Sample certificates for testing

Test certificates, chains and signing requests to download, each built to show one thing: a valid server certificate, a wildcard, an EC key, an expired certificate, a chain in the wrong order, a CSR without SAN. Every sample opens in the Certificate and CSR decoder with one click, so you can see exactly what a strict client will complain about before you test your own system with it.

All samples come from a small test PKI built for this page. Its root is named NOT TRUSTED, every name is a reserved example name, and no private key is published: the keys were deleted when the set was built.

Valid certificates

Everything here is well formed. Use them to test that a system accepts what it should: an import, a binding, a trust store, a monitoring check that must stay green.

Certificates with problems

Each one is broken in exactly one way. Use them to test that a system rejects or warns: an expiry alert, a strict client, a validation step in a pipeline.

Certificate signing requests

Requests as they go to a CA. Use them to practise the check before submission, or to test a CSR intake form.

About the test PKI

• Root: zaur.it Test Root CA – NOT TRUSTED (RSA 4096). Issuing CA: zaur.it Test Issuing CA – NOT TRUSTED (RSA 3072). Every sample except the self-signed one chains to them.
• Names: only example.com, example.net, example.org and .test names, and the documentation addresses 192.0.2.0/24 and 2001:db8::/32. None of them belongs to anyone.
• Dates: the valid samples run from 2026 to 2036, so they stay valid for years. Because that is longer than a public CA may issue, the decoder shows a lifetime line on them as information; for a private CA it is not an error. The expired and not-yet-valid samples have fixed dates.
• Keys: generated for the build and deleted at the end. No private key is in any file or in the ZIP, so nobody, including us, can sign anything with this PKI.
• Built with: OpenSSL 3.5.7, 30 September 2026. A rebuild makes new keys, so the checksums below would change.

Verify the downloads

Every file except the ZIP’s own checksum file is listed in SHA256SUMS in the sha256sum format. After downloading, check them on Linux or macOS with coreutils:

sha256sum -c --ignore-missing SHA256SUMS

On Windows, the same check in PowerShell. Get-FileHash uses SHA-256 by default and prints uppercase hex; -eq compares without case, so the lowercase values in the file still match:

Get-Content .\SHA256SUMS | ForEach-Object {
    $hash, $file = $_ -split '\s+\*?', 2
    if (Test-Path $file) {
        '{0}  {1}' -f $(if ((Get-FileHash $file).Hash -eq $hash) { 'OK' } else { 'FAILED' }), $file
    }
}

Why the comparison operator matters is covered in Get-FileHash: the comparison that reports a good file as bad. For a single value, the Hash generator works too.

What to test with them

• Expiry monitoring: point the check at expired-leaf.pem and confirm it alerts; point it at server-leaf.pem and confirm it stays quiet.
• Import on Windows: server-leaf.cer and server-fullchain.p7b are the formats the Certificate Import Wizard and certutil -addstore expect.
• Chain handling: feed chain-wrong-order.pem and chain-missing-intermediate.pem to a load balancer or a Java trust store test and see which of them it accepts.
• Strict clients: sha1-signed.pem, rsa-1024.pem and no-san.pem should all be rejected by a modern TLS client; if one is accepted, you have found a problem.
• CSR intake: a form or a script that accepts CSRs should flag csr-no-san.csr.
• Parsers and pipelines: stable URLs and checksums make the set usable as fixtures in automated tests.

FAQ

All files and SHA-256 checksums

Related

• Certificate and CSR decoder: open any of these samples, or your own certificate.
• How to Generate SSL Certificates with OpenSSL: make your own test keys and certificates.
• Get-FileHash: the comparison that reports a good file as bad: verify downloads on Windows and avoid the case trap.
• OpenSSL Cheat Sheet: the conversion and inspection commands on one page.