diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml index afec293a..37de5c3b 100644 --- a/.github/workflows/manual-release.yml +++ b/.github/workflows/manual-release.yml @@ -30,7 +30,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v2 with: - go-version: '1.21' + go-version: '1.27.3' - run: go version - name: Install dependencies run: | diff --git a/.github/workflows/scheduled-release.yml b/.github/workflows/scheduled-release.yml index e89a91f6..933f6fbd 100644 --- a/.github/workflows/scheduled-release.yml +++ b/.github/workflows/scheduled-release.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v2 with: - go-version: '1.21' + go-version: '1.27.3' - run: go version - name: Install dependencies run: | diff --git a/Dockerfile b/Dockerfile index 0ccc3cef..65648eef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,8 @@ # Dockerfile to run the cfssl_trust release script locally. # WARP must be turned off to run the script. -# Provides Go 1.21, certdump, cfssl tools, and cfssl-trust +# Provides Go 1.27.3, certdump, cfssl tools, and cfssl-trust -FROM golang:1.21-bookworm +FROM golang:1.27.3-trixie # Install git and update CA certificates RUN apt-get update && apt-get install -y \ diff --git a/README.md b/README.md index 3c1e76c5..046ec2f0 100644 --- a/README.md +++ b/README.md @@ -52,6 +52,8 @@ systems. Currently, we have trust stores from #### Prerequisites +Use Go 1.27.3 or a later patched release for the release tools. + ``` $ go install git.wntrmute.dev/kyle/goutils/cmd/certdump@v1.7.7 $ go install github.com/cloudflare/cfssl/cmd/...@latest @@ -105,3 +107,20 @@ These calls to the `expiring` command will provide an output showing if there ar 1 certificates expiring. 0 certificates revoked. ``` + +### eMudhra compromise mitigation (October 2026) + +Following the [eMudhra intermediate key compromise](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/), +AAA Certificate Services and emSign ECC Root CA - G3 have been removed from +the root bundle in release `2026.10.0`. Dated distrust records prevent future +release rolls from including them. Historical releases and platform snapshots +are preserved for reproducibility. emSign Root TLS CA - G3 and the eight +compromised intermediate keys were absent from the bundles. The unaffected +emSign C1, C3, and G1 roots remain trusted. + +Removing these roots can also reject legitimate certificate chains. +Replacement intermediates are not included. + +Consumers must deploy the updated bundle and restart services that load roots +at startup. Rebuild Go services with Go 1.27.3 or Go 1.26.10 (or a later +patched release) to also block the compromised keys during path validation. diff --git a/ca-bundle.crt b/ca-bundle.crt index 3eebc770..82d818ff 100644 --- a/ca-bundle.crt +++ b/ca-bundle.crt @@ -604,31 +604,6 @@ ecQwn+uOuFW114hcxWokPbLTBQNRxgfvzBRydD1ucs4YKIxKoHflCStFREest2d/ AYoFWpO+ocH/+OcOZ6RHSXZddZAa9SaP8A== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb -MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow -GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj -YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL -MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE -BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM -GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua -BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe -3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4 -YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR -rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm -ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU -oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF -MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v -QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t -b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF -AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q -GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz -Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2 -G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi -l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3 -smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- MIIEPzCCAyegAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MQswCQYDVQQGEwJHQjEb MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEkMCIGA1UEAwwbU2VjdXJlIENlcnRp @@ -8409,21 +8384,6 @@ RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx iN66zB+Afko= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG -EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo -bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g -RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ -TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s -b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw -djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 -WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS -fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB -zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq -hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB -CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD -+JbNR6iC8hZVdyR+EhCVBCyj ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- MIIFcjCCA1qgAwIBAgIKLwq3aw3LSq8nWDANBgkqhkiG9w0BAQwFADBWMQswCQYD VQQGEwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJ bmMxHDAaBgNVBAMTE2VtU2lnbiBSb290IENBIC0gQzIwHhcNMTgwMjE4MTgzMDAw diff --git a/cert.db b/cert.db index 8969e54f..f6290128 100644 Binary files a/cert.db and b/cert.db differ diff --git a/certdata/aaa_cross_sign_test.go b/certdata/aaa_cross_sign_test.go new file mode 100644 index 00000000..bbbda37a --- /dev/null +++ b/certdata/aaa_cross_sign_test.go @@ -0,0 +1,39 @@ +package main + +import ( + "bytes" + "testing" +) + +// Keep the independently trusted roots, but not their dead-end AAA cross-signs. +// Verifiers without issuer backtracking can otherwise select an AAA-issued +// copy instead of the self-signed root and fail after AAA is distrusted. +func TestUSERTrustAndCOMODORootsDoNotDependOnAAA(t *testing.T) { + roots := map[string]bool{ + "USERTrust RSA Certification Authority": false, + "USERTrust ECC Certification Authority": false, + "COMODO RSA Certification Authority": false, + "COMODO ECC Certification Authority": false, + } + + for _, cert := range loadBundle(t, intBundleFile) { + if _, checked := roots[cert.Subject.CommonName]; checked && cert.Issuer.CommonName == aaaRootCommonName { + t.Errorf("%s contains AAA-issued cross-sign %q (serial %X)", + intBundleFile, cert.Subject.CommonName, cert.SerialNumber) + } + } + + for _, cert := range loadBundle(t, caBundleFile) { + if _, checked := roots[cert.Subject.CommonName]; !checked { + continue + } + if bytes.Equal(cert.RawSubject, cert.RawIssuer) && cert.CheckSignatureFrom(cert) == nil { + roots[cert.Subject.CommonName] = true + } + } + for name, found := range roots { + if !found { + t.Errorf("%s is missing self-signed root %q", caBundleFile, name) + } + } +} diff --git a/certdata/ca-bundle.txt b/certdata/ca-bundle.txt index a448dd2b..5d1c5ed6 100644 --- a/certdata/ca-bundle.txt +++ b/certdata/ca-bundle.txt @@ -407,21 +407,6 @@ Details: Basic constraints: valid, is a CA certificate, max path length 12 SANs (1): email:chambersignroot@chambersign.org CERTIFICATE -Subject: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester -Issuer: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester - Signature algorithm: RSA / SHA1 -Details: - Public key: RSA-2048 - Serial number: 1 - SKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - Valid from: 2004-01-01T00:00:00+0000 - until: 2028-12-31T23:59:59+0000 - Key usages: cert sign, crl sign - Basic constraints: valid, is a CA certificate - SANs (0): -CERTIFICATE Subject: /Secure Certificate Services/C=GB/O=Comodo CA Limited/L=Salford/ST=Greater Manchester Issuer: /Secure Certificate Services/C=GB/O=Comodo CA @@ -4409,21 +4394,6 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE -Subject: /emSign ECC Root CA - G3/C=IN/O=eMudhra Technologies - Limited/OU=emSign PKI -Issuer: /emSign ECC Root CA - G3/C=IN/O=eMudhra Technologies Limited/OU=emSign - PKI - Signature algorithm: ECDSA / SHA384 -Details: - Public key: ECDSA-secp384r1 - Serial number: 287880440101571086945156 - SKI: 7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42 - Valid from: 2018-02-18T18:30:00+0000 - until: 2043-02-18T18:30:00+0000 - Key usages: cert sign, crl sign - Basic constraints: valid, is a CA certificate - SANs (0): -CERTIFICATE Subject: /emSign Root CA - C2/C=US/O=eMudhra Inc/OU=emSign PKI Issuer: /emSign Root CA - C2/C=US/O=eMudhra Inc/OU=emSign PKI Signature algorithm: RSA / SHA384 diff --git a/certdata/int-bundle.txt b/certdata/int-bundle.txt index 3ce57776..4c1e9e9c 100644 --- a/certdata/int-bundle.txt +++ b/certdata/int-bundle.txt @@ -50,42 +50,6 @@ Details: Basic constraints: valid, is a CA certificate, max path length 11 SANs (1): email:ac_camerfirma@camerfirma.com CERTIFICATE -Subject: /COMODO RSA Certification Authority/C=GB/O=COMODO CA - Limited/L=Salford/ST=Greater Manchester -Issuer: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester - Signature algorithm: RSA / SHA384 -Details: - Public key: RSA-4096 - Serial number: 138068127363266052427974132567073013892 - AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - SKI: BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4 - Valid from: 2004-01-01T00:00:00+0000 - until: 2028-12-31T23:59:59+0000 - Key usages: cert sign, crl sign, digital signature - Basic constraints: valid, is a CA certificate - SANs (0): - OCSP server: - - http://ocsp.comodoca.com -CERTIFICATE -Subject: /COMODO ECC Certification Authority/C=GB/O=COMODO CA - Limited/L=Salford/ST=Greater Manchester -Issuer: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester - Signature algorithm: RSA / SHA384 -Details: - Public key: ECDSA-secp384r1 - Serial number: 30434779307599757625323899518303222751 - AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - SKI: 75:71:A7:19:48:19:BC:9D:9D:EA:41:47:DF:94:C4:48:77:99:D3:79 - Valid from: 2004-01-01T00:00:00+0000 - until: 2028-12-31T23:59:59+0000 - Key usages: cert sign, crl sign, digital signature - Basic constraints: valid, is a CA certificate - SANs (0): - OCSP server: - - http://ocsp.comodoca.com -CERTIFICATE Subject: /UTN-USERFirst-Client Authentication and Email/C=US/O=The USERTRUST Network/OU=http://www.usertrust.com/L=Salt Lake City/ST=UT Issuer: /AAA Certificate Services/C=GB/O=Comodo CA @@ -11844,42 +11808,6 @@ Details: OCSP server: - http://ocsps.ssl.com CERTIFICATE -Subject: /USERTrust RSA Certification Authority/C=US/O=The USERTRUST - Network/L=Jersey City/ST=New Jersey -Issuer: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester - Signature algorithm: RSA / SHA384 -Details: - Public key: RSA-4096 - Serial number: 76359301477803385872276235234032301461 - AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - SKI: 53:79:BF:5A:AA:2B:4A:CF:54:80:E1:D8:9B:C0:9D:F2:B2:03:66:CB - Valid from: 2019-03-12T00:00:00+0000 - until: 2028-12-31T23:59:59+0000 - Key usages: cert sign, crl sign, digital signature - Basic constraints: valid, is a CA certificate - SANs (0): - OCSP server: - - http://ocsp.comodoca.com -CERTIFICATE -Subject: /USERTrust ECC Certification Authority/C=US/O=The USERTRUST - Network/L=Jersey City/ST=New Jersey -Issuer: /AAA Certificate Services/C=GB/O=Comodo CA - Limited/L=Salford/ST=Greater Manchester - Signature algorithm: RSA / SHA384 -Details: - Public key: ECDSA-secp384r1 - Serial number: 114849002793238729640937462275813569940 - AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 - SKI: 3A:E1:09:86:D4:CF:19:C2:96:76:74:49:76:DC:E0:35:C6:63:63:9A - Valid from: 2019-03-12T00:00:00+0000 - until: 2028-12-31T23:59:59+0000 - Key usages: cert sign, crl sign, digital signature - Basic constraints: valid, is a CA certificate - SANs (0): - OCSP server: - - http://ocsp.comodoca.com -CERTIFICATE Subject: /HARICA SSL RSA SubCA R3/C=GR/O=Hellenic Academic and Research Institutions Cert. Authority/L=Athens Issuer: /Hellenic Academic and Research Institutions RootCA diff --git a/certdata/sslcom_chain_test.go b/certdata/sslcom_chain_test.go index 0e0f4ec0..3f02d3ce 100644 --- a/certdata/sslcom_chain_test.go +++ b/certdata/sslcom_chain_test.go @@ -28,44 +28,22 @@ func loadBundle(t *testing.T, file string) []*x509.Certificate { return certificates } -func aaaRootPool(t *testing.T) *x509.CertPool { - t.Helper() - for _, root := range loadBundle(t, caBundleFile) { - if root.Subject.CommonName == aaaRootCommonName { - pool := x509.NewCertPool() - pool.AddCert(root) - return pool - } - } - t.Fatalf("%s does not contain %q", caBundleFile, aaaRootCommonName) - return nil -} - func isSSLcomTLSIssuingOrTransitCA(cert *x509.Certificate) bool { name := cert.Subject.CommonName return cert.IsCA && strings.HasPrefix(name, "SSL.com ") && (strings.Contains(name, " TLS Issuing ") || strings.Contains(name, " TLS Transit ")) } -// SSL.com TLS Issuing/Transit CAs in the intermediate bundle must not be -// copies issued by AAA Certificate Services. AAA has been removed from Chrome -// and Mozilla, and an AAA-issued copy of the CA that signs the leaf makes the -// whole chain depend on AAA (SECENG-14034). An AAA cross-sign of SSL.com TLS -// Root CA 2022 is allowed: clients that trust Root CA 2022 stop there, and -// only legacy clients use the AAA path. +// SSL.com TLS Issuing/Transit CAs must chain to SSL.com roots without +// depending on the distrusted AAA Certificate Services root. func TestSSLcomTLSIssuingAndTransitCAsAreNotIssuedByAAARoot(t *testing.T) { - aaa := aaaRootPool(t) checked := 0 for _, cert := range loadBundle(t, intBundleFile) { if !isSSLcomTLSIssuingOrTransitCA(cert) { continue } checked++ - _, err := cert.Verify(x509.VerifyOptions{ - Roots: aaa, - KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}, - }) - if err == nil { + if cert.Issuer.CommonName == aaaRootCommonName { t.Errorf("%q (serial %X) is issued by %q", cert.Subject.CommonName, cert.SerialNumber, aaaRootCommonName) } diff --git a/int-bundle.crt b/int-bundle.crt index dedb34de..6b257259 100644 --- a/int-bundle.crt +++ b/int-bundle.crt @@ -102,61 +102,6 @@ rjLBmA9ppOcTyiBWhpw607UOt4YVnns1YwlPAoNmMeEVOoDDUAm7Gx53DwSFCs3N bg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIFfjCCBGagAwIBAgIQZ970PvF72uJP9ZQGBtLAhDANBgkqhkiG9w0BAQwFADB7 -MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD -VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE -AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4 -MTIzMTIzNTk1OVowgYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1h -bmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBM -aW1pdGVkMSswKQYDVQQDEyJDT01PRE8gUlNBIENlcnRpZmljYXRpb24gQXV0aG9y -aXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAkehUktIKVrGsDSTd -xc9EZ3SZKzejfSNwAHG8U9/E+ioSj0t/EFa9n3Byt2F/yUsPF6c947AEYe7/EZfH -9IY+Cvo+XPmT5jR62RRr55yzhaCCenavcZDX7P0N+pxs+t+wgvQUfvm+xKYvT3+Z -f7X8Z0NyvQwA1onrayzT7Y+YHBSrfuXjbvzYqOSSJNpDa2K4Vf3qwbxstovzDo2a -5JtsaZn4eEgwRdWt4Q08RWD8MpZRJ7xnw8outmvqRsfHIKCxH2XeSAi6pE6p8oNG -N4Tr6MyBSENnTnIqm1y9TBsoilwie7SrmNnu4FGDwwlGTm0+mfqVF9p8M1dBPI1R -7Qu2XK8sYxrfV8g/vOldxJuvRZnio1oktLqpVj3Pb6r/SVi+8Kj/9Lit6Tf7urj0 -Czr56ENCHonYhMsT8dm74YlguIwoVqwUHZwK53Hrzw7dPamWoUi9PPevtQ0iTMAR -gexWO/bTouJbt7IEIlKVgJNp6I5MZfGRAy1wdALqi2cVKWlSArvX31BqVUa/oKMo -YX9w0MOiqiwhqkfOKJwGRXa/ghgntNWutMtQ5mv0TIZxMOmm3xaG4Nj/QN370EKI -f6MzOi5cHkERgWPOGHFrK+ymircxXDpqR+DDeVnWIBqv8mqYqnK8V0rSS527EPyw -TEHl7R09XiidnMy/s1Hap0flhFMCAwEAAaOB8jCB7zAfBgNVHSMEGDAWgBSgEQoj -PpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUu69+Aj36pvE8hI6t7jiY7NkyMtQw -DgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRV -HSAAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB -QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF -BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUAA4IB -AQB/8lY1sG2VSk50rzribwGLh9Myl+34QNJ3UxHXxxYuxp3mSFa+gKn4vHjSyGMX -roztFjH6HxjJDsfuSHmfx8m5vMyIFeNoYdGfHUthgddWBGPCCGkm8PDlL9/ACiup -BfQCWmqJ17SEQpXj6/d2IF412cDNJQgTTHE4joewM4SRmR6R8ayeP6cdYIEsNkFU -oOJGBgusG8eZNoxeoQukntlCRiTFxVuBrq2goNyfNriNwh0V+oitgRA5H0TwK5/d -EFQMBzSxNtEU/QcCPf9yVasn1iyBQXEpjUH0UFcafmVgr8vFKHaYrrOoU3aL5iFS -a+oh0IQOSU6IU9qSLucdCGbX ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIID0DCCArigAwIBAgIQFuWGeOBwlDlL39tO/KY73zANBgkqhkiG9w0BAQwFADB7 -MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD -VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE -AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4 -MTIzMTIzNTk1OVowgYUxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1h -bmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBM -aW1pdGVkMSswKQYDVQQDEyJDT01PRE8gRUNDIENlcnRpZmljYXRpb24gQXV0aG9y -aXR5MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEA0d7L3XJghWF+3XkkRbUq2KZ9T5S -CwbOQQB/l+EKJDwdAQTuPdKNCZcM4HXk+vt3iir1A2BLNosWIxatCXH0SvQoULT+ -iBxuP2wvLwlZW6VbCzOZ4sM9iflqLO+y0wbpo4HyMIHvMB8GA1UdIwQYMBaAFKAR -CiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBR1cacZSBm8nZ3qQUfflMRId5nT -eTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zARBgNVHSAECjAIMAYG -BFUdIAAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v -QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsG -AQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQEMBQAD -ggEBAHjsU4nMWJ1jJdsVWxa5HLKxt/Sqib3Q3lS5DHsjKGKRfUDdSFnlAiG3Vll+ -pX8MHWp4E0PgONUsALAM+7HcSCWDcNnkguU8PovJrH0XMBfXS1Pm3tXpUwBd/sj1 -aZUekAaDZ9Ww02ZKaCDON9X/jKsRG6j5koYCtWuS4hH/GEvLDPX+VCPCcC+NKMjU -VxP8AzvKBA/5CSp+1C3pXY8X4cRyjCWJFScGWOioc+NAaQZtGrJ5pp0WqASWeQYJ -b2uQlNzRYBFWgodwJX8Kx7rSAPJHX3LgVsZtL7a+bOzRKQCoeRmtRo9V9jNJH8HJ -MppQ/qXxmyYQTzbZCA3K17HKM8w= ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- MIIE3TCCA8WgAwIBAgIQcZL75hlfrE0ShXRxNKIYpzANBgkqhkiG9w0BAQUFADB7 MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE @@ -20241,61 +20186,6 @@ MKW0h3F9JW/NX/F7oYtWrxljheH8n2BrkDybAjEAlCxkLE0vQTYcFzrR24oogyw6 VkgTm92+jiqJTO5SSA9QUa092S5cTKiHkH2cOM6m -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIFgTCCBGmgAwIBAgIQOXJEOvkit1HX02wQ3TE1lTANBgkqhkiG9w0BAQwFADB7 -MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD -VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE -AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDMxMjAwMDAwMFoXDTI4 -MTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5 -MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO -ZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0 -aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sI -s9CsVw127c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnG -vDoZtF+mvX2do2NCtnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQ -Ijy8/hPwhxR79uQfjtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfb -IWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0 -tyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97E -xwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNV -icQNwZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5 -D9kCnusSTJV882sFqV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJ -WBp/kjbmUZIO8yZ9HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ -5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzG -KAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaOB8jCB7zAfBgNVHSMEGDAWgBSg -EQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rID -ZsswDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAG -BgRVHSAAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29t -L0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggr -BgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUA -A4IBAQAYh1HcdCE9nIrgJ7cz0C7M7PDmy14R3iJvm3WOnnL+5Nb+qh+cli3vA0p+ -rvSNb3I8QzvAP+u431yqqcau8vzY7qN7Q/aGNnwU4M309z/+3ri0ivCRlv79Q2R+ -/czSAaF9ffgZGclCKxO/WIu6pKJmBHaIkU4MiRTOok3JMrO66BQavHHxW/BBC5gA -CiIDEOUMsfnNkjcZ7Tvx5Dq2+UUTJnWvu6rvP3t3O9LEApE9GQDTF1w52z97GA1F -zZOFli9d31kWTz9RvdVFGD/tSo7oBmF0Ixa1DVBzJ0RHfxBdiSprhTEUxOipakyA -vGp4z7h/jnZymQyd/teRCBaho1+V ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIID0zCCArugAwIBAgIQVmcdBOpPmUxvEIFHWdJ1lDANBgkqhkiG9w0BAQwFADB7 -MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD -VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE -AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDMxMjAwMDAwMFoXDTI4 -MTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5 -MRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO -ZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgRUNDIENlcnRpZmljYXRpb24gQXV0 -aG9yaXR5MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEGqxUWqn5aCPnetUkb1PGWthL -q8bVttHmc3Gu3ZzWDGH926CJA7gFFOxXzu5dP+Ihs8731Ip54KODfi2X0GHE8Znc -JZFjq38wo7Rw4sehM5zzvy5cU7Ffs30yf4o043l5o4HyMIHvMB8GA1UdIwQYMBaA -FKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1 -xmNjmjAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zARBgNVHSAECjAI -MAYGBFUdIAAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5j -b20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQG -CCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQEM -BQADggEBABns652JLCALBIAdGN5CmXKZFjK9Dpx1WywV4ilAbe7/ctvbq5AfjJXy -ij0IckKJUAfiORVsAYfZFhr1wHUrxeZWEQff2Ji8fJ8ZOd+LygBkc7xGEJuTI42+ -FsMuCIKchjN0djsoTI0DQoWz4rIjQtUfenVqGtF8qmchxDM6OW1TyaLtYiKou+JV -bJlsQ2uRl9EMC5MCHdK8aXdJ5htN978UeAOwproLtOGFfy/cQjutdAFI3tZs4RmY -CV4Ks2dH/hzg1cEo70qLRDEmBDeNiXQ2Lu+lIg+DdEmSx/cQwgwp+7e9un/jX9Wf -8qn0dNW44bOwgeThpWOjzOoEeJBuv/c= ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- MIIHDTCCBPWgAwIBAgIQQNuabltugn1IBLpOCqC9DzANBgkqhkiG9w0BAQsFADCB pjELMAkGA1UEBhMCR1IxDzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVu aWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRo