After certificate issuance, the SSLFOR CSR + Certificate Matcher compares the RSA public key in the original CSR with the public key contained in the X.509 certificate. Matching components indicate that the certificate was issued for the key pair represented by that request.
This is useful during certificate renewals, multi-server deployments and CA support cases where several CSRs may have been created.
The comparison is local and does not require sending certificate-request or private-key material to the server.