Find files, editable templates and browser test targets by what you need to make or test. Explore complete business kits for connected records, templates and expected results.
Page 5 of 6; 24 results per page.
The DER OCSPRequest a client sends when checking the reference leaf, with the SHA-1 CertID that RFC 6960 mandates and no nonce extension. POST it at a stub responder to exercise request parsing without a live CA.
A successful OCSP response asserting status good for the reference leaf, signed directly by the SAMPLE issuing CA. Pair it with the request beside it to stub a responder end to end.
The OCSP counterpart of the CRL entry: status revoked for the revoked SAMPLE leaf, with the same 2026-03-01 revocation time and keyCompromise reason. Use both against the same certificate to check that CRL and OCSP paths agree.
The minimal unsuccessful OCSP response: responseStatus unauthorized and no responseBytes at all, which is what a responder returns for a certificate it does not serve. A handful of bytes that regularly breaks clients expecting a signed body.
The P-256 public key in OpenSSH form, whose blob names the curve twice — once in the key type and once inside the payload. Parsers that read only one of the two mis-handle mismatched keys.
The SAMPLE leaf's RSA key in single-line OpenSSH format with a comment — the same key material as the PEM public keys, wrapped the way authorized_keys wants it. Handy for checking that a fingerprint tool agrees across encodings.
A password-protected PKCS#12 keystore holding the SAMPLE leaf key together with its whole issuing chain, so one import gives a client both an identity and its anchors. The password `novus-p7-sample-p12` is published on purpose; nothing inside is a real credential.
The same leaf key and certificate in a PKCS#12 file with no password and no encryption. Several importers refuse an empty password, prompt anyway, or treat it as the literal empty string, so this is the fixture that finds out which.
Binary DER form of the same three-certificate PKCS#7 bundle, the encoding a .p7b download actually uses. Use it to test importers that never see the PEM armour.
A degenerate (certificates-only) PKCS#7 structure holding all three SAMPLE certificates under BEGIN PKCS7 armour — the payload Windows and Java tools distribute as a .p7b. It carries no private key and no signature over any content.
A detached PKCS#7 SignedData over signed-payload.txt, built without signed attributes so the bytes are reproducible. The content is not embedded, so verification needs both files — exactly the failure mode people hit with .p7s email attachments.
Binary DER encoding of the SAMPLE root CA certificate — the same bytes the PEM twin Base64-wraps. Feed it to ASN.1 decoders, Java keystores, and DER-to-PEM converters.
The self-signed root of the Novus Examples SAMPLE certificate hierarchy (RSA-4096, CA:TRUE, no path-length limit). Install it as the only trust anchor to make the rest of this wave's chains verifiable in a sandbox. Fictional issuer — never a real identity.
The legacy encrypted-key layout: PKCS#1 body plus `Proc-Type: 4,ENCRYPTED` and `DEK-Info` PEM headers carrying the cipher and IV, password `novus-p7-sample-pkcs1`. Parsers that strip PEM headers before decoding silently lose the IV and fail here.
The identical key material wrapped in the legacy PKCS#1 container (BEGIN RSA PRIVATE KEY), which omits the algorithm OID that PKCS#8 carries. Diff it against its PKCS#8 twin to see exactly what a container migration changes.
The SAMPLE leaf key under PKCS#8 password encryption (BEGIN ENCRYPTED PRIVATE KEY, PBES2), password `novus-p7-sample-pkcs8`. Encryption metadata lives inside the ASN.1 here, not in PEM headers — the opposite of the PKCS#1 twin.
The SAMPLE leaf's RSA-2048 key in unencrypted PKCS#8 (BEGIN PRIVATE KEY) — the modern default and the pair to the PKCS#1 twin beside it. It is deliberately published; treat it as public.
The same modulus and exponent in the raw PKCS#1 RSAPublicKey container, without the algorithm-identifier wrapper. Libraries routinely accept one armour and reject the other, so the pair is the test.
The SAMPLE leaf's public key as a bare SubjectPublicKeyInfo (BEGIN PUBLIC KEY) — the form JWT verifiers and most language runtimes expect when you hand them a key rather than a certificate.
An S/MIME-shaped certificate whose SAN is an rfc822Name rather than a DNS name, with the emailProtection EKU and a non-repudiation key usage. Useful for testing address extraction from certificates.
SAMPLE HTTP security header fixture (content-security-policy-report) for scanner regression.
SAMPLE HTTP security header fixture (cross-origin-embedder) for scanner regression.
SAMPLE HTTP security header fixture (cross-origin-opener) for scanner regression.
SAMPLE HTTP security header fixture (cross-origin-resource) for scanner regression.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.
