Merge branch 'develop' into devsecops

itext.tests/itext.sign.tests/itext/signatures/validation/RevocationDataValidatorIntegrationTest.cs

@@ -42,6 +42,9 @@ public class RevocationDataValidatorIntegrationTest : ExtendedITextTest {
         private static readonly String SOURCE_FOLDER = iText.Test.TestUtil.GetParentProjectDirectory(NUnit.Framework.TestContext
             .CurrentContext.TestDirectory) + "/resources/itext/signatures/validation/RevocationDataValidatorTest/";
 
+        private static readonly String CRL_TEST_SOURCE_FOLDER = iText.Test.TestUtil.GetParentProjectDirectory(NUnit.Framework.TestContext
+            .CurrentContext.TestDirectory) + "/resources/itext/signatures/validation/CRLValidatorTest/";
+
         private static readonly char[] PASSWORD = "testpassphrase".ToCharArray();
 
         private static IX509Certificate caCert;
@@ -107,5 +110,81 @@ public virtual void CrlWithOnlySomeReasonsTest() {
                 (checkCert).WithStatus(ReportItem.ReportItemStatus.INFO).WithMessage(CRLValidator.ONLY_SOME_REASONS_CHECKED
                 )));
         }
+
+        [NUnit.Framework.Test]
+        public virtual void CrlSignerIsValidatedCertificate() {
+            String rootCertFileName = CRL_TEST_SOURCE_FOLDER + "happyPath/ca.cert.pem";
+            String crlSignerKeyFileName = CRL_TEST_SOURCE_FOLDER + "keys/crl-key.pem";
+            String crlSignerFileName = CRL_TEST_SOURCE_FOLDER + "happyPath/crl-issuer.cert.pem";
+            String checkCertFileName = CRL_TEST_SOURCE_FOLDER + "happyPath/sign.cert.pem";
+            IX509Certificate caCert = (IX509Certificate)PemFileHelper.ReadFirstChain(rootCertFileName)[0];
+            IX509Certificate crlSigner = (IX509Certificate)PemFileHelper.ReadFirstChain(crlSignerFileName)[0];
+            IPrivateKey crlPrivateKey = PemFileHelper.ReadFirstKey(crlSignerKeyFileName, PASSWORD);
+            IX509Certificate checkCert = (IX509Certificate)PemFileHelper.ReadFirstChain(checkCertFileName)[0];
+            certificateRetriever.AddTrustedCertificates(JavaCollectionsUtil.SingletonList(caCert));
+            certificateRetriever.AddKnownCertificates(JavaCollectionsUtil.SingletonList(crlSigner));
+            DateTime checkDate = TimeTestUtil.TEST_DATE_TIME;
+            DateTime revocationDate = checkDate.AddDays(-1);
+            TestCrlBuilder builder = new TestCrlBuilder(crlSigner, crlPrivateKey, checkDate);
+            builder.SetNextUpdate(checkDate.AddDays(10));
+            //builder.addCrlEntry(caCert, revocationDate, FACTORY.createCRLReason().getKeyCompromise());
+            //TestCrlClientWrapper crlClient = new TestCrlClientWrapper(new TestCrlClient().addBuilderForCertIssuer(builder));
+            ValidationCrlClient crlClient = (ValidationCrlClient)parameters.GetCrlClients()[0];
+            crlClient.AddCrl((IX509Crl)CertificateUtil.ParseCrlFromBytes(builder.MakeCrl()), checkDate, TimeBasedContext
+                .HISTORICAL);
+            ValidationReport report = new ValidationReport();
+            certificateRetriever.AddTrustedCertificates(JavaCollectionsUtil.SingletonList(caCert));
+            parameters.SetRevocationOnlineFetching(ValidatorContexts.All(), CertificateSources.All(), TimeBasedContexts
+                .All(), SignatureValidationProperties.OnlineFetching.FETCH_IF_NO_OTHER_DATA_AVAILABLE);
+            parameters.SetFreshness(ValidatorContexts.All(), CertificateSources.All(), TimeBasedContexts.All(), TimeSpan.FromDays
+                (0));
+            RevocationDataValidator validator = validatorChainBuilder.BuildRevocationDataValidator();
+            validatorChainBuilder.WithRevocationDataValidatorFactory(() => validator);
+            validator.Validate(report, baseContext, crlSigner, checkDate);
+            AssertValidationReport.AssertThat(report, (a) => a.HasNumberOfFailures(1).HasLogItem((l) => l.WithMessage(
+                CRLValidator.CERTIFICATE_IN_ISSUER_CHAIN)));
+        }
+
+        [NUnit.Framework.Test]
+        public virtual void CrlSignerIssuerIsValidatedCertificate() {
+            String rootCertFileName = CRL_TEST_SOURCE_FOLDER + "crlSignerInValidatedChain/ca.cert.pem";
+            String intermediateFileName = CRL_TEST_SOURCE_FOLDER + "crlSignerInValidatedChain/intermediate.cert.pem";
+            String intermediate2FileName = CRL_TEST_SOURCE_FOLDER + "crlSignerInValidatedChain/intermediate2.cert.pem";
+            String crlSignerKeyFileName = CRL_TEST_SOURCE_FOLDER + "keys/crl-key.pem";
+            String crlSignerFileName = CRL_TEST_SOURCE_FOLDER + "crlSignerInValidatedChain/crl-issuer.cert.pem";
+            String checkCertFileName = CRL_TEST_SOURCE_FOLDER + "crlSignerInValidatedChain/sign.cert.pem";
+            IX509Certificate caCert = (IX509Certificate)PemFileHelper.ReadFirstChain(rootCertFileName)[0];
+            IX509Certificate intermediateCert = (IX509Certificate)PemFileHelper.ReadFirstChain(intermediateFileName)[0
+                ];
+            IX509Certificate intermediate2Cert = (IX509Certificate)PemFileHelper.ReadFirstChain(intermediate2FileName)
+                [0];
+            IX509Certificate crlSigner = (IX509Certificate)PemFileHelper.ReadFirstChain(crlSignerFileName)[0];
+            IPrivateKey crlPrivateKey = PemFileHelper.ReadFirstKey(crlSignerKeyFileName, PASSWORD);
+            IX509Certificate checkCert = (IX509Certificate)PemFileHelper.ReadFirstChain(checkCertFileName)[0];
+            certificateRetriever.AddTrustedCertificates(JavaCollectionsUtil.SingletonList(caCert));
+            certificateRetriever.AddKnownCertificates(JavaCollectionsUtil.SingletonList(crlSigner));
+            certificateRetriever.AddKnownCertificates(JavaCollectionsUtil.SingletonList(intermediateCert));
+            certificateRetriever.AddKnownCertificates(JavaCollectionsUtil.SingletonList(intermediate2Cert));
+            DateTime checkDate = TimeTestUtil.TEST_DATE_TIME;
+            DateTime revocationDate = checkDate.AddDays(-1);
+            TestCrlBuilder builder = new TestCrlBuilder(crlSigner, crlPrivateKey, checkDate);
+            builder.SetNextUpdate(checkDate.AddDays(10));
+            //builder.addCrlEntry(caCert, revocationDate, FACTORY.createCRLReason().getKeyCompromise());
+            //TestCrlClientWrapper crlClient = new TestCrlClientWrapper(new TestCrlClient().addBuilderForCertIssuer(builder));
+            ValidationCrlClient crlClient = (ValidationCrlClient)parameters.GetCrlClients()[0];
+            crlClient.AddCrl((IX509Crl)CertificateUtil.ParseCrlFromBytes(builder.MakeCrl()), checkDate, TimeBasedContext
+                .HISTORICAL);
+            ValidationReport report = new ValidationReport();
+            //certificateRetriever.addTrustedCertificates(Collections.singletonList(caCert));
+            parameters.SetRevocationOnlineFetching(ValidatorContexts.All(), CertificateSources.All(), TimeBasedContexts
+                .All(), SignatureValidationProperties.OnlineFetching.FETCH_IF_NO_OTHER_DATA_AVAILABLE);
+            parameters.SetFreshness(ValidatorContexts.All(), CertificateSources.All(), TimeBasedContexts.All(), TimeSpan.FromDays
+                (0));
+            RevocationDataValidator validator = validatorChainBuilder.BuildRevocationDataValidator();
+            validatorChainBuilder.WithRevocationDataValidatorFactory(() => validator);
+            validator.Validate(report, baseContext, intermediateCert, checkDate);
+            AssertValidationReport.AssertThat(report, (a) => a.HasNumberOfFailures(1).HasLogItem((l) => l.WithMessage(
+                CRLValidator.CERTIFICATE_IN_ISSUER_CHAIN)));
+        }
     }
 }

itext.tests/itext.sign.tests/resources/itext/signatures/validation/CRLValidatorTest/createTestData.cmd

@@ -1,15 +1,17 @@
 REM create the test keys
 IF [%1] == [] goto continue
 md keys
-openssl genrsa -out keys/root_key.pem -passout pass:testpassphrase 2048
-openssl genrsa -out keys/im_key.pem -passout pass:testpassphrase 2048
-openssl genrsa -out keys/sign-key.pem -passout pass:testpassphrase 2048
-openssl genrsa -out keys/crl-key.pem -passout pass:testpassphrase 2048
+openssl genrsa -out keys/root_key.pem -aes256 -passout pass:testpassphrase 2048
+openssl genrsa -out keys/im_key.pem -aes256 -passout pass:testpassphrase 2048
+openssl genrsa -out keys/im2_key.pem -aes256 -passout pass:testpassphrase 2048
+openssl genrsa -out keys/sign-key.pem -aes256 -passout pass:testpassphrase 2048
+openssl genrsa -out keys/crl-key.pem -aes256 -passout pass:testpassphrase 2048
 :continue
 
 call :runTestCase happyPath
 call :runTestCase crlIssuerRevokedBeforeSigningDate
 call :runTestCase crlIssuerAndSignCertHaveNoSharedRoot
+call :runTestCase crlSignerInValidatedChain
 EXIT
 
 :runTestCase

itext.tests/itext.sign.tests/resources/itext/signatures/validation/CRLValidatorTest/crlIssuerAndSignCertHaveNoSharedRoot/ca.cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwNTELMAkGA1UEBhMCQkUx
+DjAMBgNVBAoMBWlUZXh0MRYwFAYDVQQDDA1pVGV4dFRlc3RSb290MCAXDTAwMDEw
+MTAwMDAwMFoYDzI1MDAwMTAxMDAwMDAwWjA1MQswCQYDVQQGEwJCRTEOMAwGA1UE
+CgwFaVRleHQxFjAUBgNVBAMMDWlUZXh0VGVzdFJvb3QwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDYxUs+SgZkRkOhOfddCnPeuE1QP2kAm6gAsg4qjNzr
+rZpZvwziyWaz6bXXq8fATjXEAdypAiWL/BDZscdCM/M11jds9mMv7dMvCtLns6Oe
+4GbChYxxloN2rVxElFPK2siKBaEeWyItr2Ms0P+hSR5uHjFt+krzl2zv828fyEnH
+fPvln42SAcuCKsLmfjtutus5jFKBFF8oiqDFlI2eXYggKV7JELttgPLobv2ZyFa5
+nXo/xbtzlPb8AvV3/mxpX4prFhBXupJXuCwmqmzVRqGbwKSz/Bewb/4aJGSpg32x
+yIWeXTld58f+Jntfes8xHwK0aJB/Tm2WrH+RWoV+TN/pAgMBAAGjYzBhMB0GA1Ud
+DgQWBBR0MlTFwFzoq8mPVusDjIEnL5avqzAfBgNVHSMEGDAWgBR0MlTFwFzoq8mP
+VusDjIEnL5avqzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIC5DANBgkq
+hkiG9w0BAQsFAAOCAQEAK2dbxbQ7jEdtqvnMpKOZsB55PDO5OZ2hPYilT5ZVZNt1
+jdE94HdCBHED3upmOeBH+XtsK/MLk+eYICM5SZwWVCBY0aQQR0URyTsX4SA/12A5
+VhrnP6bqy4b+3mO3J9s0go59cZOtSkxQ7191teEQMsDeh8GxXGLW/7Tf4x6v7U34
+B7UghMhUD2bHJ7U8MOqto9fVar/9S93tc9vRtYOXZbfRwjFKOYD4IFm7cH3VnrX7
+od3KUEKGKhQ2ZaqrtnW19xNTbdRcMT3+8QSai9DLV0kGGSSY09AHDO3WvxkAs9ZI
+cIsMM/n+mLK0Km9fh5uE3k6NmiN3GV+QMyjbmFnVNg==
+-----END CERTIFICATE-----

itext.tests/itext.sign.tests/resources/itext/signatures/validation/CRLValidatorTest/crlIssuerAndSignCertHaveNoSharedRoot/chain.pem

@@ -3,99 +3,99 @@ MIIDSzCCAjOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwNTELMAkGA1UEBhMCQkUx
 DjAMBgNVBAoMBWlUZXh0MRYwFAYDVQQDDA1pVGV4dFRlc3RSb290MCAXDTAwMDEw
 MTAwMDAwMFoYDzI1MDAwMTAxMDAwMDAwWjA1MQswCQYDVQQGEwJCRTEOMAwGA1UE
 CgwFaVRleHQxFjAUBgNVBAMMDWlUZXh0VGVzdFJvb3QwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQDP6KUmxQzeXKuwodaQZ7IUoidvDeXWrjW7BNYmKhey
-DX9SIeIwvuiKDVUD85pWyk6jhNUvQaYvGVOv/Pbu4NJHv9FKch2d9759ckMT+MXG
-fGk/B6Ww1rlKsiHccWizQxah7R79eGweEvryPIx+hqxreCBH4yzMPjHld1C34/vC
-nUGmozKT4KENiT6lXXiBm4D+u3siCPt1Gzxavvm2MUBTHBbhQ3/n1eS/FcqT4NhI
-vXDpPiNouD9goI+4LwCW7b52dg7dXreQY/IfGCcHTcu7YK/OEW4Pqjpr13B5mEDS
-DsCqrStoh8EQ+jB62n2Xv8TT4lQju/sZh0l65IiT8fUfAgMBAAGjYzBhMB0GA1Ud
-DgQWBBRkxUEzwLkf0rdu5Txco5JSsf8WCzAfBgNVHSMEGDAWgBRkxUEzwLkf0rdu
-5Txco5JSsf8WCzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIC5DANBgkq
-hkiG9w0BAQsFAAOCAQEARJOOUQkv9AgqElJmQjGDkRdJPxkDHZtRLGOk9p0E1KbL
-lqQQdgzL7RuE4vfCROan6aBZmXFRviIPg/Gxw2hDSIv1NUZv3AIgM2b9+3y+4SQ6
-2a/sqh1JPLxwnLN+Mo5KwY/E/YlJ0N7rw3AONrLlqH89BRrBIiPjrg74zi6qPzGn
-WB2awHsbl7AOtkD2dEud7lbyLda/hCw2RGPSBQMm50pWsuInWXzdtX/Ii9yTGMyD
-kavUHX6DDVouZBSKOjmChP0fGPM17ORJNR92RbT2ygy+F0Zokh5XUgrKPr4/JTW5
-iIkycpjAXY9UEMfi8pFnnzVSRj65kkZvZZJzybelMQ==
+AQUAA4IBDwAwggEKAoIBAQDYxUs+SgZkRkOhOfddCnPeuE1QP2kAm6gAsg4qjNzr
+rZpZvwziyWaz6bXXq8fATjXEAdypAiWL/BDZscdCM/M11jds9mMv7dMvCtLns6Oe
+4GbChYxxloN2rVxElFPK2siKBaEeWyItr2Ms0P+hSR5uHjFt+krzl2zv828fyEnH
+fPvln42SAcuCKsLmfjtutus5jFKBFF8oiqDFlI2eXYggKV7JELttgPLobv2ZyFa5
+nXo/xbtzlPb8AvV3/mxpX4prFhBXupJXuCwmqmzVRqGbwKSz/Bewb/4aJGSpg32x
+yIWeXTld58f+Jntfes8xHwK0aJB/Tm2WrH+RWoV+TN/pAgMBAAGjYzBhMB0GA1Ud
+DgQWBBR0MlTFwFzoq8mPVusDjIEnL5avqzAfBgNVHSMEGDAWgBR0MlTFwFzoq8mP
+VusDjIEnL5avqzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIC5DANBgkq
+hkiG9w0BAQsFAAOCAQEAK2dbxbQ7jEdtqvnMpKOZsB55PDO5OZ2hPYilT5ZVZNt1
+jdE94HdCBHED3upmOeBH+XtsK/MLk+eYICM5SZwWVCBY0aQQR0URyTsX4SA/12A5
+VhrnP6bqy4b+3mO3J9s0go59cZOtSkxQ7191teEQMsDeh8GxXGLW/7Tf4x6v7U34
+B7UghMhUD2bHJ7U8MOqto9fVar/9S93tc9vRtYOXZbfRwjFKOYD4IFm7cH3VnrX7
+od3KUEKGKhQ2ZaqrtnW19xNTbdRcMT3+8QSai9DLV0kGGSSY09AHDO3WvxkAs9ZI
+cIsMM/n+mLK0Km9fh5uE3k6NmiN3GV+QMyjbmFnVNg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIDijCCAnKgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwOjELMAkGA1UEBhMCQkUx
 DjAMBgNVBAoMBWlUZXh0MRswGQYDVQQDDBJpVGV4dE90aGVyVGVzdFJvb3QwIBcN
 MDAwMTAxMDAwMDAwWhgPMjQ1MDAxMDEwMDAwMDBaMDoxCzAJBgNVBAYTAkJFMQ4w
 DAYDVQQKDAVpVGV4dDEbMBkGA1UEAwwSaVRleHRUZXN0Q3JsSXNzdWVyMIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlXp4Gu2nF8IKICSDPfB0tSpGKjT9
-MEcMeDmhTWUc14qg2QQb+TB2A8U3hg32q59VkGLmZFjng1pXJIoejbDv8KuxxmFt
-e2sEhBhbNHS9Gm2xuapXbF8GWq0/I+VEy3ZJGfB7dDheplKdfXdtRMs7RIGV10a3
-uH8dB8O9LNt6QlZ3xs+35wfkp7fLRx0U3KXA/nJcRl0PJT0K2TNoGkcUzy8AQ7TT
-+SpqFqnw7H5N5rvOsB+hPnyO4l0Y6W3sNEmzqOwtewNPTjOTjtyln3ThHb2XNTXO
-gyiISN9RMM7Rzl+PirhEJjNKlPeNflUkR8qWig/pNf8YNW0fnz4DdhBe4wIDAQAB
-o4GXMIGUMB0GA1UdDgQWBBTTPJ0Z+EXPSP9MaiVIk1QkTH2PZTAfBgNVHSMEGDAW
-gBSnpIPlATjoMzDOhbeswjGupOh/PTAOBgNVHQ8BAf8EBAMCAcIwQgYDVR0fBDsw
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwnsONfztmnDdLJKbWd8sE/2txomx
+72HBnrBM3G2bLpGfcvAFm9n/F0WLf1dPDYY94JAFKsBGG0Enh4eBJ753ZHgug/qw
+DIiF5DnRH57e2EtoJWwXjeSm5KLIsaWcUsUGHJDfS8SfWDqOIDCp+qm2mv1M98po
+KsIo4lRHyM4XDL5ERGUAYklA0h5noHP1V1JnCQ0/4Z+j4dX0tfTnsxp4wA+Cu8Am
+sfL+UP3LTu7Soo3rbHMtn8yf12j7eohMRTX71eRf1fR1Nes0wA72RPe6RHpd1kiX
+yW8P/Y+BNNpqujnW/R6LcjsVlc2iSPK4XonwBExXGp44yVVQjEt4G/uPrQIDAQAB
+o4GXMIGUMB0GA1UdDgQWBBQSbqEw8HXXDUnva1e6YGF7DBbGdTAfBgNVHSMEGDAW
+gBSJQJIqlFRpEC9NMuebZTa38Lxk1TAOBgNVHQ8BAf8EBAMCAcIwQgYDVR0fBDsw
 OTA3oDWgM4YxaHR0cDovL2xvY2FsaG9zdC50ZXN0L2RlZmF1bHQvY3Jscy9jcmwv
-bGF0ZXN0LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAoX9g8yKhzXz+FirY5WtC1nbJ
-DSeggirm4NFWeNvZY/nahleeO4+0RXRYp3maIjaEieWqgov4KukdtGl1SjQfvy6a
-ghoznl3fwTR/TO2d5ms6LFfETEptY0p6zDnLjMDeYFNjLLZiXFDtnEV1DjrafrXI
-PGFgF+jaYiZUp9H3oFyMUpi+gQDWmAoCppt8XBqoyWUmSqwfEk6Ls5qBu1N5KJQU
-TIV6zCK90cqGNvypKbynb0LAvQAkJiMoprOxf2PHoahNIsbuvasJp/LB2xJWbVjR
-B3/Qb8SelSNFgwwHjGq7Zqx3zknNxSMKX+9wqAMGovgyJD411faSdBL9l4KaoA==
+bGF0ZXN0LmNybDANBgkqhkiG9w0BAQsFAAOCAQEAY6Ql0oP20FsZrtKyLVFYJSkL
+c3R4mTRHJ5JbrgtPSLkLDxN3QGssgwmhZUyf8TvaCYVBomedFvOVd3xizmQPcAkD
+yDeX7XTvkrg9aSaGyjtKcOduk8eVHyPvAnFZ4eJ7m0vYJThLeVlupRYKnMcVR9AA
+HMxKk+YTTaTr6o2zWE63vbzkdAvJTYuVzfDw2Qo+6IeAGL3jD9ipa6+krN/h6z8k
+EPun+ndDEijo9TcPv+pPT+DHcXiWcLCQFi7611h4ErvFtUJoDl3xoTMsgqMKRzJJ
+46HaLTKqkLikI/s4bKZ23brDHUYzpFCHs5WkQpRfdq6jHek9lBHNRK+tp66s6w==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIDQjCCAiqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwNTELMAkGA1UEBhMCQkUx
 DjAMBgNVBAoMBWlUZXh0MRYwFAYDVQQDDA1pVGV4dFRlc3RSb290MCAXDTAwMDEw
 MTAwMDAwMFoYDzI0NTAwMTAxMDAwMDAwWjA9MQswCQYDVQQGEwJCRTEOMAwGA1UE
 CgwFaVRleHQxHjAcBgNVBAMMFWlUZXh0VGVzdEludGVybWVkaWF0ZTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAM3t0dlZupS+5Z0EGHsnruz2ZRoVKwbp
-IXwuOGuetobCTaaTfAyXmgXqcH1ZPi0u1dSzkWbHOdBNhRQLlk3ZtTfnCQrtijjU
-U6jqkiMoMhap1/jEQPoU6CHP3bbwkSdZrnNriVxyGp2IKGwNDlg9fOBGuXdNei8N
-fP5q9daV3oC9ckverNNKpcn9/0wYchISH9Y0a8N6FFUBqEYnjsEee7a5VIfgsP70
-jrhk53pNQJSObJhAFzhsbFNXxmWkZpi/YUJaBCSQYwQCUToRINyUMZOtsUIBh4es
-8EpBt2utPkVifZvBo+prKUPTYX64iKko7zY5WHyP6vIV5BihYYv3Em8CAwEAAaNS
-MFAwHQYDVR0OBBYEFKekg+UBOOgzMM6Ft6zCMa6k6H89MB8GA1UdIwQYMBaAFGTF
-QTPAuR/St27lPFyjklKx/xYLMA4GA1UdDwEB/wQEAwIB5jANBgkqhkiG9w0BAQsF
-AAOCAQEAadrnESocLAKEhOVcKC1tGOlDEI3oYkODcT4E3AOBqBq+gy4s5hfrQEpC
-HqCje0pGNY1xgdcG5OPaKNSMT7+/PLE5As7aktNQxWuhDSH0SwKQPBbG+pfs0m3J
-1R6M0WKsqvLWUtUgkzQp2f9pqu/XBrjqJnI5RwtNBBXJV8QBhLf4z/kGIk4noDM7
-2PcXdGNfl6dINcX8q3meZ1DkWTypgZ1pcEcvHU0rUPo+UPUpg6pOruOVnCERRiSx
-z97Gqp1ZDa/jH1a+tjmbq4EN1vbULzVw+xsBIMuT7lsPTLdy/AHIx2UXVMGhHoYV
-BHO096jz11DkzNKHloHf5sKPK2Ecjg==
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ6M9OSQgx20Fw14rYFeM6HQuQxBD276
+e6kXMpmdsbbkvExq5mrAWPvFGYHCmRAtH7pGm1pL91Zlgh1CbUPzwSa/Lfp9FeAX
+83G7OJn0sY3kJRthtj5B0dGinXSIFCIb6gx9ICzoVpY9Ljvl4tyBr0dkGmED3MBx
+SFltOMPplDhYwFekL7woNXMFIAxMnDWuS7dZ7xEpLAwNfH9D92I4lzSrQ9TrxwDP
+dW2gWGvi2eu77W4YqFQgydgbKmFHAzDUTA01LNmKZkASBcLUoiLnLBMmVYgDMH4f
+o4oj+2/J/OZNuGv5DK9dRCryAhnY3f8/9b8JzoPeRCmgRO9IU7ObZ/0CAwEAAaNS
+MFAwHQYDVR0OBBYEFIlAkiqUVGkQL00y55tlNrfwvGTVMB8GA1UdIwQYMBaAFHQy
+VMXAXOiryY9W6wOMgScvlq+rMA4GA1UdDwEB/wQEAwIB5jANBgkqhkiG9w0BAQsF
+AAOCAQEAMoIJ86nzczzR41l5EFHlxGvUEQY/w7BJ42LICN3F12WPmJ+A3i/GAJSQ
+14W+Jy8CXEhEFZF3R45vuOAGhOkF7igtbXeeVXunM3rmi8XIlpGjqbBZxC5w1Fd8
+IPOTArrzcF8agwthRzKOEpFSklmpUDT4MYZkdzR7TVM6TkdL+ModYFrhf9/+OFGb
+qHzKUPVv+dvNaKn6JvKfQ311MKG3fLU7vyKEUNoolAnLMy3VETsnhMTk6Wa5rfzJ
+eq2sdBiLxgwC3xhYk33Cla0X3hsr++Yqb8BX1ztKaRxu0PSi+KKJ9kvXAxRkFlwh
+Xa7iIRXelUhftWRF/4VgDsDhWx+eDQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIDVTCCAj2gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwOjELMAkGA1UEBhMCQkUx
 DjAMBgNVBAoMBWlUZXh0MRswGQYDVQQDDBJpVGV4dE90aGVyVGVzdFJvb3QwIBcN
 MDAwMTAxMDAwMDAwWhgPMjUwMDAxMDEwMDAwMDBaMDoxCzAJBgNVBAYTAkJFMQ4w
 DAYDVQQKDAVpVGV4dDEbMBkGA1UEAwwSaVRleHRPdGhlclRlc3RSb290MIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAze3R2Vm6lL7lnQQYeyeu7PZlGhUr
-BukhfC44a562hsJNppN8DJeaBepwfVk+LS7V1LORZsc50E2FFAuWTdm1N+cJCu2K
-ONRTqOqSIygyFqnX+MRA+hToIc/dtvCRJ1muc2uJXHIanYgobA0OWD184Ea5d016
-Lw18/mr11pXegL1yS96s00qlyf3/TBhyEhIf1jRrw3oUVQGoRieOwR57trlUh+Cw
-/vSOuGTnek1AlI5smEAXOGxsU1fGZaRmmL9hQloEJJBjBAJROhEg3JQxk62xQgGH
-h6zwSkG3a60+RWJ9m8Gj6mspQ9NhfriIqSjvNjlYfI/q8hXkGKFhi/cSbwIDAQAB
-o2MwYTAdBgNVHQ4EFgQUp6SD5QE46DMwzoW3rMIxrqTofz0wHwYDVR0jBBgwFoAU
-p6SD5QE46DMwzoW3rMIxrqTofz0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
-BAMCAuQwDQYJKoZIhvcNAQELBQADggEBAB+QFs5zu6uD0+IEyAt8B+jxK2lV7025
-vENBQhFsnAKqsa7KJ5BCg4MrphMKvLTYopJz8TxQ4N6lmjS2VbdYZDqaP6M0mzwc
-8E4biuW/6YptjLfoKZU73UqKPPvdh2qkll/nF/pMy8v6bf6Wg12b8pQAIrgaqu4/
-kopcba/2TftGy5/JUGVePif9+CUL95+UiUf9nvQr0KFL0+8k8L1DLs0wABKAPHXu
-dFtfs1ofM5cC8pmVlJhoiIoHCWnIYOK2ea80Z2Xl/Y5ZtvAcluLW+0Ll+hsJ3pfy
-80FH0UU7VsEJIOYrVCNx/JpXBH/AKQT0FcVzWU94FeSGb0vfihuL7nY=
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnoz05JCDHbQXDXitgV4zodC5DEEP
+bvp7qRcymZ2xtuS8TGrmasBY+8UZgcKZEC0fukabWkv3VmWCHUJtQ/PBJr8t+n0V
+4Bfzcbs4mfSxjeQlG2G2PkHR0aKddIgUIhvqDH0gLOhWlj0uO+Xi3IGvR2QaYQPc
+wHFIWW04w+mUOFjAV6QvvCg1cwUgDEycNa5Lt1nvESksDA18f0P3YjiXNKtD1OvH
+AM91baBYa+LZ67vtbhioVCDJ2BsqYUcDMNRMDTUs2YpmQBIFwtSiIucsEyZViAMw
+fh+jiiP7b8n85k24a/kMr11EKvICGdjd/z/1vwnOg95EKaBE70hTs5tn/QIDAQAB
+o2MwYTAdBgNVHQ4EFgQUiUCSKpRUaRAvTTLnm2U2t/C8ZNUwHwYDVR0jBBgwFoAU
+iUCSKpRUaRAvTTLnm2U2t/C8ZNUwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
+BAMCAuQwDQYJKoZIhvcNAQELBQADggEBAFYU69yV334eE2i93VyIs/sXpvuX7ZGd
+EXn3SwQ+hlo4Bm2Diabs6Z/4AC0CKyA8vzTJ7Hp7qb77/cjlno25/uR76vUJQEp2
+LSWWeN80Mzzn3tOLjVd5wew5tcGZ97j/4aaDWSg/6geRfo4SuMHkahFe3V8JzE1O
+vtpIvkb7q+K6B0GR/IIr4bub6dAKsVQVIQozUmmRsQU7lmQXurdkq9u1XLZKLF6J
+A2j1ORzFpCMFfvXW3yACTUbmGKvdTWoEnhSaU45hJ9KA9+SYS3xR/CGgjHRSvJRV
+O2D83nPDnIk8dN5PW0NWpyQvmotsjv89kBrSanL8yMoD8FnClJnMSSQ=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIDQjCCAiqgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwPTELMAkGA1UEBhMCQkUx
 DjAMBgNVBAoMBWlUZXh0MR4wHAYDVQQDDBVpVGV4dFRlc3RJbnRlcm1lZGlhdGUw
 IBcNMDAwMTAxMDAwMDAwWhgPMjQwMDAxMDEwMDAwMDBaMDUxCzAJBgNVBAYTAkJF
 MQ4wDAYDVQQKDAVpVGV4dDEWMBQGA1UEAwwNaVRleHRUZXN0U2lnbjCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMaJ+B8HlKGXBhb64LuOiG/xGWn3RgU+
-D1i42xD4jRIjP3oL3hLefVtqQAgaP4HJa0mI1VWU2ezTbp5u11qo9eAefPq6jxaO
-rbC3VyT/FE4EcoEvr48N/1ZB0jnKLQlO2lzzVCqnL9gyC+soakGwLzFs9SKjkI4h
-/9YCnkoVtxOI/9ZDBf/QlJxrpknOPS9RQ8Y0OK+2OIb0kvK0f28EcvfopAnvOaVb
-AHIWypIDabuRcw/YXRbmxvj2c+t1dGC7f4CLv7YKiFsEpydUJDWRUYGLnE7GvO9d
-mS3oEFaI+Kre4HjSsaCF/Rgp9fpHKgaFTr8rKOGVgQHPlRFOrtGqXV8CAwEAAaNS
-MFAwHQYDVR0OBBYEFKwAjNPp8T/Q6cWJGYu9aMR/ujVCMB8GA1UdIwQYMBaAFKek
-g+UBOOgzMM6Ft6zCMa6k6H89MA4GA1UdDwEB/wQEAwIGwDANBgkqhkiG9w0BAQsF
-AAOCAQEARWKct75OvbvIGRpTN4lvqyPJS/ZoVa/Dddbdo2rD669qltAce3/DFY2R
-W0CNwIAxBh4CHqdlG5Od1qQ+BJH2pNGB6F2W/kmQuzaoo2PecDXNOfigRJASZO9O
-nSFh+tQc+9DTNWrYyBb1MUEgZd4z0Q98dX3mWJ3YMG5Fb0pbexgpiAX5s9T3X+Da
-olCzzmIRVIbce3UWv6T3fGvRJ/tyJ0VqvR8YBbVW15KaPabyZDE+v7QFizmoRFdw
-7Dfv2tKIA/8ENO13BztYq1USTYhirfrR5Ki2oiul1Nmg48JgQRMHgfeBKMl9auyR
-B6hPOeazdx/aJXMcZVIkYoWOPQsqVg==
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALMHHzTZo1BOQkZzEZl2Q3leNfBH20Yf
+O4R0l0ZBWbnpg/099ON4I8ItO0f24Wq0gs//+1adlJqeUMeUVxQ0fpu0cHQOc9h7
+CWJLnPAJjEvItZ5WXW4l8/ppo1bo4WLB1hToF42NfHgh7Laoj2gqVLWXS6Ngd8ch
+VxITaxfKA9PG56dje+PlJnTNi+ayudB/O57dhoaAu+sbxBhog/7zRAV87OsH9zxc
+Nuw+3ZzHhss5Lpn6F+/WDcHPyXsT7QkX6rvbRvxUOpcysXtCH3v5+ZRKyUqRPlI6
+3/hyMMZBDqYtFDHiawk587hbMp2swHF6z56d10Za22Vq9lxiX4MdftsCAwEAAaNS
+MFAwHQYDVR0OBBYEFFVqj/1gRbt6YJdo1/zMvcyOmY1cMB8GA1UdIwQYMBaAFIlA
+kiqUVGkQL00y55tlNrfwvGTVMA4GA1UdDwEB/wQEAwIGwDANBgkqhkiG9w0BAQsF
+AAOCAQEAMsIeJp6AHJwChOEddcGu5dD/Q4R6l7dMIe3Q8g8vDVz94572jmvHIOa5
+Q/xJALRFn5rG1oC06q6Gy4ffbUm5S1dNBXdmwyfNzAa5yAwXraIWkXLPM5zFUueB
+qu2ekfPhHq0NjCqhVCCYkhngaf+mqeuw8usML6mMf8o0aC6TlQu7GXm/6Z4SSKmY
+wDyM4iSVR3fZHb3R/VBP7+GNKsamapZPThdxueWnm6o2vsMKSfgGHRV/41BrUqb7
+t5SXDihXCImTpUr89EL7kix42Q/BFQ60hO3LYsKn4w8gjUQffQdlB2zR6cQJx2eK
+9jrkP1+J6xcuWHHrn2l9YXw6rI7r0g==
 -----END CERTIFICATE-----