X509_CHECK_PRIVATE_KEY(3ossl)

💖 X509_CHECK_PRIVATE_KEY 💖

okay bestie, so this is the OpenSSL manual page for X509_CHECK_PRIVATE_KEY — it's filed under section 3ossl in the OpenSSL docs, and it's literally just about making sure your private key and your cert's public key are actually a matched set. like, are they giving soulmate or are they giving awkward first date? this function will tell you. 🫶

---

✨ NAME ✨

X509_check_private_key, X509_REQ_check_private_key — check the consistency of a private key with the public key in an X509 certificate or certificate request

no cap, that's the whole job. consistency check. vibe check for keys. 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int X509_check_private_key(const X509 *cert, EVP_PKEY *pkey);

int X509_REQ_check_private_key(X509_REQ *req, EVP_PKEY *pkey);

---

🦋 DESCRIPTION 🦋

so X509_check_private_key() checks the consistency of private key pkey with the public key in cert. that's it, that's the function. it's looking at both of them like 👀 "do you two actually belong together?"

X509_REQ_check_private_key() is equivalent to X509_check_private_key() except that req represents a certificate request of structure X509_REQ. same energy, different container. it's giving "same girl, different outfit". 💖

---

👑 RETURN VALUES 👑

X509_check_private_key() and X509_REQ_check_private_key() return 1 if the keys match each other, and 0 if not.

if the key is invalid or an error occurred, the reason code can be obtained using ERR_get_error(3). so like, when it goes wrong, go ask ERR_get_error(3) what happened — that's your group chat for error tea. 🍓

---

💀 BUGS 💀

bestie, listen closely, this part is IMPORTANT.

the X509_check_private_key() and X509_REQ_check_private_key() functions do not check if pkey itself is indeed a private key or not. not even a little bit. they merely compare the public materials (e.g., exponent and modulus of an RSA key) and/or key parameters (e.g. EC params of an EC key) of a key pair. so they also return success if pkey is a matching public key. 😭

translation: it's not checking IDs at the door, it's just checking vibes. a matching public key walks right in and gets a 1. iconic behaviour, honestly, but you've been warned. ⭐

---

🌈 SEE ALSO 🌈

• ERR_get_error(3)

---

🎀 COPYRIGHT 🎀

Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's a wrap, my love 💜 this was OpenSSL 3.5.9, dated 2026-09-29, page X509_CHECK_PRIVATE_KEY(3ossl). go check those keys, stay consistent, and remember: a 1 doesn't always mean what you think it means. mwah. 💅✨🧚