SAMPLE Intermediate CA Certificate (PEM)
The issuing CA that signs every leaf in this wave, itself signed by the SAMPLE root and constrained with pathLenConstraint:0 so it cannot mint further CAs. Use it to test intermediate handling and path-length enforcement.
-----BEGIN CERTIFICATE-----
MIIFHjCCAwagAwIBAgIDcAACMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSkwJwYDVQQDDCBO
b3Z1cyBFeGFtcGxlcyBTQU1QTEUgUm9vdCBDQSBSMTAeFw0yNDAxMDEwMDAwMDBa
Fw0zNDAxMDEwMDAwMDBaMF8xCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1cyBF
eGFtcGxlcyBTQU1QTEUgUEtJMSwwKgYDVQQDDCNOb3Z1cyBFeGFtcGxlcyBTQU1Q
TEUgSXNzdWluZyBDQSBJMjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGB
AMarOm90SEq+1J9YSOlgjViGXmRY+52mrK5RMGjKSpJM6sIMr2tMtHIhUSak8ne0
a4PDmv55Yv1FybObPDzlG3F/tUn6+QIj10PFb/84HrtkoAwPWLsJQC0vpplayY1X
mhYslZ9Hb34pHwzx1xmLChpU77hxrgSuDEZbb9GFNXeAGDTkKeGSx9BEXEiruvj+
U79Kn7gViiJnrmCEPDNqvO0Mk5vhysGT/RYHVhWsr3sjpcrpNn0ZUTVIaTya55L0
irqdkSptRb/ElqNQyrJwVQbJtkMNTeV8PZ9zC4wsyxeFS8arWBPV83ykEMjCW7qJ
97+H+TcMroewrQfLSlgB0rB2a0o6YB61mH+T3LrRXhql1K3Q4pzHUzILMN7xf+qd
GI4E6y/HBpgDJNjCkwQfkiN0Q5Mgkb6CK5Dr7I1oI5/IQER/LHVbBMpKkcpreZaI
gVDIHtPX7vnAWewJBwVqsg125AD00Y6imJx+AIuhamPSildo3zWYhRh40eI/TORD
pwIDAQABo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQPySRMD9x5
tqq2szcZpU8DkN/Q+jAOBgNVHQ8BAf8EBAMCAYYwHwYDVR0jBBgwFoAUhWTpSaA3
g2hVFLw+1sbf95Gn3RswDQYJKoZIhvcNAQELBQADggIBACqcGae2JORx6VcZYrki
AXsYbObv56q5kZbzG/1ysR+MgGCY6YcJDenUVpCCRvFnugnZ6P9eVOZeE4lt6CNL
V5oKAKlZE5lVASiGV970jmzbxn2/m5VnuJ83E0HcD0HhZHEdWheh+I7wsrlnn+hf
oG3E5v8jZuYo0d99YPY11w5yLmwePtbh1bmPquDebxvmkkU02fyzsuDVs5QVFFoR
YJbtm8dhYx5hfmqzae77sSbyBnd5aT8v/CLk6MNjuGPnTFy/V10VxqI+XLkE10uG
GB2k9rGX35CA3rhU8s6SObYFpxoR1HpCoB0RkkSc+7TYuIq8lvVb4nNypRIu9sM3
21m/htlRHDwuz35R6tyZOpX2UvZ62gr4XEpLYRTBTdRlQiE7v+vClfuC82Zu3qFW
vrwKw5J6z2f0fi/mjjUWMjSXOJWFkujM80SI6sHf+ih3NtxI1fQ4yibZeXKDypua
Z/5TfhPxwiFGLzq5JbikN2O4xkIWi8wt1zfrWqI9B5iZkc8NtwoUS2OYKti+Y/tO
YKrMUMOF6UF/z6jbWVVNfQPTscQxayVQDc/GiOgFpCBAbkTcj4vTWFMWA/fuwWaW
mHcIgC+rj8GqAknGvdzInyhlxlV2LCUaY4mxiy1CbxDBxiAu11qVBnSHqf8uC7uP
byRHwkp8WN92cn85TxDn4SpI
-----END CERTIFICATE-----
Specifications
- Role
- intermediate CA
- Key
- RSA-3072
- Issuer
- Novus Examples SAMPLE Root CA R1
- Path Len
- 0
- Basic Constraints
- CA:TRUE
- Validity
- 2024-01-01 to 2034-01-01
- Serial
- 0x700002
- Sample Only
- true
- Seed
- 70117
Testing contract
Reference control- Scenario
- Verify the intermediate against the SAMPLE root and attempt to build a three-CA path through it.
- Expected result
- The intermediate verifies against the root, and any path that puts another CA below it is rejected for exceeding pathLenConstraint:0.
What is a .crt file?
A .crt file holds an X.509 certificate, most often PEM-encoded (Base64 text) though sometimes DER binary. The extension is a convention for the public certificate half of a TLS identity, as opposed to the private .key file. It carries the subject, issuer, validity window, public key, and signature.
How to use this file
Use an example .crt to test certificate parsers, trust-store importers, and TLS tooling, or as input for .crt-to-.pem/.der conversion. Sample material only, self-signed and clearly labelled.
How to use this file for testing
“SAMPLE Intermediate CA Certificate (PEM)” is a deterministic Novus Examples fixture for Certificate & key testing. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117 · intermediate CA. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- jsonCRL Metadata JSON — SAMPLESAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.
- keyEd25519 Private Key (PEM) — SAMPLEDeterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.
- keyEncrypted PKCS#8 RSA Key — SAMPLEPassword-encrypted SAMPLE PKCS#8 private key (password printed in specs) for decrypt-import tests.
- csrPKCS#10 CSR — Security SAMPLEPKCS#10 certificate signing request SAMPLE for CSR parsers and CA tooling smoke tests.
- p12PKCS#12 Bundle (.p12) — SAMPLESAMPLE PKCS#12 keystore (password `novus-sample-wg`) for keystore importer tests. Not byte-stable.
- keyRSA-2048 Private Key (PEM) — SAMPLEPublished SAMPLE RSA-2048 private key (PKCS#8 PEM). Never use for a real identity.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.