SAMPLE CA Bundle — Root + Intermediate
The two CA certificates concatenated in trust-store order, the shape a `--cafile` or `ca-bundle.crt` argument expects. Point a client at this and every other valid p7 leaf becomes verifiable.
-----BEGIN CERTIFICATE-----
MIIFdzCCA1+gAwIBAgIDcAABMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSkwJwYDVQQDDCBO
b3Z1cyBFeGFtcGxlcyBTQU1QTEUgUm9vdCBDQSBSMTAeFw0yMDAxMDEwMDAwMDBa
Fw00MDAxMDEwMDAwMDBaMFwxCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1cyBF
eGFtcGxlcyBTQU1QTEUgUEtJMSkwJwYDVQQDDCBOb3Z1cyBFeGFtcGxlcyBTQU1Q
TEUgUm9vdCBDQSBSMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOHk
4ei9BVbSA7LszYI4uhZ50ejUuVDg27BrAMQKjjV6GVDfyYQiQ1On9t5dEb0k2bfU
FTfhUcPjTMJ4DgX95+UWG1vs5zkcYjYvEvEESp1JZLVc+UwY3+5eY3cDnl8BAyFa
3QyC+qWJSNRanDpV1t6/14v7OnAu2e8jVPQ387eawmvoLEvoKtzwElwpoz5+Nu4z
xQCktfleQC3pfvQOqbv4s7U0bUqKOBMEUjaVl2cVRAy4utpvlIKcJpq7jcIMdK84
YjvyqCij9urJK6QDj+X/MSrm9IDz/hL+qaSJkEsJkd5hx86DOOoeW1GEZo2KerWj
1zZB/Ar7WX5duKij1gAUo1xdQY8FDCr02+hhngR5/Li60fESMHxXzOi+Dzmd0Dhs
3M1VHpMHTXbIGeJ3Wa//RZdtfXGc98MusuViBV4D/Zz5iEN+K7NrWNPcqp6EZDMa
K+DoXjziFGYujBuQ39YHDEFd7tobsbqbf24DrvIN5boPUBmcnMMDHu/0uEHlbiQw
v//XI8dTKBTxe+pNd4UJeK1jt7W39DGoHcHgJc1Ke5ndTWOzatJGLigs8YGoM7ys
7UktDErNHb1WE76PG1X+4edwR3r+M04vTUq0Kv4T0ujPYL294cPInJDUZHsXTj1P
MdGY8iRVLfvWJiPNyc0vCsUz0NpHgLFiYZKjD+9FAgMBAAGjQjBAMA8GA1UdEwEB
/wQFMAMBAf8wHQYDVR0OBBYEFIVk6UmgN4NoVRS8PtbG3/eRp90bMA4GA1UdDwEB
/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEA39qSNEKOVaQpbNtQJdiO3uiuA7CJ
VJu33MMxryy2IUVC9UNbhrLGkd1xui06j1UZGd+/P6iQ12dvk7BVCfa0tv+7nX8S
Ct5hhb/8GseOI3Gg0ho5Ppf23bFngfdQzEVFmIcd5SlTt2AAaclfgYRrPNQNkuR/
oZiV4dUfXlB6z3KN4X/Y6twNLFyWIH6MgJKFO8erjw9PtPT41ig4sdsHOvEtA5R7
crS/XdMBABxzV8W9cgeYt3RtgfSfjfLQOHRbJa+MRBbfyJJ8IL/ToH+4BIrMWBrd
OLPWWa5KD+H4Sy9asl9OgYFJ8r1VepHCL3b2Q/L3akABsFuVDupL7tLyDQBvky0a
UJfC7L4TKlAgjiySdFUgIwIsgqbKqsOzPizM2vqrBTleMdY5zCgv/60LPQAVGrv2
icLhOxGsN6wPndWTpsznaxJYJNmzPfYDsKUwA4pzVeMTUz64ES/lK0YwOzvhyZ1W
niHC2/PAmb+MTUgK1ueO1OD+MIxda/5tQSHQ4mOExnKDSiZdvxTEXT2muUQSuasW
hfCD0A1NxjX+ZAUTEfqinrplg+67CbSIUanLvrZVr+Ee9COB4xS3IQdlAe17KGhJ
YnhqYokNT2jgVp5qFTVTNO7pKRrD6hFU5iPJXGvzGSkokiWD3rR8zruhDi1fbZHg
G2JlrMMH22NaxO0=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFHjCCAwagAwIBAgIDcAACMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSkwJwYDVQQDDCBO
b3Z1cyBFeGFtcGxlcyBTQU1QTEUgUm9vdCBDQSBSMTAeFw0yNDAxMDEwMDAwMDBa
Fw0zNDAxMDEwMDAwMDBaMF8xCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1cyBF
eGFtcGxlcyBTQU1QTEUgUEtJMSwwKgYDVQQDDCNOb3Z1cyBFeGFtcGxlcyBTQU1Q
TEUgSXNzdWluZyBDQSBJMjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGB
AMarOm90SEq+1J9YSOlgjViGXmRY+52mrK5RMGjKSpJM6sIMr2tMtHIhUSak8ne0
a4PDmv55Yv1FybObPDzlG3F/tUn6+QIj10PFb/84HrtkoAwPWLsJQC0vpplayY1X
mhYslZ9Hb34pHwzx1xmLChpU77hxrgSuDEZbb9GFNXeAGDTkKeGSx9BEXEiruvj+
U79Kn7gViiJnrmCEPDNqvO0Mk5vhysGT/RYHVhWsr3sjpcrpNn0ZUTVIaTya55L0
irqdkSptRb/ElqNQyrJwVQbJtkMNTeV8PZ9zC4wsyxeFS8arWBPV83ykEMjCW7qJ
97+H+TcMroewrQfLSlgB0rB2a0o6YB61mH+T3LrRXhql1K3Q4pzHUzILMN7xf+qd
GI4E6y/HBpgDJNjCkwQfkiN0Q5Mgkb6CK5Dr7I1oI5/IQER/LHVbBMpKkcpreZaI
gVDIHtPX7vnAWewJBwVqsg125AD00Y6imJx+AIuhamPSildo3zWYhRh40eI/TORD
pwIDAQABo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQPySRMD9x5
tqq2szcZpU8DkN/Q+jAOBgNVHQ8BAf8EBAMCAYYwHwYDVR0jBBgwFoAUhWTpSaA3
g2hVFLw+1sbf95Gn3RswDQYJKoZIhvcNAQELBQADggIBACqcGae2JORx6VcZYrkiSpecifications
- Certs
- 2
- Order
- root, intermediate
- Use
- trust store / --cafile
- Sample Only
- true
- Seed
- 70117
Testing contract
Reference control- Scenario
- Pass the bundle as the only CA file to a client verifying any valid p7 leaf.
- Expected result
- Both CA certificates are loaded and every valid p7 leaf verifies without additional anchors.
What is a .pem file?
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use this file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
How to use this file for testing
“SAMPLE CA Bundle — Root + Intermediate” is a deterministic Novus Examples fixture for Certificate & key testing. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- jsonCRL Metadata JSON — SAMPLESAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.

- keyEd25519 Private Key (PEM) — SAMPLEDeterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.

- keyEncrypted PKCS#8 RSA Key — SAMPLEPassword-encrypted SAMPLE PKCS#8 private key (password printed in specs) for decrypt-import tests.

- csrPKCS#10 CSR — Security SAMPLEPKCS#10 certificate signing request SAMPLE for CSR parsers and CA tooling smoke tests.

- p12PKCS#12 Bundle (.p12) — SAMPLESAMPLE PKCS#12 keystore (password `novus-sample-wg`) for keystore importer tests. Not byte-stable.

- keyRSA-2048 Private Key (PEM) — SAMPLEPublished SAMPLE RSA-2048 private key (PKCS#8 PEM). Never use for a real identity.

Generated by generation/security_p7.py. Free for any use, no attribution required — license.