Can you recover a private key from an Nginx certificate?

No. A certificate contains a public key, not the corresponding private key. Generating a new private key does not make it match an existing certificate. Nginx TLS termination needs access to the matching key, either from a file or a supported key provider.

Recover an existing copy or generate a new key and obtain a certificate for it.

Look where the certificate was requested or deployed

Common locations include /etc/ssl/private/, /etc/pki/tls/private/, and certificate automation directories. Start with the configured ssl_certificate_key path, deployment secrets, approved backups, and the host or service that generated the certificate request.

sudo find /etc/ssl /etc/pki /etc/letsencrypt \
  -type f \( -name '*.key' -o -name 'privkey.pem' \) 2>/dev/null

Paths vary by system. A private key may exist in several deployed copies or in a hardware-backed store; it is not necessarily confined to the original machine. Inspect file paths without printing private-key contents into logs or chats.

Compare public keys

This works for common RSA and EC keys, unlike an RSA-only modulus comparison:

openssl x509 -in server.crt -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256

openssl pkey -in server.key -pubout -outform DER \
  | openssl dgst -sha256

Both commands must succeed, and the fingerprints must match. The comparison covers the certificate's public key, not certificate expiry, hostname coverage, or chain validity. An encrypted key prompts for its passphrase.

Generate a new key and request a new certificate

If no usable matching key remains, create a new key and CSR in a protected directory:

umask 077
openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -subj '/CN=example.com' \
  -addext 'subjectAltName=DNS:example.com'

This example requires an OpenSSL version supporting -addext. -nodes writes an unencrypted key, so protect its file permissions and storage. Submit the CSR through your CA's reissue process, including all required names. If you use ACME automation such as Certbot, follow that deployment's certificate workflow rather than manually replacing its managed files.

Configure and test Nginx

server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/server.key;
}

The certificate file should contain the leaf certificate followed by the required intermediate certificates. Restrict access to the key while allowing the Nginx master to read it; root ownership and mode 600 fit many root-started deployments, but rootless deployments differ.

sudo nginx -t && sudo systemctl reload nginx

Then verify the served certificate and chain with a real TLS client. A configuration test can catch a mismatched key but does not prove every client trusts the chain.

FAQ

Can a PFX or P12 file contain the key?

Yes, if the bundle was exported with it. With authorization and the bundle passphrase:

umask 077
openssl pkcs12 -in cert.pfx -nocerts -nodes -out server.key

This exports an unencrypted private key. Verify that the output contains the intended key and protect it immediately.

Can the old certificate still work elsewhere?

Yes, where the matching private key remains available and the certificate is otherwise valid. Losing your copy does not automatically revoke it. If the key may have been exposed, follow the CA's revocation and replacement process.

Is a .crt file necessarily different from fullchain.pem?

The extension does not determine contents. Inspect the certificates present; a file named .crt can also contain a chain.

References: Nginx TLS certificate and key directives, OpenSSL req, OpenSSL pkey.