pem
What is a .pem file?
application/x-pem-file
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use a .pem file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
Download example .pem files
- X.509 Certificate (PEM)A self-signed X.509 v3 certificate in PEM (Base64) encoding with a SAN and key-usage extensions — published sample material for testing certificate and TLS parsers. Not a real identity.
- X.509 Certificate (PEM) — Security SAMPLESelf-signed X.509 SAMPLE certificate in PEM under /files/security/ — published sample material for TLS and PEM parsers.
- X.509 Certificate Chain (PEM) — SAMPLETwo-PEM-block SAMPLE chain file for multi-cert parsers and bundle importers.
- SAMPLE Leaf Certificate — RSA-2048The reference end-entity certificate for this wave: RSA-2048 subject key, two DNS SANs, serverAuth/clientAuth EKU, and AIA/CRL pointers to the fictional SAMPLE responder. Everything else in the p7 PKI is a deviation from this one.
- SAMPLE Leaf Certificate — EC P-256The elliptic-curve twin of the reference leaf: identical subject, SANs, EKU and issuer, but a P-256 subject public key instead of RSA-2048. Diff the two to isolate exactly what changes when a deployment migrates key types.
- SAMPLE Leaf Certificate — Ed25519The third key-type variant of the reference leaf, carrying an Ed25519 subject public key. Older TLS stacks and keystores reject id-Ed25519 outright, which makes this a compact compatibility probe.
- SAMPLE Leaf Certificate — ExpiredA correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.
- SAMPLE Leaf Certificate — Not Yet ValidThe mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
and 22 more in the library.