When you have a certificate issued, this is the general process:
- You generate a key pair (a private key, and its derived public key)
- You make a CSR (Certificate Signing Request) from the key pair, which basically says “hey signing authority, here’s my public key, along with some information about me and the domain I want a certificate for”
- The authority takes the CSR, extracts the public key and the information you provided, puts that information into a certificate, then signs that certificate with THEIR private key.
- They then give you back the certificate chain with your signed certificate
So here, Caddy is checking that the public key inside the certificate matches the public component of your key (public keys can be derived from a private key, by doing some fancy math, depends on the type of key how this is done).
I don’t know what exactly is wrong in your files. It might be that you’re not using the same key that was used when issuing the certificates. You can’t mix and match certificates and keys.
I like using ASN.1 JavaScript decoder when trying to debug issues with certificates and keys. You can paste your key and certificate, and you can compare whether they public keys inside match. ASN.1 is the underlying encoding format inside of PEM files (which are just base64 encoded DER… and DER is just the binary representation of an ASN.1 tree)