SAMPLE Certificate Revocation List — Stale
A validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.
-----BEGIN X509 CRL-----
MIICpDCCAQwCAQEwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UEBhMCWloxIjAgBgNV
BAoMGU5vdnVzIEV4YW1wbGVzIFNBTVBMRSBQS0kxLDAqBgNVBAMMI05vdnVzIEV4
YW1wbGVzIFNBTVBMRSBJc3N1aW5nIENBIEkyFw0yMDAxMDEwMDAwMDBaFw0yMDAy
MDEwMDAwMDBaMEgwIgIDcBAMFw0yNjAzMDEwMDAwMDBaMAwwCgYDVR0VBAMKAQEw
IgIDcBD/Fw0yNjA0MTUwMDAwMDBaMAwwCgYDVR0VBAMKAQSgLzAtMAoGA1UdFAQD
AgECMB8GA1UdIwQYMBaAFA/JJEwP3Hm2qrazNxmlTwOQ39D6MA0GCSqGSIb3DQEB
CwUAA4IBgQCJ0vMWKMN26h8fOGE2bNUaP9gvGDCYb/IpVTuM5utPLIBdO746Di0N
EIPttmaubgHM8pZu4kKalFdSOw/hE9GfsRUEaTEZLMV8N+0ZWw4wX49p+TEvnZp1
bPolIC5nYS4GHYcgKO6AS4ug5orx3YAlA+8lLw42dOlKbIJg9jWN7/o8P4SJjMfH
JPdJVcQlD+Z1AJG3lnerzhuhndXD1xG/d3wnWCoXooznS66wKi+IXDeVP5t5c318
fxkpCmtjO++9+XVr2HY/Nqd9s7jnHvKEhB/XEdybgZf7fY0ah4EHlDe6ddW2L8Mv
A2ZoGtnXOntBB0wAN3Vv6tkiNBGxJ9qioX6tuOHODcEQIr5zYqvkNJzKBEzv5HQv
aoAIMRhcwSpBVcTBE1Zyai2LAKFfaLzrggdJ9PI9pvtTLOjCvqizFeG0aEoup4lH
zwWHx2VNw60yxfT336VRDgC+/6ea6750wmOJuQQ1YrO3YKw1FkfWRjNa38N2x2+L
qirtlEQPfzU=
-----END X509 CRL-----
Specifications
- This Update
- 2020-01-01
- Next Update
- 2020-02-01
- Stale
- true
- Crl Number
- 2
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to fail- Scenario
- Use this CRL as the revocation source for a chain validated at a present-day clock.
- Expected result
- The client reports the CRL as expired at nextUpdate 2020-02-01 instead of accepting its contents as current.
What is a .pem file?
PEM (Privacy-Enhanced Mail) is a text container that Base64-encodes DER binary data between BEGIN/END header lines, used to hold X.509 certificates, certificate requests, and keys. A single .pem file may contain a certificate, a chain, or a private key, which makes it the most common format for TLS material.
How to use this file
Use an example .pem certificate to test X.509 and TLS parsers, PEM decoders, certificate-chain validators, and PEM-to-DER converters. This is published sample material — never a real production key.
How to use this file for testing
“SAMPLE Certificate Revocation List — Stale” is a deterministic Novus Examples fixture for Certificate & key testing, Error handling. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file — all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion — never deploy it anywhere real.
Related files
- csrSAMPLE CSR — Intentionally Corrupt Base64An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.
- pemSAMPLE Leaf Certificate — ExpiredA correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.
- pemSAMPLE Leaf Certificate — No SAN ExtensionA pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.
- pemSAMPLE Leaf Certificate — Not Yet ValidThe mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
- pemSAMPLE Leaf Certificate — RevokedA leaf that is valid in every structural respect and revoked in the matching CRL and OCSP response shipped alongside it. It is the fixture that proves a client actually performs revocation checking rather than stopping at path building.
- pemSAMPLE Leaf Certificate — SAN/CN MismatchThe certificate's CN is app.pki.sample.example but its only SAN is different.pki.sample.example. RFC 6125 clients must ignore the CN entirely, so this separates modern verifiers from ones still falling back to Common Name.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.