summaryrefslogtreecommitdiff
path: root/tests/keys
diff options
context:
space:
mode:
Diffstat (limited to 'tests/keys')
-rw-r--r--tests/keys/README31
-rw-r--r--tests/keys/demoCA/index.txt1
-rw-r--r--tests/keys/demoCA/index.txt.old1
-rw-r--r--tests/keys/demoCA/newcerts/AFA28BB933ADDAB5.pem60
-rw-r--r--tests/keys/demoCA/serial2
-rw-r--r--tests/keys/demoCA/serial.old2
-rw-r--r--tests/keys/dsa2048key-win.p12bin0 -> 4998 bytes
-rw-r--r--tests/keys/dsa3072key-win.p12bin0 -> 5638 bytes
-rw-r--r--tests/keys/ecdsa-secp256r1-cert.derbin0 -> 899 bytes
-rw-r--r--tests/keys/ecdsa-secp256r1-cert.pem60
-rw-r--r--tests/keys/ecdsa-secp256r1-key.derbin0 -> 121 bytes
-rw-r--r--tests/keys/ecdsa-secp256r1-key.p12bin0 -> 3621 bytes
-rw-r--r--tests/keys/ecdsa-secp256r1-key.p8-derbin0 -> 179 bytes
-rw-r--r--tests/keys/ecdsa-secp256r1-key.pem5
-rw-r--r--tests/keys/enveloped-ecdsa-java-bug-cert.derbin0 -> 642 bytes
-rw-r--r--tests/keys/enveloped-ecdsa-java-bug-cert.pem16
-rw-r--r--tests/keys/merlincert.derbin0 -> 848 bytes
17 files changed, 165 insertions, 13 deletions
diff --git a/tests/keys/README b/tests/keys/README
index 7a5a5684..6b4bbecc 100644
--- a/tests/keys/README
+++ b/tests/keys/README
@@ -81,12 +81,13 @@ README
G. Generate ECDSA key with second level CA
> openssl ecparam -list_curves
- > openssl ecparam -name secp256k1 -genkey -noout -out ecdsa-secp256k1-key.pem
- > openssl req -config ./openssl.cnf -new -key ecdsa-secp256k1-key.pem -out ecdsa-secp256k1-req.pem
+ > openssl ecparam -name secp256r1 -genkey -noout -out ecdsa-secp256r1-key.pem
+ Here use 'ECDSA secp256r1 Key' for Common Name:
+ > openssl req -config ./openssl.cnf -new -key ecdsa-secp256r1-key.pem -out ecdsa-secp256r1-req.pem
> openssl ca -config ./openssl.cnf -cert ca2cert.pem -keyfile ca2key.pem \
- -out ecdsa-secp256k1-cert.pem -infiles ecdsa-secp256k1-req.pem
- > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem ecdsa-secp256k1-cert.pem
- > rm ecdsa-secp256k1-req.pem
+ -out ecdsa-secp256r1-cert.pem -infiles ecdsa-secp256r1-req.pem
+ > openssl verify -CAfile cacert.pem -untrusted ca2cert.pem ecdsa-secp256r1-cert.pem
+ > rm ecdsa-secp256r1-req.pem
3. Converting key and certs between PEM and DER formats
@@ -101,7 +102,7 @@ README
> openssl dsa -inform PEM -outform DER -in dsa3072key.pem -out dsa3072key.der
ECDSA keys:
- > openssl ec -inform PEM -outform DER -in ecdsa-secp256k1-key.pem -out ecdsa-secp256k1-key.der
+ > openssl ec -inform PEM -outform DER -in ecdsa-secp256r1-key.pem -out ecdsa-secp256r1-key.der
- Convert PEM cert file to DER file
> openssl x509 -outform DER -in cacert.pem -out cacert.der
@@ -112,7 +113,7 @@ README
> openssl x509 -outform DER -in rsacert.pem -out rsacert.der
> openssl x509 -outform DER -in largersacert.pem -out largersacert.der
> openssl x509 -outform DER -in expiredcert.pem -out expiredcert.der
- > openssl x509 -outform DER -in ecdsa-secp256k1-cert.pem -out ecdsa-secp256k1-cert.der
+ > openssl x509 -outform DER -in ecdsa-secp256r1-cert.pem -out ecdsa-secp256r1-cert.der
- (optional) Convert PEM public key file to DER file
RSA key:
@@ -141,7 +142,7 @@ README
-outform pem -topk8
> openssl pkcs8 -in largersakey.der -inform der -out largersakey.p8-der \
-outform der -topk8
- > openssl pkcs8 -in ecdsa-secp256k1-key.der -inform der -out ecdsa-secp256k1-key.p8-der \
+ > openssl pkcs8 -in ecdsa-secp256r1-key.der -inform der -out ecdsa-secp256r1-key.p8-der \
-outform der -topk8
5. NSS is unfriendly towards standalone private keys.
@@ -167,9 +168,9 @@ README
> openssl pkcs12 -export -in allexpired.pem -name TestExpiredRsaKey \
-out expiredkey.p12
- > cat ecdsa-secp256k1-key.pem ecdsa-secp256k1-cert.pem ca2cert.pem cacert.pem > all-ecdsa-secp256k1.pem
- > openssl pkcs12 -export -in all-ecdsa-secp256k1.pem -name TestEcdsaSecp256k1Key -out ecdsa-secp256k1-key.p12
- > rm all-ecdsa-secp256k1.pem
+ > cat ecdsa-secp256r1-key.pem ecdsa-secp256r1-cert.pem ca2cert.pem cacert.pem > all-ecdsa-secp256r1.pem
+ > openssl pkcs12 -export -in all-ecdsa-secp256r1.pem -name TestEcdsaSecp256k1Key -out ecdsa-secp256r1-key.p12
+ > rm all-ecdsa-secp256r1.pem
5a.
Input: DSA/RSA private key in PEM or DER format
@@ -247,3 +248,11 @@ Worse, the CSP is different for XP and older versions
> openssl pkcs12 -export -in alllargersa.pem -name TestLargeRsaKey -out largersakey-winxp.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)"
> openssl pkcs12 -export -in alllargersa.pem -name TestLargeRsaKey -out largersakey-win.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
+ > cat dsa2048key.pem dsa2048cert.pem ca2cert.pem cacert.pem > alldsa2048.pem
+ > openssl pkcs12 -export -in alldsa2048.pem -name TestDsa2048Key -out dsa2048key-win.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
+
+ > cat dsa3072key.pem dsa3072cert.pem ca2cert.pem cacert.pem > alldsa3072.pem
+ > openssl pkcs12 -export -in alldsa3072.pem -name TestDsa3072Key -out dsa3072key-win.p12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
+
+
+
diff --git a/tests/keys/demoCA/index.txt b/tests/keys/demoCA/index.txt
index 1b8c10fb..1bef0651 100644
--- a/tests/keys/demoCA/index.txt
+++ b/tests/keys/demoCA/index.txt
@@ -7,3 +7,4 @@ V 140524175816Z AFA28BB933ADDAB1 unknown /C=US/ST=California/O=XML Security Lib
V 21150209225409Z AFA28BB933ADDAB2 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Test Third Level DSA 2048 Certificate/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
V 21150209225453Z AFA28BB933ADDAB3 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Test Third Level DSA 3072 Certificate/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
V 21160105172612Z AFA28BB933ADDAB4 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/CN=ECDSA secp256k1 Key/emailAddress=xmlsec@aleksey.com
+V 21170122220821Z AFA28BB933ADDAB5 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/CN=ECDSA secp256r1 Key/emailAddress=xmlsec@aleksey.com
diff --git a/tests/keys/demoCA/index.txt.old b/tests/keys/demoCA/index.txt.old
index c8270ea2..1b8c10fb 100644
--- a/tests/keys/demoCA/index.txt.old
+++ b/tests/keys/demoCA/index.txt.old
@@ -6,3 +6,4 @@ V 21140429175706Z AFA28BB933ADDAB0 unknown /C=US/ST=California/O=XML Security L
V 140524175816Z AFA28BB933ADDAB1 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Test Expired RSA Certificate/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
V 21150209225409Z AFA28BB933ADDAB2 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Test Third Level DSA 2048 Certificate/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
V 21150209225453Z AFA28BB933ADDAB3 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Test Third Level DSA 3072 Certificate/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
+V 21160105172612Z AFA28BB933ADDAB4 unknown /C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/CN=ECDSA secp256k1 Key/emailAddress=xmlsec@aleksey.com
diff --git a/tests/keys/demoCA/newcerts/AFA28BB933ADDAB5.pem b/tests/keys/demoCA/newcerts/AFA28BB933ADDAB5.pem
new file mode 100644
index 00000000..3404e672
--- /dev/null
+++ b/tests/keys/demoCA/newcerts/AFA28BB933ADDAB5.pem
@@ -0,0 +1,60 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number:
+ af:a2:8b:b9:33:ad:da:b5
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=California, O=XML Security Library (http://www.aleksey.com/xmlsec), CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
+ Validity
+ Not Before: Feb 15 22:08:21 2017 GMT
+ Not After : Jan 22 22:08:21 2117 GMT
+ Subject: C=US, ST=California, O=XML Security Library (http://www.aleksey.com/xmlsec), CN=ECDSA secp256r1 Key/emailAddress=xmlsec@aleksey.com
+ Subject Public Key Info:
+ Public Key Algorithm: id-ecPublicKey
+ Public-Key: (256 bit)
+ pub:
+ 04:6d:2e:ce:aa:75:98:77:d1:f7:31:0c:b1:88:88:
+ 5e:43:4f:b6:d6:72:8f:46:8f:f2:21:3d:c2:52:8d:
+ a7:dc:7b:de:42:67:36:69:65:f2:5e:3b:31:90:d6:
+ 56:3b:6b:73:21:67:d5:75:33:c4:7e:ea:59:52:58:
+ 8c:f0:46:a6:d4
+ ASN1 OID: prime256v1
+ NIST CURVE: P-256
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:TRUE
+ Netscape Comment:
+ OpenSSL Generated Certificate
+ X509v3 Subject Key Identifier:
+ 7A:2C:3C:AF:7F:B0:88:7C:34:E5:3F:B7:A9:18:63:7E:10:19:BB:D9
+ X509v3 Authority Key Identifier:
+ keyid:FE:E4:EC:53:24:F0:95:95:C7:10:B5:E1:44:B5:5D:39:65:5A:E3:7E
+ DirName:/C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Root CA/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
+ serial:AF:A2:8B:B9:33:AD:DA:AD
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 1b:38:21:ee:bd:d4:14:77:d0:a8:bd:30:ce:63:cc:68:56:96:
+ 75:ac:f1:26:86:26:40:25:27:17:24:86:15:66:bd:5f:f9:72:
+ 7b:4b:be:e4:0d:18:fa:59:26:d9:18:f1:c5:48:c3:6f:c6:e1:
+ 79:81:05:a7:7b:95:97:2e:39:a8
+-----BEGIN CERTIFICATE-----
+MIIDfzCCAymgAwIBAgIJAK+ii7kzrdq1MA0GCSqGSIb3DQEBBQUAMIGcMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTE9MDsGA1UEChM0WE1MIFNlY3Vy
+aXR5IExpYnJhcnkgKGh0dHA6Ly93d3cuYWxla3NleS5jb20veG1sc2VjKTEWMBQG
+A1UEAxMNQWxla3NleSBTYW5pbjEhMB8GCSqGSIb3DQEJARYSeG1sc2VjQGFsZWtz
+ZXkuY29tMCAXDTE3MDIxNTIyMDgyMVoYDzIxMTcwMTIyMjIwODIxWjCBojELMAkG
+A1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExPTA7BgNVBAoTNFhNTCBTZWN1
+cml0eSBMaWJyYXJ5IChodHRwOi8vd3d3LmFsZWtzZXkuY29tL3htbHNlYykxHDAa
+BgNVBAMTE0VDRFNBIHNlY3AyNTZyMSBLZXkxITAfBgkqhkiG9w0BCQEWEnhtbHNl
+Y0BhbGVrc2V5LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABG0uzqp1mHfR
+9zEMsYiIXkNPttZyj0aP8iE9wlKNp9x73kJnNmll8l47MZDWVjtrcyFn1XUzxH7q
+WVJYjPBGptSjggFFMIIBQTAMBgNVHRMEBTADAQH/MCwGCWCGSAGG+EIBDQQfFh1P
+cGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUeiw8r3+wiHw0
+5T+3qRhjfhAZu9kwgeMGA1UdIwSB2zCB2IAU/uTsUyTwlZXHELXhRLVdOWVa436h
+gbSkgbEwga4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMT0wOwYD
+VQQKEzRYTUwgU2VjdXJpdHkgTGlicmFyeSAoaHR0cDovL3d3dy5hbGVrc2V5LmNv
+bS94bWxzZWMpMRAwDgYDVQQLEwdSb290IENBMRYwFAYDVQQDEw1BbGVrc2V5IFNh
+bmluMSEwHwYJKoZIhvcNAQkBFhJ4bWxzZWNAYWxla3NleS5jb22CCQCvoou5M63a
+rTANBgkqhkiG9w0BAQUFAANBABs4Ie691BR30Ki9MM5jzGhWlnWs8SaGJkAlJxck
+hhVmvV/5cntLvuQNGPpZJtkY8cVIw2/G4XmBBad7lZcuOag=
+-----END CERTIFICATE-----
diff --git a/tests/keys/demoCA/serial b/tests/keys/demoCA/serial
index f10ea957..ee29801f 100644
--- a/tests/keys/demoCA/serial
+++ b/tests/keys/demoCA/serial
@@ -1 +1 @@
-AFA28BB933ADDAB5
+AFA28BB933ADDAB6
diff --git a/tests/keys/demoCA/serial.old b/tests/keys/demoCA/serial.old
index adf3394d..f10ea957 100644
--- a/tests/keys/demoCA/serial.old
+++ b/tests/keys/demoCA/serial.old
@@ -1 +1 @@
-AFA28BB933ADDAB4
+AFA28BB933ADDAB5
diff --git a/tests/keys/dsa2048key-win.p12 b/tests/keys/dsa2048key-win.p12
new file mode 100644
index 00000000..374a13e0
--- /dev/null
+++ b/tests/keys/dsa2048key-win.p12
Binary files differ
diff --git a/tests/keys/dsa3072key-win.p12 b/tests/keys/dsa3072key-win.p12
new file mode 100644
index 00000000..36071ecc
--- /dev/null
+++ b/tests/keys/dsa3072key-win.p12
Binary files differ
diff --git a/tests/keys/ecdsa-secp256r1-cert.der b/tests/keys/ecdsa-secp256r1-cert.der
new file mode 100644
index 00000000..c2f99e4f
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-cert.der
Binary files differ
diff --git a/tests/keys/ecdsa-secp256r1-cert.pem b/tests/keys/ecdsa-secp256r1-cert.pem
new file mode 100644
index 00000000..3404e672
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-cert.pem
@@ -0,0 +1,60 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number:
+ af:a2:8b:b9:33:ad:da:b5
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=California, O=XML Security Library (http://www.aleksey.com/xmlsec), CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
+ Validity
+ Not Before: Feb 15 22:08:21 2017 GMT
+ Not After : Jan 22 22:08:21 2117 GMT
+ Subject: C=US, ST=California, O=XML Security Library (http://www.aleksey.com/xmlsec), CN=ECDSA secp256r1 Key/emailAddress=xmlsec@aleksey.com
+ Subject Public Key Info:
+ Public Key Algorithm: id-ecPublicKey
+ Public-Key: (256 bit)
+ pub:
+ 04:6d:2e:ce:aa:75:98:77:d1:f7:31:0c:b1:88:88:
+ 5e:43:4f:b6:d6:72:8f:46:8f:f2:21:3d:c2:52:8d:
+ a7:dc:7b:de:42:67:36:69:65:f2:5e:3b:31:90:d6:
+ 56:3b:6b:73:21:67:d5:75:33:c4:7e:ea:59:52:58:
+ 8c:f0:46:a6:d4
+ ASN1 OID: prime256v1
+ NIST CURVE: P-256
+ X509v3 extensions:
+ X509v3 Basic Constraints:
+ CA:TRUE
+ Netscape Comment:
+ OpenSSL Generated Certificate
+ X509v3 Subject Key Identifier:
+ 7A:2C:3C:AF:7F:B0:88:7C:34:E5:3F:B7:A9:18:63:7E:10:19:BB:D9
+ X509v3 Authority Key Identifier:
+ keyid:FE:E4:EC:53:24:F0:95:95:C7:10:B5:E1:44:B5:5D:39:65:5A:E3:7E
+ DirName:/C=US/ST=California/O=XML Security Library (http://www.aleksey.com/xmlsec)/OU=Root CA/CN=Aleksey Sanin/emailAddress=xmlsec@aleksey.com
+ serial:AF:A2:8B:B9:33:AD:DA:AD
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 1b:38:21:ee:bd:d4:14:77:d0:a8:bd:30:ce:63:cc:68:56:96:
+ 75:ac:f1:26:86:26:40:25:27:17:24:86:15:66:bd:5f:f9:72:
+ 7b:4b:be:e4:0d:18:fa:59:26:d9:18:f1:c5:48:c3:6f:c6:e1:
+ 79:81:05:a7:7b:95:97:2e:39:a8
+-----BEGIN CERTIFICATE-----
+MIIDfzCCAymgAwIBAgIJAK+ii7kzrdq1MA0GCSqGSIb3DQEBBQUAMIGcMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTE9MDsGA1UEChM0WE1MIFNlY3Vy
+aXR5IExpYnJhcnkgKGh0dHA6Ly93d3cuYWxla3NleS5jb20veG1sc2VjKTEWMBQG
+A1UEAxMNQWxla3NleSBTYW5pbjEhMB8GCSqGSIb3DQEJARYSeG1sc2VjQGFsZWtz
+ZXkuY29tMCAXDTE3MDIxNTIyMDgyMVoYDzIxMTcwMTIyMjIwODIxWjCBojELMAkG
+A1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExPTA7BgNVBAoTNFhNTCBTZWN1
+cml0eSBMaWJyYXJ5IChodHRwOi8vd3d3LmFsZWtzZXkuY29tL3htbHNlYykxHDAa
+BgNVBAMTE0VDRFNBIHNlY3AyNTZyMSBLZXkxITAfBgkqhkiG9w0BCQEWEnhtbHNl
+Y0BhbGVrc2V5LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABG0uzqp1mHfR
+9zEMsYiIXkNPttZyj0aP8iE9wlKNp9x73kJnNmll8l47MZDWVjtrcyFn1XUzxH7q
+WVJYjPBGptSjggFFMIIBQTAMBgNVHRMEBTADAQH/MCwGCWCGSAGG+EIBDQQfFh1P
+cGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUeiw8r3+wiHw0
+5T+3qRhjfhAZu9kwgeMGA1UdIwSB2zCB2IAU/uTsUyTwlZXHELXhRLVdOWVa436h
+gbSkgbEwga4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMT0wOwYD
+VQQKEzRYTUwgU2VjdXJpdHkgTGlicmFyeSAoaHR0cDovL3d3dy5hbGVrc2V5LmNv
+bS94bWxzZWMpMRAwDgYDVQQLEwdSb290IENBMRYwFAYDVQQDEw1BbGVrc2V5IFNh
+bmluMSEwHwYJKoZIhvcNAQkBFhJ4bWxzZWNAYWxla3NleS5jb22CCQCvoou5M63a
+rTANBgkqhkiG9w0BAQUFAANBABs4Ie691BR30Ki9MM5jzGhWlnWs8SaGJkAlJxck
+hhVmvV/5cntLvuQNGPpZJtkY8cVIw2/G4XmBBad7lZcuOag=
+-----END CERTIFICATE-----
diff --git a/tests/keys/ecdsa-secp256r1-key.der b/tests/keys/ecdsa-secp256r1-key.der
new file mode 100644
index 00000000..a26a34c3
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-key.der
Binary files differ
diff --git a/tests/keys/ecdsa-secp256r1-key.p12 b/tests/keys/ecdsa-secp256r1-key.p12
new file mode 100644
index 00000000..b81eba3a
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-key.p12
Binary files differ
diff --git a/tests/keys/ecdsa-secp256r1-key.p8-der b/tests/keys/ecdsa-secp256r1-key.p8-der
new file mode 100644
index 00000000..44c8eb5e
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-key.p8-der
Binary files differ
diff --git a/tests/keys/ecdsa-secp256r1-key.pem b/tests/keys/ecdsa-secp256r1-key.pem
new file mode 100644
index 00000000..e5e864ff
--- /dev/null
+++ b/tests/keys/ecdsa-secp256r1-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEID5bCaVHTwFNu+anJe0XrGEg+ExsbUIlyub3bPWh5BcMoAoGCCqGSM49
+AwEHoUQDQgAEbS7OqnWYd9H3MQyxiIheQ0+21nKPRo/yIT3CUo2n3HveQmc2aWXy
+XjsxkNZWO2tzIWfVdTPEfupZUliM8Eam1A==
+-----END EC PRIVATE KEY-----
diff --git a/tests/keys/enveloped-ecdsa-java-bug-cert.der b/tests/keys/enveloped-ecdsa-java-bug-cert.der
new file mode 100644
index 00000000..27befe6f
--- /dev/null
+++ b/tests/keys/enveloped-ecdsa-java-bug-cert.der
Binary files differ
diff --git a/tests/keys/enveloped-ecdsa-java-bug-cert.pem b/tests/keys/enveloped-ecdsa-java-bug-cert.pem
new file mode 100644
index 00000000..9e9b4330
--- /dev/null
+++ b/tests/keys/enveloped-ecdsa-java-bug-cert.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICfjCCAd+gAwIBAgIJAP1+F7krF+SAMAoGCCqGSM49BAMEMFYxCzAJBgNVBAYT
+AkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
+aXRzIFB0eSBMdGQxDzANBgNVBAMMBnRlc3RDQTAeFw0xODEwMTIxNDU2MjNaFw0y
+MTA4MDExNDU2MjNaMFYxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRl
+MSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxDzANBgNVBAMMBnRl
+c3RDQTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAfAiTmdR/hzwGEkmWH0b8aQS
+VaKm5hNni8aksuGjAboVttvArn/mnBdktrl0H91MqTuHmx984RhCICNBqfI7ZO4k
+AVhMf6TbYUY/aUlrJ9xR3SkFQlMlYAY9bxB/rNpIc1ekEr5444+jlARGtusIvDDV
+Dl2h9MXHqNggYSdUROvuXfnIo1MwUTAdBgNVHQ4EFgQUKkgkI/02fv+9G1PD/afM
+VJ29xaEwHwYDVR0jBBgwFoAUKkgkI/02fv+9G1PD/afMVJ29xaEwDwYDVR0TAQH/
+BAUwAwEB/zAKBggqhkjOPQQDBAOBjAAwgYgCQgD6de1JRP+F/sifVtD0ksElwdJk
+5oJYnVC+6L4dIWLhRUHzPclgUxWcPqIWhBsraJIdWTey2/c1B1jwgN/yDe7CbAJC
+AKYAKS/Cl2PNFc3wv9nfn1bymZn1gzHmmELlhIJAbJ+4mg18RD9/RYvodxQiwXjm
+56qbo9H0/EYrHQe0wSf1Qqe6
+-----END CERTIFICATE-----
diff --git a/tests/keys/merlincert.der b/tests/keys/merlincert.der
new file mode 100644
index 00000000..b1f5d146
--- /dev/null
+++ b/tests/keys/merlincert.der
Binary files differ
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 13:58:12 +0000