SAMPLE RSA Private Key: PKCS#1, Encrypted (DEK-Info)
The legacy encrypted-key layout: PKCS#1 body plus `Proc-Type: 4,ENCRYPTED` and `DEK-Info` PEM headers carrying the cipher and IV, password `novus-p7-sample-pkcs1`. Parsers that strip PEM headers before decoding silently lose the IV and fail here.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,D0018AC3F986715FF8DE788EA4F88581
CiO7dbG7S9lOU4kyOhfI0pnSivEcwylD5z2tOo7izluPJCj44hUOwfL0QWA+ItfT
smSNpcQzgyNLAVhY3eAvYPCFqo3iXbRSN28D5ryr4JsNYHLdua5GQ69d9wEDP1Xs
6y7jepAAzeZlzGNHi5To5JBZKJO0MVPCM99XLKYcYFElgrAVCKZIEfF8JIycTIUI
ucSnAp00cY2nbEI2QxOpDWBE+g0+gBPStY4h9urxAJNDx4Ol737d30sCupvJ11v/
zqQJ6WxRqEtJSC/0FgmYfpVRwvyL6j4ymZr/q0F4iGVN4zVqyZrEwidklPkL8Ee3
DzMFjesQdCTvG0fiHpDrWh87mE7HjoRIFvb1eAvCUGB2mXi23II835nuuBz4StIF
NuDUh21ui+FVO6w/Gc2geNUID5Z3rBBSwg88oBr5up8ph41qrdHOCRzTZnFejtxt
Brp5JnVugSN40/NPTXOJlJiHNT0ClR5HXW4sa222jo7lcUWGVsKdnp/WGSYIE5dj
rSxAsEOyqPE0UpXLuM3E0zJB5y46x9XOpfMFjbxfgkfIrR8kDLd5F32YT3Z8UBeF
6NOgtFNx2iPA3JxbUS17Fzt0uxPNOFpYOjxol2j9Qfezha2WiT/TBb2b5JQRs62t
YTSENVV+9PwHrUBoKBb+VfgDBOKFEquiNdpNK6QgAqfLUd+HRbygkjwFUyVckVdy
GQN7MzqbMiNo5cceMfUZi4Lt//5B2ryjH1U4XB1mhzY2njF/ddhkHBFjEnF01lSK
4p0xTpPTCVaqt0wbbZ2cuu32YPDetJvwR8gQQyzEOGJvFbycIro5dxeXkHHidXIO
p6zwuuS4Q11px4jwe4ulhjNBJEt0JzuzZQqo78rAJ7BcASti7aBVzz/xdcTx9bvM
HUepPDC8Id25usyO+Sh9LYF+3K5xOaA1si9bM3aoZzKV5qzQE35HAKqnz4kBs6QY
Jvmm5IVvnmuiMzDlTh2EiflkWZtKJ1L/3qhsXCf7PpbAdlgLTVnQy44ZwVpAWhtc
6D7t/stIsptQCjeWNxxqxLpBT3UvEz+TJ3M7fAyESJVSScUENnack59fAXBuLG8t
QYXL8FekdNunZ02a7xzrqy6xL8dQP8twZTqW8RTByNycHL6G/uzKNXc89qm4GY6e
f++jWX/5ixHEZo9ojPCUHtO+5XFw70R1XKuJN51EO9Ck9aH1okXgiqyBgUeUy1SZ
AC+zPVtkE4RzUa2wCiAZm3FVJjjCt/jdOT0k8TJLSfd/Z/v7HKc+Y09cBjki0U9b
vikWiDkBtmytBrAc99dN9/vhtYDeqkhmGfo6Kj0/yl4gj4dxD1xNwDjvsoik89hc
ztGqVBdIVXXegTqBzB41OxWe9+O/agmho3nuR/NTWE1GcfZ5IuLxS+hbE54vn1qf
0Qw+Hv0N8HCg4QVGy+hHKGHUUx0Y7q427uPJ+VK3nn5BXWT0K/2wlhX2JQUAVBiK
2pNe3EnzzBu8U93Ot//vNybvtd2mr4MwXddcbUDuv5OFLKS0X5Cyhi7WedInG6w5
CU24Lt+9PQ/6V4rvV566iBmPZStfPmKlC0lbVTmpu7BEqrlNsRrLaEkvnQS5qgVm
-----END RSA PRIVATE KEY-----
Specifications
- Algorithm
- RSA
- Bits
- 2048
- Container
- PKCS#1 with PEM encryption headers
- Headers
- Proc-Type: 4,ENCRYPTED and DEK-Info
- Password
- novus-p7-sample-pkcs1
- Encrypted
- true
- Pinned
- the DEK-Info IV is per-run random, so these bytes are pinned in the generator
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to pass- Scenario
- Load the key with password `novus-p7-sample-pkcs1` in the library under test.
- Expected result
- The Proc-Type/DEK-Info headers are honoured and the decrypted key matches the plain PKCS#1 twin.
What is a .key file?
A .key file holds a private key, usually PEM-encoded in PKCS#8 (BEGIN PRIVATE KEY) or a key-type-specific format. It is the secret half of a TLS or SSH identity and must normally be protected. The examples here are published, sample-only keys that must never be used in production.
How to use this file
Use an example .key to test PEM key parsers, PKCS#8 decoders, and key-format converters (for example PEM to DER or OpenSSH). These are deliberately published sample keys, for parser testing only, never for real use.
How to use this file for testing
“SAMPLE RSA Private Key: PKCS#1, Encrypted (DEK-Info)” is a deterministic Testaroo fixture for Certificate & key testing, Error handling. Self-signed X.509 certificates (PEM, CRT, DER), a CSR, RSA and Ed25519 keys, an SSH public key, a PKCS#12 bundle, and an htpasswd file, all published sample-only material, for testing certificate parsers, TLS tooling, keystore importers, and PEM/DER decoders.
Documented properties for this file: seed 70117 · RSA. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material, never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
This is a published, sample-only certificate/key. Parse it, verify the chain or signature, and test PEM↔DER conversion, never deploy it anywhere real.
Generated by generation/security_p7.py. Free for any use, no attribution required, license.
Related files
- pemSAMPLE Certificate Revocation List: EmptyA correctly signed CRL with an absent revokedCertificates field: what a CA publishes when it has revoked nothing. Parsers that assume the list is always present tend to fault here rather than report zero entries.
- pemSAMPLE Certificate Revocation List: StaleA validly signed CRL whose nextUpdate passed in 2020. Whether a client hard-fails, soft-fails, or silently trusts stale revocation data is a real policy decision, and this is the fixture that reveals which one it made.
- csrSAMPLE CSR: Intentionally Corrupt Base64An intentionally corrupt PKCS#10 request: the PEM armour is intact but four illegal characters have been substituted into the Base64 body, so decoding fails part-way. It exists to check that a CSR intake path reports a parse error instead of a stack trace or a partially populated record.
- pemSAMPLE Leaf Certificate: ExpiredA correctly signed leaf whose notAfter fell in the past (2020). The only thing wrong with it is the clock, which makes it the clean way to assert that an expiry error is reported as expiry and not as a signature failure.
- pemSAMPLE Leaf Certificate: No SAN ExtensionA pre-RFC 6125-style certificate carrying only a Common Name and no subjectAltName extension. Every current browser and most TLS libraries reject it outright, which makes it a precise legacy-compatibility probe.
- pemSAMPLE Leaf Certificate: Not Yet ValidThe mirror of the expired leaf: identical in every respect except that notBefore is 2035, so it is rejected from the other side of the validity window. Pairs with it to prove a verifier distinguishes the two clock errors.
