problem when using .txt format.


The private key and the certificate may not match.


To check this, you need to compare the modulus part of the private key with that of the certificate:

Copy the private key contents for domain.tld into a file (e.g., domain.tld) and check its modulus part:

    # openssl rsa -text -noout -in domain.tld -modulus | grep Modulus=

Then check the modulus part of the certificate:

    openssl x509 -text -noout -in domain.tld.crt -modulus | grep Modulus=

If the modulus parts do not match, the issue is caused by the certificate itself, which must be re-issued. You need to contact the CA that issued the certificate with the same CSR for a new certificate.

Have more questions? Submit a request
Please sign in to leave a comment.