Add tests for start_tls

https://github.com/python-ldap/python-ldap/pull/42 Signed-off-by: Christian Heimes <cheimes@redhat.com>
ECN · Nov 28, 2017 · 5f8c419 · 5f8c419
1 parent 1626749
commit 5f8c419
Show file tree

Hide file tree

Showing 13 changed files with 580 additions and 0 deletions.
diff --git a/Lib/slapdtest.py b/Lib/slapdtest.py
@@ -37,6 +37,12 @@
 suffix "%(suffix)s"
 rootdn "%(rootdn)s"
 rootpw "%(rootpw)s"
+
+TLSCACertificateFile "%(cafile)s"
+TLSCertificateFile "%(servercert)s"
+TLSCertificateKeyFile "%(serverkey)s"
+# ignore missing client cert but fail with invalid client cert
+TLSVerifyClient try
 """
 
 LOCALHOST = '127.0.0.1'
@@ -140,6 +146,15 @@ def __init__(self):
         self.ldap_uri = "ldap://%s:%d/" % (LOCALHOST, self._port)
         ldapi_path = os.path.join(self.testrundir, 'ldapi')
         self.ldapi_uri = "ldapi://%s" % quote_plus(ldapi_path)
+        # TLS certs
+        capath = os.path.abspath(os.path.join(
+            os.getcwd(), 'Tests/certs'
+        ))
+        self.cafile = os.path.join(capath, 'ca.pem')
+        self.servercert = os.path.join(capath, 'server.pem')
+        self.serverkey = os.path.join(capath, 'server.key')
+        self.clientcert = os.path.join(capath, 'client.pem')
+        self.clientkey = os.path.join(capath, 'client.key')
 
     def _check_requirements(self):
         binaries = [
@@ -218,6 +233,9 @@ def gen_config(self):
             'rootpw': self.root_pw,
             'root_uid': os.getuid(),
             'root_gid': os.getgid(),
+            'cafile': self.cafile,
+            'servercert': self.servercert,
+            'serverkey': self.serverkey,
         }
         return self.slapd_conf_template % config_dict
 

diff --git a/Tests/certs/README b/Tests/certs/README
@@ -0,0 +1,24 @@
+python-ldap test certificates
+=============================
+
+Certificates and keys
+---------------------
+
+* ``ca.pem``: internal root CA certificate
+* ``server.pem``: TLS server certificate for slapd, signed by root CA. The
+  server cert is valid for DNS Name ``localhost`` and IPs ``127.0.0.1`` and
+  ``:1``.
+* ``server.key``: private key for ``server.pem``, no password protection
+* ``client.pem``: certificate for TLS client cert authentication, signed by
+  root CA.
+* ``client.key``: private key for ``client.pem``, no password protection
+
+Configuration and scripts
+-------------------------
+
+* ``ca.conf`` contains the CA definition as well as extensions for the
+  client and server certificates.
+* ``client.conf`` and ``server.conf`` hold the subject and base configuration
+  for server and client certs.
+* ``gencerts.sh`` creates new CA, client and server certificates.
+* ``gennssdb.sh`` can be used to create a NSSDB for all certs and keys.
diff --git a/Tests/certs/ca.conf b/Tests/certs/ca.conf
@@ -0,0 +1,77 @@
+# Written by Christian Heimes
+
+[default]
+ca = "ca"
+tmpdir = $ENV::CATMPDIR
+outdir = $ENV::CAOUTDIR
+name_opt = multiline,-esc_msb,utf8
+
+[req]
+default_bits = 2048
+encrypt_key = no
+default_md = sha256
+utf8 = yes
+string_mask = utf8only
+prompt = no
+distinguished_name = ca_dn
+
+[ca_dn]
+countryName = "DE"
+organizationName = "python-ldap"
+organizationalUnitName = "slapd-test"
+commonName = "Python LDAP Test CA"
+
+[ca]
+default_ca = python_ldap_ca
+
+[python_ldap_ca]
+certificate = $outdir/$ca.pem
+private_key = $outdir/$ca.key
+new_certs_dir = $tmpdir
+serial = $tmpdir/$ca.crt.srl
+crlnumber = $tmpdir/$ca.crl.srl
+database = $tmpdir/$ca.db
+unique_subject = no
+default_days = 1461
+default_md = sha256
+policy = match_pol
+email_in_dn = no
+preserve = no
+name_opt = $name_opt
+cert_opt = ca_default
+copy_extensions = none
+default_crl_days = 365
+
+[match_pol]
+countryName = match
+stateOrProvinceName = optional
+localityName = optional
+organizationName = match
+organizationalUnitName = match
+commonName = supplied
+
+[ca_ext]
+basicConstraints = critical,CA:true
+keyUsage = critical,keyCertSign,cRLSign
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+
+[server_san]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1
+
+[server_ext]
+basicConstraints = critical,CA:false
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = critical,serverAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
+subjectAltName = @server_san
+
+[client_ext]
+basicConstraints = critical,CA:false
+keyUsage = critical,digitalSignature
+extendedKeyUsage = critical,clientAuth
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always
diff --git a/Tests/certs/ca.pem b/Tests/certs/ca.pem
@@ -0,0 +1,80 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Validity
+            Not Before: Nov 28 13:49:28 2017 GMT
+            Not After : Nov 28 13:49:28 2021 GMT
+        Subject: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b4:bd:47:78:d9:62:4e:8e:ae:18:53:b8:8e:9f:
+                    0b:13:ea:f2:59:c0:1d:7f:0b:5c:5a:ed:c8:b8:cd:
+                    ff:66:94:c4:40:d5:cd:4c:da:06:d2:35:1c:6a:c5:
+                    76:70:6d:f0:81:8a:25:e4:35:c8:d5:79:17:3e:35:
+                    ec:2b:97:73:77:6c:04:7f:1f:0b:b5:f3:fd:1a:cd:
+                    76:2c:5c:17:45:6a:6d:c4:d1:6c:f8:09:ba:a0:f8:
+                    57:44:d7:b4:1c:a4:be:a4:4b:e4:76:34:1c:b1:0b:
+                    12:42:7e:79:e4:01:e0:5f:8f:6c:03:2d:2a:b6:4e:
+                    72:85:f1:b9:ac:d5:22:a7:0a:fc:5a:0c:e5:75:8f:
+                    9f:20:c2:14:ab:53:6a:b0:e6:8a:0d:f4:97:53:7f:
+                    f7:79:29:dd:ea:df:ae:39:6f:59:d8:b3:8e:da:bf:
+                    08:cd:03:ea:2a:91:33:c9:6f:21:a6:56:06:10:c1:
+                    40:4b:31:95:b0:47:2a:1e:2f:7d:eb:9b:f1:d4:27:
+                    af:1a:5d:bf:0f:b4:f5:d5:b8:1d:04:61:fa:06:af:
+                    49:6f:ff:99:88:f3:44:16:ed:3b:f1:c8:ea:31:0a:
+                    f3:f5:97:7a:17:08:e5:e8:8f:dd:1d:c8:8f:55:bf:
+                    47:93:9a:be:84:99:6f:f3:99:61:5d:b7:13:56:34:
+                    04:91
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+            X509v3 Authority Key Identifier: 
+                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+
+    Signature Algorithm: sha256WithRSAEncryption
+         03:d2:e6:f5:e4:1d:99:2e:df:02:b9:5b:f7:e0:82:ca:39:76:
+         5c:8f:3d:f1:5f:d4:bd:1b:4b:4f:35:4b:5d:f6:21:8b:c0:87:
+         23:de:7e:9d:93:1b:67:60:6d:df:7b:95:f0:6a:87:94:5c:f9:
+         a3:62:50:7b:68:02:b0:5c:d2:4b:f9:b1:97:ba:24:84:47:6e:
+         e1:e9:d6:e0:fa:2f:f7:9b:c5:67:3a:eb:8e:bc:b7:8f:31:7d:
+         5c:ba:91:ce:9d:2c:91:85:32:74:e7:e9:ba:07:61:7c:8b:55:
+         69:db:f9:7b:1d:ef:55:fc:bf:58:fc:99:66:9c:9e:92:35:75:
+         53:0a:31:e1:34:8a:cf:bc:79:b0:0e:ac:bf:aa:f0:e3:74:88:
+         f2:a6:5c:38:ad:21:31:ea:cd:e2:57:01:6b:9e:0b:24:62:78:
+         ac:6a:88:ba:ae:be:20:27:63:ab:3b:e9:2c:c0:5c:81:c5:e7:
+         e6:fe:a7:09:30:b4:28:65:51:6f:1b:1d:22:f8:30:7d:87:ae:
+         da:28:99:5c:8b:15:f0:b7:45:d0:1d:3b:ad:c5:29:4a:ed:11:
+         68:c4:af:28:a3:0b:9f:1b:c8:86:56:80:3d:6b:d3:1f:c6:b0:
+         3d:4a:39:1c:10:57:2d:22:df:d7:7b:ad:7d:f9:12:47:bb:33:
+         29:61:14:c4
+-----BEGIN CERTIFICATE-----
+MIIDijCCAnKgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
+MTM0OTI4WjBWMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNVBAMME1B5dGhvbiBMREFQIFRlc3QgQ0Ew
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0vUd42WJOjq4YU7iOnwsT
+6vJZwB1/C1xa7ci4zf9mlMRA1c1M2gbSNRxqxXZwbfCBiiXkNcjVeRc+Newrl3N3
+bAR/Hwu18/0azXYsXBdFam3E0Wz4Cbqg+FdE17QcpL6kS+R2NByxCxJCfnnkAeBf
+j2wDLSq2TnKF8bms1SKnCvxaDOV1j58gwhSrU2qw5ooN9JdTf/d5Kd3q3645b1nY
+s47avwjNA+oqkTPJbyGmVgYQwUBLMZWwRyoeL33rm/HUJ68aXb8PtPXVuB0EYfoG
+r0lv/5mI80QW7TvxyOoxCvP1l3oXCOXoj90dyI9Vv0eTmr6EmW/zmWFdtxNWNASR
+AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1Ud
+DgQWBBQ9gOO7lJfb3d/IGiOKyyvBPRrmhTAfBgNVHSMEGDAWgBQ9gOO7lJfb3d/I
+GiOKyyvBPRrmhTANBgkqhkiG9w0BAQsFAAOCAQEAA9Lm9eQdmS7fArlb9+CCyjl2
+XI898V/UvRtLTzVLXfYhi8CHI95+nZMbZ2Bt33uV8GqHlFz5o2JQe2gCsFzSS/mx
+l7okhEdu4enW4Pov95vFZzrrjry3jzF9XLqRzp0skYUydOfpugdhfItVadv5ex3v
+Vfy/WPyZZpyekjV1Uwox4TSKz7x5sA6sv6rw43SI8qZcOK0hMerN4lcBa54LJGJ4
+rGqIuq6+ICdjqzvpLMBcgcXn5v6nCTC0KGVRbxsdIvgwfYeu2iiZXIsV8LdF0B07
+rcUpSu0RaMSvKKMLnxvIhlaAPWvTH8awPUo5HBBXLSLf13utffkSR7szKWEUxA==
+-----END CERTIFICATE-----
diff --git a/Tests/certs/client.conf b/Tests/certs/client.conf
@@ -0,0 +1,16 @@
+# Written by Christian Heimes
+
+[req]
+default_bits = 2048
+encrypt_key = no
+default_md = sha256
+utf8 = yes
+string_mask = utf8only
+prompt = no
+distinguished_name = client_dn
+
+[client_dn]
+countryName = "DE"
+organizationName = "python-ldap"
+organizationalUnitName = "slapd-test"
+commonName = "client"
diff --git a/Tests/certs/client.key b/Tests/certs/client.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4aZb1WfASk2JR
+VAwFMMQCJNkbBDj7d8QdqSMa32jgTG8m/0N5RYGhdIi6zVeO2GmrSDuRd9Lv5hqu
+6ZgFI/rRCYSZHrIe6MXSOs6ZZKHIeQYkZcKa7Eg1FWQPBS51FJjYcotoHj5uxyKZ
+pOBMC63qODgq77G4zcqIKVswKS34KAIwvBAAUmTMtyMOOEh8oZm4V4ILpFFNBfs9
+CcyKMcAtCiFXOYZQ0G16ExzT560FMxMmCHd8HkevhfgFlKZb9/bsHNb+tvBwTQNm
+eUl4gnPDJk6YLBGIscBImvSRJu8o07aZBvAZvRhPa5iX/mtnlg0pDQ9jiGFK24qB
+VPQKtwHjAgMBAAECggEBAIYO7Fir6uP2FHD+4kYbr0HHu7PyG+JirETLoeN1KW50
+4hC9XDWam6PdbVAu2knTdO248uTK8KLI6fjhg0upXjn761LMh7wEh1pOucW07A8q
+O5bWCuRIhC1iwXxRzfX65SnkCwfDhKtPRA3hV9SwYNt1xw8fdFjd8S+OsOWP6gUN
+A33rBN6L44zfabZmcIO4DvSjDP4zoOL640uFg9dyf2yHzFI+q4mZgMK2iW5TZILl
+pNfdQF/hZsqrme+kzUyEtQHzLxGk1twYlFubePS0K1wzXRw6OqFRA0+pYNYP+JmJ
+bQs1k/e/y5qRiD9+UzR3MOTASl9BWDu9KCK1LF5pqYECgYEA7SD43REkVmQkFinf
+Re1kfOTkqCub1t4veTZBqVBNCF10fnQwPk1UQ2PShum1iJun6S3P0NzJP/svGc0N
+m44XJaD8QHnXdsDkHGx36/Cj15+VYpGvSpkPUgVQk4Q82n29Y3v8/xR6xqhXiB2N
+kuWHig8WIrrc690mUlL1NLQvH+ECgYEAxxaggQXlBTdDSMj2x3Y/0TJlkese2Oet
+JxWu6xGfjrsjMxZj1c5C3ESeKws3Z1eH9nk3AVzJ/q/+2SyCM3lM+eFz6dAtKVDB
+Olly4YhxoEZDgW4JXMVLP8d7xNDxWk9y7UitpvfDJ8J0hf//y9KR2jnokkfSKScN
+AsqrMe7+6kMCgYEAgndztV3rGkU6vZ8II1c7xKPDUuu7cHsKr6w0cE2oNIQGxlRy
+/rRZOkK/4E7R/Hl35wm3n3j6mWNARPfXFtEU1zU91NO0wrfaSfE8AeqCmu5IqNTz
+Fx4jmcMm1CMbwDMScpwTVN0VuBuDHXb1H+99pW4rhaw+RN+GaCEQnJDOpMECgYBv
+UTOFcOpRNEkm1VdGx9N/ARLRuAmTdlbW18TqIvx4LiLMWeSQk7fGuYdGwgrEeajI
+I5ah6GP5SCbS/5P9fAGSZoENZx0ZUNH58jHN8SC3YRI1uHT7rkUY8E1ACyQoPuwf
+yNdv2HECNjQ5CJ7aNG7g+igUQpw77l3UBcYbMWrPSQKBgG+R+nFGbjJ7oHyvJyJI
+C3rlD6vay9BoXmjA05dCO36zDcq5xZqwLnQmYkFgBw+RwvwV8gbBirG7GEpy0rdt
+5YbHwiI6fMfLsXocU9f86o2dhhpA2o42ig3mfe8X3LteWtmRfJ3BtHbW2ZWS8Kvx
+MnZGm64AmjWV5oJb7e5jpgu6
+-----END PRIVATE KEY-----
diff --git a/Tests/certs/client.pem b/Tests/certs/client.pem
@@ -0,0 +1,83 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, O=python-ldap, OU=slapd-test, CN=Python LDAP Test CA
+        Validity
+            Not Before: Nov 28 13:49:28 2017 GMT
+            Not After : Nov 28 13:49:28 2021 GMT
+        Subject: C=DE, O=python-ldap, OU=slapd-test, CN=client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:69:96:f5:59:f0:12:93:62:51:54:0c:05:30:
+                    c4:02:24:d9:1b:04:38:fb:77:c4:1d:a9:23:1a:df:
+                    68:e0:4c:6f:26:ff:43:79:45:81:a1:74:88:ba:cd:
+                    57:8e:d8:69:ab:48:3b:91:77:d2:ef:e6:1a:ae:e9:
+                    98:05:23:fa:d1:09:84:99:1e:b2:1e:e8:c5:d2:3a:
+                    ce:99:64:a1:c8:79:06:24:65:c2:9a:ec:48:35:15:
+                    64:0f:05:2e:75:14:98:d8:72:8b:68:1e:3e:6e:c7:
+                    22:99:a4:e0:4c:0b:ad:ea:38:38:2a:ef:b1:b8:cd:
+                    ca:88:29:5b:30:29:2d:f8:28:02:30:bc:10:00:52:
+                    64:cc:b7:23:0e:38:48:7c:a1:99:b8:57:82:0b:a4:
+                    51:4d:05:fb:3d:09:cc:8a:31:c0:2d:0a:21:57:39:
+                    86:50:d0:6d:7a:13:1c:d3:e7:ad:05:33:13:26:08:
+                    77:7c:1e:47:af:85:f8:05:94:a6:5b:f7:f6:ec:1c:
+                    d6:fe:b6:f0:70:4d:03:66:79:49:78:82:73:c3:26:
+                    4e:98:2c:11:88:b1:c0:48:9a:f4:91:26:ef:28:d3:
+                    b6:99:06:f0:19:bd:18:4f:6b:98:97:fe:6b:67:96:
+                    0d:29:0d:0f:63:88:61:4a:db:8a:81:54:f4:0a:b7:
+                    01:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+            X509v3 Extended Key Usage: critical
+                TLS Web Client Authentication
+            X509v3 Subject Key Identifier: 
+                C5:E2:E2:72:A6:55:C1:FB:D3:4B:11:01:D0:A0:AE:99:B6:8F:F1:39
+            X509v3 Authority Key Identifier: 
+                keyid:3D:80:E3:BB:94:97:DB:DD:DF:C8:1A:23:8A:CB:2B:C1:3D:1A:E6:85
+
+    Signature Algorithm: sha256WithRSAEncryption
+         11:76:03:a3:a6:9d:4e:3e:74:93:50:3b:31:d5:c7:d0:a8:34:
+         84:01:6b:a2:08:cd:89:11:57:97:a2:e9:83:f0:a6:ef:03:8c:
+         b2:8d:31:8f:ee:b3:c9:8c:49:1f:e4:fc:21:58:8d:22:c2:17:
+         96:2e:b1:d1:64:03:d6:48:70:41:65:22:38:bf:9f:00:dd:a8:
+         82:a0:df:22:e0:9a:1b:27:16:4b:db:7f:b0:fe:9f:a8:80:90:
+         69:ad:35:be:e6:95:fe:f9:64:96:0a:d8:d7:8e:aa:63:fb:9a:
+         d5:d0:e9:cb:8c:f3:08:c0:0c:26:72:c9:c6:29:5c:cf:3c:9e:
+         e2:38:37:5a:16:2f:70:82:0b:e6:80:27:90:bd:81:b4:58:52:
+         6c:4e:b7:77:fc:49:76:7a:4f:6c:ee:ff:02:1f:f4:49:6e:78:
+         c3:fa:cd:ee:d3:e7:e5:05:a4:16:97:48:16:44:9f:81:1c:ac:
+         a9:30:0e:1d:ea:15:32:d7:2b:1e:68:92:0a:9c:5b:b2:27:57:
+         d3:21:3e:76:71:94:2d:da:76:61:aa:64:99:b7:54:1c:ba:e2:
+         a5:b3:21:a4:a8:36:fe:5d:a3:73:6a:5e:77:af:ab:9a:d9:62:
+         00:f0:fd:90:1e:b6:cc:57:5d:92:0d:16:16:97:78:48:27:fc:
+         d9:2d:55:4d
+-----BEGIN CERTIFICATE-----
+MIIDkjCCAnqgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJERTEU
+MBIGA1UECgwLcHl0aG9uLWxkYXAxEzARBgNVBAsMCnNsYXBkLXRlc3QxHDAaBgNV
+BAMME1B5dGhvbiBMREFQIFRlc3QgQ0EwHhcNMTcxMTI4MTM0OTI4WhcNMjExMTI4
+MTM0OTI4WjBJMQswCQYDVQQGEwJERTEUMBIGA1UECgwLcHl0aG9uLWxkYXAxEzAR
+BgNVBAsMCnNsYXBkLXRlc3QxDzANBgNVBAMMBmNsaWVudDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBALhplvVZ8BKTYlFUDAUwxAIk2RsEOPt3xB2pIxrf
+aOBMbyb/Q3lFgaF0iLrNV47YaatIO5F30u/mGq7pmAUj+tEJhJkesh7oxdI6zplk
+och5BiRlwprsSDUVZA8FLnUUmNhyi2gePm7HIpmk4EwLreo4OCrvsbjNyogpWzAp
+LfgoAjC8EABSZMy3Iw44SHyhmbhXggukUU0F+z0JzIoxwC0KIVc5hlDQbXoTHNPn
+rQUzEyYId3weR6+F+AWUplv39uwc1v628HBNA2Z5SXiCc8MmTpgsEYixwEia9JEm
+7yjTtpkG8Bm9GE9rmJf+a2eWDSkND2OIYUrbioFU9Aq3AeMCAwEAAaN4MHYwDAYD
+VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
+AwIwHQYDVR0OBBYEFMXi4nKmVcH700sRAdCgrpm2j/E5MB8GA1UdIwQYMBaAFD2A
+47uUl9vd38gaI4rLK8E9GuaFMA0GCSqGSIb3DQEBCwUAA4IBAQARdgOjpp1OPnST
+UDsx1cfQqDSEAWuiCM2JEVeXoumD8KbvA4yyjTGP7rPJjEkf5PwhWI0iwheWLrHR
+ZAPWSHBBZSI4v58A3aiCoN8i4JobJxZL23+w/p+ogJBprTW+5pX++WSWCtjXjqpj
++5rV0OnLjPMIwAwmcsnGKVzPPJ7iODdaFi9wggvmgCeQvYG0WFJsTrd3/El2ek9s
+7v8CH/RJbnjD+s3u0+flBaQWl0gWRJ+BHKypMA4d6hUy1yseaJIKnFuyJ1fTIT52
+cZQt2nZhqmSZt1QcuuKlsyGkqDb+XaNzal53r6ua2WIA8P2QHrbMV12SDRYWl3hI
+J/zZLVVN
+-----END CERTIFICATE-----