Public Key Extractor

The Public Key Extractor isolates the public key from X.509 certificates or Certificate Signing Requests, outputting it in standard PEM SubjectPublicKeyInfo (SPKI) format -- essential for key matching verification, public key pinning, and confirming that a certificate was issued for the correct private key. Paste a certificate or CSR and get the extracted public key with algorithm, size, and SPKI hash.

Understanding Public Key Extraction

Every certificate and CSR contains a public key, but that key is buried inside a larger data structure along with the subject name, issuer, validity dates, extensions, and signatures. Sometimes you need just the key itself -- stripped of all the surrounding certificate metadata. This is what public key extraction does: it pulls out the SubjectPublicKeyInfo (SPKI) structure that contains the key algorithm identifier and the key data, and presents it as a standalone PEM block.

The most practical reason to extract a public key is to verify that a certificate, a CSR, and a private key all belong together. When you generate a key pair, the private key and the certificate issued from it must contain the same public key. If they do not match -- because someone mixed up files, or the wrong CSR was submitted -- your TLS server will fail to start with a cryptic error about key mismatch. Extracting the public key from each file and comparing the SPKI hashes is the fastest way to confirm they are a matching set.

Public key extraction is also central to public key pinning. Unlike certificate pinning, which pins to a specific certificate (and breaks on renewal), public key pinning pins to the key itself. As long as you reuse the same key pair when renewing, the pin remains valid. Mobile apps, API clients, and security-sensitive services commonly use SPKI hashes for pinning, and this tool provides those hashes in the correct format for Android, iOS, and custom implementations.

How to Extract a Public Key from a Certificate

1. Paste a PEM-encoded certificate (-----BEGIN CERTIFICATE-----) or CSR (-----BEGIN CERTIFICATE REQUEST-----)
2. The tool extracts the public key in SPKI PEM format
3. Review the key metadata (algorithm, size, hash)
4. Copy the extracted public key or use the hash for comparison

Example Public Key Extraction

From a certificate with CN=www.example.com:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzR4p3vGh8Kx2...
...truncated...
-----END PUBLIC KEY-----

Key Metadata:
  Algorithm:   RSA
  Key Size:    2048 bits
  SPKI Hash:   sha256/YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=

Key Types and Their Output

How to Verify Certificate and Private Key Match

The most common use of extracted public keys is verifying that a certificate was issued for a specific private key. Two methods:

Method 1: Compare SPKI Hashes

Extract the public key from both the certificate and the private key file, then compare their SPKI SHA-256 hashes:

# From certificate (using this tool or OpenSSL):
openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256
# Output: sha256=YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=

# From private key:
openssl pkey -in key.pem -pubout -outform DER | openssl dgst -sha256
# Output: sha256=YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=

If the hashes match, the certificate and private key are a valid pair.

Method 2: Compare Modulus (RSA Only)

For RSA keys, compare the modulus values:

openssl x509 -in cert.pem -noout -modulus | openssl md5
openssl rsa -in key.pem -noout -modulus | openssl md5

Matching MD5 hashes confirm the key pair matches.

When to Use This Tool

• Key matching before deployment -- verify that your certificate, CSR, and private key all share the same public key before configuring a server
• Public key pinning -- extract the SPKI hash for implementing HTTP Public Key Pinning (HPKP) or app-level pinning in Android/iOS applications
• Certificate renewal verification -- confirm whether a renewed certificate uses the same key pair or a new one
• Cross-CA comparison -- compare certificates issued by different CAs for the same key pair (e.g., migrating from one CA to another)
• Key rotation tracking -- document public key hashes over time to track when key rotations occur
• Forensic analysis -- determine whether two certificates from different sources share the same underlying key pair

How Public Key Pinning Differs from Certificate Pinning

Public key pinning is generally preferred because it allows certificate renewal without updating pins, as long as the same key pair is reused. However, some security policies require key rotation on every renewal, in which case certificate pinning provides tighter control.

Key Extraction in Practice

The most important use case for key extraction is the pre-deployment check that prevents the dreaded "key mismatch" error. Before you install a new certificate on a production server, extract the public key from three sources: the certificate, the CSR that was submitted, and the private key on the server. All three SPKI hashes should match. If the certificate hash does not match the private key hash, the certificate was issued for a different key pair and cannot be used with that private key. This check takes seconds and prevents the far more painful process of discovering the mismatch during a maintenance window at 2 AM.

For public key pinning in mobile applications, the workflow is straightforward: extract the SPKI hash from your server's certificate using this tool, then embed that hash in your app's pinning configuration. On Android, this goes into network-security-config.xml; on iOS, you implement it in your URLSessionDelegate. Always include at least two pins -- the current key and a backup key that you have generated but not yet deployed. Without a backup pin, a key rotation forces an emergency app update before users can connect.

When tracking key rotations across your infrastructure, keep a log of SPKI hashes for each service endpoint. After a certificate renewal, extract the public key and compare it against the previous hash. If the hash changed, the renewal included a key rotation. If the hash is the same, the same key was reused. This information matters for compliance audits that require periodic key rotation and for security teams tracking cryptographic material lifecycle.

Frequently Asked Questions

What is SubjectPublicKeyInfo (SPKI)? SPKI is the ASN.1 structure defined in RFC 5280 that wraps a public key along with its algorithm identifier. It includes the key algorithm (RSA, ECDSA, etc.) and the key data itself. The -----BEGIN PUBLIC KEY----- PEM format contains DER-encoded SPKI. This format is universally understood by OpenSSL, Java, .NET, and most cryptographic libraries.

Can I extract a public key from a private key instead? This tool works with certificates and CSRs. To extract the public key from a private key file, use OpenSSL: openssl pkey -in private.key -pubout -out public.pem. The resulting public key will be in the same SPKI format and can be compared with keys extracted from certificates using this tool.

How do I use the extracted key for Android certificate pinning? Android's network-security-config.xml uses base64-encoded SHA-256 hashes of the SPKI DER encoding. This tool provides the hash in the correct format. Add it to your configuration: <pin digest="SHA-256">YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=</pin>.

Why do two certificates with different expiry dates have the same public key hash? Because public key pinning only hashes the key material and algorithm, not the certificate metadata. If you renewed a certificate while reusing the same key pair, the new certificate will have different validity dates, serial number, and signature, but the public key -- and therefore the SPKI hash -- will be identical.

Is it safe to share my public key? Yes. Public keys are designed to be shared freely. They are included in every certificate your server presents during TLS handshakes, so anyone who connects to your server already has your public key. The private key is what must be kept secret.

Related Tools

• Certificate Fingerprint Generator - Generate certificate-level fingerprints (different from public key hashes)
• X.509 Certificate Viewer - View complete certificate details including the key algorithm and size
• CSR Viewer - Inspect the CSR that was used to request the certificate
• SAN Extractor - Extract domain names covered by the certificate
• PEM Bundle Splitter - Split a chain to extract individual certificates for key comparison