I have a couple keys that seem to have been generated with the same names. I would like to know which public key match up with which private keys so I can rename/delete them. Is this something that is important (keeping around the public key) or does a public key get generated each time you request a certificate?

  • 1
    Were you able to find a solution for this? I have the same problem and can't seem to find an answer.
    – Axeva
    Mar 21, 2011 at 15:49
  • No, I haven't. The best solution I have found is to just give them more unique name to begin with unfortunately.
    – ACBurk
    Mar 21, 2011 at 20:04
  • Yeah, that's not terribly helpful AFTER we've already made the mistake of not naming them properly. ;) I've seen rumblings that suggest the OpenSSL command line tool may be able to help, but I haven't yet figured out how.
    – Axeva
    Mar 21, 2011 at 21:44

1 Answer 1


I guess you have been able to get around your problem as this is an old thread, but I am just writing a reply for any future reference.

The basic idea is to export your private and public keys, and use openssl to view their modulus. Matching private/public keys will have the same modulus.

Here is how to see the modulus of a private key:

  1. In Keychain Access export your private key and select "Personal Information Exchange (.p12)" file format. This will create .p12 file.

  2. Launch a terminal and use openssl to convert your .p12 file to a .pem file:

    openssl pkcs12 -in key.p12 -out key.pem -nodes
  3. Use openssl to view the modulus of the pem private key:

    openssl rsa -in key.pem -modulus -noout

Here is how to see the modulus of a public key:

  1. In Keychain Access export your public key and select "Privacy Enhanced Mail (.pem)" file format. This will create .pem file.

  2. This .pem file is a PKCS#1 PEM file (with a header -----BEGIN RSA PUBLIC KEY-----), while openssl can only read PKCS#8 PEM (with a header -----BEGIN PUBLIC KEY-----). So open up your exported public key in TextEdit and remove the RSA bit from the header and the footer, and save the changes.

  3. Use openssl to view the modulus of the pem public key:

    openssl rsa -pubin -in pubkey.pem -modulus -noout

Please also note that in fact, you could also delete your public keys and re-create them from the private keys (that way you could be certain of your matching pairs). To create the matching public key from a private key use the following openssl command:

openssl rsa -in key.pem -pubout -out pubkey.pem
  • 1
    Thanks, old question but seeming always a problem so it's nice to finally have a good solution.
    – ACBurk
    Sep 30, 2013 at 18:45
  • 1
    Brilliant, just what I was looking for. Thanks for the good description.
    – Baza207
    Oct 9, 2013 at 16:37
  • I just about asked this question again on SuperUser, but have been so fortunate to discover this answer already given.. +1 all around.
    – Tom Pace
    Jan 7, 2014 at 21:08
  • To see the modulus of a public certificate: openssl x509 -noout -modulus -in public.[crt|pem] Jun 3, 2020 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.