> Source: [sk113079](https://support.checkpoint.com/results/sk/sk113079)

# sk113079 - 'No certificate matches private key' error after user types the P12 certificate creation command

| Property | Value |
|----------|-------|
| Solution ID | sk113079 |
| Date Created | 2016-08-30 |
| Last Modified | 2017-09-25 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * 'No certificate matches private key' error after user types the P12 certificate creation command:  
  *cpopenssl pkcs12 -export -out \<output file\> -in \<signed cert chain file\> -inkey \<private key file\>*
* Same error after performing sk69660 to convert certificate to P12.
* #cpopenssl pkcs7 -print_certs -in your_certificate.p7b -out output_certificate.cer unable to load PKCS7 object 4746:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:646:Expecting: PKCS7

## Cause

1. Once a CSR is created, the Mobile Access gateway generates a key pair: a Private and a Public key.
2. The public key is combined with the CSR into a single file (*\*.csr*), while the private key is kept secured in the Mobile Access gateway.
3. The CA receives the CSR (combined with the public key) and creates the certificate according the CSR content.
4. At this stage, the new certificate contains the public key generated by the Mobile Access gateway.
5. After the certificate creation, the CA signs the certificate with its own private key.
6. The signed certificate (containing the gateway public key) is fused with the Mobile Access gateway's private key into an encrypted P12 certificate.

In our scenario, the user failed to fuse the private key and the signed certificate.

The certificate signed by the CA contains invalid syntax, where prohibited spaces were included in the base64 code content.

When you edit the certificate file with Notepad++ or any other text editor, the spaces can be revealed.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content