# Private key does not match with my certificate **URL:** \ **Category:** Help\ **Created:** [April 17, 2018, 12:54pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722 "2018-04-17T12:54:24Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 12:54pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/1 "2018-04-17T12:54:24Z")
I ran this command: /opt/letsencrypt/letsencrypt-auto certonly --rsa-key-size 4096 --webroot --webroot-path /var/www/mondomaine.fr -d [mondomaine.fr](http://mondomaine.fr) It produced this output: error:04065072:rsa routines:rsa\_ossl\_private\_decrypt:padding check failed2 (when I run openssl\_private\_decrypt [php] ) I’m running on Debian 9 and nginx I am using cert.pem for public key and privkey.pem My HTTPS is running with certificate A Do you know what’s going on ? ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 17, 2018, 1:37pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/2 "2018-04-17T13:37:46Z")
Hi, I’ve no clue what is going on with your certificate, but Can you try to run this command and verify if the two out put is the same? ``` `openssl x509 -noout -modulus -in (public keyl | openssl md5` `openssl rsa -noout -modulus -in (private key) | openssl md5` ``` Thank you ---
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 2:16pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/3 "2018-04-17T14:16:02Z")
Hey, privkey.pem does not match with cert.pem, but i found out that it matches with fullchain.pem. (with md5) However, i still get an error: old\_rsa\_priv\_decode:RSA lib ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [April 17, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/4 "2018-04-17T14:23:40Z")
> [@Galax](#): > > Hey, privkey.pem does not match with cert.pem, but i found out that it matches with fullchain.pem. (with md5) `cert.pem` and `fullchain.pem` should always contain the same certificate... (`fullchain.pem` _also_ contains the intermediate certificate from `chain.pem`.) > [@Galax](#): > > However, i still get an error: old\_rsa\_priv\_decode:RSA lib What are you trying to do? Why handle a Let's Encrypt private key with PHP at all? (And is it secure?) You could post the PHP code and error message here, but some sort of security-oriented PHP forum would be better. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 17, 2018, 2:25pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/5 "2018-04-17T14:25:12Z")
Hi, Can you try this and share the output? `openssl rsa -in privkey.key -out testpriv.key` Also, is the key start and ends with the correct format? (-------BEGIN PRIVATE KEY-------)(--------END--------PRIVATE-------KEY) Thank you ---
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 2:33pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/6 "2018-04-17T14:33:56Z")
I would like to do an asymeric encryption as below: > **[Public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography#/media/File:Public_key_encryption.svg)** > > Public-key cryptography, or asymmetric cryptography, is a cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. The generation of such keys depends on cryptographic algorithms based on mathematical problems to produce one-way functions. Effective security only requires keeping the private key private; the public key can be openly distributed without compromising security. > In such a system, any person can ... I though i would be able to use private and public key from Letsencrypt, but maybe it is not the right way. I don’t know why both cert are different… The only error i’ve got is the old\_rsa\_priv\_decode:RSA lib so maybe it’s a Letsencrypt’s issue ---
**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\ **Post date:** [April 17, 2018, 2:43pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/7 "2018-04-17T14:43:27Z")
While certificates are an example of public key cryptography, they also contain a lot more information that your library probably isn’t handling correctly, as it’s usually used for x.509-based operations. You can generate your own keypairs whenever you want with the command `ssh-keygen -t rsa` and follow the prompts. Now, an important side note. **_If you are implementing a production system that is protecting confidential information - do not attempt to roll your own cryptography._** There are hundreds of small things you can do wrong that leak information and completely break any security in quite insidious ways. You should always use an established and well-vetted library to handle these things. You might be already, we can’t know with the information given, but if what you’re building is going to protect real user information you should be aware of this. ---
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 2:57pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/8 "2018-04-17T14:57:44Z")
-----BEGIN RSA PRIVATE KEY----- MIIJKAIBAAKCAgEAoRCcml4v6D6sNLK4uCbBBIbNefcz98cuJGWIeJx1pQeOA2wc GaP8HjP8EplVC8KLAeJ/CH2EE0Ky4i02ks/IgkoelXDPfvhtEwIs3PMqHBm/r1Tk … uaxd4dWioTwgHZmYPvBwlp6BmljQU9RdrnBtAv6gEZ8LcVFJ6RbhVQ6JefmWd9OV yjKg82Amv3B3Tx8ux+mf3S89YzCkUIKB+B8neVRFGVwPnteZSXdJtfZ30Hs= -----END RSA PRIVATE KEY----- the MD5 is now the same but still the same error ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 17, 2018, 3:00pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/9 "2018-04-17T15:00:38Z")
@Galax Dude, you didn’t post the full key. Did you? ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 17, 2018, 3:01pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/10 "2018-04-17T15:01:07Z")
DON’T post the full key. I mean ---
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 3:02pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/11 "2018-04-17T15:02:09Z")
Ok maybe you’re right, I have 2 weeks ahead me to build a complete project and find a way to secure my http request, so I’m stressed and confuse 😕 I have to find a quick and easy library as soon as possible, do you have a recommendation ? ---
**Author:** ![Galax](https://avatars.discourse-cdn.com/v4/letter/g/ce7236/32.png) [@Galax](https://community.letsencrypt.org/u/Galax)\ **Post date:** [April 17, 2018, 3:03pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/12 "2018-04-17T15:03:05Z")
Not the full (meaning of “…”) but i can cut more ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 17, 2018, 3:10pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/13 "2018-04-17T15:10:14Z")
Hi, (As I still don’t know what happens…) Do you want to try to issue another tls certificate and see if that works? (Maybe this key has some trouble) Thank you ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [April 17, 2018, 4:25pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/14 "2018-04-17T16:25:39Z")
Three quick notes: (1) Posting _part_ of a private key is still a problem, both because the privkey.pem stores multiple secrets, any one of which may be enough to compromise the key, and because Nadia Heninger has devised mathematical techniques for reconstructing a full private RSA key from a partial key. (2) As @jared.m notes, implementing your own cryptosystem from scratch is not a recipe for good security. There are tons of pitfalls that are not at all obvious. The "Cryptopals" series of challenges highlights this by having you break realistic encryption implementations because of extraordinarily subtle flaws. (3) I think we still haven't understood what you're looking to accomplish and why. If you want to protect network connections over the Internet, you can use the existing TLS implementations on your system with your Let's Encrypt certificate and you don't have to write any of your own encryption code. If you want to protect some other information in some other way, as @jared.m said, there's no need to use Let's Encrypt at all. > [@jared.m](#): > > While certificates are an example of public key cryptography, they also contain a lot more information that your library probably isn’t handling correctly, as it’s usually used for x.509-based operations. You can generate your own keypairs whenever you want with the command ssh-keygen -t rsa and follow the prompts. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 17, 2018, 4:39pm UTC](https://community.letsencrypt.org/t/private-key-does-not-match-with-my-certificate/59722/15 "2018-05-17T16:39:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.