Troubleshoot SSL certificates and keys
If you get an error about certificate/key mismatch in the Web server log file, it is because an incorrect certificate or key is in use.
Verify that the current key matches the certificate file with the following commands. Note that the SHA checksum of the key and certificate must match.
Check your certificate:
$ openssl x509 -in server.crt -pubkey -noout -outform pem | sha256sum
Check your key:
$ openssl pkey -in server.key -pubout -outform pem | sha256sum
The output of the two commands above should match. In case of a mismatch, the wrong key is in use for the certificate and so the Web server will not start until the issue is resolved.