CertGuru

Extract a public key

To extract the public key from a private key, run `openssl pkey -in private.key -pubout -out public.pem`. From a certificate, run `openssl x509 -in certificate.crt -noout -pubkey -out public.pem`. From a CSR, run `openssl req -in request.csr -noout -pubkey -out public.pem`. All three produce the same `-----BEGIN PUBLIC KEY-----` SubjectPublicKeyInfo structure, which is why hashing the output is the reliable way to check whether a key, certificate and CSR all belong to the same key pair.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

From a private key # 

openssl pkey -in private.key -pubout -out public.pem
What the result looks like
head -n1 public.pem
Expected output 
-----BEGIN PUBLIC KEY-----

From a certificate # 

openssl x509 -in certificate.crt -noout -pubkey -out public.pem

From a CSR # 

openssl req -in request.csr -noout -pubkey -out public.pem

Why this is the useful primitive #

All three commands emit the same structure for the same key pair. That makes a hash of the output a clean equality test — and it works for RSA, EC and Ed25519 alike, unlike the older -modulus comparison which is RSA-only:

Do these three files belong together?
openssl pkey -in private.key    -pubout | openssl sha256
openssl req  -in request.csr    -noout -pubkey | openssl sha256
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256
Expected output 
SHA2-256(stdin)= 9d4c1f2e8a3b...
SHA2-256(stdin)= 9d4c1f2e8a3b...
SHA2-256(stdin)= 9d4c1f2e8a3b...

Three identical hashes mean the key, the request and the issued certificate are all one key pair. See check whether a key matches a certificate.

Inspecting a public key # 

openssl pkey -pubin -in public.pem -noout -text
Expected output 
Public-Key: (2048 bit)
Modulus:
  00:c4:1f:...
Exponent: 65537 (0x10001)

Note -pubin — without it OpenSSL expects a private key and fails.

DER output # 

openssl pkey -in private.key -pubout -outform der -out public.der

An SSH public key from a TLS private key #

Occasionally useful when the same key pair serves both purposes:

ssh-keygen -y -f private.key > public.pub

Frequently asked questions

Can I recover a private key from a public key?
No. That is the entire premise of public key cryptography. If the private key is lost, generate a new one and have the certificate reissued.
Why do all three sources produce identical output?
Because all three contain the same public key in the same SubjectPublicKeyInfo structure. That is what makes hashing the output a valid equality test across a key, a CSR and a certificate.
Is it safe to share a public key?
Yes. Public keys are published inside every certificate that any TLS server sends to every client. There is nothing sensitive in one.
How do I get the public key in DER instead?
Add -outform der to the pkey command, or -pubout with -outform der. See PEM to DER.

References

Related pages