pem1.8 KB

SAMPLE Leaf Certificate — RSA-2048

The reference end-entity certificate for this wave: RSA-2048 subject key, two DNS SANs, serverAuth/clientAuth EKU, and AIA/CRL pointers to the fictional SAMPLE responder. Everything else in the p7 PKI is a deviation from this one.

Certificate & key testing

Preview — first 31 linespem

Specifications

Subject Key: RSA-2048
Issuer: Novus Examples SAMPLE Issuing CA I2
San: leaf.pki.sample.example, www.leaf.pki.sample.example
Eku: serverAuth, clientAuth
Crl Distribution Point: http://crl.pki.sample.example/issuing-ca-i2.crl
Ocsp: http://ocsp.pki.sample.example
Validity: 2026-01-01 to 2027-01-01
Serial: 0x701001
Sample Only: true
Seed: 70117

Testing contract

Expected to pass

Scenario: Verify the leaf against the SAMPLE intermediate and root with hostname leaf.pki.sample.example at a clock inside 2026.
Expected result: Path building succeeds, the hostname matches a DNS SAN, and no policy or validity error is raised.

What is a .pem file?

PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.

How to use this file

Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.

How to use this file for testing

“SAMPLE Leaf Certificate — RSA-2048” is a deterministic Novus Examples fixture for Certificate & key testing. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.

Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.

This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.