title: Private Key doesn't Match Certificate
body: <p>I'm having some weird issues with generating CSRs and certificates from them which I don't fully understand.</p>
  <p>Here's what I've done:</p>
  <p>Generate private key and CSR (done on Ubuntu on WSL if that's of any significance)</p>
  <pre><code>openssl req -newkey rsa:2048 -keyout PRIVATEKEY.key -out MYCSR.csr
  </code></pre>
  <p>Uploaded that to CA and got back a certificate beginning with <code>-----BEGIN CERTIFICATE-----</code> which would indicate a PEM-encoded certificate, right?</p>
  <p>Tried combining all of this into a PFX for ease of use</p>
  <pre><code>openssl pkcs12 -export -out CERTIFICATE.pfx -inkey PRIVATEKEY.key -in CERTIFICATE.cer
  </code></pre>
  <p>It then asks for the private key and then throws the error <code>No certificate matches private key</code></p>
  <p>Some people suggested reencoding the certificate from DER to PEM, but that just throws an error indicating the certificate is already X509</p>
  <pre><code>sudo openssl x509 -inform DER -outform PEM -in CERTIFICATE.cer -out CERTIFICATE.pem
  unable to load certificate
  140390322082240:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1130:
  140390322082240:error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:290:Type=X509
  </code></pre>
  <p>The following command generates quite sensible output, so the certificate seems to be alright to some extent</p>
  <pre><code>openssl x509 -in CERTIFICATE.cer -text -noout
  </code></pre>
  <p>The CA is Telia if this is of any use to anybody. I have had some issues in the past with them, for example Digicert's Certificate Utility doesn't recognize their certificates as valid for some reason (but that might of course be cause by me using the wrong file extension or something).</p>