How the tools word it
| Node 26 tls | error:05800074:x509 certificate routines::key values mismatch (ERR_OSSL_X509_KEY_VALUES_MISMATCH) |
|---|---|
| OpenSSL 3.6 s_server | error:05800074:x509 certificate routines:ossl_x509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:413: |
| Python 3.14 ssl | ssl.SSLError: [X509: KEY_VALUES_MISMATCH] key values mismatch |
Common causes
A different key of the same type
Two Ed25519 keys look alike but are unrelated. Under Match, paste the private key in the first box and the certificate's public key in the second. The Key Inspector compares the public keys exactly.
Input, first box
-----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIAvXQSzkUXiBUvR8YJRi5koamd18fdoiwoI7BD04DB1Z -----END PRIVATE KEY-----
Second box, under Match
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAG21+6IjqqzkNb/VRmFQnmHgzvg3K0Pf/tX0SP/fyWEc= -----END PUBLIC KEY-----
Key Inspector says
Keys do not match · Same type, different keys
A key of another type
A certificate for an ECDSA key cannot be used with an Ed25519 key. Python then says no certificate assigned instead of key values mismatch.
Input, first box
-----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIAvXQSzkUXiBUvR8YJRi5koamd18fdoiwoI7BD04DB1Z -----END PRIVATE KEY-----
Second box, under Match
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5NXanSQuq4otLh3OfsPi0iu50Hmh d8zGQPcqKwlwkW0lbPpqaOaazXUqbRW1rPPB0oGCCCHBvtG/h1EOI03ADQ== -----END PUBLIC KEY-----
Key Inspector says
Keys do not match · Different key types
The key that belongs to the certificate
The same private key and public key match, and the Key Inspector shows one fingerprint for both.
Input, first box
-----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIAvXQSzkUXiBUvR8YJRi5koamd18fdoiwoI7BD04DB1Z -----END PRIVATE KEY-----
Second box, under Match
-----BEGIN PUBLIC KEY----- MCowBQYDK2VwAyEAtzY2YFtLIQMYpRoUoyBMUqnvPaVbLnm4sCZSE1nR9sw= -----END PUBLIC KEY-----
Key Inspector says
Keys match · Same Ed25519 public key
How to fix it
- Compare the two public keys. openssl pkey -in key.pem -pubout and openssl x509 -in cert.pem -noout -pubkey print the same text when they belong together.
- Find the key that was used to create the certificate request. A renewal made with a new key needs the new key, not the old one.
- Check the file names in the server configuration. The certificate and the key are often swapped between sites.
- Paste the certificate in the Certificate Decoder and the key under Match, or the key and the certificate's public key in the Key Inspector.
- If the key is lost, create a new key and a new request and have the certificate issued again.