key values mismatch

Confirm it #

openssl pkey -in private.key -pubout | openssl sha256
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256

SHA2-256(stdin)= 9d4c1f2e8a3b...
SHA2-256(stdin)= 5f2a8c1d4e7b...

Different output confirms the diagnosis. This test works for RSA and EC keys alike, unlike the -modulus comparison you will find in older answers — see why.

Find the right key #

Before reissuing, look for the key that does match. It is often still on the machine.

target=$(openssl x509 -in certificate.crt -noout -pubkey | openssl sha256)
for k in /etc/ssl/private/*.key /etc/ssl/private/*.pem; do
[ -e "$k" ] || continue
if [ "$(openssl pkey -in "$k" -pubout 2>/dev/null | openssl sha256)" = "$target" ]; then
  echo "MATCH: $k"
fi
done

Places worth checking:

• Other paths under /etc/ssl/private/ and /etc/pki/tls/private/
• The machine the CSR was originally generated on, which is often not this one
• A .pfx the certificate was delivered in — extract the key from it
• Configuration backups, your secrets manager, or the previous host during a migration

Check you have the right certificate too #

Sometimes the key is fine and the wrong certificate got deployed — easy on a host serving several sites:

openssl x509 -in certificate.crt -noout -subject -ext subjectAltName

If that names a different site than the one you are configuring, you have found the problem.

When the key is genuinely gone #

There is no recovery. Generate a new key, submit a new CSR, and have the certificate reissued:

openssl req -new -newkey rsa:2048 -nodes \
-keyout example.com.key -out example.com.csr \
-subj "/CN=example.com" \
-addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Most CAs reissue for the remaining term at no charge. With ACME, it is a single renewal command.

Avoiding it next time #

• Generate the key and CSR on the machine that will serve the certificate, and keep them together.
• Never regenerate the CSR after ordering — that creates a new key and orphans the certificate.
• Verify the pair as a deploy step, before reloading the service:

[ "$(openssl pkey -in private.key -pubout | openssl sha256)" \
= "$(openssl x509 -in certificate.crt -noout -pubkey | openssl sha256)" ] \
|| { echo "key/cert mismatch — refusing to reload"; exit 1; }