From 324279c17f6c02f93ad9a40e483ba7c93c91d0c2 Mon Sep 17 00:00:00 2001 From: Andrew Berglund Date: Tue, 20 Oct 2026 14:58:40 -0500 Subject: [PATCH] Update CA bundle path compatibility Remove two obsolete cross-signed CA certificates from the current intermediate bundle while retaining both self-signed roots and reverse-direction cross-signs. Preserve historical bundle snapshots and add regression coverage. Validation: go test ./... -count=1 and go vet ./... --- cert.db | Bin 58126336 -> 58126336 bytes certdata/epki_cross_sign_test.go | 48 ++++++++++++++++++ certdata/int-bundle.txt | 40 --------------- int-bundle.crt | 83 ------------------------------- 4 files changed, 48 insertions(+), 123 deletions(-) create mode 100644 certdata/epki_cross_sign_test.go diff --git a/cert.db b/cert.db index f6290128b3b559aa615c5de70ff9725bd77e798d..5736575cc8e3f7a3debe30f03691a5f3c7c87230 100644 GIT binary patch delta 4157 zcmW;NRa6yR6M$jQ0RgeF161r5EL807?jE}X?8X>dz{Eb--HI)CcemKxU7!EF|Hb>P z*;jk5eK9*M?v8Jm73u2;nC@565inX*94bx~Hx+l4_$nSMo+@4{2~@mQ5~?IpNvx7Y zC8>&!N-~w?Dk)S_s-#j$t&&D1tx7tT^eVn8ekvJMGOA=!@mI;Ll0_w}N;Z}3Dmheg zs^n71t&&G2uS!0Z{3-=h0#pK33aS)RDXdaNrKn1fN->qX{^#jrKw6Y zmF6lfR9dREQfaNyMy0Kay-z!p_9`7zI;wP1>8#R4rK?IemF_A%RC=oPQt7SIN2RYy zh)SqRKb8I}15^g83{n}aGDKyl$}pATDkD@zs*F+zQyHx?MrEwZI2BbHuQEYpqRJ$d z$tqJ+rm9R+30H|wiBy@cGDBsi$}E-HDsxn#ROYJ8Q<<-_KxLuIB9+A|E|qANB`Ql* zmZ>aPS)sC0WtGZml{G4BRo1DjSJ|MlQDu|LW|b`}TUEBHY**Q_Lt>UEbq|a;GoCA> z6m$BydtLXM7UdsZC4E#SpO_q;&RcH3+_t*8LN?!Xri+S#}vlx@ujsu3I;(o7OGswspt4Yu&T%TMw)_>!J0?dTc$h zo?6eW=hh4BrS-~sZN0JHTJNm))(7jO^~w5deX+h;->mP}59_D(%ld8ovHn{BS^uVt zN$H5NzzJ^P4)MVQJi!YRfHx$BM35MgKvM95WRM(E!2j<^#grP-Kw3x#>A@HLAOmEC zOyCchAq!-MY>*vtKu*X7xgihag?x}73P1n^LP015g`o%(g&-&f#i0ZQLrEwFrJ)Rz zg>q0HDnLc31eKu*RE26#9cn;Ls0Fp54%CHuP#+pVLudqzp$RmFX3!j3Kuc%^t)UIH z1%Yea}Pv`}`p%3(h5D0~S&>sfCKo|srVF(O`VK5vCS+4QpU6tb_Hi0XD)W*bG}>D{O=9umfUXC+vdVum|?SKG+WjAQle7 zAvg?2;3yn}<8T5_!YMcnXW%THgY$3!F2W_a3|HVPT!ZUy18%}CxD9vUF5H9r@BrfA zAv}V|@C2U1Gk6X!;3d3**YF13!aH~mAK)W=g3s^;zQQ;74nN>0{DR-`2mZo;@XulE z&uN1LoZtrT5Fb3i6TBb+ctb)+1c@ODBn2Nx=8U!V=N!|+y`UpBo-0vgsH0(2+l#?I zj!;+M$aRjKiz25uy`#dzd~>;?M<;itiM<<^+&Mdm%e{7gw}|k_SUIg+R&FbgmDkE=<+lo00al<@&?;mV zwu)Fqod+U=oDP3?&pPpfT=6#tIm@}Kn}N=`@$Bav>C7BE*N!nBu3b0#yUmD*+Zp6E zia~KG0l`obNImMnM>ihA}V}#(~0km;e)D5=@3EFcqdjI7C1sOotgT6K26|m;+HT z7v{lySO5!Q5iAB5M8gtT3d>+QtbmoU3Rc4!SPSc5J#2uDun9K97T5~gU_0!97}yEB zU^nc6y|54V!vTnegK!8A!x1hk;66NnICuz;;4wUbr|=A(!wYx`ui!Pjfw%Au-opp@2%q3He1Wg<4Zgz< z_zAz@H~fLW@E`nhPKn#;W`hHq;0EpxA3VSlydVL1LqbRdi6IFj1s_NT$sq-#gjA3k z(m+~B2kF5V{2&8lgiPQMnIQ{gg=~-=azIYV1-T&)lKKN9Y8dp$l|{ZqOZiKu_oey`c~Eg%AjZeqjHetv|O| KTYql;#s3F@cI@;3 delta 4220 zcmYM#RaBLG6M%8|-himsEp{h@fvsRCcGuY5-56sFnAqFy4s5ZzyT$JAI-YsXckx|3 zzcuTB^RD$?%!J0=_6@Znd>wvM)0T7ijT9A!ic`g<;-TWH;-wN>#aktgN?etADn2Ul zRT8KqR7s?gSS5){Qk7&X$yHLQq*O_zl3FE=imysqm2@iURWhh#RLP{0StW}~R+Vfj z*;R6=YRs2-~R0^mRR4JrVSS3)Uh)PkFVk*T|N~n}nDWy_c zrHo3DO0Y^v=S*40fRh4Qg)m3V!gs9Y1sijg|rH)Enm3k`mRT`)? zRB5ErSfz8a97rMF5SmA)$dRQjt7P#LH)NM*3f5S5`S!&HW=j8F+x8L2W#Wwgo|6;&ClGEQZ@ z$^?~(Dw9+ut4vV|QwdjzP?@SSO=Y^u43(KGvs5BgW~g#|v~|EbXdSW+TSu&;)-mh2b;3Gnow80_XRNc$-Kr zx@q0AZd-S(yVgDHz7=CVupU~EtjE?9>#6n3dTzb2URtlL*VY^Bt@X}&Z+);nTA!@X z))(um_09Tj{jh#ozpUTZAL}3M@1)>lj&KW{-~tcu1TTmU-Vg`kLOk$+_>ce+LLx{E zNgyfw_l@LCDIg`Jg4B=(d?78QgY=LAGD0TE3|Sy6WP|LG19Czx$PIZQFXRJ1$PfMy z00p2R6oSGK2t}YM6ocYW0!l(DC=F#G2!f$3l!Nk60V+Zzs0>x0DpZ5&Py<4sCe(u3 zPzUNlJ*W>2pdmDZ#?Sq2HHY9Xb&BrBXok!&;`0eH|P#MpeOW# z-p~j7LOhCQ$s_Q8ILh68XA4#8nK0!QH(9ETHd5>CNsI0I+l9Gr&>a1k!S zWw-)Y;Tl|r8*meD!ELw$ci|q~hZuMO58)9!h9~e8p22f?0WaYdyoNXM7T&>o_y8Z_ z6MTj*@D;wnclZH6;TQadKkyIyb=dlI+TZ{uxWEHE!3$!8H^hOs5D$DHJ|uvIkO&ex zqiy{;4|j2U1U+$dba#J$#F5J#9@Es}9T^tto725$WD;k}=sTfFoHG+RD*t!P%6Jy@ z^LI{kZ*E-L@&7{>5*Crf85WV$N@gXuQdlXiR90#$jpb{lwbEJXtqfL1E0dMk%3@`; zvRT=!99B*%mzCSfW97B-S$gXYizT7p0;Xbo+kEwqF7&;dF^C+G}apeuBP?$85zLNDkIeV{M&gZ?l8 z2Erg13`1Zj41?h?0zzRVjDpcH1{B7^I2aETU?NO{$uI@NARHoKDolgvFau`7EQo~J zFbC$sJeUs)U?I3+5iEu!uoRZTa##T?VHK=~HLw=e!Ft#L8(|Y{hApraw!wCYf*r6E zcEN7g1AAc~?1yML00-d^9EKxs6pq1hH~}Z&6r6@La2C$NdAI-<;SyYiD{vLA!F9L+ zH{llChC6THUH0#D%?Jck$X5?;Y;cmr?Y9lVDR@DV=2XZQkN;TwF1 zAMg`?!Eg8j|G;18q?jEp8yw&S7kGdtctLFNhBy!x;(-suhXjxi5i2GNCUo*7Scg_$N(836J&-gkQK5)cE|xaAs6I^JdhXifgj`te+YmAP!I}1VF-jG zP!x(maVP;Lp%j#cG7tp8P!`HTd8hytp%PSvDo_=wL3OABAy5-)L2al5b)g>AhX&9P z8bM=d0!^VAG=~<@5(HX7YiI*)p&hh`4$u)gL1*X!U7;IvhaS)qdO>gK1AU>NE85nd ID`U}r0pJ#-t^fc4 diff --git a/certdata/epki_cross_sign_test.go b/certdata/epki_cross_sign_test.go new file mode 100644 index 00000000..9ec0bd07 --- /dev/null +++ b/certdata/epki_cross_sign_test.go @@ -0,0 +1,48 @@ +package main + +import ( + "bytes" + "crypto/x509" + "slices" + "testing" +) + +// Cross-signs must provide paths to the older root without allowing issuer +// selection to cycle between the older root and G2. +func TestEPKICrossSignsDoNotFormLoop(t *testing.T) { + var older, g2 *x509.Certificate + for _, cert := range loadBundle(t, caBundleFile) { + // Trust anchors do not depend on their historical self-signature algorithm. + if !cert.IsCA || !bytes.Equal(cert.RawSubject, cert.RawIssuer) { + continue + } + if slices.Contains(cert.Subject.OrganizationalUnit, "ePKI Root Certification Authority") { + older = cert + } + if cert.Subject.CommonName == "ePKI Root Certification Authority - G2" { + g2 = cert + } + } + if older == nil || g2 == nil { + t.Fatal("both self-signed ePKI roots must remain in the root bundle") + } + + reverseCrossSigns := 0 + for _, cert := range loadBundle(t, intBundleFile) { + if bytes.Equal(cert.RawSubject, older.RawSubject) && bytes.Equal(cert.RawIssuer, g2.RawSubject) { + t.Errorf("older ePKI root issued by G2 can form a loop (serial %X)", cert.SerialNumber) + } + if bytes.Equal(cert.RawSubject, g2.RawSubject) && bytes.Equal(cert.RawIssuer, older.RawSubject) { + if !bytes.Equal(cert.RawSubjectPublicKeyInfo, g2.RawSubjectPublicKeyInfo) { + t.Error("ePKI G2 cross-sign does not share the retained G2 root's key") + } + if err := cert.CheckSignatureFrom(older); err != nil { + t.Errorf("ePKI G2 cross-sign cannot terminate at the older root: %v", err) + } + reverseCrossSigns++ + } + } + if reverseCrossSigns == 0 { + t.Error("missing ePKI G2 cross-signs supporting clients that trust only the older root") + } +} diff --git a/certdata/int-bundle.txt b/certdata/int-bundle.txt index 4c1e9e9c..8f35fa94 100644 --- a/certdata/int-bundle.txt +++ b/certdata/int-bundle.txt @@ -3505,46 +3505,6 @@ Details: OCSP server: - http://uniper-group-ca-2-2015.ocsp.d-trust.net CERTIFICATE -Subject: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification - Authority -Issuer: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co., - Ltd. - Signature algorithm: RSA / SHA256 -Details: - Public key: RSA-4096 - Serial number: 7083007561045021846628119216699988972 - AKI: 72:5B:BA:AA:72:38:EE:25:90:24:B5:94:22:FA:09:88:CA:8B:0A:FB - SKI: 1E:0C:F7:B6:67:F2:E1:92:26:09:45:C0:55:39:2E:77:3F:42:4A:A2 - Valid from: 2015-11-17T08:31:41+0000 - until: 2034-12-20T02:31:27+0000 - Key usages: cert sign, crl sign - Basic constraints: valid, is a CA certificate - SANs (0): - 1 AIA: - http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b - OCSP server: - - http://ocsp.eca.hinet.net/OCSP/ocspG2sha2 -CERTIFICATE -Subject: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification - Authority -Issuer: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co., - Ltd. - Signature algorithm: RSA / SHA256 -Details: - Public key: RSA-4096 - Serial number: 269677336687240111117627827670483958575 - AKI: 72:5B:BA:AA:72:38:EE:25:90:24:B5:94:22:FA:09:88:CA:8B:0A:FB - SKI: 1E:0C:F7:B6:67:F2:E1:92:26:09:45:C0:55:39:2E:77:3F:42:4A:A2 - Valid from: 2015-11-17T08:31:41+0000 - until: 2034-12-20T02:31:27+0000 - Key usages: cert sign, crl sign - Basic constraints: valid, is a CA certificate - SANs (0): - 1 AIA: - http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b - OCSP server: - - http://ocsp.eca.hinet.net/OCSP/ocspG2sha2 -CERTIFICATE Subject: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co., Ltd. Issuer: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification diff --git a/int-bundle.crt b/int-bundle.crt index 6b257259..ec222300 100644 --- a/int-bundle.crt +++ b/int-bundle.crt @@ -6271,89 +6271,6 @@ fEoIXppf8vB10x3mNeBW4L+KFVPATupuTQarDILbbpVObH8RtXk6nis3+G1yDn5i nNKFefD+IxxpmvL+aPWgT+IpfdSnWTsviER93t9Z+XTtKie9vSs= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIHNTCCBR2gAwIBAgIQBVQjPBnG8p6lFfhbaJfb7DANBgkqhkiG9w0BAQsFADBj -MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0 -ZC4xLzAtBgNVBAMMJmVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt -IEcyMB4XDTE1MTExNzA4MzE0MVoXDTM0MTIyMDAyMzEyN1owXjELMAkGA1UEBhMC -VFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBMdGQuMSowKAYDVQQL -DCFlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3 -DQEBAQUAA4ICDwAwggIKAoICAQDhJQ/ujduIM3Vnza0ffTpObZ3TLxTzY3TLASFq -N+qEUAdLJlsJQ2whnmrI1QP1YGmPzPAi5B/n92oiMbcsFfLg/gBqQ/+HZca1GsGn -TG0icCGKMfKXdIkJEiYcnsrZEqKVPNrpZ78IoGTj1kK3Re+X9Pb117VKFQJYfZhY -S2C8zdcNmhMzU9Fh+XrV13izmjP3AIbOHU2UOK+o7HhRcIpcEINRIfcRPTSGXuVI -zZeBgjVMGexl9mvFBaHuRxPWsyEnlBAK2SQ7ur5EE0YwP5c82NfXau47OOMr1JcO -uRvnB0l/Nyr5d3jPVO1bRp2jgA6RQ8HWW18Uup+mjSRHQFm/cjiyNmw3/5nRXQ5Z -Cqtp98CyBEV6VACuvlP2tefh+DyjMdKp/iFSZMWmZ/B1BwaUFIFVxifkAY8XwWpx -175L+5RYfX4RM7FC92JsGNbPCWg+f2z2Ho9iraVj2wmnHyJCQR5vmYo+1/k/QHp5 -sKUBktKdPQgVpRABLbMydqiVDbN6mvsHEHgRb+GPx7oPJRp0KuUcmEGZ3yGH6JUG -agqzakd2ZfY6z49iFxl7CijNGtKDHiHHLL++/2Fot2cbu3hNjc5n5eTBjrcjZuKd -kHU0mKk2K4qalLmd7MyKsfgliVxati+MH215JKdSaMOENeJmjWMOJU3VGbLmeTen -Ip1UMQIDAQABo4IB6DCCAeQwHwYDVR0jBBgwFoAUclu6qnI47iWQJLWUIvoJiMqL -CvswHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMA4GA1UdDwEB/wQEAwIB -BjA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vZWNhLmhpbmV0Lm5ldC9yZXBvc2l0 -b3J5L0NSTDIvQ0EuY3JsMIGLBggrBgEFBQcBAQR/MH0wRAYIKwYBBQUHMAKGOGh0 -dHA6Ly9lY2EuaGluZXQubmV0L3JlcG9zaXRvcnkvQ2VydHMvSXNzdWVkVG9UaGlz -Q0EucDdiMDUGCCsGAQUFBzABhilodHRwOi8vb2NzcC5lY2EuaGluZXQubmV0L09D -U1Avb2NzcEcyc2hhMjAPBgNVHRMBAf8EBTADAQH/MIG0BgNVHSAEgawwgakwDQYL -KwYBBAGBtyNkAAEwDQYLKwYBBAGBtyNkAAIwDQYLKwYBBAGBtyNkAAMwDQYLKwYB -BAGBtyNkAAQwDQYLKwYBBAGBtyNkAAAwCQYHYIZ2AWQAATAJBgdghnYBZAACMAkG -B2CGdgFkAAMwCQYHYIZ2AWQABDAJBgdghnYBZAAAMAgGBmeBDAECATAIBgZngQwB -AgIwCAYGZ4EMAQIDMAcGBWeBDAEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFQwADfZ99 -HtG9yxM4ll7ky9eZOoLuH+IpuC/F1trdc5oWCR087nOHPkDNRlbQbkZljYTg7qG3 -5LgtugFBXc0LPuwAPlKDngdRJguL9vfMDSnisW7JXFsv3ArG5zeyVn+vqK1+cqPa -Pd/LdfpL0YFTWHEXyPnOUm7x97Dy9wU9dtE/h1G6L2AQmIkYK+fpIeXEN7uz4vio -pcPvxEykO8QkAR74vLrLj87lKJABY6BvRbzkR+mFTvC1u1DOKeyUdSWYnOgVgcpV -RXE5IyleB35EcyYSBLw6PAyV9+E4G6Gl3p8AQtD1QpIvMuKKLWqNHIF7fISv3VSj -829LyyqRvPTwBywgYXMYOM2OmiGZYbooBDDsxOefyEPVKfw4vk84JQOoyKV/LtSJ -4KAv1WFWefdoAfSzfK9EgH7q0f4+H0xx1lv4y47gyXyxVBIt0FdXrgsUs0MdCLTe -CfB7BIWbofJ6241+ugEa0/JtJM1tUjIL0BeTAws+WFBIr46SeXPitJgQUfvVp7zA -5Pgjmb8robprTMIAv1Hmlz4krE77hydE/APsZGH68gq/n//2CxHrj9qhADleYjNA -oZEmf1C9NsaEya7pUzBUwcf/BQidnnAxz+pODwNBUIKC+cwPF+8uFx82AMujEfWz -6WQ3FGbvbR5swAxI2gqIrtbfAmVRxMFvCw== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIHdTCCBV2gAwIBAgIRAMrh9z78rFuxnIjBxy9vey8wDQYJKoZIhvcNAQELBQAw -YzELMAkGA1UEBhMCVFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBM -dGQuMS8wLQYDVQQDDCZlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg -LSBHMjAeFw0xNTExMTcwODMxNDFaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYT -AlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UE -CwwhZVBLSSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG -9w0BAQEFAAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEh -ajfqhFAHSyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrB -p0xtInAhijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2Y -WEtgvM3XDZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7l -SM2XgYI1TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SX -Drkb5wdJfzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0O -WQqraffAsgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fq -cde+S/uUWH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6 -ebClAZLSnT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iV -BmoKs2pHdmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2bi -nZB1NJipNiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3 -pyKdVDECAwEAAaOCAicwggIjMB8GA1UdIwQYMBaAFHJbuqpyOO4lkCS1lCL6CYjK -iwr7MB0GA1UdDgQWBBQeDPe2Z/LhkiYJRcBVOS53P0JKojAOBgNVHQ8BAf8EBAMC -AQYwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2VjYS5oaW5ldC5uZXQvcmVwb3Np -dG9yeS9DUkwyL0NBLmNybDCBiwYIKwYBBQUHAQEEfzB9MEQGCCsGAQUFBzAChjho -dHRwOi8vZWNhLmhpbmV0Lm5ldC9yZXBvc2l0b3J5L0NlcnRzL0lzc3VlZFRvVGhp -c0NBLnA3YjA1BggrBgEFBQcwAYYpaHR0cDovL29jc3AuZWNhLmhpbmV0Lm5ldC9P -Q1NQL29jc3BHMnNoYTIwDwYDVR0TAQH/BAUwAwEB/zCB8wYDVR0gBIHrMIHoMA0G -CysGAQQBgbcjZAABMA0GCysGAQQBgbcjZAACMA0GCysGAQQBgbcjZAADMA0GCysG -AQQBgbcjZAAEMA0GCysGAQQBgbcjZAAJMA0GCysGAQQBgbcjZAAAMAkGB2CGdgFk -AAEwCQYHYIZ2AWQAAjAJBgdghnYBZAADMAkGB2CGdgFkAAQwCQYHYIZ2AWQAADAI -BgZngQwBAgEwCAYGZ4EMAQICMAgGBmeBDAECAzA3BgVngQwBATAuMCwGCCsGAQUF -BwIBFiBodHRwczovL2VjYS5oaW5ldC5uZXQvcmVwb3NpdG9yeTANBgkqhkiG9w0B -AQsFAAOCAgEAbvb5/9P544BlP4nZKjoQ/tzh5CZ/WUg+JAQgMblhtRa1Zmhpl2HD -R1rzt/jRjxOhZMqtO1ogNI6KvESAt0pBBMZv9CTBvZv47p4HnuLxCxgFBk1s73vo -uFc13OfAeV3EVAdzSrCZLfJHHfnuvPExW4SlmEzKp3seetbjH4DUSO6ZlwKUCTme -p4DzbP82kDnwC7igowL0w+PKZYGiNvyjZr6/V1HLOn6Z6eBqVUeIgoJRxe49PbLc -FFKXQdoMzAeElONPUpkv7/AX7CxflnbMWNwOCFrcT6pF3kLErgz8cA0PkW6gObjU -zYs9Uk4dGI8AU4DSvamYe6abqPEBDjFec2EbycftofsqfGNF9T8HAZDAT7HnvKnT -lRnQU66+IJo4Hw9LNjP/NwH+ZZJaRmyE870f+Lp+I6r/aS3yDARIqK6ZVrXh9VU4 -wWNoLRWpvuUIFbVpXl8cNTHgp7QEq6oUTgCDwy9LrinBiV44PGtEHC/2U1zrbuwk -uIRo3Dgf+lMYOLbTAYiWm807/P0kJ/fzBO+/0cReN1n1blmMrl1WFJaPRehqL1YU -2BAcJ3TM+E5yQJzQqHPXywTHPnRJO7Nn4iJmR3bSeW1w5GhVdeP69+IO0CM0Au1c -U9jG7d32NlY1QTMUJo22nmCCAEJKAEomOyJJ+l7BFmnnYG/UQUWuKGs= ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- MIIHZDCCBUygAwIBAgIRAK/NjWQsYtZFBn3IV/2o8V0wDQYJKoZIhvcNAQELBQAw XjELMAkGA1UEBhMCVFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBM dGQuMSowKAYDVQQLDCFlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw