Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't want the certificate revocation lists. I want actual full on revoked certificates for test purposes.

For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and got rogue certs for them from Verisign. I think it'd be interesting to have both of these certs.

Like one thing I'm curious about: was the CRLDistribituionPoint extension present in them? I'm curious about other things too but if someone has them that'd be great. Thanks!

share|improve this question
What are you trying to test? You can probably set up your own CA and test the scenarios yourself. – LamonteCristo Nov 10 '12 at 17:09
up vote 2 down vote accepted

You could just use a MD5 rogue certificate (directly to the demo page). Also see the research paper.

I also found a research on the rogue certificates from March 2011.

Maybe searching the Internet for those black-listed rogue certificates' serial number will help:


These serial numbers are from the Microsoft certificate store after applying the relevant updates.

I did some searching, but all i found was the link 4 I already mentioned above.

share|improve this answer

I was able to obtain revoked certificates for testing by opening the Certificates Snapin in Microsoft Management Console and looking in the Untrusted Certificates store. There you will see a large number of revoked certificates. Right click and export to get them into a file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.