SAMPLE Intermediate CA Certificate (DER)
Binary DER encoding of the SAMPLE intermediate CA certificate — the same bytes the PEM twin Base64-wraps. Feed it to ASN.1 decoders, Java keystores, and DER-to-PEM converters.
| Field | Value |
|---|---|
| Type | X.509 intermediate CA (DER) |
| Subject | CN=Novus Examples SAMPLE Issuing CA I2,O=Novus Examples SAMPLE PKI,C=ZZ |
| Issuer | CN=Novus Examples SAMPLE Root CA R1,O=Novus Examples SAMPLE PKI,C=ZZ |
| Serial | 0x700002 |
| Not before | 2024-01-01T00:00:00Z |
| Not after | 2034-01-01T00:00:00Z |
| SHA-256 fingerprint | fc543273e82561b6074c67c0f9d65290dbfda6ef8c161474d3b7da5ea7c84af4 |
Specifications
- Encoding
- DER (binary)
- Role
- intermediate CA
- Serial
- 0x700002
- Sha256
- fc543273e82561b6074c67c0f9d65290dbfda6ef8c161474d3b7da5ea7c84af4
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to pass- Scenario
- Decode the DER intermediate CA certificate and compare its SHA-256 fingerprint with the PEM twin.
- Expected result
- Both encodings yield the identical TBSCertificate and the same SHA-256 fingerprint.
What is a .der file?
DER (Distinguished Encoding Rules) is the binary encoding of an X.509 certificate (or other ASN.1 structure) — the same data a PEM file Base64-wraps, without the text armour. A .der certificate is compact and byte-exact, common in Java keystores and Windows tooling.
How to use this file
Use an example .der certificate to test binary X.509 parsers, ASN.1 decoders, and DER-to-PEM converters, or to confirm a tool reads raw certificate bytes. Published sample certificate, not a real identity.
How to use this file for testing
“SAMPLE Intermediate CA Certificate (DER)” is a deterministic Novus Examples fixture for Certificate & key testing, Conversion testing. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117 · intermediate CA · DER (binary). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- derSAMPLE Certificate Revocation List (DER)Binary DER twin of the SAMPLE CRL — the exact encoding a CRL distribution point serves over HTTP. Use it to test binary CRL fetching and caching paths that never see PEM armour.
- keySAMPLE EC P-256 Private Key — SEC 1The same P-256 scalar in the SEC 1 container (BEGIN EC PRIVATE KEY), which names the curve inline instead of through a PKCS#8 algorithm identifier. Some deployment tools accept only one of the two.
- derSAMPLE PKCS#7 Certificate Bundle (DER)Binary DER form of the same three-certificate PKCS#7 bundle, the encoding a .p7b download actually uses. Use it to test importers that never see the PEM armour.
- pemSAMPLE PKCS#7 Certificate Bundle (PEM)A degenerate (certificates-only) PKCS#7 structure holding all three SAMPLE certificates under BEGIN PKCS7 armour — the payload Windows and Java tools distribute as a .p7b. It carries no private key and no signature over any content.
- keySAMPLE RSA Private Key — PKCS#1, UnencryptedThe identical key material wrapped in the legacy PKCS#1 container (BEGIN RSA PRIVATE KEY), which omits the algorithm OID that PKCS#8 carries. Diff it against its PKCS#8 twin to see exactly what a container migration changes.
- pemSAMPLE RSA Public Key — PKCS#1The same modulus and exponent in the raw PKCS#1 RSAPublicKey container, without the algorithm-identifier wrapper. Libraries routinely accept one armour and reject the other, so the pair is the test.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.