SSL Certificates have a key pair: a public and a private key. These keys work together to establish an encrypted connection. They are not interchangeable with other keys, thus it can be important to verify an existing public server certificate and a private key are a pair before attempting to use them for encrypting communication.

Follow the steps below in a terminal window to verify a public certificate and private key are a pair. 
Those commands validate if the private key belongs to the public certificate:
 

1. openssl x509 -noout -modulus -in <public.crt> | openssl md5 > /tmp/crt.pub
   Note: Replace <public.crt> with the filename of the public certificate.
    
2. openssl rsa -noout -modulus -in <private.key> | openssl md5 > /tmp/key.pub
   Note: Replace <private.key> with the filename of the private key. Enter the password if prompted.
    
3. diff /tmp/crt.pub /tmp/key.pub
   Note: If nothing is printed to the console, they were found to be a pair. Any differences are printed to the console in detail.