Security

The security category is a first-class hub for auth and PKI SAMPLE fixtures, published sample-only material that must never be used as a real identity. It deepens certificate and key coverage under permanent /files/security/… paths (the older data/security paths remain shipped and unchanged). Expect self-signed X.509 certificates and CSRs, RSA/Ed25519 keys, PKCS#12 SAMPLE bundles, JWT algorithm variants (none/HS/RS), JWKS documents, OAuth token-response JSON, CORS and CSP header text, htpasswd variants, and SSH known_hosts samples. Every private key and token is labelled SAMPLE and deliberately committed for parser, TLS, and auth-harness tests.

Filter security on Browse · 135 files · 8 subcategories

135 of 135 files

Headers

Browser Security Headers Pack — SAMPLE

SAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.

File: HEADERS · Headers
Use case: API testing

Content-Security-Policy Header — SAMPLE

SAMPLE CSP header line for CSP parsers and security-header scanners.

File: HEADERS · Headers
Use case: API testing

CORS Misconfigured Headers — SAMPLE

Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.

File: HEADERS · Headers
Use case: API testingError handling

CORS Response Headers — SAMPLE

SAMPLE CORS response header block as plain text for header parsers and policy tests.

File: HEADERS · Headers
Use case: API testing

HSTS Header — SAMPLE

SAMPLE Strict-Transport-Security header for TLS policy scanners.

File: HEADERS · Headers
Use case: API testing

Security Header — Content Security Policy Report

SAMPLE HTTP security header fixture (content-security-policy-report) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Cross Origin Embedder

SAMPLE HTTP security header fixture (cross-origin-embedder) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Cross Origin Opener

SAMPLE HTTP security header fixture (cross-origin-opener) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Cross Origin Resource

SAMPLE HTTP security header fixture (cross-origin-resource) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Expect Ct Legacy

SAMPLE HTTP security header fixture (expect-ct-legacy) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Permissions Policy

SAMPLE HTTP security header fixture (permissions-policy) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Referrer Policy Strict

SAMPLE HTTP security header fixture (referrer-policy-strict) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — Strict Transport Security

SAMPLE HTTP security header fixture (strict-transport-security) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — X Content Type Options

SAMPLE HTTP security header fixture (x-content-type-options) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

Security Header — X Frame Options Deny

SAMPLE HTTP security header fixture (x-frame-options-deny) for scanner regression.

File: HEADERS · Headers
Use case: Certificate & key testingWeb assets· Conversion set

X-XSS-Protection Header — SAMPLE

SAMPLE X-XSS-Protection: 0 header for legacy header scanners.

File: HEADERS · Headers
Use case: API testing

Htpasswd

htpasswd (APR1 MD5) — SAMPLE

SAMPLE htpasswd using Apache APR1 MD5-style hash for legacy Basic-auth tests.

File: HTPASSWD · Htpasswd
Use case: Certificate & key testing

htpasswd (bcrypt) — SAMPLE

SAMPLE htpasswd with a bcrypt hash line for Basic-auth file parsers.

File: HTPASSWD · Htpasswd
Use case: Certificate & key testing

htpasswd (Mixed Algorithms) — SAMPLE

Multi-user SAMPLE htpasswd mixing bcrypt, APR1, and {SHA} lines for algorithm-detection tests.

File: HTPASSWD · Htpasswd
Use case: Certificate & key testing

Jwks

JWKS (Empty Keys) — SAMPLE

Empty JWKS keys array for edge-case JWKS loaders.

File: JSON · Jwks
Use case: JWT / JWKS testingError handling· Conversion set

JWKS (RSA) — SAMPLE

SAMPLE JWKS document exposing the Wave G RSA public key for JWT signature verification tests.

File: JSON · Jwks
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWK — EC P-256 Public Key

A single P-256 public JWK. Its x and y are fixed 32-byte base64url values, left-padded when a coordinate happens to be short — the padding rule that libraries stripping leading zeroes get wrong.

File: JSON · Jwks
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWK — Ed25519 Private Key

An OKP-type JWK holding the Ed25519 key pair as raw 32-byte x and d values. OKP is the newest JWK key type and the one older JOSE libraries reject outright.

File: JSON · Jwks
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWK — RSA Private Key

The full RSA private key as a JWK, including the CRT parameters p, q, dp, dq and qi. It is the input for testing JWK-to-PEM conversion, where dropping the CRT values quietly costs a large amount of signing performance.

File: JSON · Jwks
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWK — Symmetric oct Key

The symmetric HMAC secret used by this wave's HS256 tokens, expressed as an oct JWK. The secret is printed in the specs on purpose so a verifier can be wired up without guessing.

File: JSON · Jwks
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWKS — Duplicate kid

Two keys of different types published under the same kid — what a botched key rotation leaves behind. A resolver that returns the first match silently verifies against the wrong key type instead of reporting the ambiguity.

File: JSON · Jwks
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWKS — Keys Without kid

A JWK Set whose keys carry no kid at all, which RFC 7517 permits. Verifiers must then fall back to trying candidates by algorithm, and the ones that index the set by kid alone find nothing.

File: JSON · Jwks
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWKS — RSA, EC, and Ed25519 Keys

A three-key JWK Set publishing the public halves of this wave's RSA, P-256, and Ed25519 keys, each with a distinct kid. It is the resolver input for every p7 JWT, so kid selection can be tested against a set that really has more than one candidate.

File: JSON · Jwks
Use case: JWT / JWKS testingCertificate & key testing· Conversion set

SAMPLE JWKS — With x5c Certificate Chain

A JWK carrying the full x5c certificate chain and an x5t#S256 thumbprint alongside the raw n/e values. The x5c array is standard Base64 while every other JWK field is base64url — a real and frequently mis-implemented detail.

File: JSON · Jwks
Use case: JWT / JWKS testingCertificate & key testing· Conversion set

Jwt

JWT — Intentionally Invalid Segments

Intentionally invalid JWT (truncated) for parser error-path tests.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling

JWT (HS256 Expired) — SAMPLE

SAMPLE HS256 JWT with a past exp claim — for expiry-validation harnesses.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling

JWT (HS256) — SAMPLE

SAMPLE JWT with alg=HS256 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (HS384) — SAMPLE

SAMPLE JWT with alg=HS384 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (HS512) — SAMPLE

SAMPLE JWT with alg=HS512 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (none) — SAMPLE

SAMPLE JWT with alg=none for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (RS256) — SAMPLE

SAMPLE JWT with alg=RS256 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (RS384) — SAMPLE

SAMPLE JWT with alg=RS384 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT (RS512) — SAMPLE

SAMPLE JWT with alg=RS512 for auth parsers and algorithm-handling tests. Published sample material only.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

JWT Header Claims — RS256 SAMPLE

JWT Header Claims — RS256 SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).

File: JSON · Jwt
Use case: JWT / JWKS testingJSON parsing· Conversion set

JWT Payload — Expired SAMPLE

JWT Payload — Expired SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).

File: JSON · Jwt
Use case: JWT / JWKS testingJSON parsing· Conversion set

SAMPLE JWS — Flattened JSON Serialization

The single-signature flattened JSON form of the exact same RS256 token shipped in compact serialization. Both encodings must verify to the identical payload, which is the round-trip this pair is for.

File: JSON · Jwt
Use case: JWT / JWKS testingAPI testing· Conversion set

SAMPLE JWS — General JSON Serialization

One payload carrying two independent signatures — RS256 and EdDSA — in the General JSON serialization that the compact form cannot express. Multi-signature handling is the part of RFC 7515 most libraries never implemented.

File: JSON · Jwt
Use case: JWT / JWKS testingAPI testing· Conversion set

SAMPLE JWT — alg none, Unsigned

An unsecured JWS: alg is none and the signature segment is empty, leaving only the trailing dot. Any verifier that accepts it will accept a claim set an attacker wrote, which is why this is the first negative test to run.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWT — Algorithm Confusion (HS256 over an RSA Public Key)

The classic algorithm-confusion shape: a token that claims HS256 while its kid points at an RSA key, MACed with that key's public PEM as the shared secret. A verifier that picks its algorithm from the header rather than from the key type accepts it.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWT — EdDSA, Bad Signature

The EdDSA token with one bit of its signature flipped. Ed25519 verification either succeeds or fails with no partial credit, which makes this the cleanest possible negative case.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Paired fixture

SAMPLE JWT — EdDSA, Valid

An EdDSA (Ed25519) token with a fixed 64-byte signature and the same claim set as the RS256 reference. EdDSA signing is deterministic, so this token is reproducible in a way an ES256 one could never be.

File: JWT · Jwt
Use case: JWT / JWKS testing· Paired fixture

SAMPLE JWT — HS256 with a Published Secret

A symmetric HS256 token whose secret is printed in the specs and shipped as an oct JWK, so a verifier can be stood up without any key exchange. It shares its claim set with the RS256 reference token.

File: JWT · Jwt
Use case: JWT / JWKS testing· Conversion set

SAMPLE JWT — RS256, Bad Signature

The valid RS256 token with the last bit of its signature flipped. Header and payload are byte-identical to the valid twin, so any difference in outcome is entirely down to signature verification.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Paired fixture

SAMPLE JWT — RS256, Expired

A correctly signed RS256 token whose exp passed on 2020-01-01. The signature still verifies, so it isolates expiry handling from every other check — including the libraries that validate the signature and then forget to look at exp.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWT — RS256, Not Yet Valid

A valid signature over a claim set whose nbf is 2035. Many verifiers check exp diligently and skip nbf entirely, so this is the token that finds out.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWT — RS256, Signed by the Wrong Key

A perfectly well-formed RS256 signature made with the SAMPLE root key while the kid header still names the leaf key. Verifiers that trust the kid without checking the signature against that exact key accept it.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

SAMPLE JWT — RS256, Valid

The reference token for this wave: RS256, signed by the SAMPLE leaf key, with iss, aud, iat, nbf, exp and jti all present and an expiry in 2036. Every other JWT here is a deliberate deviation from it.

File: JWT · Jwt
Use case: JWT / JWKS testing· Paired fixture

SAMPLE JWT — Unknown kid

A genuinely valid RS256 signature whose kid names a key that has been rotated out of the JWK set. The right behaviour is a clean key-not-found error, not a silent fallback to whichever key happens to be first.

File: JWT · Jwt
Use case: JWT / JWKS testingError handling· Conversion set

Oauth

OAuth Device Code Response — SAMPLE

SAMPLE OAuth device-authorization response for device-flow client tests.

File: JSON · Oauth
Use case: JWT / JWKS testingAPI testing

OAuth Error — Insufficient Scope

OAuth 2.0 SAMPLE error JSON (insufficient_scope) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Error — Invalid Client

OAuth 2.0 SAMPLE error JSON (invalid_client) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Error — Invalid Grant

OAuth 2.0 SAMPLE error JSON (invalid_grant) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Error — Invalid Scope

OAuth 2.0 SAMPLE error JSON (invalid_scope) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Error — Temporarily Unavailable

OAuth 2.0 SAMPLE error JSON (temporarily_unavailable) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Error — Unauthorized Client

OAuth 2.0 SAMPLE error JSON (unauthorized_client) for client error-path tests.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1· Conversion set

OAuth Token Error — SAMPLE

SAMPLE OAuth error JSON for token-endpoint failure handling.

File: JSON · Oauth
Use case: JWT / JWKS testingError handling+1

OAuth Token Introspection — SAMPLE

SAMPLE RFC 7662-style token introspection response for auth middleware tests.

File: JSON · Oauth
Use case: JWT / JWKS testingAPI testing

OAuth Token Response — SAMPLE

SAMPLE OAuth 2.0 token endpoint JSON with access, refresh, and id_token fields.

File: JSON · Oauth
Use case: JWT / JWKS testingAPI testing

OpenID Provider Configuration — SAMPLE

SAMPLE OpenID Connect discovery document for OIDC client and metadata parsers.

File: JSON · Oauth
Use case: JWT / JWKS testingAPI testing

Pgp

OpenPGP Public Key (ASCII Armor) — SAMPLE Shape

ASCII-armored SAMPLE-shaped PGP public key placeholder for armor detectors (not a cryptographically valid key).

File: TXT · Pgp
Use case: Certificate & key testing

Pki

CRL Metadata JSON — SAMPLE

SAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.

File: JSON · Pki
Use case: Certificate & key testing

Ed25519 Private Key (PEM) — SAMPLE

Deterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.

File: KEY · Pki
Use case: Certificate & key testing· Conversion set

Encrypted PKCS#8 RSA Key — SAMPLE

Password-encrypted SAMPLE PKCS#8 private key (password printed in specs) for decrypt-import tests.

File: KEY · Pki
Use case: Certificate & key testing

PKCS#10 CSR — Security SAMPLE

PKCS#10 certificate signing request SAMPLE for CSR parsers and CA tooling smoke tests.

File: CSR · Pki · PEM
Use case: Certificate & key testing

PKCS#12 Bundle (.p12) — SAMPLE

SAMPLE PKCS#12 keystore (password `novus-sample-wg`) for keystore importer tests. Not byte-stable.

File: P12 · Pki
Use case: Certificate & key testing

RSA-2048 Private Key (PEM) — SAMPLE

Published SAMPLE RSA-2048 private key (PKCS#8 PEM). Never use for a real identity.

File: KEY · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE CA Bundle — Root + Intermediate

The two CA certificates concatenated in trust-store order, the shape a `--cafile` or `ca-bundle.crt` argument expects. Point a client at this and every other valid p7 leaf becomes verifiable.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Certificate Revocation List — Empty

A correctly signed CRL with an absent revokedCertificates field — what a CA publishes when it has revoked nothing. Parsers that assume the list is always present tend to fault here rather than report zero entries.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Certificate Revocation List — Stale

A validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Certificate Revocation List (DER)

Binary DER twin of the SAMPLE CRL — the exact encoding a CRL distribution point serves over HTTP. Use it to test binary CRL fetching and caching paths that never see PEM armour.

File: DER · Pki · DER (binary)
Use case: Certificate & key testingConversion testing· Paired fixture

SAMPLE Certificate Revocation List (PEM)

The issuing CA's revocation list, PEM-armoured, naming the revoked SAMPLE leaf (keyCompromise) plus a second serial with no matching certificate file — because a real CRL lists serials, not certificates. Signed by the same intermediate that issued them.

File: PEM · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE Chain — Leaf + Intermediate

The bundle a TLS server actually presents: leaf first, then the issuing CA, with the root deliberately omitted because clients must already trust it. This is the correct-by-construction reference for the chain-order fixtures beside it.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Chain — Leaf + Intermediate + Root

The same chain with the self-signed root appended. Sending the root is legal and common, merely wasteful, so a verifier must ignore the extra anchor rather than treat it as an error.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Chain — Missing Intermediate

Leaf plus root with the issuing CA left out — the single most common TLS misconfiguration, and the one that works in browsers with a cached intermediate and fails everywhere else. Use it to prove a client does not silently paper over the gap.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Chain — Wrong Order

The leaf and intermediate concatenated backwards. Strict servers reject the file outright while tolerant path builders reorder it silently, so it cleanly separates the two behaviours.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Client Authentication Certificate

A mutual-TLS client certificate: EC P-256 subject key, clientAuth EKU only, and an OU naming the fictional access group. Present it to an mTLS endpoint to test client-certificate parsing and EKU enforcement.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Code Signing Certificate

A code-signing certificate (codeSigning EKU, digitalSignature only) issued by the SAMPLE intermediate. It signs nothing real — it exists so signature-verification tooling has an EKU-correct certificate to reason about.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE CSR — Common Name Only

A CSR with nothing but a Common Name and no requested extensions — the output of the shortest possible openssl req invocation. Intake code that assumes an extensionRequest attribute exists breaks on it.

File: CSR · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE CSR — Ed25519

An Ed25519 certificate request. Its signature algorithm identifier carries no separate hash OID, which is exactly the field that trips older CSR parsers written around RSA and ECDSA.

File: CSR · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE CSR — Intentionally Corrupt Base64

An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.

File: CSR · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE CSR — RSA with SAN

The CSR shape a modern CA expects: full subject DN, a requested subjectAltName extension, and a self-signature proving possession of the RSA key. Everything a CA intake form needs to parse.

File: CSR · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE CSR — Wildcard

A wildcard certificate request covering *.csr.pki.sample.example plus the apex. CA policy engines usually treat wildcards specially, so this is the input that exercises that branch.

File: CSR · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Detached Signature Payload

The exact bytes covered by the detached PKCS#7 signature shipped beside it. LF line endings are part of the contract — rewriting the file with CRLF is the fastest way to watch a signature check fail for a reason nobody suspects.

File: TXT · Pki · UTF-8
Use case: Certificate & key testing· Paired fixture

SAMPLE EC P-256 Private Key — PKCS#8

The P-256 key behind the EC leaf certificate, in PKCS#8. Its scalar is derived deterministically from a fixed label so the whole wave reproduces byte for byte.

File: KEY · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE EC P-256 Private Key — SEC 1

The same P-256 scalar in the SEC 1 container (BEGIN EC PRIVATE KEY), which names the curve inline instead of through a PKCS#8 algorithm identifier. Some deployment tools accept only one of the two.

File: KEY · Pki
Use case: Certificate & key testingConversion testing· Paired fixture

SAMPLE EC P-256 Public Key — SubjectPublicKeyInfo

The P-256 public key in SubjectPublicKeyInfo form, carrying the named-curve OID and an uncompressed point. It matches the EC leaf certificate and the EC entry in the p7 JWK set.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Ed25519 Private Key — PKCS#8

The Ed25519 key behind the Ed25519 leaf and the EdDSA JWTs, in PKCS#8. RFC 8410 keys have no traditional-OpenSSL container at all, which is why only one serialisation ships.

File: KEY · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Intermediate CA Certificate (DER)

Binary DER encoding of the SAMPLE intermediate CA certificate — the same bytes the PEM twin Base64-wraps. Feed it to ASN.1 decoders, Java keystores, and DER-to-PEM converters.

File: DER · Pki · DER (binary)
Use case: Certificate & key testingConversion testing· Conversion set

SAMPLE Intermediate CA Certificate (PEM)

The issuing CA that signs every leaf in this wave, itself signed by the SAMPLE root and constrained with pathLenConstraint:0 so it cannot mint further CAs. Use it to test intermediate handling and path-length enforcement.

File: CRT · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Leaf Certificate — EC P-256

The elliptic-curve twin of the reference leaf: identical subject, SANs, EKU and issuer, but a P-256 subject public key instead of RSA-2048. Diff the two to isolate exactly what changes when a deployment migrates key types.

File: PEM · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE Leaf Certificate — Ed25519

The third key-type variant of the reference leaf, carrying an Ed25519 subject public key. Older TLS stacks and keystores reject id-Ed25519 outright, which makes this a compact compatibility probe.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Leaf Certificate — Expired

A correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.

File: PEM · Pki
Use case: Certificate & key testingError handling· Paired fixture

SAMPLE Leaf Certificate — IP Address SAN

A leaf whose SAN carries both a DNS name and an iPAddress entry (192.0.2.10, from the RFC 5737 documentation range). Connecting by literal IP must match the iPAddress entry, never the DNS one.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Leaf Certificate — No SAN Extension

A pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Leaf Certificate — Not Yet Valid

The mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.

File: PEM · Pki
Use case: Certificate & key testingError handling· Paired fixture

SAMPLE Leaf Certificate — Revoked

A leaf that is valid in every structural respect and revoked in the matching CRL and OCSP response shipped alongside it. It is the fixture that proves a client actually performs revocation checking rather than stopping at path building.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Leaf Certificate — RSA-2048

The reference end-entity certificate for this wave: RSA-2048 subject key, two DNS SANs, serverAuth/clientAuth EKU, and AIA/CRL pointers to the fictional SAMPLE responder. Everything else in the p7 PKI is a deviation from this one.

File: PEM · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE Leaf Certificate — SAN/CN Mismatch

The certificate's CN is app.pki.sample.example but its only SAN is different.pki.sample.example. RFC 6125 clients must ignore the CN entirely, so this separates modern verifiers from ones still falling back to Common Name.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Leaf Certificate — Self-Signed

An end-entity certificate that signs itself and chains to nothing — the shape a development server produces when nobody ran a CA. It is internally consistent, so the only defect a verifier can find is the missing trust anchor.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Leaf Certificate — Wildcard SAN

A wildcard certificate covering *.wild.pki.sample.example plus the bare apex. Use it to check that a matcher accepts exactly one label and refuses to stretch the wildcard across a dot.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE Leaf Certificate — Wrong Common Name

A valid, correctly chained certificate for the wrong host: both CN and SAN say wrong-host.pki.sample.example. Serve it for leaf.pki.sample.example to exercise the hostname-verification path on its own.

File: PEM · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE Leaf Certificate (DER)

Binary DER encoding of the SAMPLE leaf certificate — the same bytes the PEM twin Base64-wraps. Feed it to ASN.1 decoders, Java keystores, and DER-to-PEM converters.

File: DER · Pki · DER (binary)
Use case: Certificate & key testingConversion testing· Conversion set

SAMPLE OCSP Request (DER)

The DER OCSPRequest a client sends when checking the reference leaf, with the SHA-1 CertID that RFC 6960 mandates and no nonce extension. POST it at a stub responder to exercise request parsing without a live CA.

File: DER · Pki
Use case: Certificate & key testingAPI testing· Conversion set

SAMPLE OCSP Response — Good

A successful OCSP response asserting status good for the reference leaf, signed directly by the SAMPLE issuing CA. Pair it with the request beside it to stub a responder end to end.

File: DER · Pki
Use case: Certificate & key testingAPI testing· Conversion set

SAMPLE OCSP Response — Revoked

The OCSP counterpart of the CRL entry: status revoked for the revoked SAMPLE leaf, with the same 2026-03-01 revocation time and keyCompromise reason. Use both against the same certificate to check that CRL and OCSP paths agree.

File: DER · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE OCSP Response — Unauthorized

The minimal unsuccessful OCSP response: responseStatus unauthorized and no responseBytes at all, which is what a responder returns for a certificate it does not serve. A handful of bytes that regularly breaks clients expecting a signed body.

File: DER · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE PKCS#12 Keystore — Key + Full Chain

A password-protected PKCS#12 keystore holding the SAMPLE leaf key together with its whole issuing chain, so one import gives a client both an identity and its anchors. The password `novus-p7-sample-p12` is published on purpose; nothing inside is a real credential.

File: P12 · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE PKCS#12 Keystore — No Password

The same leaf key and certificate in a PKCS#12 file with no password and no encryption. Several importers refuse an empty password, prompt anyway, or treat it as the literal empty string, so this is the fixture that finds out which.

File: P12 · Pki
Use case: Certificate & key testingError handling· Conversion set

SAMPLE PKCS#7 Certificate Bundle (DER)

Binary DER form of the same three-certificate PKCS#7 bundle, the encoding a .p7b download actually uses. Use it to test importers that never see the PEM armour.

File: DER · Pki
Use case: Certificate & key testingConversion testing· Conversion set

SAMPLE PKCS#7 Certificate Bundle (PEM)

A degenerate (certificates-only) PKCS#7 structure holding all three SAMPLE certificates under BEGIN PKCS7 armour — the payload Windows and Java tools distribute as a .p7b. It carries no private key and no signature over any content.

File: PEM · Pki
Use case: Certificate & key testingConversion testing· Conversion set

SAMPLE PKCS#7 Detached Signature (DER)

A detached PKCS#7 SignedData over signed-payload.txt, built without signed attributes so the bytes are reproducible. The content is not embedded, so verification needs both files — exactly the failure mode people hit with .p7s email attachments.

File: DER · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE Root CA Certificate (DER)

Binary DER encoding of the SAMPLE root CA certificate — the same bytes the PEM twin Base64-wraps. Feed it to ASN.1 decoders, Java keystores, and DER-to-PEM converters.

File: DER · Pki · DER (binary)
Use case: Certificate & key testingConversion testing· Conversion set

SAMPLE Root CA Certificate (PEM)

The self-signed root of the Novus Examples SAMPLE certificate hierarchy (RSA-4096, CA:TRUE, no path-length limit). Install it as the only trust anchor to make the rest of this wave's chains verifiable in a sandbox. Fictional issuer — never a real identity.

File: CRT · Pki
Use case: Certificate & key testing· Conversion set

SAMPLE RSA Private Key — PKCS#1, Encrypted (DEK-Info)

The legacy encrypted-key layout: PKCS#1 body plus `Proc-Type: 4,ENCRYPTED` and `DEK-Info` PEM headers carrying the cipher and IV, password `novus-p7-sample-pkcs1`. Parsers that strip PEM headers before decoding silently lose the IV and fail here.

File: KEY · Pki
Use case: Certificate & key testingError handling· Paired fixture

SAMPLE RSA Private Key — PKCS#1, Unencrypted

The identical key material wrapped in the legacy PKCS#1 container (BEGIN RSA PRIVATE KEY), which omits the algorithm OID that PKCS#8 carries. Diff it against its PKCS#8 twin to see exactly what a container migration changes.

File: KEY · Pki
Use case: Certificate & key testingConversion testing· Paired fixture

SAMPLE RSA Private Key — PKCS#8, Encrypted

The SAMPLE leaf key under PKCS#8 password encryption (BEGIN ENCRYPTED PRIVATE KEY, PBES2), password `novus-p7-sample-pkcs8`. Encryption metadata lives inside the ASN.1 here, not in PEM headers — the opposite of the PKCS#1 twin.

File: KEY · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE RSA Private Key — PKCS#8, Unencrypted

The SAMPLE leaf's RSA-2048 key in unencrypted PKCS#8 (BEGIN PRIVATE KEY) — the modern default and the pair to the PKCS#1 twin beside it. It is deliberately published; treat it as public.

File: KEY · Pki
Use case: Certificate & key testing· Paired fixture

SAMPLE RSA Public Key — PKCS#1

The same modulus and exponent in the raw PKCS#1 RSAPublicKey container, without the algorithm-identifier wrapper. Libraries routinely accept one armour and reject the other, so the pair is the test.

File: PEM · Pki
Use case: Certificate & key testingConversion testing· Paired fixture

SAMPLE RSA Public Key — SubjectPublicKeyInfo

The SAMPLE leaf's public key as a bare SubjectPublicKeyInfo (BEGIN PUBLIC KEY) — the form JWT verifiers and most language runtimes expect when you hand them a key rather than a certificate.

File: PEM · Pki
Use case: Certificate & key testingJWT / JWKS testing· Paired fixture

SAMPLE S/MIME Email Certificate

An S/MIME-shaped certificate whose SAN is an rfc822Name rather than a DNS name, with the emailProtection EKU and a non-repudiation key usage. Useful for testing address extraction from certificates.

File: PEM · Pki
Use case: Certificate & key testing· Conversion set

X.509 Certificate (.crt) — Security SAMPLE

Same SAMPLE certificate as .crt (PEM bytes) for tools that expect the CRT extension.

File: CRT · Pki · PEM-as-CRT
Use case: Certificate & key testing· Conversion set

X.509 Certificate (DER) — Security SAMPLE

DER-encoded twin of the Wave G SAMPLE certificate for binary X.509 decoders.

File: DER · Pki · DER
Use case: Certificate & key testing· Conversion set

X.509 Certificate (PEM) — Security SAMPLE

Self-signed X.509 SAMPLE certificate in PEM under /files/security/ — published sample material for TLS and PEM parsers.

File: PEM · Pki · PEM
Use case: Certificate & key testing· Conversion set

X.509 Certificate Chain (PEM) — SAMPLE

Two-PEM-block SAMPLE chain file for multi-cert parsers and bundle importers.

File: PEM · Pki · PEM
Use case: Certificate & key testing

Ssh

SAMPLE OpenSSH Public Key — ECDSA P-256

The P-256 public key in OpenSSH form, whose blob names the curve twice — once in the key type and once inside the payload. Parsers that read only one of the two mis-handle mismatched keys.

File: PUB · Ssh
Use case: Certificate & key testing· Conversion set

SAMPLE OpenSSH Public Key — RSA

The SAMPLE leaf's RSA key in single-line OpenSSH format with a comment — the same key material as the PEM public keys, wrapped the way authorized_keys wants it. Handy for checking that a fingerprint tool agrees across encodings.

File: PUB · Ssh
Use case: Certificate & key testing· Conversion set

SSH authorized_keys — SAMPLE

Single-entry SAMPLE authorized_keys file for SSH access-control parsers.

File: TXT · Ssh
Use case: Certificate & key testing

SSH Config — SAMPLE

SAMPLE OpenSSH client config stanza for SSH config parsers.

File: CONF · Ssh
Use case: Certificate & key testing

SSH Ed25519 Public Key — SAMPLE

OpenSSH-format SAMPLE Ed25519 public key for authorized_keys and SSH parsers.

File: PUB · Ssh
Use case: Certificate & key testing

SSH known_hosts — SAMPLE

SAMPLE SSH known_hosts with fictional hostnames for known_hosts parsers and StrictHostKeyChecking tests.

File: TXT · Ssh
Use case: Certificate & key testing

Frequently asked questions

Are these real certificates or secrets?

Never. Every key, cert, JWT, and token is published SAMPLE-only material under /files/security/…, do not use them as real identities. Older data/security paths remain shipped and unchanged.

What JWT algorithms are included?

SAMPLE JWTs for none, HS256/384/512, and RS256/384/512, plus expired and intentionally invalid tokens, JWKS, and OAuth token-response JSON.

Do you include CORS and CSP examples?

Yes, plain-text header fixtures for CORS, CSP, HSTS, and a deliberately misconfigured CORS sample for policy linters.