mongo 2.10.5 → 2.15.1

data/spec/support/aws_utils/provisioner.rb

@@ -0,0 +1,363 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+module AwsUtils
+  class Provisioner < Base
+
+    def setup_aws_auth_resources
+      security_group_id = ssh_security_group_id
+      if security_group_id.nil?
+        security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+        ).group_id
+      end
+      puts "EC2 Security group: #{security_group_id}"
+      setup_security_group(security_group_id)
+
+      vpc = ec2_client.describe_vpcs(
+        filters: [{
+          name: 'cidr',
+          values: [AWS_AUTH_VPC_CIDR],
+        }],
+      ).vpcs.first
+      if vpc.nil?
+        vpc = ec2_client.create_vpc(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+        ).vpc
+      end
+
+      # The VPC must have an internet gateway and the subnet in the VPC
+      # must have a route to the internet gateway.
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#d0e22943
+      # Internet gateways cannot be named when they are created, therefore
+      # we check if our VPC has a gateway and if not, create an unnamed one
+      # and attach it right away.
+      # https://aws.amazon.com/premiumsupport/knowledge-center/ecs-pull-container-error/
+      igw = ec2_client.describe_internet_gateways(
+        filters: [{
+          name: 'attachment.vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).internet_gateways.first
+      if igw.nil?
+        igw = ec2_client.create_internet_gateway.internet_gateway
+        ec2_client.attach_internet_gateway(
+          internet_gateway_id: igw.internet_gateway_id,
+          vpc_id: vpc.vpc_id,
+        )
+      end
+
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing
+      route_table = ec2_client.describe_route_tables(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).route_tables.first
+      ec2_client.create_route(
+        destination_cidr_block: '0.0.0.0/0',
+        gateway_id: igw.internet_gateway_id,
+        route_table_id: route_table.route_table_id,
+      )
+
+      vpc_security_group_id = ssh_vpc_security_group_id
+      if vpc_security_group_id.nil?
+        vpc_security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_VPC_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+          vpc_id: vpc.vpc_id,
+        ).group_id
+      end
+      setup_security_group(vpc_security_group_id)
+
+      subnet = ec2_client.describe_subnets(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).subnets.first
+      if subnet.nil?
+        subnet = ec2_client.create_subnet(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+          vpc_id: vpc.vpc_id,
+        ).subnet
+      end
+      puts "VPC: #{vpc.vpc_id}, subnet: #{subnet.subnet_id}, security group: #{vpc_security_group_id}"
+
+      # For testing regular credentials, create an IAM user with no permissions.
+
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        resp = iam_client.create_user(
+          user_name: AWS_AUTH_REGULAR_USER_NAME,
+        )
+        user = resp.user
+      end
+
+      puts "Regular AWS auth unprivileged user: #{user.arn}"
+
+      # Assume role testing
+      # https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/
+      #
+      # The instructions given in the above guide create an intermediate user
+      # who has the ability to assume the role. This script reuses the
+      # regular unprivileged user to be the user that assumes the role.
+      user_policy = detect_object(iam_client.list_policies, :policies, :policy_name, AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME)
+      if user_policy.nil?
+        user_policy_document = {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": [
+                "ec2:Describe*",
+                "iam:ListRoles",
+                "sts:AssumeRole",
+              ],
+              "Resource": "*",
+            },
+          ],
+        }
+        user_policy = iam_client.create_policy(
+          policy_name: AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME,
+          policy_document: user_policy_document.to_json,
+        ).policy
+      end
+
+      iam_client.attach_user_policy(
+        policy_arn: user_policy.arn,
+        user_name: user.user_name,
+      )
+
+      assume_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ASSUME_ROLE_NAME)
+      if assume_role.nil?
+        aws_account_id = user.arn.split(':')[4]
+        assume_role_policy = {
+          "Version": "2012-10-17",
+          "Statement": {
+            "Effect": "Allow",
+            "Principal": { "AWS": "arn:aws:iam::#{aws_account_id}:root" },
+            "Action": "sts:AssumeRole",
+          },
+        }
+        resp = iam_client.create_role(
+          role_name: AWS_AUTH_ASSUME_ROLE_NAME,
+          assume_role_policy_document: assume_role_policy.to_json,
+          max_session_duration: 12*3600,
+        )
+        assume_role = resp.role
+      end
+      puts "Assume role ARN: #{assume_role.arn}"
+
+      # For testing retrieval of credentials from EC2 link local endpoint,
+      # create an instance profile.
+      ips = iam_client.list_instance_profiles
+      instance_profile = ips.instance_profiles.detect do |instance_profile|
+        instance_profile.instance_profile_name == AWS_AUTH_INSTANCE_PROFILE_NAME
+      end
+      if instance_profile.nil?
+        resp = iam_client.create_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        )
+        instance_profile = resp.instance_profile
+      end
+
+      puts "EC2 instance profile: #{instance_profile.arn}"
+
+      # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role
+      assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": {
+          "Effect": "Allow",
+          "Principal": {"Service": "ec2.amazonaws.com"},
+          "Action": "sts:AssumeRole",
+        },
+      }
+      ec2_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "ec2:Describe*",
+            ],
+            "Resource": "*",
+          },
+        ],
+      }
+      ec2_role = create_role_with_policy(
+        AWS_AUTH_EC2_ROLE_NAME,
+        {
+          assume_role_policy_document: assume_role_policy_document.to_json,
+        },
+        ec2_role_policy_document,
+      )
+      puts "EC2 role ARN: #{ec2_role.arn}"
+
+      instance_profile.roles.each do |role|
+        iam_client.remove_role_from_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+          role_name: role.role_name,
+        )
+      end
+
+      iam_client.add_role_to_instance_profile(
+        instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        role_name: AWS_AUTH_EC2_ROLE_NAME,
+      )
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html
+      puts "ECS cluster name: #{AWS_AUTH_ECS_CLUSTER_NAME}"
+      resp = ecs_client.describe_clusters(
+        clusters: [AWS_AUTH_ECS_CLUSTER_NAME],
+      )
+      cluster = detect_object(resp, :clusters, :cluster_name, AWS_AUTH_ECS_CLUSTER_NAME)
+      if cluster.nil?
+        resp = ecs_client.create_cluster(
+          cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+        )
+        cluster = resp.cluster
+      end
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      ecs_assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Sid": "",
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "ecs-tasks.amazonaws.com",
+            },
+            "Action": "sts:AssumeRole",
+          },
+        ],
+      }
+
+      # The task role itself does not have any permissions.
+      # The example given in https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      # allows read-only access to an S3 bucket.
+      ecs_task_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [],
+      }
+      ecs_task_role = create_role_with_policy(
+        AWS_AUTH_ECS_TASK_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+      )
+
+      # Logging to CloudWatch:
+      # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
+      ecs_execution_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents",
+            "logs:DescribeLogStreams",
+          ],
+          "Resource": [
+            "*"
+          ],
+        }],
+      }
+      ecs_execution_role = create_role_with_policy(
+        AWS_AUTH_ECS_EXECUTION_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+        ecs_execution_role_policy_document,
+      )
+
+=begin
+      iam_client.attach_role_policy(
+        role_name: AWS_AUTH_ECS_ROLE_NAME,
+        policy_arn: "arn:aws:iam::aws:policy/AmazonECSTaskExecutionRolePolicy",
+      )
+=end
+
+      log_group = logs_client.describe_log_groups(
+        log_group_name_prefix: AWS_AUTH_ECS_LOG_GROUP,
+      ).log_groups.first
+      unless log_group
+        logs_client.create_log_group(
+          log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        )
+      end
+
+      logs_client.put_retention_policy(
+        log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        retention_in_days: 1,
+      )
+    end
+
+    def reset_keys
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        raise 'No user found, please run `aws setup-resources`'
+      end
+
+      iam_client.list_access_keys(
+        user_name: user.user_name,
+      ).to_h[:access_key_metadata].each do |access_key|
+        iam_client.delete_access_key(
+          user_name: user.user_name,
+          access_key_id: access_key[:access_key_id],
+        )
+      end
+
+      resp = iam_client.create_access_key(
+        user_name: user.user_name,
+      )
+      access_key = resp.to_h[:access_key]
+
+      puts "Credentials for regular user (#{AWS_AUTH_REGULAR_USER_NAME}):"
+      puts "AWS_ACCESS_KEY_ID=#{access_key[:access_key_id]}"
+      puts "AWS_SECRET_ACCESS_KEY=#{access_key[:secret_access_key]}"
+      puts
+    end
+
+    private
+
+    def create_role_with_policy(role_name, role_options, role_policy_document = nil)
+      role = detect_object(iam_client.list_roles, :roles, :role_name, role_name)
+      if role.nil?
+        resp = iam_client.create_role({
+          role_name: role_name,
+        }.update(role_options))
+        role = resp.role
+      end
+
+      if role_policy_document
+        iam_client.put_role_policy(
+          role_name: role_name,
+          policy_name: "#{role_name}.policy",
+          policy_document: role_policy_document.to_json,
+        )
+      end
+
+      role
+    end
+
+    def setup_security_group(security_group_id)
+      ec2_client.authorize_security_group_ingress(
+        group_id: security_group_id,
+        ip_permissions: [{
+          from_port: 22,
+          to_port: 22,
+          ip_protocol: 'tcp',
+          ip_ranges: [{
+            cidr_ip: '0.0.0.0/0',
+          }],
+        }],
+      )
+    rescue Aws::EC2::Errors::InvalidPermissionDuplicate
+    end
+  end
+end

data/spec/support/aws_utils.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+autoload :Byebug, 'byebug'
+autoload :Paint, 'paint'
+
+module Aws
+  autoload :CloudWatchLogs, 'aws-sdk-cloudwatchlogs'
+  autoload :Credentials, 'aws-sdk-core'
+  autoload :EC2, 'aws-sdk-ec2'
+  autoload :ECS, 'aws-sdk-ecs'
+  autoload :IAM, 'aws-sdk-iam'
+  autoload :STS, 'aws-sdk-core'
+end
+
+module AwsUtils
+  NAMESPACE = 'mdb-ruby'.freeze
+
+  AWS_AUTH_REGULAR_USER_NAME = "#{NAMESPACE}.aws-auth-regular".freeze
+
+  AWS_AUTH_ASSUME_ROLE_NAME = "#{NAMESPACE}.assume-role".freeze
+
+  AWS_AUTH_SECURITY_GROUP_NAME = "#{NAMESPACE}.ssh".freeze
+
+  AWS_AUTH_VPC_GATEWAY_NAME = NAMESPACE
+
+  AWS_AUTH_VPC_SECURITY_GROUP_NAME = "#{NAMESPACE}.vpc-ssh".freeze
+
+  AWS_AUTH_VPC_CIDR = "10.42.142.64/28".freeze
+
+  AWS_AUTH_EC2_AMI_NAMES = {
+    # https://wiki.debian.org/Cloud/AmazonEC2Image/Buster
+    'debian10' => 'debian-10-amd64-20200210-166',
+    'ubuntu1604' => 'ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20200317',
+  }.freeze
+
+  AWS_AUTH_EC2_INSTANCE_NAME = "#{NAMESPACE}.aws-auth)".freeze
+
+  AWS_AUTH_INSTANCE_PROFILE_NAME = "#{NAMESPACE}.ip".freeze
+
+  AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME = "#{NAMESPACE}.assume-role-user-policy".freeze
+
+  AWS_AUTH_EC2_ROLE_NAME = "#{NAMESPACE}.ec2-role".freeze
+
+  AWS_AUTH_ECS_CLUSTER_NAME = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_TASK_FAMILY = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_SERVICE_NAME = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_LOG_GROUP = "/ecs/#{NAMESPACE}/aws-auth-ecs".freeze
+
+  AWS_AUTH_ECS_LOG_STREAM_PREFIX = "task".freeze
+
+  # This role allows ECS tasks access to output logs to CloudWatch.
+  AWS_AUTH_ECS_EXECUTION_ROLE_NAME = "#{NAMESPACE}.ecs-execution-role".freeze
+
+  # This role is assumed by ECS tasks.
+  AWS_AUTH_ECS_TASK_ROLE_NAME = "#{NAMESPACE}.ecs-task-role".freeze
+
+  autoload :Base, 'support/aws_utils/base'
+  autoload :Inspector, 'support/aws_utils/inspector'
+  autoload :Orchestrator, 'support/aws_utils/orchestrator'
+  autoload :Provisioner, 'support/aws_utils/provisioner'
+end

data/spec/support/background_thread_registry.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'singleton'
+require 'ostruct'
+
+module Mongo
+  module BackgroundThread
+
+    alias :start_without_tracking! :start!
+
+    def start!
+      start_without_tracking!.tap do |thread|
+        BackgroundThreadRegistry.instance.register(self, thread)
+      end
+    end
+  end
+end
+
+class BackgroundThreadRegistry
+  include Singleton
+
+  def initialize
+    @lock = Mutex.new
+    @records = []
+  end
+
+  def register(object, thread)
+    @lock.synchronize do
+      @records << OpenStruct.new(
+        thread: thread,
+        object: object,
+        example: $current_example,
+      )
+    end
+  end
+
+  def verify_empty!
+    @lock.synchronize do
+      alive_thread_records = @records.select { |record| record.thread.alive? }
+      if alive_thread_records.any?
+        msg = +"Live background threads after closing all clients:"
+        alive_thread_records.each do |record|
+          msg << "\n  #{record.object}"
+          if record.object.respond_to?(:options)
+            msg << "\n  with options: #{record.object.options}"
+          end
+          if record.example
+            msg << "\n  in #{record.example.id} #{record.example.full_description}"
+          else
+            msg << "\n  not in an example"
+          end
+        end
+        raise msg
+      end
+      @records.clear
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.around do |example|
+    $current_example = example
+    begin
+      example.run
+    ensure
+      $current_example = nil
+    end
+  end
+end

data/spec/support/certificates/README.md

@@ -8,8 +8,9 @@ the x509gen MongoDB tool.
 The file extensions map to content as follows:
 
 - `.key` - private key
-- `.crt` - certificate
-- `.pem` - certificate and private key combined in the same file
+- `.crt` - certificate or a certificate chain
+- `.pem` - certificate (or a certificate chain) and private key combined
+in the same file
 
 The file name fragments have the following meaning:
 
@@ -21,10 +22,14 @@ chains. The server and the client sides have their own intermediate certificates
 - `bundle` - these files contain the leaf certificates followed by intermediate
 certificates up to the CA certificates, but do not include the CA certificates.
 
+## Generation
+
 Keep in mind the following important notes:
 
 - In multi-ca.crt, the Ruby driver CA certificate must be last (the first
 certificate must be an unrelated certificate).
+- All server certificates should have `localhost.test.build.10gen.cc` in
+the Subject Alternate Name field for testing SRV monitoring.
 
 ## Tools
 

data/spec/support/certificates/atlas-ocsp-ca.crt

@@ -0,0 +1,118 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            91:2b:08:4a:cf:0c:18:a7:53:f6:d6:2e:25:a7:5f:5a
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1
+        Validity
+            Not Before: Sep  4 00:00:00 2020 GMT
+            Not After : Sep 15 16:00:00 2025 GMT
+        Subject: C = US, O = Let's Encrypt, CN = R3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (2048 bit)
+                Modulus:
+                    00:bb:02:15:28:cc:f6:a0:94:d3:0f:12:ec:8d:55:
+                    92:c3:f8:82:f1:99:a6:7a:42:88:a7:5d:26:aa:b5:
+                    2b:b9:c5:4c:b1:af:8e:6b:f9:75:c8:a3:d7:0f:47:
+                    94:14:55:35:57:8c:9e:a8:a2:39:19:f5:82:3c:42:
+                    a9:4e:6e:f5:3b:c3:2e:db:8d:c0:b0:5c:f3:59:38:
+                    e7:ed:cf:69:f0:5a:0b:1b:be:c0:94:24:25:87:fa:
+                    37:71:b3:13:e7:1c:ac:e1:9b:ef:db:e4:3b:45:52:
+                    45:96:a9:c1:53:ce:34:c8:52:ee:b5:ae:ed:8f:de:
+                    60:70:e2:a5:54:ab:b6:6d:0e:97:a5:40:34:6b:2b:
+                    d3:bc:66:eb:66:34:7c:fa:6b:8b:8f:57:29:99:f8:
+                    30:17:5d:ba:72:6f:fb:81:c5:ad:d2:86:58:3d:17:
+                    c7:e7:09:bb:f1:2b:f7:86:dc:c1:da:71:5d:d4:46:
+                    e3:cc:ad:25:c1:88:bc:60:67:75:66:b3:f1:18:f7:
+                    a2:5c:e6:53:ff:3a:88:b6:47:a5:ff:13:18:ea:98:
+                    09:77:3f:9d:53:f9:cf:01:e5:f5:a6:70:17:14:af:
+                    63:a4:ff:99:b3:93:9d:dc:53:a7:06:fe:48:85:1d:
+                    a1:69:ae:25:75:bb:13:cc:52:03:f5:ed:51:a1:8b:
+                    db:15
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication, TLS Web Server Authentication
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Subject Key Identifier: 
+                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
+            X509v3 Authority Key Identifier: 
+                keyid:79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E
+
+            Authority Information Access: 
+                CA Issuers - URI:http://x1.i.lencr.org/
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://x1.c.lencr.org/
+
+            X509v3 Certificate Policies: 
+                Policy: 2.23.140.1.2.1
+                Policy: 1.3.6.1.4.1.44947.1.1.1
+
+    Signature Algorithm: sha256WithRSAEncryption
+         85:ca:4e:47:3e:a3:f7:85:44:85:bc:d5:67:78:b2:98:63:ad:
+         75:4d:1e:96:3d:33:65:72:54:2d:81:a0:ea:c3:ed:f8:20:bf:
+         5f:cc:b7:70:00:b7:6e:3b:f6:5e:94:de:e4:20:9f:a6:ef:8b:
+         b2:03:e7:a2:b5:16:3c:91:ce:b4:ed:39:02:e7:7c:25:8a:47:
+         e6:65:6e:3f:46:f4:d9:f0:ce:94:2b:ee:54:ce:12:bc:8c:27:
+         4b:b8:c1:98:2f:a2:af:cd:71:91:4a:08:b7:c8:b8:23:7b:04:
+         2d:08:f9:08:57:3e:83:d9:04:33:0a:47:21:78:09:82:27:c3:
+         2a:c8:9b:b9:ce:5c:f2:64:c8:c0:be:79:c0:4f:8e:6d:44:0c:
+         5e:92:bb:2e:f7:8b:10:e1:e8:1d:44:29:db:59:20:ed:63:b9:
+         21:f8:12:26:94:93:57:a0:1d:65:04:c1:0a:22:ae:10:0d:43:
+         97:a1:18:1f:7e:e0:e0:86:37:b5:5a:b1:bd:30:bf:87:6e:2b:
+         2a:ff:21:4e:1b:05:c3:f5:18:97:f0:5e:ac:c3:a5:b8:6a:f0:
+         2e:bc:3b:33:b9:ee:4b:de:cc:fc:e4:af:84:0b:86:3f:c0:55:
+         43:36:f6:68:e1:36:17:6a:8e:99:d1:ff:a5:40:a7:34:b7:c0:
+         d0:63:39:35:39:75:6e:f2:ba:76:c8:93:02:e9:a9:4b:6c:17:
+         ce:0c:02:d9:bd:81:fb:9f:b7:68:d4:06:65:b3:82:3d:77:53:
+         f8:8e:79:03:ad:0a:31:07:75:2a:43:d8:55:97:72:c4:29:0e:
+         f7:c4:5d:4e:c8:ae:46:84:30:d7:f2:85:5f:18:a1:79:bb:e7:
+         5e:70:8b:07:e1:86:93:c3:b9:8f:dc:61:71:25:2a:af:df:ed:
+         25:50:52:68:8b:92:dc:e5:d6:b5:e3:da:7d:d0:87:6c:84:21:
+         31:ae:82:f5:fb:b9:ab:c8:89:17:3d:e1:4c:e5:38:0e:f6:bd:
+         2b:bd:96:81:14:eb:d5:db:3d:20:a7:7e:59:d3:e2:f8:58:f9:
+         5b:b8:48:cd:fe:5c:4f:16:29:fe:1e:55:23:af:c8:11:b0:8d:
+         ea:7c:93:90:17:2f:fd:ac:a2:09:47:46:3f:f0:e9:b0:b7:ff:
+         28:4d:68:32:d6:67:5e:1e:69:a3:93:b8:f5:9d:8b:2f:0b:d2:
+         52:43:a6:6f:32:57:65:4d:32:81:df:38:53:85:5d:7e:5d:66:
+         29:ea:b8:dd:e4:95:b5:cd:b5:56:12:42:cd:c4:4e:c6:25:38:
+         44:50:6d:ec:ce:00:55:18:fe:e9:49:64:d4:4e:ca:97:9c:b4:
+         5b:c0:73:a8:ab:b8:47:c2
+-----BEGIN CERTIFICATE-----
+MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
+WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
+R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
+sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
+NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
+Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
+/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
+AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
+FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
+AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
+Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
+gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
+PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
+ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
+CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
+lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
+avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
+yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
+yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
+hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
+HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
+MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
+nLRbwHOoq7hHwg==
+-----END CERTIFICATE-----