SAMPLE Leaf Certificate — IP Address SAN
A leaf whose SAN carries both a DNS name and an iPAddress entry (192.0.2.10, from the RFC 5737 documentation range). Connecting by literal IP must match the iPAddress entry, never the DNS one.
-----BEGIN CERTIFICATE-----
MIIFDzCCA3egAwIBAgIDcBAKMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSwwKgYDVQQDDCNO
b3Z1cyBFeGFtcGxlcyBTQU1QTEUgSXNzdWluZyBDQSBJMjAeFw0yNjAxMDEwMDAw
MDBaFw0yNzAxMDEwMDAwMDBaMFExCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1
cyBFeGFtcGxlcyBTQU1QTEUgUEtJMR4wHAYDVQQDDBVpcC5wa2kuc2FtcGxlLmV4
YW1wbGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8VD4Uq+k6GCZy
m1SEJmT1CL8tz2CKcEF0dVV9fsYEPUut7eHbMErRm6rMqGteNqD6ExzJFWiXKg+d
+kIaaf4mvZC08ATRSO4bTvBZ/Ujp2GDt08eOR5YATMOpPa1vbjiOdgpU9XNOPtfo
vcFS95l8WIqrMZmnal5BInnoKh7XddJF20NS2gbVVi7nQ+z1AlHqgq/1vS6O4pzt
2Ev95rq9atyBUuCAqPTZq5B6Eupnwc5qybE+mv8tbSRwTAJKFsc9zaqSBntio2hz
FtIH0B07UWfcZFUBxjWG4jecs9DjEvtvOaKKfIRpzSc9F9zLMiu1kj/csdo2tbuV
JsxZf723AgMBAAGjggFgMIIBXDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRHUdJu
Bm8g628uXAt9F6H5HxSq7zAOBgNVHQ8BAf8EBAMCBaAwJgYDVR0RBB8wHYIVaXAu
cGtpLnNhbXBsZS5leGFtcGxlhwTAAAIKMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjAfBgNVHSMEGDAWgBQPySRMD9x5tqq2szcZpU8DkN/Q+jBABgNVHR8E
OTA3MDWgM6Axhi9odHRwOi8vY3JsLnBraS5zYW1wbGUuZXhhbXBsZS9pc3N1aW5n
LWNhLWkyLmNybDBzBggrBgEFBQcBAQRnMGUwKgYIKwYBBQUHMAGGHmh0dHA6Ly9v
Y3NwLnBraS5zYW1wbGUuZXhhbXBsZTA3BggrBgEFBQcwAoYraHR0cDovL3BraS5z
YW1wbGUuZXhhbXBsZS9pc3N1aW5nLWNhLWkyLmNydDANBgkqhkiG9w0BAQsFAAOC
AYEASaI5ykCkwpvR0rqU7lAxRQqsUfvl4fsP8QDdHBzVG6yewYqZBvBCe5AGFA4Q
cBuPzgocYcz/jMlB5bW9Mw98ubb1+aFWa8XutbRqOt3TxKmE1UVFvunyAIwUuwwU
7S6QYz6f6EUugeomOcbh2JCARdHnPaLs+Ur7z4TMFJBNy6TXRqb0tj66NpAgPBcD
FnbKdWOWN3QCUDAMiFd20+Xy+FqUspoHoZaj+CVOIZ3JLe56h1btPlaNMNtQAa6+
SVfMl/2mZrLVBy7nEEd/5BBtGOjiwLmNNj9NbEu/V4bEbhcOEed/kNJoxeskRget
C5E/arzrj3NMM8gFokwI+c1+XDFvc5JXg7xXQBbpBSB4JeX7dOGaQXi4s9+lz/7S
HUOySvAA/8q3QUyIF4i8UhBV1kgfxlt74y7HwS0M/RlSgLr0RgyEaGNCTQwrs7xx
sceE8o+2NY8FtNzHN3jnhuTaeZqZRaYs8HrdMfJuyJ1wjAcdGU89Mm3P0goxCzbx
/WFK
-----END CERTIFICATE-----
Specifications
- San
- DNS:ip.pki.sample.example, IP:192.0.2.10
- Ip Range
- TEST-NET-1 (RFC 5737)
- Serial
- 0x70100a
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to pass- Scenario
- Verify this certificate for the literal address 192.0.2.10 and again for 192.0.2.11.
- Expected result
- 192.0.2.10 matches the iPAddress SAN entry; 192.0.2.11 is rejected, and neither is matched against the DNS entry.
What is a .pem file?
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use this file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
How to use this file for testing
“SAMPLE Leaf Certificate — IP Address SAN” is a deterministic Novus Examples fixture for Certificate & key testing. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- jsonCRL Metadata JSON — SAMPLESAMPLE CRL metadata JSON (no binary CRL) for revocation-list UI and loader tests.
- keyEd25519 Private Key (PEM) — SAMPLEDeterministic SAMPLE Ed25519 private key for SSH/TLS tooling tests.
- keyEncrypted PKCS#8 RSA Key — SAMPLEPassword-encrypted SAMPLE PKCS#8 private key (password printed in specs) for decrypt-import tests.
- csrPKCS#10 CSR — Security SAMPLEPKCS#10 certificate signing request SAMPLE for CSR parsers and CA tooling smoke tests.
- p12PKCS#12 Bundle (.p12) — SAMPLESAMPLE PKCS#12 keystore (password `novus-sample-wg`) for keystore importer tests. Not byte-stable.
- keyRSA-2048 Private Key (PEM) — SAMPLEPublished SAMPLE RSA-2048 private key (PKCS#8 PEM). Never use for a real identity.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.