Any openssl command line to verify ECDSA prime256v1 certificate and private key match?

You can verify that a certificate and any supported key (including an ECDSA prime256v1 key) match using OpenSSL.

This command will get the public key from the certificate:

openssl x509 -noout -pubkey -in Org1-cert.pem

This command will get the public key from the key:

openssl pkey -pubout -in Org1-key.pem

You can compare them visually...

OR you can automate the comparison of any cert and key as follows with Bash:

1. Create a script called verify-cert-key:

   #!/usr/bin/env bash
   certFile="${1}"
   keyFile="${2}"
   certPubKey="$(openssl x509 -noout -pubkey -in "${certFile}")"
   keyPubKey="$(openssl pkey -pubout -in "${keyFile}")"
   if [[ "${certPubKey}" == "${keyPubKey}" ]]
   then
     echo "PASS: key and cert match"
   else
     echo "FAIL: key and cert DO NOT match"
   fi
   

2. Make the script executable:

   chmod +x verify-cert-key
   

3. Run it:

   ./verify-cert-key Org1-cert.pem Org1-key.pem
   

CAVEAT: openssl on macOS Sierra doesn't have pkey

On macOS Sierra, the script may say "FAIL: key and cert DO NOT match" even if they do.

Verify that pkey is missing:

openssl pkey -in

If it is missing, you will see this:

openssl:Error: 'pkey' is an invalid command.

Followed by tons of other usage summary output from OpenSSL.

You may also see "openssl:Error: 'pkey' is an invalid command."

If pkey is missing, you'll need install a newer openssl and set your PATH accordingly.

I installed a newer OpenSSL with Homebrew and set my PATH like this:

export PATH=/usr/local/Cellar/openssl/1.0.2m/bin/:$PATH

Verify that pkey is available:

openssl pkey -in

This should show pkey usage summary:

Usage pkey [options]
where options are

Now the script should work as expected.

What you need to do is read the certificate and private key and check if the public key of the certificate matches the public key in the private key.

openssl x509 -in signcerts/peer.pem -text -noout

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:45:70:b1:2c:74:4e:6a:9d:6f:33:70:95:e3:41:07:3a:08:4f:4c
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=US, ST=California, L=San Francisco, O=Internet Widgets, Inc., OU=WWW, CN=example.com
        Validity
            Not Before: Nov 11 17:07:00 2016 GMT
            Not After : Nov 11 17:07:00 2017 GMT
        Subject: C=US, ST=North Carolina, L=Raleigh, O=Hyperledger Fabric, OU=COP
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:1c:1b:8a:b0:03:b8:de:1b:38:24:6a:45:7e:21:
                    8c:90:1f:f1:b0:82:d3:b0:eb:e6:37:65:a6:c2:9b:
                    0f:1d:93:4b:eb:0f:07:59:ed:f1:08:f4:2d:74:6f:
                    d7:24:9b:d9:f8:2e:f9:e8:a1:2c:50:13:37:cb:0e:
                    4f:4d:f9:2e:f2
                ASN1 OID: prime256v1
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                E1:42:75:C5:19:E1:EB:37:96:D8:82:80:05:43:A3:22:DF:56:93:C8
            X509v3 Authority Key Identifier: 
                keyid:17:67:42:3D:AA:9E:82:3F:C4:C5:1D:9F:5B:C3:99:D1:B5:9C:48:10

            X509v3 Subject Alternative Name: 
                DNS:myhost.com, DNS:www.myhost.com
    Signature Algorithm: ecdsa-with-SHA256
         30:45:02:20:37:fd:1d:b9:78:c6:7d:f3:e0:4c:0d:2a:68:a5:
         33:d9:57:d8:5a:b8:8d:6a:40:69:15:41:f7:b3:a6:54:47:b2:
         02:21:00:db:96:83:3d:01:c6:1a:ad:80:be:12:93:d3:0b:ed:
         d3:c7:17:d4:64:c6:08:86:df:9a:e2:e9:33:02:90:8f:7f

openssl ec -in keystore/key.pem -text -noout

read EC key
Private-Key: (256 bit)
priv:
    0b:16:c0:5b:a7:13:3a:b3:d5:18:7a:9e:f0:f8:32:
    23:e4:28:2b:66:a3:1c:e1:de:34:ea:b8:6e:4c:49:
    b7:8b
pub: 
    04:1c:1b:8a:b0:03:b8:de:1b:38:24:6a:45:7e:21:
    8c:90:1f:f1:b0:82:d3:b0:eb:e6:37:65:a6:c2:9b:
    0f:1d:93:4b:eb:0f:07:59:ed:f1:08:f4:2d:74:6f:
    d7:24:9b:d9:f8:2e:f9:e8:a1:2c:50:13:37:cb:0e:
    4f:4d:f9:2e:f2
ASN1 OID: prime256v1