PkiFuzzer

Overview

PkiFuzzer is a PKI test vector generation tool for creating configurable X.509 certificates, PKCS#10 CSRs, malformed key material, and certificate-profile-based artifacts.

The project is intended for PKI development, interoperability testing, certificate parser validation, negative testing, certificate linting validation, CA/RA workflow testing, and experimentation with unusual or intentionally non-standard certificate structures.

PkiFuzzer is useful when standard certificate generation tools are too restrictive and the tester needs control over details such as subject field ordering, custom subject OIDs, explicit subject string encodings, unusual serial numbers, validity boundaries, custom or malformed X.509 extensions, rare GeneralName forms, Certificate Transparency structures, profile-driven generation, malformed key encodings, and classical or post-quantum key families.

PkiFuzzer is intended for development, testing, research, and interoperability validation. It is not intended to be used as a production Certification Authority.

---

Main Features

Certificate and CSR generation

• X.509 certificate generation.
• PKCS#10 CSR generation.
• Self-signed certificate generation.
• CA-signed certificate generation.
• Dummy issuer mode.
• Uploaded CA PKCS#12 issuer mode.
• Downloadable artifact archives.

Profile-based generation

• Built-in standard profiles.
• JSON-based profile definitions.
• Profile storage on disk.
• Custom profile loading.
• Profile compliance level metadata.
• Profile materialization into generation requests.

Manual custom generation

• Key type selection.
• Key parameter configuration.
• Subject configuration.
• Validity configuration.
• Serial number configuration.
• Output mode selection.
• Issuer configuration.
• X.509 extension configuration.
• Malformed key options.

Negative testing

• Unusual certificate structures.
• Non-standard extension combinations.
• Malformed extension values where supported.
• Malformed key encodings.
• Edge-case serial numbers.
• Empty or unusual subject structures.
• Certificate Transparency edge cases.

---

Architecture

PkiFuzzer separates PKI generation logic from the web interface.

PkiFuzzer.Core
  Constants
  Generators
  Interfaces
  Models
  Services
  Utilities

PkiFuzzer.Web
  Blazor and MudBlazor UI
  Application configuration
  Profile storage
  Dialog services
  Reverse proxy path configuration

PkiFuzzer.Web.Client
  Client-side Blazor components

The core layer contains the reusable PKI generation pipeline. The web layer provides the interactive UI used to configure and generate artifacts.

---

Generation Flow

User input or profile JSON
  |
  v
CertificateBuildRequest
  |
  v
Key material generation
  |
  v
Subject generation
  |
  v
Extension building
  |
  v
Certificate or CSR generation
  |
  v
Artifact export

This model keeps generation logic modular and makes the project easier to extend with new key types, new X.509 extensions, new profile formats, and future automation surfaces such as a REST API or CLI.

---

Certificate Profiles

PkiFuzzer supports profile-driven certificate generation.

Profiles are represented as JSON definitions and can be loaded from the configured profile storage directory.

Example storage configuration:

{
  "Profiles": {
    "StorageDirectory": "data/profiles"
  }
}

A profile may define:

• profile code;
• display name;
• description;
• compliance level;
• subject;
• key options;
• validity;
• extensions.

Supported compliance levels:

Draft
StructurallyComplete
RfcAligned
CabForumAligned
ComplianceReviewed
Experimental

Profile support is intended to make repeatable generation easier, especially for standard CA, subordinate CA, TLS, experimental, and negative testing scenarios.

---

Key Types

PkiFuzzer uses a key abstraction model where each key family can define its own generation parameters, supported signature algorithms, and output restrictions.

Key family	Purpose
RSA	Classical PKI testing and compatibility validation
EC	ECC certificate testing, named curve testing, and ECDSA workflows
ML-DSA	Post-quantum signature experimentation
SLH-DSA	Hash-based post-quantum signature experimentation
ML-KEM	KEM material generation and special workflow testing

Some key types may not support all output modes. For example, KEM algorithms are not signing algorithms, so CSR or certificate signing workflows may be restricted.

---

Malformed Key Testing

PkiFuzzer includes a malformed key material layer intended for negative testing.

This can be used to generate artifacts that help validate:

• key import logic;
• parser robustness;
• ASN.1 decoding behavior;
• certificate and CSR validation tools;
• applications that consume public or private key material.

Malformed key scenarios are useful when testing whether external tools fail safely and report clear errors when presented with damaged or non-standard key encodings.

---

Subject Builder

The subject builder provides detailed control over X.500 distinguished names.

Supported capabilities include:

• normal subject generation;
• empty subject generation;
• predefined DN attributes;
• custom OID attributes;
• explicit attribute ordering;
• multiple values;
• multiple RDN handling;
• per-field encoding selection.

Example scenarios:

Scenario	Purpose
CN=example.test	Basic certificate generation
Multiple OU values	Multi-value subject testing
Custom OID field	Proprietary or negative profile testing
Explicit field order	DN comparison and parser behavior testing
PrintableString / UTF8String / IA5String selection	ASN.1 interoperability testing
Empty subject	SAN-only profile testing

---

Serial Number Testing

Certificate serial numbers can be generated automatically or provided explicitly.

Mode	Description
Random	Generates a random positive serial number
Random with length	Generates a random positive serial number with a selected byte length
Custom HEX	Uses a tester-provided hexadecimal serial number
Custom decimal	Uses a tester-provided decimal serial number

This is useful for testing certificate parsers, linting rules, serial length boundaries, and CA policy validation.

---

Validity Testing

Certificate validity can be configured through notBefore and notAfter.

Useful scenarios include:

• expired certificates;
• not-yet-valid certificates;
• short-lived certificates;
• long-lived certificates;
• policy boundary testing;
• second-level validity precision.

---

X.509 Extensions

PkiFuzzer models X.509 extensions as dedicated option classes and ASN.1 value builders.

Targeted extension areas include:

Area	Examples
Core X.509	Basic Constraints, Key Usage, Extended Key Usage
Names	Subject Alternative Name, Issuer Alternative Name
Identifiers	Subject Key Identifier, Authority Key Identifier
Revocation	CRL Distribution Points, Freshest CRL
Access methods	Authority Information Access
Policies	Certificate Policies, Policy Mappings, Policy Constraints, Inhibit Any Policy
Name constraints	Name Constraints
Private key usage	Private Key Usage Period
Subject attributes	Subject Directory Attributes
Certificate Transparency	CT Precertificate Poison, Signed Certificate Timestamp List
CAB Forum	cabfOrganizationIdentifier
Custom testing	Custom OIDs and raw/custom extension values

The extension system is intentionally modular so that new extension builders can be added without turning the certificate generator into a single monolithic class.

---

GeneralName Handling

Several X.509 extensions rely on GeneralName.

PkiFuzzer is designed to support common and advanced forms such as:

• rfc822Name;
• dNSName;
• directoryName;
• uniformResourceIdentifier;
• iPAddress;
• registeredID;
• otherName;
• ediPartyName;
• raw DER structures where advanced fuzzing requires them.

For many GeneralName types, ASN.1 encoding is fixed by the standard. For example, dNSName, rfc822Name, and uniformResourceIdentifier are encoded as IA5String.

---

Certificate Transparency Testing

PkiFuzzer includes support for Certificate Transparency related extension scenarios, including:

• CT Precertificate Poison;
• Signed Certificate Timestamp List;
• SCT list structure testing;
• SCT signing scenarios;
• timestamp variation;
• malformed SCT length and list encoding scenarios.

These features are useful for testing CT parsers, certificate linting tools, and relying party behavior when CT-related structures are missing, malformed, duplicated, or unusual.

---

Output Modes

PkiFuzzer supports multiple generation modes depending on the selected key type and configuration.

Output mode	Description
CSR only	Generates a PKCS#10 certification request
Self-signed certificate	Generates a certificate signed by its own key
CA-signed certificate	Generates a certificate signed by issuer material
Dummy issuer	Uses generated issuer material for test chains
Uploaded CA PKCS#12	Uses tester-provided CA material

Generated output may include:

• private key;
• public key;
• CSR;
• certificate;
• issuer certificate;
• chain files;
• metadata or auxiliary files;
• archive package.

---

Web UI

The web interface is built with Blazor and MudBlazor.

Main UI areas:

• custom certificate generator;
• standard profile selector;
• searchable profile selection;
• profile details preview;
• key parameter editors;
• subject editor;
• validity editor;
• serial number editor;
• extension editors;
• malformed key encoding panel;
• output mode and issuer configuration;
• generation result export.

The UI is designed for manual testing, exploration, and repeatable generation of PKI artifacts.

---

Deployment Notes

PkiFuzzer can run as a standard ASP.NET Core application.

Run locally

dotnet run --project PkiFuzzer.Web/PkiFuzzer.Web

Build

dotnet build

Publish

dotnet publish PkiFuzzer.Web/PkiFuzzer.Web/PkiFuzzer.Web.csproj -c Release -o ./publish

Path base configuration

When hosting behind a reverse proxy under a sub-path, configure:

App__PathBase=/pki-fuzzer

Example Docker environment settings:

environment:
  - ASPNETCORE_ENVIRONMENT=Production
  - ASPNETCORE_URLS=http://+:8080
  - App__PathBase=/pki-fuzzer

The application normalizes the configured path base and uses forwarded headers, which makes it suitable for Nginx or similar reverse proxy deployments.

---

Example Workflow

1. Select Custom Generator or Standard Profiles.
2. Select or configure the key type.
3. Configure key parameters.
4. Configure subject fields and encodings.
5. Set certificate validity.
6. Configure the serial number.
7. Select the output mode.
8. Configure issuer material if needed.
9. Add and configure X.509 extensions.
10. Optionally enable malformed key or malformed extension options.
11. Generate the artifact archive.
12. Use the generated material in PKI tests, linters, parsers, or CA/RA workflows.

---

Use Cases

PkiFuzzer can be used for:

• certificate parser testing;
• ASN.1 robustness testing;
• X.509 linting test vectors;
• PKCS#10 enrollment workflow testing;
• CA/RA integration testing;
• relying party behavior testing;
• browser or platform policy boundary testing;
• Certificate Transparency extension testing;
• regression test vector generation;
• post-quantum certificate workflow experimentation;
• malformed key import testing;
• custom enterprise profile experimentation.

---

Negative Testing Philosophy

PkiFuzzer intentionally exposes options that may generate unusual, incomplete, or non-compliant structures.

Examples include:

• unusual serial number lengths;
• empty subjects;
• custom subject OIDs;
• explicit subject encodings;
• extensions marked critical in uncommon ways;
• empty extension sequences;
• malformed extension values;
• uncommon policy structures;
• custom access methods;
• rare GeneralName types;
• malformed SCT lists;
• malformed key encodings;
• algorithm and output mode edge cases.

Some deeply invalid structures may not be possible through high-level certificate generation APIs. Those scenarios may require a future raw ASN.1 certificate builder.

---

Security Notes

• PkiFuzzer is intended for testing, not production.
• Generated keys should be treated as test material.
• Do not use generated certificates in real systems without review and a proper security policy.
• Some generated outputs may be intentionally non-compliant.
• Some artifacts may be malformed by design.
• The tool should be used in isolated test environments when generating negative or malformed artifacts.

---

Dependencies

• .NET SDK 10.0 or a compatible SDK used by the project
• ASP.NET Core
• Blazor
• MudBlazor
• BouncyCastle

---

Limitations

• Some invalid ASN.1 structures cannot be generated through high-level APIs.
• Some key types restrict available output modes.
• ML-KEM is not a signing algorithm and is therefore limited in CSR/certificate signing workflows.
• Some GeneralName encodings are fixed by ASN.1 rules.
• Profile completeness depends on the provided profile JSON definitions.
• Advanced fuzzing may require future raw DER/ASN.1 generation support.

---

Roadmap Ideas

Possible future development directions:

• REST API generation surface;
• CLI generation mode;
• reusable GeneralName editor;
• richer profile editor;
• profile import/export from the UI;
• larger built-in profile catalog;
• raw ASN.1 certificate generation mode;
• certificate linting integration;
• automated test vector generation;
• deterministic generation mode for regression tests;
• extended malformed key scenarios;
• extended post-quantum algorithm support;
• more CAB Forum and browser policy profile templates;
• reusable help/manual page inside the application.

---

References

• RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and CRL Profile
• RFC 2986 - PKCS #10 Certification Request Syntax
• RFC 6962 - Certificate Transparency
• NIST FIPS 203 - ML-KEM
• NIST FIPS 204 - ML-DSA
• NIST FIPS 205 - SLH-DSA
• BouncyCastle C#

---

License

Copyright (c) 2026 MO226. All rights reserved.

This project is provided for educational and research purposes only.

No permission is granted to use, copy, modify, distribute, sublicense, or sell this software without explicit written permission from the author.

---

Status

Status: Active Development
Compatibility: .NET 10.0+