SAMPLE Leaf Certificate — Self-Signed
An end-entity certificate that signs itself and chains to nothing — the shape a development server produces when nobody ran a CA. It is internally consistent, so the only defect a verifier can find is the missing trust anchor.
-----BEGIN CERTIFICATE-----
MIID0DCCArigAwIBAgIDcBALMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNVBAYTAlpa
MSIwIAYDVQQKDBlOb3Z1cyBFeGFtcGxlcyBTQU1QTEUgUEtJMSYwJAYDVQQDDB1z
ZWxmc2lnbmVkLnBraS5zYW1wbGUuZXhhbXBsZTAeFw0yNjAxMDEwMDAwMDBaFw0y
NzAxMDEwMDAwMDBaMFkxCzAJBgNVBAYTAlpaMSIwIAYDVQQKDBlOb3Z1cyBFeGFt
cGxlcyBTQU1QTEUgUEtJMSYwJAYDVQQDDB1zZWxmc2lnbmVkLnBraS5zYW1wbGUu
ZXhhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALxUPhSr6ToY
JnKbVIQmZPUIvy3PYIpwQXR1VX1+xgQ9S63t4dswStGbqsyoa142oPoTHMkVaJcq
D536Qhpp/ia9kLTwBNFI7htO8Fn9SOnYYO3Tx45HlgBMw6k9rW9uOI52ClT1c04+
1+i9wVL3mXxYiqsxmadqXkEieegqHtd10kXbQ1LaBtVWLudD7PUCUeqCr/W9Lo7i
nO3YS/3mur1q3IFS4ICo9NmrkHoS6mfBzmrJsT6a/y1tJHBMAkoWxz3NqpIGe2Kj
aHMW0gfQHTtRZ9xkVQHGNYbiN5yz0OMS+285oop8hGnNJz0X3MsyK7WSP9yx2ja1
u5UmzFl/vbcCAwEAAaOBoDCBnTAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRHUdJu
Bm8g628uXAt9F6H5HxSq7zAOBgNVHQ8BAf8EBAMCBaAwKAYDVR0RBCEwH4Idc2Vs
ZnNpZ25lZC5wa2kuc2FtcGxlLmV4YW1wbGUwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
HwYDVR0jBBgwFoAUR1HSbgZvIOtvLlwLfReh+R8Uqu8wDQYJKoZIhvcNAQELBQAD
ggEBADOKpJUHX2vlsnNeh5ZX7f2Bt8NuO19VCUM6Rp2OvbcdhXPpoyacHwCc5WsO
2izj9bbSglGk5zQxb9YGPmBd1hqayYb2HMvdVBiDdhvRUlBDLdjrUpSzsF0c4Rhw
uLCzcqgaYWw8N43TNJ6smPurpJ7GPIAhOzP36KChogjHnMub0Xv3MjDiMQIS7jhx
K1hXbHZgz+KKU5l5+wtSn9eBff+IJVxnqHXtNTsXo7HIZrlf7HauZuM+WqViaqf7
RzYYVrdlPAxhMjbBVspSHbAUrn6IH49dTeVvs5qoVWZMg3MxmJ7qv2UzjbI6WGbq
XSIkWE02rUyNiK+E2Ca029cnWVQ=
-----END CERTIFICATE-----
Specifications
- Self Signed
- true
- Issuer
- itself
- Basic Constraints
- CA:FALSE
- Serial
- 0x70100b
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to fail- Scenario
- Validate this certificate against a trust store containing the SAMPLE root but not the certificate itself.
- Expected result
- Validation fails with a self-signed/unknown-issuer error while the signature over its own TBSCertificate still checks out.
What is a .pem file?
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use this file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
How to use this file for testing
“SAMPLE Leaf Certificate — Self-Signed” is a deterministic Novus Examples fixture for Certificate & key testing, Error handling. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- pemSAMPLE Certificate Revocation List — EmptyA correctly signed CRL with an absent revokedCertificates field — what a CA publishes when it has revoked nothing. Parsers that assume the list is always present tend to fault here rather than report zero entries.
- pemSAMPLE Certificate Revocation List — StaleA validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.
- csrSAMPLE CSR — Intentionally Corrupt Base64An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.
- pemSAMPLE Leaf Certificate — ExpiredA correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.
- pemSAMPLE Leaf Certificate — No SAN ExtensionA pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.
- pemSAMPLE Leaf Certificate — Not Yet ValidThe mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.