X509_check_private_key(3ssl)

X509_check_private_key3ssl

Check the consistency of a private key with the public key in an x509 certificate or certificate request

Usage

 #include <openssl/x509.h>
 int X509_check_private_key(const X509 *cert, EVP_PKEY *pkey);
 int X509_REQ_check_private_key(X509_REQ *req, EVP_PKEY *pkey);

Overview

X509_check_private_key() function checks the consistency of private key pkey with the public key in cert.

X509_REQ_check_private_key() is equivalent to X509_check_private_key() except that req represents a certificate request of structure X509_REQ.

Return values

X509_check_private_key() and X509_REQ_check_private_key() return 1 if the keys match each other, and 0 if not.

If the key is invalid or an error occurred, the reason code can be obtained using ERR_get_error(3).

Releases

5 releases since Debian 10 (Buster); the text changed 4 times.

  1. 10
  2. 11
  3. 12
  4. 13
  5. Arch

Bugs

The X509_check_private_key() and X509_REQ_check_private_key() functions do not check if pkey itself is indeed a private key or not. They merely compare the public materials (e.g., exponent and modulus of an RSA key) and/or key parameters (e.g. EC params of an EC key) of a key pair. So they also return success if pkey is a matching public key.

From openssl 3.6.5-1 in Arch Linux 2026-11-01. Parsed by carta from the page's man source.