SAMPLE CSR — Intentionally Corrupt Base64
An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.
-----BEGIN CERTIFICATE REQUEST-----
MIICajCCAVICAQAwJTEjMCEGA1UEAwwabWluaW1hbC5wa2kuc2FtcGxlLmV4YW1w
bGUwggEiMA0GCSqGSIb3!!!!AQUAA4IBDwAwggEKAoIBAQC8VD4Uq+k6GCZym1SE
JmT1CL8tz2CKcEF0dVV9fsYEPUut7eHbMErRm6rMqGteNqD6ExzJFWiXKg+d+kIa
af4mvZC08ATRSO4bTvBZ/Ujp2GDt08eOR5YATMOpPa1vbjiOdgpU9XNOPtfovcFS
95l8WIqrMZmnal5BInnoKh7XddJF20NS2gbVVi7nQ+z1AlHqgq/1vS6O4pzt2Ev9
5rq9atyBUuCAqPTZq5B6Eupnwc5qybE+mv8tbSRwTAJKFsc9zaqSBntio2hzFtIH
0B07UWfcZFUBxjWG4jecs9DjEvtvOaKKfIRpzSc9F9zLMiu1kj/csdo2tbuVJsxZ
f723AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAo+aoMNIeYsEgfSuXPjey4GIg
ITDWE6Jk3YofevcvV/qVKKBThpOCMFLKUd98+vdfMYNJhSpKaHkuzDy5DvkoWPdy
BE7HxY1IjiAhoF7Fm9SH/fj61xfsvKmqiDj8LJfonwXsi4o05n/gBF/zrUl0OKVY
9Xc4eMcaT3t55nT7lP9toRO22Oe74N1+BmhpsK/WXHnOwVpiKwLQJ8hSowRLWKQS
i6hMkkC0Qh+0ySMieNGns4WhwHgRsndWtWhWvSMMCzJLRWFfANSBn803icF7oaIT
B9e2cSBroQZvKsH0OIrQjI5JDSIrGNcQQZSKge7cINu/tTq5N1eLgPCZZHZL+w==
-----END CERTIFICATE REQUEST-----
Specifications
- Valid
- false
- Issue
- intentionally corrupt: '!!!!' substituted into the Base64 body
- Armour
- intact BEGIN/END CERTIFICATE REQUEST lines
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to fail- Scenario
- Submit the intentionally corrupt CSR to the parser or CA intake path under test.
- Expected result
- A Base64/ASN.1 decode error is reported and no partially populated request object is created.
What is a .csr file?
A CSR (Certificate Signing Request, PKCS#10) is a PEM-encoded request a party sends to a certificate authority to be issued a certificate. It contains the subject distinguished name and public key, self-signed with the matching private key to prove possession, but has no validity dates or issuer.
How to use this file
Use an example .csr to test CSR parsers, certificate-authority intake flows, and PKCS#10 decoders, or to verify subject and public-key extraction. Sample request only.
How to use this file for testing
“SAMPLE CSR — Intentionally Corrupt Base64” is a deterministic Novus Examples fixture for Certificate & key testing, Error handling. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117 · intentionally invalid. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- pemSAMPLE Certificate Revocation List — EmptyA correctly signed CRL with an absent revokedCertificates field — what a CA publishes when it has revoked nothing. Parsers that assume the list is always present tend to fault here rather than report zero entries.
- pemSAMPLE Certificate Revocation List — StaleA validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.
- pemSAMPLE Leaf Certificate — ExpiredA correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.
- pemSAMPLE Leaf Certificate — No SAN ExtensionA pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.
- pemSAMPLE Leaf Certificate — Not Yet ValidThe mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
- pemSAMPLE Leaf Certificate — RevokedA leaf that is valid in every structural respect and revoked in the matching CRL and OCSP response shipped alongside it. It is the fixture that proves a client actually performs revocation checking rather than stopping at path building.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.