SAMPLE Leaf Certificate — Not Yet Valid
The mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
-----BEGIN CERTIFICATE-----
MIIFETCCA3mgAwIBAgIDcBAFMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSwwKgYDVQQDDCNO
b3Z1cyBFeGFtcGxlcyBTQU1QTEUgSXNzdWluZyBDQSBJMjAeFw0zNTAxMDEwMDAw
MDBaFw0zNjAxMDEwMDAwMDBaMFUxCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1
cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSIwIAYDVQQDDBlub3R5ZXQucGtpLnNhbXBs
ZS5leGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvFQ+FKvp
OhgmcptUhCZk9Qi/Lc9ginBBdHVVfX7GBD1Lre3h2zBK0ZuqzKhrXjag+hMcyRVo
lyoPnfpCGmn+Jr2QtPAE0UjuG07wWf1I6dhg7dPHjkeWAEzDqT2tb244jnYKVPVz
Tj7X6L3BUveZfFiKqzGZp2peQSJ56Coe13XSRdtDUtoG1VYu50Ps9QJR6oKv9b0u
juKc7dhL/ea6vWrcgVLggKj02auQehLqZ8HOasmxPpr/LW0kcEwCShbHPc2qkgZ7
YqNocxbSB9AdO1Fn3GRVAcY1huI3nLPQ4xL7bzmiinyEac0nPRfcyzIrtZI/3LHa
NrW7lSbMWX+9twIDAQABo4IBXjCCAVowDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU
R1HSbgZvIOtvLlwLfReh+R8Uqu8wDgYDVR0PAQH/BAQDAgWgMCQGA1UdEQQdMBuC
GW5vdHlldC5wa2kuc2FtcGxlLmV4YW1wbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwEG
CCsGAQUFBwMCMB8GA1UdIwQYMBaAFA/JJEwP3Hm2qrazNxmlTwOQ39D6MEAGA1Ud
HwQ5MDcwNaAzoDGGL2h0dHA6Ly9jcmwucGtpLnNhbXBsZS5leGFtcGxlL2lzc3Vp
bmctY2EtaTIuY3JsMHMGCCsGAQUFBwEBBGcwZTAqBggrBgEFBQcwAYYeaHR0cDov
L29jc3AucGtpLnNhbXBsZS5leGFtcGxlMDcGCCsGAQUFBzAChitodHRwOi8vcGtp
LnNhbXBsZS5leGFtcGxlL2lzc3VpbmctY2EtaTIuY3J0MA0GCSqGSIb3DQEBCwUA
A4IBgQCEK8gOrczb/dlNZ3KcLcSMcS+dfcZMKJVBzIXzBJLqBTPqWUBURI1L2MRL
GZHsqJzwsKS7ceXwNHMwIHGkcja7wyGDua3t0YcXMbgAAXOsSJHTAySEtiTkaaIe
f3jDoREeoYN+oxzB5MLjzWt/1DygX+pFS2wthMafDheAOhf3PBtEs11IXFNh0OwB
TyYkJZ2P1oTPv41VBZlfva8zGGS6MgdCpt9Ztv8VpJG9VnDKXjZH3ioJK4RjQ2by
qv5V6MQlZPJkNFr30y+63BDDgmFy2lxiupi3WA7A69IkubRHvA4sPqoHYxurp7FL
idE72RL7KgTDp70tuuyHuOG0Fc13OZgxduNIpMN+EVHnYKjJl7dmumuOgERzBtnM
zUYzS6dGYEyUHxHvB9/D2RqYsk8ga0STnNfhtLHIJYuzmsjPRjXuxCR2/4N033jo
PzESfCQr4XVJ8efm9mOa22uWYEkee553jdQs8W0xSR8cCd93qX5CroQ8qVJU0X4a
pTY/Uls=
-----END CERTIFICATE-----
Specifications
- Validity
- 2035-01-01 to 2036-01-01
- Not Yet Valid
- true
- Serial
- 0x701005
- Issuer
- Novus Examples SAMPLE Issuing CA I2
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to fail- Scenario
- Validate the chain at any present-day clock and compare the error with the expired twin's.
- Expected result
- Validation fails with a certificate-not-yet-valid error naming notBefore 2035-01-01, distinct from the expired twin's error code.
What is a .pem file?
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use this file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
How to use this file for testing
“SAMPLE Leaf Certificate — Not Yet Valid” is a deterministic Novus Examples fixture for Certificate & key testing, Error handling. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- pemSAMPLE Certificate Revocation List — EmptyA correctly signed CRL with an absent revokedCertificates field — what a CA publishes when it has revoked nothing. Parsers that assume the list is always present tend to fault here rather than report zero entries.
- pemSAMPLE Certificate Revocation List — StaleA validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.
- csrSAMPLE CSR — Intentionally Corrupt Base64An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.
- pemSAMPLE Leaf Certificate — No SAN ExtensionA pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.
- pemSAMPLE Leaf Certificate — RevokedA leaf that is valid in every structural respect and revoked in the matching CRL and OCSP response shipped alongside it. It is the fixture that proves a client actually performs revocation checking rather than stopping at path building.
- pemSAMPLE Leaf Certificate — SAN/CN MismatchThe certificate's CN is app.pki.sample.example but its only SAN is different.pki.sample.example. RFC 6125 clients must ignore the CN entirely, so this separates modern verifiers from ones still falling back to Common Name.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.