Test Vectors for CBOR Encoded X.509 (C509) Certificates

Introduction This document contains examples of X.509 certificates, certification requests, and certification request templates encoded in CBOR according to the C509 specification . It complements the C509 specification by providing readable examples that illustrate the encodings of certificate and certification request fields and that can be used to test interoperability between C509 implementations. The examples are shown in multiple encodings and formats: X.509 certificates and certification requests in PEM format, and C509 certificates and certification requests in plain hexadecimal and annotated forms. The examples include two types of C509 certificates, distinguished by the value of the c509CertificateType field (see ):

c509CertificateType = 03 (called type 3 in this document) is a reversible CBOR encoding of an X.509 certificate, in which the issuerSignatureValue field of the C509 certificate contains the signatureValue field of the X.509 certificate, that is, the digital signature computed over the ASN.1 DER encoding.
c509CertificateType = 02 (called type 2 in this document) differs from type 3 only in this value and in that the issuerSignatureValue field of the C509 certificate contains the signature over the TBSCertificate of the C509 certificate, that is, the digital signature computed over the CBOR encoding.

The examples also include two types of C509 certification requests, called type 2 and type 3 in this document, distinguished by the value of the c509CertificationRequestType field. Following , the C509 plain hex contains the ~C509Certificate, ~C509CertificationRequest, and ~C509CertificationRequestTemplate, that is, the unwrapped CBOR Sequence . These can readily be converted to CBOR diagnostic notation (see ) using the CBOR Playground . Note that CBOR Sequences require selecting the cborseq option in the CBOR Playground. Private keys are also provided to enable the creation of signatures and the verification of ECDH proof of possession. The keys printed in these examples are not secret and MUST NOT be used for any purpose other than testing. The examples are structured as follows:

contains a CA certificate used in later sections.
contains certificates with different subject public key types, including RSA, Weierstrass EC, Edwards EC, and Montgomery EC keys.
contains certificates with different signature and proof-of-possession algorithms and points to the sections where those algorithms are encoded.
contains certificates with different RDN attributes and points to the sections where those attributes are encoded.
contains certificates with different extensions and points to the sections where those extensions are encoded.
provides examples of certificates with RDN attributes or extensions for which no dedicated CBOR encoding has been defined and for which generic constructs such as CBOR OID are used.
provides examples of certification requests with different signature or proof-of-possession algorithms.
provides examples of certification requests with different CR attributes.
provides examples of certification request templates.

Editor's note: The current version does not include keys or signatures for post-quantum algorithms. These may be included in a future version or in a separate document.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Readers are expected to be familiar with C509 .

CA Certificate

The CA uses an Ed25519 public key because the resulting signature is compact.
Signature algorithm: unsigned
Key: Ed25519

Private Key

X.509 Certificate PEM content (245 bytes): Textual Representation: ]]>

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .
Compared to the C509 type 2 certificate, the only differences are the certificate type, the signature value, and the public key identifier.

Plain hex (96 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (96 bytes): Annotated hex: 5: 1A 67748580 # [4]. notBefore=1735689600: 2025-01-01T00:00:00Z 10: 1A 6B36EC7F # [5]. notAfter=1798761599: 2026-12-31T23:59:59Z 15: 67 # [6]. subject=char[7] 16: 74657374206361 # "test ca" 23: 0C # [7]. subjectPublicKeyAlg=12: Ed25519 24: 58 20 # [8]. subject public key=EC point=byte[32] 26: 5A9414AC56D1B6AF0C966FC53B9476B5C95D0EEAAEF764D9EFE86DB7320C 56: 36E1 58: 88 # [9]. extensions=array[8] # extension[0] 59: 01 # type=1: SubjectKeyIdentifier 60: 54 # value=byte[20] 61: 0369D71F96FE1258A746AC2B208E756E6D1D3ED9 # extension[1] 81: 21 # type=-2: KeyUsage, critical 82: 18 60 # value=96: [keyCertSign, cRLSign] # extension[2] 84: 03 # type=3: SubjectAlternativeName 85: 67 # DNS, value=char[7] 86: 6162632E636F6D # "abc.com" # extension[3] 93: 23 # type=-4: BasicConstraints, critical 94: 20 # value=-1: CA: true, pathLenConstraint: # unlimited 95: 40 # [10]. signature value=byte[0] ]]>

Certificates With Different Subject Public Keys

RSA Public Key With Public Exponent 65537

Self-signed certificate
RSA public key with public exponent 65537 (= 2^16 + 1) and a 1024-bit modulus.
Signature algorithm: sha256WithRSAEncryption
NotAfter: null
Subject: a commonName containing an EUI-48 value
Extensions: a single non-critical keyUsage extension

Private Key

X.509 Certificate PEM content (464 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .
Compared to the C509 type 2 certificate, the only differences are the certificate type, the signature value, and the public key identifier.

Plain hex (283 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (283 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: F6 # [5]. notAfter=: 9999-12-31T23:59:59Z 12: D8 30 # [6]. subject=tag(48) 14: 46 # byte[6] 15: 1234567890AB 21: 00 # [7]. subjectPublicKeyAlg=0: RSA 22: 58 80 # [8]. subject public key=modulus=byte[128] 24: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 54: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 84: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 114: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 144: 83F6478DAF4253DB 152: 01 # [9]. extensions=1, KeyUsage: # [digitalSignature] 153: 58 80 # [10]. signature value=byte[128] 155: 371A7322CDD9DECB1F3B4851A18A47B461A479C29DCE7397290C79DB9564 185: 3A5C7FE2B1F02DB6AF5F0BCA9602D837F7EB3D4AA28738CBCAD385043304 215: E648022A1E9FE0FD19687839AC3EC7C7B6F6E5F85B4416BA085D5C9E367A 245: 0B892829F2F3E4A31D3FDA0E58EA701A72CB3F1B4A06E3DF44F4492FCFBD 275: 5C5F71F03340D7CA ]]>

RSA Public Key With Public Exponent 4294967297

Self-signed certificate
RSA public key with public exponent 4294967297 (= 2^32 + 1) and a 1024-bit modulus
Signature algorithm: sha384WithRSAEncryption
Subject: a commonName containing an EUI-64 value
Extensions: a single critical keyUsage extension

Private Key

X.509 Certificate PEM content (467 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (297 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (297 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: D8 30 # [6]. subject=tag(48) 19: 48 # byte[8] 20: 1234567890ABCDEF 28: 00 # [7]. subjectPublicKeyAlg=0: RSA 29: 82 # [8]. subject public key=array[2] 30: 58 80 # modulus=byte[128] 32: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FA 61: CE5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F 90: 727A763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E 119: 89C6D1731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4 148: E6B6E57283F6478DAF4253DB 160: 45 # exponent=byte[5] 161: 0100000001 166: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 167: 58 80 # [10]. signature value=byte[128] 169: 507EE326549994969B3FAD4309A2704F424E435A24C505603F51104F1E8D 199: DB153D784A9E34E88BC74F67143970B0FCBD2119AC89E87ABF9C2818FFBF 229: 5C6993F87F7A5B640BB7E0FDBCE5F2136377F70C279D76866D725E5868F4 259: FE56F031E80ACBEDE58A6E1AD1CD65A0ADB303C555F408651D5E7F752805 289: EA4B79EF36105344 ]]>

Weierstrass EC Public Key On Curve secp256r1

Self-signed certificate
EC public key on the curve secp256r1
Signature algorithm: ecdsa-with-sha256
Subject: a commonName containing an even number of lowercase hexadecimal characters
Extensions
- Basic Constraints: CA, without pathLenConstraint
- Extended Key Usage: only an integer-identified usage
- Subject Key Identifier

Private Key

X.509 Certificate PEM content (383 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (189 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the public key identifier.

C509 Type 2 Certificate Plain hex (189 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 48 # [6]. subject=byte[8] 17: 1234567890ABCDEF 25: 01 # [7]. subjectPublicKeyAlg=1: EC public key on # curve secp256r1 26: 58 41 # [8]. subject public key=EC point=byte[65] 28: 04F413596A87125995B4E0D8B7BEFBC4D6EDB11F61AF08AB32408D4FF9F9 58: 078DDBAB3635AFD496D5656A22EFDC3D59C4482A99836BB358FBF4CA78D3 88: 930436C857 93: 88 # [9]. extensions=array[8] # extension[0] 94: 01 # type=1: SubjectKeyIdentifier 95: 54 # value=byte[20] 96: 1F3BC19DE194830066C6EAE7CB9D211339EDD942 # extension[1] 116: 02 # type=2: KeyUsage 117: 18 60 # value=96: [keyCertSign, cRLSign] # extension[2] 119: 23 # type=-4: BasicConstraints, critical 120: 20 # value=-1: CA: true, pathLenConstraint: # unlimited # extension[3] 121: 08 # type=8: ExtendedKeyUsage 122: 01 # 1: serverAuth 123: 58 40 # [10]. signature value=byte[64] 125: 8A25E8AABBA4B19B8E0D1596A476C2C42F5068F5F3457606806E2F284A22 155: E6E71EF91E63F35636A4D497E1FB4D3C393ADCDB09D92E02E0194D703ECD 185: 98EB2D79 ]]>

Compressed Weierstrass EC Public Key On Curve secp256r1

Self-signed certificate
EC public key on the curve secp256r1, compressed only in the C509 certificates
Signature algorithm: ecdsa-with-sha256
Subject: a commonName containing an even number of lowercase hexadecimal characters
Extensions
- Basic Constraints: CA, without pathLenConstraint
- Extended Key Usage: only an integer-identified usage
- Subject Key Identifier

Private Key See

X.509 Certificate PEM content (383 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (157 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the public key identifier.

C509 Type 2 Certificate Plain hex (157 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 48 # [6]. subject=byte[8] 17: 1234567890ABCDEF 25: 01 # [7]. subjectPublicKeyAlg=1: EC public key on # curve secp256r1 26: 58 21 # [8]. subject public key=EC point=byte[33] 28: FDF413596A87125995B4E0D8B7BEFBC4D6EDB11F61AF08AB32408D4FF9F9 58: 078DDB 61: 88 # [9]. extensions=array[8] # extension[0] 62: 01 # type=1: SubjectKeyIdentifier 63: 54 # value=byte[20] 64: 26CD540B3E3D99A64AAB0B62ECA277B4359EAD04 # extension[1] 84: 02 # type=2: KeyUsage 85: 18 60 # value=96: [keyCertSign, cRLSign] # extension[2] 87: 23 # type=-4: BasicConstraints, critical 88: 20 # value=-1: CA: true, pathLenConstraint: # unlimited # extension[3] 89: 08 # type=8: ExtendedKeyUsage 90: 01 # 1: serverAuth 91: 58 40 # [10]. signature value=byte[64] 93: 8A25E8AABBA4B19B8E0D1596A476C2C42F5068F5F3457606806E2F284A22 123: E6E7017CEE1E3B865C5EEA2A7946503C5BA1C39424F71ACDC6AFA5FB55F7 153: E397B83C ]]>

Weierstrass EC Public Key On Curve secp384r1

Self-signed certificate
EC public key on the curve secp384r1
Subject: a commonName containing free-form text
Extensions
- Basic Constraints: CA, with pathLenConstraint
- Extended Key Usage: only an OID-identified usage
- Certificate Policies
- Inhibit anyPolicy

Private Key

X.509 Certificate PEM content (539 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (308 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (308 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 72 # [6]. subject=char[18] 17: 73656C667369676E2D73656370333834 # "selfsign-secp384" 33: 7231 # "r1" 35: 02 # [7]. subjectPublicKeyAlg=2: EC public key on # curve secp384r1 36: 58 61 # [8]. subject public key=EC point=byte[97] 38: 04DD6762F035899451372B2FE9B52A8314AD10E2C4363C5A5849E296FE51 68: AAB9BFD03AB038D33418A0BCD83280ABA0BD9104017165C048B5346B5410 98: 9E449FCC889E4EE870B5F8A2C63DAE414DE19755BE278A175E040D4A4C1A 128: 0EE46E924A5C29 135: 8A # [9]. extensions=array[10] # extension[0] 136: 02 # type=2: KeyUsage 137: 18 60 # value=96: [keyCertSign, cRLSign] # extension[1] 139: 23 # type=-4: BasicConstraints, critical 140: 01 # value=1: CA: true, pathLenConstraint: 1 # extension[2] 141: 06 # type=6: CertificatePolicies 142: 84 # value=array[4] # CertificatePolicy[0] 143: 03 # PolicyIdentifier=3: # individual-validated 144: 80 # PolicyQualifierInfos=array[0] # CertificatePolicy[1] 145: 00 # PolicyIdentifier=0: anyPolicy 146: 84 # PolicyQualifierInfos=array[4] # PolicyQualifierInfo[0] 147: 01 # policyQualifierId=1: # domain-validated 148: 76 # qualifier=char[22] 149: 687474703A2F2F6370732E657861 # "http://cps.exa" 163: 6D706C652E636F6D # "mple.com" # PolicyQualifierInfo[1] 171: 02 # policyQualifierId=2: # organization-validated 172: 77 # qualifier=char[23] 173: 7468697320697320746865207573 # "this is the us" 187: 6572206E6F74696365 # "er notice" # extension[3] 196: 08 # type=8: ExtendedKeyUsage 197: 49 # byte[9]: 198: 2B0601040181FD5904 # oid: 1.3.6.1.4.1.32473.4 # extension[4] 207: 18 1E # type=30: InhibitAnyPolicy 209: 00 # value=simple-uint(0) 210: 58 60 # [10]. signature value=byte[96] 212: 347EB5ED49E1F6536E2A3F3B5DF1C12D9BAEF440DFBC42BD45D31F4B3FDA 242: BDFA9D685A84582D98B1B2474210F1C785DA055BE26787AB4DD58FD330E3 272: 435AC84EBE49A4382FB964591C3EACC9A04F3814FC2964C1B4B201C013AE 302: 7CCB3727CDF7 ]]>

Weierstrass EC Public Key On Curve secp521r1

Self-signed certificate
EC public key on the curve secp521r1
Signature algorithm: ecdsa-with-sha512
Subject: empty
Extensions
- Basic Constraints: non-CA
- Extended Key Usage: integer-identified and OID-identified usages
- Subject Alternative Name

Private Key

X.509 Certificate PEM content (753 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (512 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (512 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 80 # [6]. subject=array[0], 0 attribute 17: 03 # [7]. subjectPublicKeyAlg=3: EC public key on # curve secp521r1 18: 58 85 # [8]. subject public key=EC point=byte[133] 20: 04005538CE8F7CDE229335C85958AACD029DDF65CFC2A72A75055E63B8FE 50: 59D07FB4BDF10DB7B8BA7D57C5C691EB96EAB97411615A6A430E51787031 80: 719CEBC305E69200705CC828B9755F8FD53452B777A40CB6792554E5718B 110: AB91EA3F03086A4072A47047CEEC2493C384045FCC6ED8E4F748A5223AF1 140: 2901EB2E19A6C288951C939B05 153: 88 # [9]. extensions=array[8] # extension[0] 154: 02 # type=2: KeyUsage 155: 01 # value=1: [digitalSignature] # extension[1] 156: 03 # type=3: SubjectAlternativeName 157: 96 # value=array[22] # GeneralName[0] 158: 04 # GeneralNameType=4: directoryName 159: 84 # GeneralNameValue=array[4], 2 # attributes # attribute[0] 160: 04 # type=4: country 161: 62 # value=char[2] 162: 4445 # "DE" # attribute[1] 164: 01 # type=1: commonName 165: 67 # value=char[7] 166: 6578616D706C65 # "example" # GeneralName[1] 173: 02 # GeneralNameType=2: dNSName 174: 6F # GeneralNameValue=char[15] 175: 6162632E6578616D706C652E636F6D # "abc.example.com" # GeneralName[2] 190: 01 # GeneralNameType=1: rfc822Name 191: 6F # GeneralNameValue=char[15] 192: 616263406578616D706C652E636F6D # "abc@example.com" # GeneralName[3] 207: 21 # GeneralNameType=-2: on-SmtpUTF8Mailbox 208: 74 # GeneralNameValue=char[20] 209: 736D747075746638406578616D706C # "smtputf8@exampl" 224: 652E636F6D # "e.com" # GeneralName[4] 229: 06 # GeneralNameType=6: uri 230: 78 1C # GeneralNameValue=char[28] 232: 687474703A2F2F6D797572692E6578 # "http://myuri.ex" 247: 616D706C652E636F6D2F616263 # "ample.com/abc" # GeneralName[5] 260: 08 # GeneralNameType=8: registeredID 261: 49 # GeneralNameValue=byte[9]: 262: 2B0601040181FD5908 # oid: 1.3.6.1.4.1.32473.8 # GeneralName[6] 271: 07 # GeneralNameType=7: iPAddress 272: 44 # GeneralNameValue=byte[4] 273: 11111111 # GeneralName[7] 277: 00 # GeneralNameType=0: otherName 278: 82 # GeneralNameValue=array[2] 279: 49 # id=byte[9]: 280: 2B0601040181FD5901 # oid: 1.3.6.1.4.1.32473.1 289: 4C # value=byte[12] 290: 040A22222222222222222222 # GeneralName[8] 302: 22 # GeneralNameType=-3: on-MACAddress 303: 46 # GeneralNameValue=byte[6] 304: 222222222222 # GeneralName[9] 310: 21 # GeneralNameType=-2: on-SmtpUTF8Mailbox 311: 78 1C # GeneralNameValue=char[28] 313: 736D74702E757466386D61696C626F # "smtp.utf8mailbo" 328: 78406578616D706C652E636F6D # "x@example.com" # GeneralName[10] 341: 20 # GeneralNameType=-1: # on-hardwareModuleName 342: 82 # GeneralNameValue=array[2] 343: 49 # id=byte[9]: 344: 2B0601040181FD5902 # oid: 1.3.6.1.4.1.32473.2 353: 52 # value=byte[18] 354: 041033333333333333333333333333333333 # extension[2] 372: 23 # type=-4: BasicConstraints, critical 373: 21 # value=-2: CA: false # extension[3] 374: 08 # type=8: ExtendedKeyUsage 375: 82 # value=array[2] 376: 02 # 2: clientAuth 377: 01 # 1: serverAuth 378: 58 84 # [10]. signature value=byte[132] 380: 012F8358F64621CA68F7DB644AEFE37958041A686436AFCEDDE70ACEBA73 410: 744D70147784A41AD67673A1EE5B3B9B1A8351553A29E87815ABFCCA5D1D 440: E1099F284B4C00ED9B37F0DA14D5086C5E3195C84346364CBB9CB0B2E36F 470: FADDE2A8D170A7B92F4F4C0AEB15CAC4F71968E2A5A04A17FBF3BCDC45B5 500: 286C491FE10F6CD53A26413F ]]>

Weierstrass EC Public Key On Curve sm2p256v1

Self-signed certificate
EC public key on the curve sm2p256v1
Signature algorithm: sm2-with-sm3
Subject:
- serialNumber
- organization
- organizationalUnit
- organizationIdentifier
Extensions:
- Policy Constraints containing only inhibitPolicyMapping
- Name Constraints containing only excludedSubTrees

Private Key

X.509 Certificate PEM content (644 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (325 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (325 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 8A # [6]. subject=array[10], 5 attributes # attribute[0] 17: 01 # type=1: commonName 18: 72 # value=char[18] 19: 73656C667369676E2D736D3270323536 # "selfsign-sm2p256" 35: 7631 # "v1" # attribute[1] 37: 03 # type=3: serialNumber 38: 6F # value=char[15] 39: 6D792073657269616C4E756D626572 # "my serialNumber" # attribute[2] 54: 08 # type=8: organization 55: 6F # value=char[15] 56: 6D79206F7267616E697A6174696F6E # "my organization" # attribute[3] 71: 09 # type=9: organizationalUnit 72: 75 # value=char[21] 73: 6D79206F7267616E697A6174696F6E61 # "my organizationa" 89: 6C556E6974 # "lUnit" # attribute[4] 94: 12 # type=18: organizationIdentifier 95: 78 19 # value=char[25] 97: 6D79206F7267616E697A6174696F6E49 # "my organizationI" 113: 64656E746966696572 # "dentifier" 122: 06 # [7]. subjectPublicKeyAlg=6: EC public key on # curve sm2p256v1 123: 58 41 # [8]. subject public key=EC point=byte[65] 125: 0495FFF4BE8611C8149C81ADEC14125DACCA746A2F3FE38CD2EAB711E8C9 155: 9F101FBB448423F166F9FFD98F0E321597BB394835A6FB240337A3891290 185: 7A22C3F04A 190: 86 # [9]. extensions=array[6] # extension[0] 191: 02 # type=2: KeyUsage 192: 01 # value=1: [digitalSignature] # extension[1] 193: 18 1A # type=26: NameConstraints 195: 82 # value=array[2] 196: F6 # permittedSubtrees= 197: 84 # excludedSubtrees=array[4] # GeneralName[0] 198: 02 # GeneralNameType=2: dNSName 199: 78 19 # GeneralNameValue=char[25] 201: 6578636C756465642E646E73312E65 # "excluded.dns1.e" 216: 78616D706C652E636F6D # "xample.com" # GeneralName[1] 226: 02 # GeneralNameType=2: dNSName 227: 78 19 # GeneralNameValue=char[25] 229: 6578636C756465642E646E73322E65 # "excluded.dns2.e" 244: 78616D706C652E636F6D # "xample.com" # extension[2] 254: 18 1C # type=28: PolicyConstraints 256: 82 # value=array[2] 257: F6 # requireExplicitPolicy= 258: 02 # inhibitPolicyMapping=2 259: 58 40 # [10]. signature value=byte[64] 261: 59F40C77AE8AC0BD0638E0B822001FD47EEF15667C7034436A95C97E94CE 291: EE5FEFA1441C1F6537A76692605BED70A1168D2AFE6B03B4E9F925024D1B 321: 76729555 ]]>

Weierstrass EC Public Key On Curve brainpoolP256r1

Self-signed certificate
EC public key on the curve brainpoolP256r1
Signature algorithm: ecdsa-with-shake128
Subject:
- country
- state
- locality
- postalCode
- street
Extensions:
- IPAddrBlocks with SAFI = null and IP Address Choice = null
- IPAddrBlocks V2 with SAFI = null and IP Address Choice = null
- ASIdentifiers
- ASIdentifiers V2

Private Key

X.509 Certificate PEM content (646 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (263 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (263 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 8C # [6]. subject=array[12], 6 attributes # attribute[0] 17: 01 # type=1: commonName 18: 78 18 # value=char[24] 20: 73656C667369676E2D627261696E706F # "selfsign-brainpo" 36: 6F6C703235367231 # "olp256r1" # attribute[1] 44: 04 # type=4: country 45: 62 # value=char[2] 46: 4445 # "DE" # attribute[2] 48: 05 # type=5: locality 49: 6B # value=char[11] 50: 6D79206C6F63616C697479 # "my locality" # attribute[3] 61: 06 # type=6: state 62: 68 # value=char[8] 63: 6D79207374617465 # "my state" # attribute[4] 71: 07 # type=7: street 72: 69 # value=char[9] 73: 6D7920737472656574 # "my street" # attribute[5] 82: 0C # type=12: postalCode 83: 6D # value=char[13] 84: 6D7920706F7374616C436F6465 # "my postalCode" 97: 18 18 # [7]. subjectPublicKeyAlg=24: EC public key on # curve brainpoolp256r1 99: 58 41 # [8]. subject public key=EC point=byte[65] 101: 0477B077412EE98950779ED882FFCB1648E014272354469624F5BCE2F14F 131: 3242AD4ACC5686A86508D59FB729FDC29811188D8BF016CE4A5151054DAF 161: 888C48D5ED 166: 8A # [9]. extensions=array[10] # extension[0] 167: 02 # type=2: KeyUsage 168: 01 # value=1: [digitalSignature] # extension[1] 169: 18 20 # type=32: IPAddrBlocks 171: 86 # value=array[6] # IPAddrBlock[0] 172: 01 # AFI=1: IPv4 173: F6 # SAFI= 174: F6 # IP Address Choice= # IPAddrBlock[1] 175: 02 # AFI=2: IPv6 176: F6 # SAFI= 177: F6 # IP Address Choice= # extension[2] 178: 18 21 # type=33: ASIdentifiers 180: 82 # value=array[2] 181: 02 # id=2 182: 82 # range=array[2] 183: 01 # min=1 184: 03 # max=3 # extension[3] 185: 18 22 # type=34: IPAddrBlocksV2 187: 86 # value=array[6] # IPAddrBlock[0] 188: 01 # AFI=1: IPv4 189: 01 # SAFI=1: unicast 190: F6 # IP Address Choice= # IPAddrBlock[1] 191: 02 # AFI=2: IPv6 192: 01 # SAFI=1: unicast 193: F6 # IP Address Choice= # extension[4] 194: 18 23 # type=35: ASIdentifiersV2 196: F6 # value= 197: 58 40 # [10]. signature value=byte[64] 199: 4BF673AB08781A572889717416F5B662A188B3218506F1780EB1D17C8B02 229: 07FF9F318BB7DBFD17F6C829E93C0CDCB657E795436FA8FC4240A71F223D 259: C0366059 ]]>

Weierstrass EC Public Key On Curve brainpoolP384r1

Self-signed certificate
EC public key on the curve brainpoolP384r1
Signature algorithm: ecdsa-with-sha384
Subject:
- surname
- givenName
- title
- name
Extensions:
- IPAddrBlocks with non-null SAFI and IntIPAddressChoice`
- IPAddrBlocks V2 with non-null SAFI, IntIPAddressChoice and IPAddressChoice

Private Key

X.509 Certificate PEM content (717 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (405 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (405 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 8A # [6]. subject=array[10], 5 attributes # attribute[0] 17: 01 # type=1: commonName 18: 78 18 # value=char[24] 20: 73656C667369676E2D627261696E706F # "selfsign-brainpo" 36: 6F6C703338347231 # "olp384r1" # attribute[1] 44: 02 # type=2: surname 45: 6A # value=char[10] 46: 6D79207375726E616D65 # "my surname" # attribute[2] 56: 0A # type=10: title 57: 68 # value=char[8] 58: 6D79207469746C65 # "my title" # attribute[3] 66: 0D # type=13: givenName 67: 6C # value=char[12] 68: 6D7920676976656E4E616D65 # "my givenName" # attribute[4] 80: 18 19 # type=25: name 82: 67 # value=char[7] 83: 6D79206E616D65 # "my name" 90: 18 19 # [7]. subjectPublicKeyAlg=25: EC public key on # curve brainpoolp384r1 92: 58 61 # [8]. subject public key=EC point=byte[97] 94: 046709C992919B49C48FD931D05C497D3865E6084C91DF3A4C7E781F4185 124: 43B023D59E8BF25D133FB1A094E9D42C8FA6ED3B46E9883A35ABD4B0A9D3 154: 0AAEFD9B7E88ED3800565D1E7F0633134D6519292D49BD55EC30A167197F 184: EC0F7429822B95 191: 86 # [9]. extensions=array[6] # extension[0] 192: 02 # type=2: KeyUsage 193: 01 # value=1: [digitalSignature] # extension[1] 194: 18 20 # type=32: IPAddrBlocks 196: 86 # value=array[6] # IPAddrBlock[0] 197: 01 # AFI=1: IPv4 198: F6 # SAFI= 199: 83 # IntIPAddressChoice=array[3] 200: 1A 01C00002 # [0]=AddressPrefix=29360130 205: 1B 00000005C47363FE # [1]=AddressPrefix=24770733054 214: 3B 00000005C468638E # [2]=AddressPrefix=-24770012047 # IPAddrBlock[1] 223: 02 # AFI=2: IPv6 224: F6 # SAFI= 225: 82 # IntIPAddressChoice=array[2] 226: 1B 000120010DB81234 # [0]=AddressPrefix=3166638739338 # 76 235: 82 # [1]=AddressRange=array[2] 236: 3B 000120010C78132D # min=-316663852962606 245: 09 # max=9 # extension[2] 246: 18 22 # type=34: IPAddrBlocksV2 248: 86 # value=array[6] # IPAddrBlock[0] 249: 01 # AFI=1: IPv4 250: 01 # SAFI=1: unicast 251: 83 # IntIPAddressChoice=array[3] 252: 1A 01C00002 # [0]=AddressPrefix=29360130 257: 1B 00000005C47363FE # [1]=AddressPrefix=24770733054 266: 3B 00000005C468638E # [2]=AddressPrefix=-24770012047 # IPAddrBlock[1] 275: 02 # AFI=2: IPv6 276: 01 # SAFI=1: unicast 277: 82 # IPAddressChoice=array[2] 278: 47 # [0]=AddressPrefix=byte[7] 279: 0020010DB81234 286: 82 # [1]=AddressRange=array[2] 287: 45 # min=byte[5] 288: 003FFF0003 293: 4D # max=byte[13] 294: 003FFF01220000223333445566 307: 58 60 # [10]. signature value=byte[96] 309: 6709C992919B49C48FD931D05C497D3865E6084C91DF3A4C7E781F418543 339: B023D59E8BF25D133FB1A094E9D42C8FA6ED01853890E65008EADEEAB491 369: 4203C9AE8EC9DA8908B30BFA61E9A1618C2047C3ECF3BAB63E2008D66C9D 399: E3B4F3AE0193 ]]>

Weierstrass EC Public Key On Curve brainpoolP512r1

Self-signed certificate
EC public key on the curve brainpoolP512r1
Signature algorithm: ecdsa-with-shake256
Subject:
- jurisdictionCountryName
- jurisdictionStateOrProvinceName
- jurisdictionLocalityName
Extensions:
- Subject Directory Attributes
- Subject Information Access
- Policy Mappings

Private Key

X.509 Certificate PEM content (809 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (431 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (431 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 88 # [6]. subject=array[8], 4 attributes # attribute[0] 17: 01 # type=1: commonName 18: 78 18 # value=char[24] 20: 73656C667369676E2D627261696E706F # "selfsign-brainpo" 36: 6F6C703531327231 # "olp512r1" # attribute[1] 44: 13 # type=19: jurisdictionLocalityName 45: 77 # value=char[23] 46: 6D79206A7572697364696374696F6E4C # "my jurisdictionL" 62: 6F63616C697479 # "ocality" # attribute[2] 69: 14 # type=20: jurisdictionStateOrProvinceName 70: 74 # value=char[20] 71: 6D79206A7572697364696374696F6E53 # "my jurisdictionS" 87: 74617465 # "tate" # attribute[3] 91: 15 # type=21: jurisdictionCountryName 92: 62 # value=char[2] 93: 5345 # "SE" 95: 18 1A # [7]. subjectPublicKeyAlg=26: EC public key on # curve brainpoolp512r1 97: 58 81 # [8]. subject public key=EC point=byte[129] 99: 046D327067D334CE53FA29317AA207B85CA237623F19A10C594BF024FC3F 129: FEB64FAB5884D0D448A271552E02E7CF44D8BF104DA182CEC1DE895C8418 159: B8529D9B8B2C4B80A736DDC56471D6A52C6CE414E69D57356B15FC08A46B 189: 61FA5B721FABC76932F3836DADE4F70F6F0CACB8D3351A7EB54EFF077C40 219: 2368C49BB715B53458 228: 88 # [9]. extensions=array[8] # extension[0] 229: 02 # type=2: KeyUsage 230: 01 # value=1: [digitalSignature] # extension[1] 231: 18 18 # type=24: SubjectDirectoryAttributes 233: 82 # value=array[2], 1 Attribute 234: 04 # attributeType=4: country 235: 82 # attributeValue=array[2] 236: 62 # attributeValue[0]=char[2] 237: 4445 # "DE" 239: 62 # attributeValue[1]=char[2] 240: 5345 # "SE" # extension[2] 242: 18 1B # type=27: PolicyMappings 244: 84 # value=array[4] # policyMapping[0] 245: 02 # issuerDomainPolicy=2: # organization-validated 246: 01 # subjectDomainPolicy=1: # domain-validated # policyMapping[1] 247: 49 # issuerDomainPolicy=byte[9]: 248: 2B0601040181FD5906 # oid: 1.3.6.1.4.1.32473.6 257: 49 # subjectDomainPolicy=byte[9]: 258: 2B0601040181FD5907 # oid: 1.3.6.1.4.1.32473.7 # extension[3] 267: 18 1F # type=31: SubjectInfoAccess 269: 82 # value=array[2] # AccessDescription[0] 270: 02 # accessMethod=2: caIssuers 271: 78 1C # uri=char[28] 273: 687474703A2F2F6361697373756572 # "http://caissuer" 288: 732E6578616D706C652E636F6D # "s.example.com" 301: 58 80 # [10]. signature value=byte[128] 303: A0B9ED538672D0B80E48F3D7C4E902503BAC0BDC88B45DAC784DDCFA551A 333: F188B6E2E51F6E695D7CFC91396BEB17FD91CF9C82D1FB819FEA09C9C4AC 363: 9BDCEF1B9AE37BD98556C3917E9D2FA7327C4FDE6A6CFC99320B3CA09776 393: 6A9C1A41227A5227CE4F29079B59D533DEAFDE51B599B052C91178BE8FA2 423: 9F86F0FADBC412F9 ]]>

Weierstrass EC Public Key On Curve frp256v1

Self-signed certificate
EC public key on the curve frp256v1
Signature algorithm: ecdsa-with-sha1
Subject:
- emailAddress
- telephoneNumber
- businessCategory
Extensions:
- Policy Constraints containing only requireExplicitPolicy
- Name Constraints containing only permittedSubTrees

Private Key

X.509 Certificate PEM content (584 bytes): Textual Representation: ### C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (302 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (302 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 88 # [6]. subject=array[8], 4 attributes # attribute[0] 18: 00 # type=0: emailAddress 19: 6F # value=char[15] 20: 616263406578616D706C652E6F7267 # "abc@example.org" # attribute[1] 35: 01 # type=1: commonName 36: 71 # value=char[17] 37: 73656C667369676E2D66727032353676 # "selfsign-frp256v" 53: 31 # "1" # attribute[2] 54: 0B # type=11: businessCategory 55: 73 # value=char[19] 56: 6D7920627573696E6573734361746567 # "my businessCateg" 72: 6F7279 # "ory" # attribute[3] 75: 18 1A # type=26: telephoneNumber 77: 72 # value=char[18] 78: 6D792074656C6570686F6E654E756D62 # "my telephoneNumb" 94: 6572 # "er" 96: 18 1B # [7]. subjectPublicKeyAlg=27: EC public key on # curve frp256v1 98: 58 41 # [8]. subject public key=EC point=byte[65] 100: 04378D2D28A1F6547124F2DB6A42F63915BFA2F6537AE20CF0417D675FBE 130: 6603DA80A4CF3F1E43633343AB3BE80150EC04E9649DD62705BC055BDCDA 160: 791EB25062 165: 86 # [9]. extensions=array[6] # extension[0] 166: 02 # type=2: KeyUsage 167: 01 # value=1: [digitalSignature] # extension[1] 168: 18 1A # type=26: NameConstraints 170: 82 # value=array[2] 171: 84 # permittedSubtrees=array[4] # GeneralName[0] 172: 02 # GeneralNameType=2: dNSName 173: 78 1A # GeneralNameValue=char[26] 175: 7065726D69747465642E646E73312E # "permitted.dns1." 190: 6578616D706C652E636F6D # "example.com" # GeneralName[1] 201: 02 # GeneralNameType=2: dNSName 202: 78 1A # GeneralNameValue=char[26] 204: 7065726D69747465642E646E73322E # "permitted.dns2." 219: 6578616D706C652E636F6D # "example.com" 230: F6 # excludedSubtrees= # extension[2] 231: 18 1C # type=28: PolicyConstraints 233: 82 # value=array[2] 234: 01 # requireExplicitPolicy=1 235: F6 # inhibitPolicyMapping= 236: 58 40 # [10]. signature value=byte[64] 238: 378D2D28A1F6547124F2DB6A42F63915BFA2F6537AE20CF0417D675FBE66 268: 03DA6F2D4CE3787CBACE549599BC5F3BAACCA2B7E67352E4A6BA1F4496CE 298: AD53D8E6 ]]>

Montgomery EC Public Key On Curve X25519

X25519 public key
Extensions
- authorityKeyIdentifier containing only the keyIdentifier component
- authorityInfoAccess
- issuerAltName

Private Key

X.509 Certificate

Issued by the CA in .

PEM content (643 bytes): Textual Representation: ]]>

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (398 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate

Issued by the CA in .

Plain hex (398 bytes): Annotated hex:

Montgomery EC Public Key On Curve X448

X448 public key
Extensions:
- authorityKeyIdentifier containing all fields
- crlDistributionPoints
- freshestCRL

Private Key

X.509 Certificate

Issued by the CA in .

PEM content (518 bytes): Textual Representation: ]]>

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (301 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate

Issued by the CA in .

Plain hex (301 bytes): Annotated hex:

Edwards EC Public Key On Curve ED25519

Self-signed certificate
Edwards public key Ed25519
Signature algorithm: ed25519
Subject:
- domainComponent
- dnQualifier
- dmdName
- unstructuredName
- unstructuredAddress
- generationQualifier
Extensions:
- Policy Constraints containing both requireExplicitPolicy and inhibitPolicyMapping
- Name Constraints containing both permittedSubTrees and excludedSubTrees

Private Key

X.509 Certificate PEM content (784 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (383 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (383 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 8E # [6]. subject=array[14], 7 attributes # attribute[0] 17: 01 # type=1: commonName 18: 70 # value=char[16] 19: 73656C667369676E2D65643235353139 # "selfsign-ed25519" # attribute[1] 35: 0F # type=15: generationQualifier 36: 76 # value=char[22] 37: 6D792067656E65726174696F6E517561 # "my generationQua" 53: 6C6966696572 # "lifier" # attribute[2] 59: 10 # type=16: DNQualifier 60: 6E # value=char[14] 61: 6D7920646E5175616C6966696572 # "my dnQualifier" # attribute[3] 75: 16 # type=22: domainComponent 76: 72 # value=char[18] 77: 6D7920646F6D61696E436F6D706F6E65 # "my domainCompone" 93: 6E74 # "nt" # attribute[4] 95: 18 1B # type=27: DMDName 97: 6A # value=char[10] 98: 6D7920646D644E616D65 # "my dmdName" # attribute[5] 108: 18 1D # type=29: unstructuredName 110: 73 # value=char[19] 111: 6D7920756E737472756374757265644E # "my unstructuredN" 127: 616D65 # "ame" # attribute[6] 130: 18 1E # type=30: unstructuredAddress 132: 76 # value=char[22] 133: 6D7920756E7374727563747572656441 # "my unstructuredA" 149: 646472657373 # "ddress" 155: 0C # [7]. subjectPublicKeyAlg=12: Ed25519 156: 58 20 # [8]. subject public key=EC point=byte[32] 158: 46270AEC0F32837E128779D30B249C531D6D42C1AC29E402328EDC79FAC2 188: BE95 190: 86 # [9]. extensions=array[6] # extension[0] 191: 02 # type=2: KeyUsage 192: 01 # value=1: [digitalSignature] # extension[1] 193: 18 1A # type=26: NameConstraints 195: 82 # value=array[2] 196: 84 # permittedSubtrees=array[4] # GeneralName[0] 197: 02 # GeneralNameType=2: dNSName 198: 78 1A # GeneralNameValue=char[26] 200: 7065726D69747465642E646E73312E # "permitted.dns1." 215: 6578616D706C652E636F6D # "example.com" # GeneralName[1] 226: 02 # GeneralNameType=2: dNSName 227: 78 1A # GeneralNameValue=char[26] 229: 7065726D69747465642E646E73322E # "permitted.dns2." 244: 6578616D706C652E636F6D # "example.com" 255: 84 # excludedSubtrees=array[4] # GeneralName[0] 256: 02 # GeneralNameType=2: dNSName 257: 78 19 # GeneralNameValue=char[25] 259: 6578636C756465642E646E73312E65 # "excluded.dns1.e" 274: 78616D706C652E636F6D # "xample.com" # GeneralName[1] 284: 02 # GeneralNameType=2: dNSName 285: 78 19 # GeneralNameValue=char[25] 287: 6578636C756465642E646E73322E65 # "excluded.dns2.e" 302: 78616D706C652E636F6D # "xample.com" # extension[2] 312: 18 1C # type=28: PolicyConstraints 314: 82 # value=array[2] 315: 01 # requireExplicitPolicy=1 316: 02 # inhibitPolicyMapping=2 317: 58 40 # [10]. signature value=byte[64] 319: 213CF14F253BCECA58A1CDF0AAD3565E01D6612461F86DBACC6E0140995A 349: C3EEF507AF1341D604243751562CCB363B0C72C989E9D2F260C594228342 379: AFAC7B00 ]]>

Edwards EC Public Key On Curve ED448

Self-signed certificate
Edwards public key Ed448
Signature algorithm: ed448
Subject:
- initials
- pseudonym
- userId
Extensions:
- OCSP No Check
- TLS Features

Private Key

X.509 Certificate PEM content (503 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (260 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (260 bytes): Annotated hex: 6: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 11: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 16: 88 # [6]. subject=array[8], 4 attributes # attribute[0] 17: 01 # type=1: commonName 18: 6E # value=char[14] 19: 73656C667369676E2D6564343438 # "selfsign-ed448" # attribute[1] 33: 0E # type=14: initials 34: 6B # value=char[11] 35: 6D7920696E697469616C73 # "my initials" # attribute[2] 46: 11 # type=17: pseudonym 47: 6C # value=char[12] 48: 6D792070736575646F6E796D # "my pseudonym" # attribute[3] 60: 18 1C # type=28: userID 62: 69 # value=char[9] 63: 6D7920757365726964 # "my userid" 72: 0D # [7]. subjectPublicKeyAlg=13: Ed448 73: 58 39 # [8]. subject public key=EC point=byte[57] 75: 8C35E491DB58702D7B99167C19F86B2681EA25D21F83AC6EC78040A90411 105: 4FCB1DCF239F6C4D845147F7E22793A891A9F9CA5D1E20A7398C80 132: 86 # [9]. extensions=array[6] # extension[0] 133: 02 # type=2: KeyUsage 134: 01 # value=1: [digitalSignature] # extension[1] 135: 18 24 # type=36: OCSPNoCheck 137: F6 # value= # extension[2] 138: 18 26 # type=38: TLSFeatures 140: 82 # value=array[2] 141: 18 2C # value=44: cookie 143: 10 # value=16: application layer protocol # negotiation 144: 58 72 # [10]. signature value=byte[114] 146: 5E12D7D2F577CBDB36BA15DD9EA97B9BB9B49284210308CCFB2B1C2F9E2F 176: F80398CC5D4F50293AFD24C5BCE3569379D344BCC4D31C6062A400EC5824 206: 89B9F8B8CDCF0F4F2C2C38482A6201B78D9B222B8E7CF75431BDBE4FA906 236: 1B066DA656B5509F36D6005D0C2B602018B79E79C9A20A00 ]]>

Certificates With Different Signature Algorithms

RSASSA-PKCS1-v1_5 With SHA-1

Self-signed certificate
Signature algorithm: sha1WithRSAEncryption

Private Key See .

X.509 Certificate PEM content (463 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (302 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (302 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 76 # [6]. subject=char[22] 18: 73656C667369676E2D7273612D776974 # "selfsign-rsa-wit" 34: 682D73686131 # "h-sha1" 40: 00 # [7]. subjectPublicKeyAlg=0: RSA 41: 58 80 # [8]. subject public key=modulus=byte[128] 43: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 73: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 103: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 133: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 163: 83F6478DAF4253DB 171: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 172: 58 80 # [10]. signature value=byte[128] 174: 0150926C5642D9CB2AAA27A17B68FBBFC9F47AA42CD9E6779B4E9A7A81C7 204: 60589C53AC23BAD6A94F5A6B275BE292B79BA9CB59D045E44809353DCE73 234: C936A06EC20D51AE24C559DDB02EBF4B0838F515328058F601D91F6DAE5B 264: FF55DC78DEB80970D2F74757FC5F96BE6F217825DC8286D9446CCA0C9AF2 294: 57FCE66CD963F891 ]]>

ECDSA With SHA1

Signature algorithm: ecdsa-with-sha1

See .

ECDSA With SHA256

Signature algorithm: ecdsa-with-sha256

See .

ECDSA With SHA384

Signature algorithm: ecdsa-with-sha384

See .

ECDSA With SHA512

Signature algorithm: ecdsa-with-sha512

See .

ECDSA With SHAKE128

Signature algorithm: ecdsa-with-shake128

See .

ECDSA With SHAKE256

Signature algorithm: ecdsa-with-shake256

See .

Unsigned

Signature algorithm: unsigned

See .

SM2 With SM3

Signature algorithm: sm2-with-sm3

See .

Ed25519

Signature algorithm: ed25519

See .

Ed448

Signature algorithm: ed448

See .

ECDH PoP With SHA-256 And HMAC-SHA256

Signature algorithm: sa-ecdhPop-sha256-hmac-sha256

See .

ECDH PoP With SHA-384 And HMAC-SHA384

Signature algorithm: sa-ecdhPop-sha384-hmac-sha384

See .

ECDH PoP With SHA-512 And HMAC-SHA512

Signature algorithm: sa-ecdhPop-sha512-hmac-sha512

See .

RSASSA-PKCS1-v1_5 With SHA-256

Signature algorithm: sha256WithRSAEncryption

See .

RSASSA-PKCS1-v1_5 With SHA-384

Signature algorithm: sha384WithRSAEncryption

See .

RSASSA-PKCS1-v1_5 With SHA-512

Self-signed certificate
Signature algorithm: sha512WithRSAEncryption

Private Key See .

X.509 Certificate PEM content (467 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (305 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (305 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 18 # [6]. subject=char[24] 19: 73656C667369676E2D7273612D776974 # "selfsign-rsa-wit" 35: 682D736861353132 # "h-sha512" 43: 00 # [7]. subjectPublicKeyAlg=0: RSA 44: 58 80 # [8]. subject public key=modulus=byte[128] 46: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 76: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 106: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 136: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 166: 83F6478DAF4253DB 174: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 175: 58 80 # [10]. signature value=byte[128] 177: B5D4C31502957FBEE2E4DED7E45E723A8B9A86A46E9FEA1D87817808D1AC 207: E802370B91718755F101FFB3B971816120BE5CC05D2EE866422D78EF7D16 237: AA78CE4011E4DC92AE1C7DA3C7831773A44A7B2F5BAFED5D2B8A6A4E6E49 267: 638B3335DC68B596AE5FC48360E1C7DD50BD457CF2CFDCF56F98BE1EA310 297: 3B12DD5B6221DB21 ]]>

RSASSA-PSS With SHA-256

Self-signed certificate
Signature algorithm: rsassa-pss-with-sha256

Private Key See .

X.509 Certificate PEM content (575 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (307 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (307 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 1A # [6]. subject=char[26] 19: 73656C667369676E2D7273617373612D # "selfsign-rsassa-" 35: 7073732D736861323536 # "pss-sha256" 45: 00 # [7]. subjectPublicKeyAlg=0: RSA 46: 58 80 # [8]. subject public key=modulus=byte[128] 48: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 78: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 108: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 138: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 168: 83F6478DAF4253DB 176: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 177: 58 80 # [10]. signature value=byte[128] 179: 4D8FB6928B9C34EF6E53A22DE2BED6579A58FB990CED4C7CC5B0227CBB21 209: 0741B3C3DA6A72CFA764CEF937DABC9C373776FD882ABBD052936D6B4A14 239: A12E628AF43CA89A6CAAC11513AA9C4438C668447FFF7497F32BE445B58A 269: 4EA2E40E30C32165558EFB66E2B17640B93B061BD8BF5812818B318415E9 299: F20FFE5EA50C9D39 ]]>

RSASSA-PSS With SHA-384

Self-signed certificate
Signature algorithm: rsassa-pss-with-sha384

Private Key See .

X.509 Certificate PEM content (575 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (307 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (307 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 1A # [6]. subject=char[26] 19: 73656C667369676E2D7273617373612D # "selfsign-rsassa-" 35: 7073732D736861333834 # "pss-sha384" 45: 00 # [7]. subjectPublicKeyAlg=0: RSA 46: 58 80 # [8]. subject public key=modulus=byte[128] 48: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 78: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 108: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 138: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 168: 83F6478DAF4253DB 176: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 177: 58 80 # [10]. signature value=byte[128] 179: 62E00951C6AC6536337911F5568E8FCB79440A0A7A59EA7EEFFC20CD8A85 209: E2111502116A040D14A209602BCD8F635D9B91689429F8B43D35FC79A4B3 239: AE34824D41B56D9472513673F7D13B2F77B81992B205DDFF91088CCDF03E 269: 85A7F07471EFF6549AF07A77BBAE313D1B909DDF2EC94C67E0F20A342CC2 299: 5CFFF87A820CE9DC ]]>

RSASSA-PSS With SHA-512

Self-signed certificate
RSA public key with 1536-bit modulus
Signature algorithm: rsassa-pss-with-sha512

Private Key

X.509 Certificate PEM content (703 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (435 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (435 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 1A # [6]. subject=char[26] 19: 73656C667369676E2D7273617373612D # "selfsign-rsassa-" 35: 7073732D736861353132 # "pss-sha512" 45: 00 # [7]. subjectPublicKeyAlg=0: RSA 46: 58 C0 # [8]. subject public key=modulus=byte[192] 48: B511729186EDC01B2335EC7E46AB1CF3B31FB8D46133CE350588EFD85ED0 78: 876568B7BE006CE3527ABA643A1B0F8FA5EC5402229630442CFCE3050804 108: CB03FA99E5BC3F8D48B3EEA94B420C26F8DEC7B78E8580A79E29AEA0DC9B 138: DC5973F89D9B3DB7E8BBEB0BFD357CE710D9EF39E4AB628B861285DB9093 168: 9F0D2FD01D8E9BC9717CF4C4E42FB17DCC522C42A9FA000B05FFFBA9E24E 198: E64B991C1E01824A9D5AFDC37EA11C81AF2A1FA82BD58940AD7D4DB61F8D 228: C688C48A686C45B1065626D3 240: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 241: 58 C0 # [10]. signature value=byte[192] 243: A2218182F9D326F7A5164835FF9B2D24927A5277D9482AB0A729D4321D66 273: 365D58A0DFADDABB6D6D57FF358CFB090DFDFE12EA0D1FCA209808AAFAD0 303: DC4F24F1ACA12B364B6922B93DD574737BA10B77B1BFF69512C4A35692C0 333: 3565E19EB8F3123A3B07063783A08F9AB93FEDCEAB7C2295F47226D4B6ED 363: 536E71BB7E671DD9D9BCC9BF592353C9BCEFFC0B78BC1615F4C53C6B8EF4 393: 03B606E6D89A3458AA16C786609F353E40F8EB5BACDA815B1BDDA10132BC 423: 8642EBBF6FF5D9AB1A11D272 ]]>

RSASSA-PSS With SHAKE128

Self-signed certificate
Signature algorithm: rsassa-pss-with-shake128

Private Key See .

X.509 Certificate PEM content (469 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (309 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (309 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 1C # [6]. subject=char[28] 19: 73656C667369676E2D7273617373612D # "selfsign-rsassa-" 35: 7073732D7368616B65313238 # "pss-shake128" 47: 00 # [7]. subjectPublicKeyAlg=0: RSA 48: 58 80 # [8]. subject public key=modulus=byte[128] 50: B8092F6F04726A921CFAB2D313AE9D2F01C7CE465FAB7DA62C7A5C73FACE 80: 5FFBA2F1DD80A29ADC43399CFCA22279B89A264810E5B926BB5E0D3F727A 110: 763E16013F89F8FEAC59D0FBDD5E8B0C52827E5490F13B84C3634E89C6D1 140: 731AE5F1A60F88ED118D080E1AB2CAA532D06C2F7D2A0874DEE4E6B6E572 170: 83F6478DAF4253DB 178: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 179: 58 80 # [10]. signature value=byte[128] 181: 06B4F24DEFA5DC3C58E8C0B8E30A03C43A43A42B6EAD06458EE0FFB5EAA4 211: 43204DA030DFD19BCDCA2D5C0B4D6C848B5F9EC444C39CDF4C7263887D92 241: 2AE17D8989A5F2046E6B4D2D9F114BA960DC55DFFFF775F9481F580DAD43 271: A984BAE37A650297C563C9AAA24CBFC3086BBCD6CAEE405E23EDC9104DD1 301: 6F653B47C9EB6B31 ]]>

RSASSA-PSS With SHAKE256

Self-signed certificate
Signature algorithm: rsassa-pss-with-shake256

Private Key See .

X.509 Certificate PEM content (597 bytes): Textual Representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (437 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certificate in . The only differences are the certificate type, the signature value, and the key identifiers.

C509 Type 2 Certificate Plain hex (437 bytes): Annotated hex: 7: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 12: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 17: 78 1C # [6]. subject=char[28] 19: 73656C667369676E2D7273617373612D # "selfsign-rsassa-" 35: 7073732D7368616B65323536 # "pss-shake256" 47: 00 # [7]. subjectPublicKeyAlg=0: RSA 48: 58 C0 # [8]. subject public key=modulus=byte[192] 50: B511729186EDC01B2335EC7E46AB1CF3B31FB8D46133CE350588EFD85ED0 80: 876568B7BE006CE3527ABA643A1B0F8FA5EC5402229630442CFCE3050804 110: CB03FA99E5BC3F8D48B3EEA94B420C26F8DEC7B78E8580A79E29AEA0DC9B 140: DC5973F89D9B3DB7E8BBEB0BFD357CE710D9EF39E4AB628B861285DB9093 170: 9F0D2FD01D8E9BC9717CF4C4E42FB17DCC522C42A9FA000B05FFFBA9E24E 200: E64B991C1E01824A9D5AFDC37EA11C81AF2A1FA82BD58940AD7D4DB61F8D 230: C688C48A686C45B1065626D3 242: 20 # [9]. extensions=-1, KeyUsage, critical: # [digitalSignature] 243: 58 C0 # [10]. signature value=byte[192] 245: 3C5A7DBA06D0918EB0397D881C60312E0668171E2644F9E30E05DC76231A 275: F177C8E1B460A763B31B7B869F2070602BB5749D627A7074973D4D49ADF9 305: A282C506101713DD246B92AD47D2A8A914891538670F8F38F32B4C39A87C 335: 5B4FF1DFBF7F00A6353F199F885EA95172C334B61335A46D9DE493D2A1DB 365: 40B7CF7F39E6297D951CC35D459B911A591EF16511D9470C861320B6559A 395: 138D1F4AE6B4FF8E493A3B9C5150B123FEB2FB84B5FDE60CE4FBC5FA74E4 425: E1B9CCDAA8F2A8D4CF574263 ]]>

Certificates With Different RDN Attributes

One RDN Attribute CommonName With EUI-48

Subject: a single RDN attribute, commonName, containing an EUI-48 value.

See .

One RDN Attribute CommonName With EUI-64

Subject: a single RDN attribute, commonName, containing an EUI-64 value.

See .

One RDN Attribute CommonName With Even Number Of Lowercase Hex Letters

Subject: a single RDN attribute, commonName, containing an even number of lowercase hexadecimal characters.

See .

One RDN Attribute CommonName With Other Text

Subject: a single RDN attribute, commonName, containing text other than an EUI-48 value, an EUI-64 value, or an even number of lowercase hexadecimal characters.

See .

Empty Subject

Subject: empty.

See .

Subject With RDN Attribute Business Category

Subject: includes the RDN attribute businessCategory.

See .

Subject With RDN Attribute Country

Subject: includes the RDN attribute countryName.

See .

Subject With RDN Attribute Directory Management Domain Name

Subject: includes the RDN attribute directoryManagementDomainName.

See .

Subject With RDN Attribute DN Qualifier

Subject: includes the RDN attribute dnQualifier.

See .

Subject With RDN Attribute Domain Component

Subject: includes the RDN attribute domainComponent.

See .

Subject With RDN Attribute Email Address

Subject: includes the RDN attribute emailAddress.

See .

Subject With RDN Attribute Generation Qualifier

Subject: includes the RDN attribute generationQualifier.

See .

Subject With RDN Attribute Given Name

Subject: includes the RDN attribute givenName.

See .

Subject With RDN Attribute Initials

Subject: includes the RDN attribute initials.

See .

Subject With RDN Attribute Jurisdiction Country

Subject: includes the RDN attribute jurisdictionCountryName.

See .

Subject With RDN Attribute Jurisdiction Locality

Subject: includes the RDN attribute jurisdictionLocalityName.

See .

Subject With RDN Attribute Jurisdiction State Or Province

Subject: includes the RDN attribute jurisdictionStateOrProvinceName.

See .

Subject With RDN Attribute Locality

Subject: includes the RDN attribute localityName.

See .

Subject With RDN Attribute Name

Subject: includes the RDN attribute name.

See .

Subject With RDN Attribute Organization

Subject: includes the RDN attribute organizationName.

See .

Subject With RDN Attribute Organizational Unit

Subject: includes the RDN attribute organizationalUnitName.

See .

Subject With RDN Attribute Organization Identifier

Subject: includes the RDN attribute organizationIdentifier.

See .

Subject With RDN Attribute Postal Code

Subject: includes the RDN attribute postalCode.

See .

Subject With RDN Attribute Pseudonym

Subject: includes the RDN attribute pseudonym.

See .

Subject With RDN Attribute Serial Number

Subject: includes the RDN attribute serialNumber.

See .

Subject With RDN Attribute State

Subject: includes the RDN attribute stateOrProvinceName.

See .

Subject With RDN Attribute Street

Subject: includes the RDN attribute street.

See .

Subject With RDN Attribute Surname

Subject: includes the RDN attribute surname.

See .

Subject With RDN Attribute Telephone Number

Subject: includes the RDN attribute telephoneNumber.

See .

Subject With RDN Attribute Title

Subject: includes the RDN attribute title.

See .

Subject With RDN Attribute Unstructured Address

Subject: includes the RDN attribute unstructuredAddress.

See .

Subject With RDN Attribute Unstructured Name

Subject: includes the RDN attribute unstructuredName.

See .

Subject With RDN Attribute User Id

Subject: includes the RDN attribute userId.

See .

Certificates With Different Extensions

Empty Extensions

Extensions: none

Not applicable to certificates; see for examples in certification requests.

One Extension: Non-Critical keyUsage

Extensions: a single non-critical keyUsage extension

See .

One Extension: Critical keyUsage

Extensions: a single critical keyUsage extension

See .

Authority Information Access See .

Authority Key Identifier

With only the keyIdentifier field present See .
With all fields present See .

ASIdentifiers And ASIdentifiers V2

ASIdentifiers set to null
A non-empty array of ASIdOrRange

See .

Basic Constraints

CA = true and pathLenConstraint absent See .
CA = true and pathLenConstraint present See .
CA = false See .

Certificate Policies See .

CRL Distribution Points and Freshest CRL See .

Extended Key Usage

Integer-identified usages See .
~oid-identified usages See .
Integer-identified and ~oid-identified usages See .

Inhibit anyPolicy See .

Issuer Alternative Name See .

IPAddrBlocks and IPAddrBlocks V2

With SAFI = null and IP Address Choice = null
With SAFI = null and IP Address Choice = null See .
IPAddrBlocks with non-null SAFI and IntIPAddressChoice`
IPAddrBlocks V2 with non-null SAFI, IntIPAddressChoice and IPAddressChoice See .

Name Constraints

Only PermittedSubTree See .
Only ExcludedSubTree See .
Both PermittedSubTree and ExcludedSubTree See .

OCSP No Check See .

Policy Constraints

Only RequireExplicitPolicy See .
Only InhibitPolicyMapping See .
Both RequireExplicitPolicy and InhibitPolicyMapping See .

Policy Mappings See .

Subject Alternative Name See .

Subject Directory Attributes See .

Subject Information Access See .

Subject Key Identifier See .

TLS Features See .

X.509 Certificate With Unconvertible RDN Attributes And Extensions

Common Name: text encoded in a string type other than PrintableString or UTF8String.
Subject Public Key Algorithm: an EC public key with an unknown curve OID in the parameters field.
ASIdentifiers: includes the rdi field.
Name Constraints: includes a DirectoryName option encoded as IA5String.

Private Key See .

X.509 Certificate PEM content (387 bytes) Textual Representation: Text representation:

C509 Type 3 Certificate

C509 type 3 certificate converted from the X.509 certificate in .

Plain hex (256 bytes): Annotated hex: 5: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 10: 1A 69570A80 # [5]. notAfter=1767312000: 2026-01-02T00:00:00Z 15: 82 # [6]. subject=array[2], 1 attribute # attribute[0] 16: 43 # type=byte[3]: 17: 550403 # oid: 2.5.4.3 (commonName) 20: 58 19 # value=byte[25] 22: 1617416E20494135537472696E6720436F6D6D6F6E4E616D65 47: 82 # [7]. subjectPublicKeyAlg=array[2] 48: 47 # algorithm=byte[7]: 49: 2A8648CE3D0201 # oid: 1.2.840.10045.2.1 56: 4B # parameters=byte[11] 57: 06092B0601040181FD5905 68: 58 41 # [8]. subject public key=byte[65] 70: 04F413596A87125995B4E0D8B7BEFBC4D6EDB11F61AF08AB32408D4FF9F9 100: 078DDBAB3635AFD496D5656A22EFDC3D59C4482A99836BB358FBF4CA78D3 130: 930436C857 135: 84 # [9]. extensions=array[4] # extension[0] 136: 48 # type=byte[8]: 137: 2B06010505070108 # oid: 1.3.6.1.5.5.7.1.8 # (ASIdentifiers) 145: 46 # value=byte[6] 146: 3004A1020500 # extension[1] 152: 18 1A # type=26: NameConstraints 154: 82 # value=array[2] 155: 82 # permittedSubtrees=array[2] # GeneralName[0] 156: 04 # GeneralNameType=4: directoryName 157: 82 # GeneralNameValue=array[2], 1 # attribute # attribute[0] 158: 43 # type=byte[3]: 159: 550403 # oid: 2.5.4.3 (commonName) 162: 58 19 # value=byte[25] 164: 1617416E20494135537472696E6720436F6D6D6F6E4E61 187: 6D65 189: F6 # excludedSubtrees= 190: 58 40 # [10]. signature value=byte[64] 192: 8A25E8AABBA4B19B8E0D1596A476C2C42F5068F5F3457606806E2F284A22 222: E6E74F787D4E04FE4B62DEDDA880077DC9CB2A5D7A1D8ED62309CD467E61 252: 854DC30A ]]>

Certification Requests With Different Signature Algorithms

ECDSA With SHA256

Signature algorithm: ecdsa-with-sha256
CR attributes: one extensionRequest attribute.

Private Key See .

X.509 Certification Request PEM content (248 bytes): Text representation:

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (159 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request Plain hex (159 bytes): Annotated hex:

ECDSA With SHA384

Signature algorithm: ecdsa-with-sha384
CR attributes: one challengePassword attribute with a PrintableString value.

Private Key See .

X.509 Certification Request PEM content (300 bytes): Text representation:

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (227 bytes): Annotated hex:

C509 Type 2 Certification Request A PrintableString challengePassword value is not supported in a type 2 certification request.

ECDH PoP With SHA-256 And HMAC-SHA256

Signature algorithm: sa-ecdhPop-sha256-hmac-sha256
Signature value: only the hashValue field is present.
CR attributes: one challengePassword attribute with a UTF8String value.

Private Key

X.509 Certification Request

The peer private key and certificate are given in and .

PEM content (206 bytes): Text representation:

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (131 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request

The peer private key and certificate are given in and .

Plain hex (131 bytes): Annotated hex:

ECDH PoP With SHA-384 And HMAC-SHA384

Signature algorithm: sa-ecdhPop-sha384-hmac-sha384
Signature value: all fields are present.
CR attributes: none.

Private Key

X.509 Certification Request

The peer private key and certificate are given in and .

PEM content (261 bytes): Text representation:

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (189 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request

The peer private key and certificate are given in and .

Plain hex (189 bytes): Annotated hex:

ECDH PoP With SHA-512 And HMAC-SHA512

Signature algorithm: sa-ecdhPop-sha512-hmac-sha512
Signature value: only the hashValue field is present.
CR attributes: none.

Private Key

X.509 Certification Request

The peer private key and certificate are given in and .

PEM content (278 bytes): Text representation:

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (218 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request

The peer private key and certificate are given in and .

Plain hex (218 bytes): Annotated hex:

Unsigned PoP With X25519 Key

Signature algorithm: unsigned
CR attributes: a privateKeyPossessionStatement attribute without the cert field.

Private Key

X.509 Certification Request PEM content (135 bytes): Text representation: ]]>

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (63 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request Plain hex (63 bytes): Annotated hex: 62: 40 # [6]. signature value=byte[0] ]]>

Unsigned PoP With X25519 Key And Cert

Signature algorithm: unsigned
CR attributes: a privateKeyPossessionStatement attribute with the cert field.

Private Key

X.509 Certification Request PEM content (433 bytes): Text representation: ]]>

C509 Type 3 Certification Request

C509 type 3 certification request converted from the X.509 certification request in .

Plain hex (227 bytes): Annotated hex:

See the annotated hex for the C509 type 2 certification request in . The only differences are the certification request type and the signature value.

C509 Type 2 Certification Request Plain hex (227 bytes): Annotated hex: 90: 1A 6775D700 # [4]. notBefore=1735776000: # 2025-01-02T00:00:00Z 95: 1A 69570A80 # [5]. notAfter=1767312000: # 2026-01-02T00:00:00Z 100: 77 # [6]. subject=char[23] 101: 73696D706C652D73656C667369676E # "simple-selfsign" 116: 2D65643235353139 # "-ed25519" 124: 0C # [7]. subjectPublicKeyAlg=12: Ed25519 125: 58 20 # [8]. subject public key=EC # point=byte[32] 127: 46270AEC0F32837E128779D30B249C531D6D42C1AC29E40232 152: 8EDC79FAC2BE95 159: 20 # [9]. extensions=-1, KeyUsage, # critical: [digitalSignature] 160: 58 40 # [10]. signature value=byte[64] 162: 25623EF44534BC07269D6071FB3BBBA8F22FF3ED3B65B5C854 187: 56151C0F5F9FC259C2932C1F3184D5088823EBB0B85AE5B7FE 212: 9578D2778F10E088944ACB28CC07 226: 40 # [6]. signature value=byte[0] ]]>

Certification Requests With Different CR Attributes

With Empty CR Attributes

CR attributes: none.

See and .

With challengePassword Attribute

CR attributes: one challengePassword attribute of type UTF8String.

See .

CR attributes: one challengePassword attribute of type PrintableString.

See .

With extensionRequest Attribute

CR attributes: one extensionRequest attribute.

See .

With privateKeyPossessionStatement Attribute

CR attributes: one privateKeyPossessionStatement attribute without the cert field.

See .

CR attributes: one privateKeyPossessionStatement attribute with the cert field.

See .

Certification Request Templates

All Fields Set to "undefined" Where Possible

c509CertificationRequestType: undefined
subjectSignatureAlgorithm: undefined
subject: undefined
subjectPublicKeyAlgorithm: undefined
subjectPublicKey: undefined
extensionsRequest: undefined

Plain hex (7 bytes): Annotated hex: 2: F7 # [2]. subjectSignatureAlgorithm= 3: F7 # [3]. subject= 4: F7 # [4]. subjectPublicKeyAlgorithm= 5: F7 # [5]. subjectPublicKey= 6: F7 # [6]. extensions= ]]>

With One Element in Each Field

c509CertificationRequestType: one element
subjectSignatureAlgorithm: one element
subject: one element
subjectPublicKeyAlgorithm: one element
extensionsRequest: one element

Plain hex (17 bytes): Annotated hex: 10: 81 # [4]. subjectPublicKeyAlgorithm=array[1] 11: 01 # [0]=1: EC public key on curve secp256r1 12: F7 # [5]. subjectPublicKey= 13: 83 # [6]. extensions=array[3] # extension[0] 14: 03 # type=3: SubjectAlternativeName 15: F4 # required 16: F7 # value= ]]>

Complex Template

c509CertificationRequestType: multiple values
subjectSignatureAlgorithm: all choices
subjectPublicKeyAlgorithm: all choices
subject
- choice (int, Defined)
- choice (int, undefined)
- choice (~oid, Defined)
- choice (~oid, undefined)
extensions
- choice (int, Defined)
- choice (int, undefined)
- choice (~oid, Defined)
- choice (~oid, undefined)

Plain hex (152 bytes): Annotated hex: # attribute[1] 35: 04 # type=4: country 36: 01 # minOccurs=1 37: 01 # maxOccurs=1 38: 62 # value=char[2] 39: 4445 # "DE" # attribute[2] 41: 49 # type=byte[9]: 42: 2B0601040181FD590B # oid: 1.3.6.1.4.1.32473.11 51: 01 # minOccurs=1 52: 01 # maxOccurs=1 53: F7 # value= # attribute[3] 54: 49 # type=byte[9]: 55: 2B0601040181FD590C # oid: 1.3.6.1.4.1.32473.12 64: 01 # minOccurs=1 65: 01 # maxOccurs=1 66: 4D # value=byte[13] 67: 0C0B636F6E73742D76616C7565 80: 83 # [4]. subjectPublicKeyAlgorithm=array[3] 81: 01 # [0]=1: EC public key on curve secp256r1 82: 49 # [1]=byte[9]: 83: 2B0601040181FD5909 # oid: 1.3.6.1.4.1.32473.9 92: 82 # [2]=array[2] 93: 49 # algorithm=byte[9]: 94: 2B0601040181FD590A # oid: 1.3.6.1.4.1.32473.10 103: 42 # parameters=byte[2] 104: 0500 106: F7 # [5]. subjectPublicKey= 107: 8C # [6]. extensions=array[12] # extension[0] 108: 08 # type=8: ExtendedKeyUsage 109: F4 # required 110: F7 # value= # extension[1] 111: 02 # type=2: KeyUsage 112: F5 # optional 113: 18 60 # value=96: [keyCertSign, cRLSign] # extension[2] 115: 49 # type=byte[9]: 116: 2B0601040181FD590D # oid: 1.3.6.1.4.1.32473.13 125: F4 # required 126: F7 # value= # extension[3] 127: 49 # type=byte[9]: 128: 2B0601040181FD590E # oid: 1.3.6.1.4.1.32473.14 137: F4 # required 138: 4D # value=byte[13] 139: 0C0B636F6E73742D76616C7565 ]]>

Security Considerations The private keys shown in this document are for example purposes only. They are not secret and MUST NOT be used in deployments. The examples use 1024-bit or 1536-bit RSA keys and reuse key pairs to keep the examples compact. In deployments, key pairs are expected to be generated uniquely and not reused. The examples also use RSA PKCS#1 v1.5 signatures and SHA-1 to cover all signature algorithms defined in . These choices do not reflect current state-of-the-art security recommendations; at the time of writing, RSA keys of at least 3072 bits, stronger hash functions, and RSA-PSS are required for adequate security.

Privacy Considerations There are no privacy considerations.

IANA Considerations There are no IANA considerations.