mongo 2.11.2 → 2.13.0.beta1

data/spec/support/aws_utils/provisioner.rb

@@ -0,0 +1,360 @@
+module AwsUtils
+  class Provisioner < Base
+
+    def setup_aws_auth_resources
+      security_group_id = ssh_security_group_id
+      if security_group_id.nil?
+        security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+        ).group_id
+      end
+      puts "EC2 Security group: #{security_group_id}"
+      setup_security_group(security_group_id)
+
+      vpc = ec2_client.describe_vpcs(
+        filters: [{
+          name: 'cidr',
+          values: [AWS_AUTH_VPC_CIDR],
+        }],
+      ).vpcs.first
+      if vpc.nil?
+        vpc = ec2_client.create_vpc(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+        ).vpc
+      end
+
+      # The VPC must have an internet gateway and the subnet in the VPC
+      # must have a route to the internet gateway.
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#d0e22943
+      # Internet gateways cannot be named when they are created, therefore
+      # we check if our VPC has a gateway and if not, create an unnamed one
+      # and attach it right away.
+      # https://aws.amazon.com/premiumsupport/knowledge-center/ecs-pull-container-error/
+      igw = ec2_client.describe_internet_gateways(
+        filters: [{
+          name: 'attachment.vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).internet_gateways.first
+      if igw.nil?
+        igw = ec2_client.create_internet_gateway.internet_gateway
+        ec2_client.attach_internet_gateway(
+          internet_gateway_id: igw.internet_gateway_id,
+          vpc_id: vpc.vpc_id,
+        )
+      end
+
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing
+      route_table = ec2_client.describe_route_tables(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).route_tables.first
+      ec2_client.create_route(
+        destination_cidr_block: '0.0.0.0/0',
+        gateway_id: igw.internet_gateway_id,
+        route_table_id: route_table.route_table_id,
+      )
+
+      vpc_security_group_id = ssh_vpc_security_group_id
+      if vpc_security_group_id.nil?
+        vpc_security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_VPC_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+          vpc_id: vpc.vpc_id,
+        ).group_id
+      end
+      setup_security_group(vpc_security_group_id)
+
+      subnet = ec2_client.describe_subnets(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).subnets.first
+      if subnet.nil?
+        subnet = ec2_client.create_subnet(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+          vpc_id: vpc.vpc_id,
+        ).subnet
+      end
+      puts "VPC: #{vpc.vpc_id}, subnet: #{subnet.subnet_id}, security group: #{vpc_security_group_id}"
+
+      # For testing regular credentials, create an IAM user with no permissions.
+
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        resp = iam_client.create_user(
+          user_name: AWS_AUTH_REGULAR_USER_NAME,
+        )
+        user = resp.user
+      end
+
+      puts "Regular AWS auth unprivileged user: #{user.arn}"
+
+      # Assume role testing
+      # https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/
+      #
+      # The instructions given in the above guide create an intermediate user
+      # who has the ability to assume the role. This script reuses the
+      # regular unprivileged user to be the user that assumes the role.
+      user_policy = detect_object(iam_client.list_policies, :policies, :policy_name, AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME)
+      if user_policy.nil?
+        user_policy_document = {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": [
+                "ec2:Describe*",
+                "iam:ListRoles",
+                "sts:AssumeRole",
+              ],
+              "Resource": "*",
+            },
+          ],
+        }
+        user_policy = iam_client.create_policy(
+          policy_name: AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME,
+          policy_document: user_policy_document.to_json,
+        ).policy
+      end
+
+      iam_client.attach_user_policy(
+        policy_arn: user_policy.arn,
+        user_name: user.user_name,
+      )
+
+      assume_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ASSUME_ROLE_NAME)
+      if assume_role.nil?
+        aws_account_id = user.arn.split(':')[4]
+        assume_role_policy = {
+          "Version": "2012-10-17",
+          "Statement": {
+            "Effect": "Allow",
+            "Principal": { "AWS": "arn:aws:iam::#{aws_account_id}:root" },
+            "Action": "sts:AssumeRole",
+          },
+        }
+        resp = iam_client.create_role(
+          role_name: AWS_AUTH_ASSUME_ROLE_NAME,
+          assume_role_policy_document: assume_role_policy.to_json,
+          max_session_duration: 12*3600,
+        )
+        assume_role = resp.role
+      end
+      puts "Assume role ARN: #{assume_role.arn}"
+
+      # For testing retrieval of credentials from EC2 link local endpoint,
+      # create an instance profile.
+      ips = iam_client.list_instance_profiles
+      instance_profile = ips.instance_profiles.detect do |instance_profile|
+        instance_profile.instance_profile_name == AWS_AUTH_INSTANCE_PROFILE_NAME
+      end
+      if instance_profile.nil?
+        resp = iam_client.create_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        )
+        instance_profile = resp.instance_profile
+      end
+
+      puts "EC2 instance profile: #{instance_profile.arn}"
+
+      # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role
+      assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": {
+          "Effect": "Allow",
+          "Principal": {"Service": "ec2.amazonaws.com"},
+          "Action": "sts:AssumeRole",
+        },
+      }
+      ec2_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "ec2:Describe*",
+            ],
+            "Resource": "*",
+          },
+        ],
+      }
+      ec2_role = create_role_with_policy(
+        AWS_AUTH_EC2_ROLE_NAME,
+        {
+          assume_role_policy_document: assume_role_policy_document.to_json,
+        },
+        ec2_role_policy_document,
+      )
+      puts "EC2 role ARN: #{ec2_role.arn}"
+
+      instance_profile.roles.each do |role|
+        iam_client.remove_role_from_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+          role_name: role.role_name,
+        )
+      end
+
+      iam_client.add_role_to_instance_profile(
+        instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        role_name: AWS_AUTH_EC2_ROLE_NAME,
+      )
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html
+      puts "ECS cluster name: #{AWS_AUTH_ECS_CLUSTER_NAME}"
+      resp = ecs_client.describe_clusters(
+        clusters: [AWS_AUTH_ECS_CLUSTER_NAME],
+      )
+      cluster = detect_object(resp, :clusters, :cluster_name, AWS_AUTH_ECS_CLUSTER_NAME)
+      if cluster.nil?
+        resp = ecs_client.create_cluster(
+          cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+        )
+        cluster = resp.cluster
+      end
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      ecs_assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Sid": "",
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "ecs-tasks.amazonaws.com",
+            },
+            "Action": "sts:AssumeRole",
+          },
+        ],
+      }
+
+      # The task role itself does not have any permissions.
+      # The example given in https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      # allows read-only access to an S3 bucket.
+      ecs_task_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [],
+      }
+      ecs_task_role = create_role_with_policy(
+        AWS_AUTH_ECS_TASK_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+      )
+
+      # Logging to CloudWatch:
+      # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
+      ecs_execution_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents",
+            "logs:DescribeLogStreams",
+          ],
+          "Resource": [
+            "*"
+          ],
+        }],
+      }
+      ecs_execution_role = create_role_with_policy(
+        AWS_AUTH_ECS_EXECUTION_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+        ecs_execution_role_policy_document,
+      )
+
+=begin
+      iam_client.attach_role_policy(
+        role_name: AWS_AUTH_ECS_ROLE_NAME,
+        policy_arn: "arn:aws:iam::aws:policy/AmazonECSTaskExecutionRolePolicy",
+      )
+=end
+
+      log_group = logs_client.describe_log_groups(
+        log_group_name_prefix: AWS_AUTH_ECS_LOG_GROUP,
+      ).log_groups.first
+      unless log_group
+        logs_client.create_log_group(
+          log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        )
+      end
+
+      logs_client.put_retention_policy(
+        log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        retention_in_days: 1,
+      )
+    end
+
+    def reset_keys
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        raise 'No user found, please run `aws setup-resources`'
+      end
+
+      iam_client.list_access_keys(
+        user_name: user.user_name,
+      ).to_h[:access_key_metadata].each do |access_key|
+        iam_client.delete_access_key(
+          user_name: user.user_name,
+          access_key_id: access_key[:access_key_id],
+        )
+      end
+
+      resp = iam_client.create_access_key(
+        user_name: user.user_name,
+      )
+      access_key = resp.to_h[:access_key]
+
+      puts "Credentials for regular user (#{AWS_AUTH_REGULAR_USER_NAME}):"
+      puts "AWS_ACCESS_KEY_ID=#{access_key[:access_key_id]}"
+      puts "AWS_SECRET_ACCESS_KEY=#{access_key[:secret_access_key]}"
+      puts
+    end
+
+    private
+
+    def create_role_with_policy(role_name, role_options, role_policy_document = nil)
+      role = detect_object(iam_client.list_roles, :roles, :role_name, role_name)
+      if role.nil?
+        resp = iam_client.create_role({
+          role_name: role_name,
+        }.update(role_options))
+        role = resp.role
+      end
+
+      if role_policy_document
+        iam_client.put_role_policy(
+          role_name: role_name,
+          policy_name: "#{role_name}.policy",
+          policy_document: role_policy_document.to_json,
+        )
+      end
+
+      role
+    end
+
+    def setup_security_group(security_group_id)
+      ec2_client.authorize_security_group_ingress(
+        group_id: security_group_id,
+        ip_permissions: [{
+          from_port: 22,
+          to_port: 22,
+          ip_protocol: 'tcp',
+          ip_ranges: [{
+            cidr_ip: '0.0.0.0/0',
+          }],
+        }],
+      )
+    rescue Aws::EC2::Errors::InvalidPermissionDuplicate
+    end
+  end
+end

data/spec/support/background_thread_registry.rb

@@ -40,9 +40,13 @@ class BackgroundThreadRegistry
         alive_thread_records.each do |record|
           msg << "\n  #{record.object}"
           if record.object.respond_to?(:options)
-            msg << "\n  #{record.object.options}"
+            msg << "\n  with options: #{record.object.options}"
+          end
+          if record.example
+            msg << "\n  in #{record.example.id} #{record.example.full_description}"
+          else
+            msg << "\n  not in an example"
           end
-          msg << "\n  in #{record.example.id} #{record.example.full_description}"
         end
         raise msg
       end

data/spec/support/certificates/README.md

@@ -21,10 +21,14 @@ chains. The server and the client sides have their own intermediate certificates
 - `bundle` - these files contain the leaf certificates followed by intermediate
 certificates up to the CA certificates, but do not include the CA certificates.
 
+## Generation
+
 Keep in mind the following important notes:
 
 - In multi-ca.crt, the Ruby driver CA certificate must be last (the first
 certificate must be an unrelated certificate).
+- All server certificates should have `localhost.test.build.10gen.cc` in
+the Subject Alternate Name field for testing SRV monitoring.
 
 ## Tools
 

data/spec/support/certificates/server-second-level-bundle.pem

@@ -1,103 +1,103 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 403728 (0x62910)
+        Serial Number: 78086 (0x13106)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: CN = intermediate-server, OU = Ruby Driver, O = MongoDB, L = New York City, ST = New York, C = US
         Validity
-            Not Before: May 30 22:28:04 2019 GMT
-            Not After : May 30 22:28:04 2039 GMT
+            Not Before: Feb 24 22:50:04 2020 GMT
+            Not After : Feb 24 22:50:04 2040 GMT
         Subject: CN = localhost, OU = Ruby Driver, O = MongoDB, L = New York City, ST = New York, C = US
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 RSA Public-Key: (2048 bit)
                 Modulus:
-                    00:94:9a:50:f9:bc:68:39:68:e3:54:1d:48:d9:83:
-                    b7:7f:8c:59:cd:54:8d:ba:af:13:ef:25:a5:9d:c4:
-                    d6:0a:f4:10:c4:ee:e7:b5:60:81:83:5f:3f:88:bd:
-                    63:d7:39:68:8d:2b:d6:85:a8:f6:4a:6e:52:6c:f1:
-                    03:71:a7:2e:2f:e2:80:6a:c3:5a:94:7a:70:2c:5f:
-                    a1:ea:17:e5:db:54:24:75:d3:3a:8d:83:22:96:76:
-                    21:9f:b5:51:ff:b8:4d:33:b8:6c:39:bb:68:98:71:
-                    50:b5:41:67:bd:f5:76:f8:49:1e:58:fe:d7:a4:54:
-                    c1:15:25:b1:24:2f:20:ea:56:a4:29:2f:83:f4:c2:
-                    a9:13:12:a1:f3:9b:9e:95:6d:25:c4:bf:d9:74:0f:
-                    d3:1f:7a:87:f7:a8:f8:82:8b:0d:4f:e8:5b:6e:32:
-                    00:e0:e8:8a:35:91:75:82:56:37:7f:f5:ab:5d:0f:
-                    7f:b9:61:62:13:e4:38:44:f8:3b:58:f9:87:23:6a:
-                    aa:79:cf:6b:df:52:2b:40:0c:4d:12:b0:84:ac:40:
-                    f3:6e:f1:0f:37:23:f0:54:7c:f5:e3:b8:0b:20:77:
-                    27:ef:7f:2a:bf:20:ee:06:50:25:0b:42:57:1a:45:
-                    ca:a2:65:71:e1:bf:5d:f1:79:6f:66:3d:22:28:b9:
-                    d9:93
+                    00:8d:fb:0f:3a:2f:65:aa:a5:0c:1a:d2:2b:3f:f6:
+                    c8:58:a3:03:35:97:47:6c:8e:a2:3e:b4:11:f0:51:
+                    a7:a3:f9:ab:a1:89:53:48:93:e6:bf:54:e0:bb:3d:
+                    f2:83:e1:b8:df:15:cd:05:f7:1e:82:c0:41:c4:8f:
+                    62:e5:91:3f:89:64:62:13:05:bc:51:51:6f:6f:83:
+                    44:6a:e5:3c:e3:56:ff:a1:bb:14:5c:16:fe:97:a5:
+                    66:7c:5d:46:55:82:18:5e:21:4c:cf:e8:7d:73:9e:
+                    ed:33:72:c9:cf:2e:31:fe:11:af:95:1c:b9:5a:23:
+                    6e:11:3a:6b:36:c2:21:2c:98:d3:9d:c6:e1:41:22:
+                    68:ed:b6:0b:7b:7d:11:c6:d2:31:6e:58:58:c3:e9:
+                    21:0a:23:1e:82:84:40:2f:f3:ab:b8:65:d7:08:82:
+                    8a:21:9f:a3:f1:32:13:2f:ce:51:c4:f6:36:29:b7:
+                    44:6e:95:50:2b:66:97:8c:59:0d:d9:93:4d:2a:1c:
+                    2b:dc:70:c2:80:c4:1a:ce:10:af:37:21:3b:38:71:
+                    dd:93:c7:de:80:1c:07:50:d4:20:b8:b8:a4:67:c7:
+                    1e:98:4d:c9:0b:c8:85:19:44:1d:1f:72:3c:b9:ff:
+                    b1:dd:09:62:c9:f3:5e:df:ff:db:b3:7d:d8:09:d2:
+                    84:43
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Alternative Name: 
-                DNS:localhost, IP Address:127.0.0.1
+                DNS:localhost, IP Address:127.0.0.1, DNS:localhost.test.build.10gen.cc
     Signature Algorithm: sha256WithRSAEncryption
-         8a:2d:64:a3:92:30:31:8c:b8:50:8d:20:9f:24:e9:62:8f:98:
-         e4:6b:4b:75:3b:90:fb:51:b3:65:79:a8:5f:ac:fc:57:f1:ca:
-         34:72:6b:07:37:82:d0:b8:89:a4:6d:eb:4a:2e:c5:7c:f6:eb:
-         bf:40:84:5d:56:0c:77:c8:79:f6:28:6c:86:50:ad:0b:d4:99:
-         58:ec:da:b3:ad:e0:55:93:b6:be:2f:4a:29:dd:4c:f4:41:85:
-         41:59:ba:3f:0a:3d:ce:c5:66:c6:41:c6:b0:94:f5:f9:f9:e9:
-         ff:85:c4:df:f7:36:33:7e:80:fc:b6:89:cc:d8:72:c8:2f:ae:
-         49:80:c7:65:c2:ec:5b:31:c1:ed:da:76:39:92:bf:cb:d9:8a:
-         ef:44:7c:a3:e3:ae:db:17:19:4d:7e:4e:e5:61:09:bc:18:b8:
-         c4:09:b7:46:d8:0f:f9:6f:d8:60:ec:ec:a5:51:28:a7:06:83:
-         bd:5d:39:76:aa:26:cc:b1:d0:ac:f4:ad:88:40:0d:8b:73:32:
-         62:a8:5e:47:12:99:6c:a1:6a:25:a3:f4:62:45:5e:89:36:d4:
-         17:ed:e4:54:cf:1d:6a:67:19:67:eb:4e:64:83:7b:5b:67:e4:
-         a4:e5:26:1d:0e:56:4f:7f:b7:32:19:44:85:fe:ba:ae:58:d4:
-         e3:ed:a5:71
+         3a:2c:98:cc:63:78:18:f4:2f:26:92:da:04:f9:3d:18:80:81:
+         27:85:75:23:7b:77:da:49:92:c6:0e:2b:14:3e:3e:68:a4:40:
+         e9:e4:d2:c2:b6:c4:99:12:17:88:47:f6:c6:f4:62:cb:a9:13:
+         1a:d5:7e:da:4e:54:ee:0c:f1:e9:21:82:8d:b7:64:4d:63:3c:
+         33:d5:06:b4:3d:04:7f:d0:04:ef:27:47:3f:e4:9d:eb:1d:46:
+         86:80:61:7b:25:03:0b:e9:24:49:68:8b:af:e3:0e:28:b8:dd:
+         02:9d:fb:49:d4:56:f1:7c:16:66:31:b4:42:d3:0f:3a:fe:c8:
+         9e:a9:85:25:5f:e1:57:78:c3:22:77:0f:1d:f4:32:7f:10:60:
+         00:73:7a:f9:91:af:47:57:74:5d:6f:21:f9:ba:0d:43:c0:e9:
+         98:20:2f:47:2d:4d:3b:37:c3:02:b4:56:7c:fe:f5:47:6b:cb:
+         79:65:a6:d5:cd:dd:3e:66:69:b1:23:59:d2:90:70:8a:95:82:
+         cf:7a:9d:02:82:b9:c2:ff:76:55:cb:57:c7:ae:41:36:09:69:
+         df:08:b0:9a:11:12:1b:c0:25:ce:24:9f:ce:5e:b5:5b:07:b4:
+         4e:4e:c1:a1:bd:7b:4d:24:13:38:dd:d6:49:21:91:d1:c9:ac:
+         c1:bd:fc:7f
 -----BEGIN CERTIFICATE-----
-MIIDjTCCAnWgAwIBAgIDBikQMA0GCSqGSIb3DQEBCwUAMH4xHDAaBgNVBAMTE2lu
+MIIDrDCCApSgAwIBAgIDATEGMA0GCSqGSIb3DQEBCwUAMH4xHDAaBgNVBAMTE2lu
 dGVybWVkaWF0ZS1zZXJ2ZXIxFDASBgNVBAsTC1J1YnkgRHJpdmVyMRAwDgYDVQQK
 EwdNb25nb0RCMRYwFAYDVQQHEw1OZXcgWW9yayBDaXR5MREwDwYDVQQIEwhOZXcg
-WW9yazELMAkGA1UEBhMCVVMwHhcNMTkwNTMwMjIyODA0WhcNMzkwNTMwMjIyODA0
+WW9yazELMAkGA1UEBhMCVVMwHhcNMjAwMjI0MjI1MDA0WhcNNDAwMjI0MjI1MDA0
 WjB0MRIwEAYDVQQDEwlsb2NhbGhvc3QxFDASBgNVBAsTC1J1YnkgRHJpdmVyMRAw
 DgYDVQQKEwdNb25nb0RCMRYwFAYDVQQHEw1OZXcgWW9yayBDaXR5MREwDwYDVQQI
 EwhOZXcgWW9yazELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCUmlD5vGg5aONUHUjZg7d/jFnNVI26rxPvJaWdxNYK9BDE7ue1YIGD
-Xz+IvWPXOWiNK9aFqPZKblJs8QNxpy4v4oBqw1qUenAsX6HqF+XbVCR10zqNgyKW
-diGftVH/uE0zuGw5u2iYcVC1QWe99Xb4SR5Y/tekVMEVJbEkLyDqVqQpL4P0wqkT
-EqHzm56VbSXEv9l0D9Mfeof3qPiCiw1P6FtuMgDg6Io1kXWCVjd/9atdD3+5YWIT
-5DhE+DtY+Ycjaqp5z2vfUitADE0SsISsQPNu8Q83I/BUfPXjuAsgdyfvfyq/IO4G
-UCULQlcaRcqiZXHhv13xeW9mPSIoudmTAgMBAAGjHjAcMBoGA1UdEQQTMBGCCWxv
-Y2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEAii1ko5IwMYy4UI0gnyTp
-Yo+Y5GtLdTuQ+1GzZXmoX6z8V/HKNHJrBzeC0LiJpG3rSi7FfPbrv0CEXVYMd8h5
-9ihshlCtC9SZWOzas63gVZO2vi9KKd1M9EGFQVm6Pwo9zsVmxkHGsJT1+fnp/4XE
-3/c2M36A/LaJzNhyyC+uSYDHZcLsWzHB7dp2OZK/y9mK70R8o+Ou2xcZTX5O5WEJ
-vBi4xAm3RtgP+W/YYOzspVEopwaDvV05dqomzLHQrPStiEANi3MyYqheRxKZbKFq
-JaP0YkVeiTbUF+3kVM8damcZZ+tOZIN7W2fkpOUmHQ5WT3+3MhlEhf66rljU4+2l
-cQ==
+ggEKAoIBAQCN+w86L2WqpQwa0is/9shYowM1l0dsjqI+tBHwUaej+auhiVNIk+a/
+VOC7PfKD4bjfFc0F9x6CwEHEj2LlkT+JZGITBbxRUW9vg0Rq5TzjVv+huxRcFv6X
+pWZ8XUZVghheIUzP6H1znu0zcsnPLjH+Ea+VHLlaI24ROms2wiEsmNOdxuFBImjt
+tgt7fRHG0jFuWFjD6SEKIx6ChEAv86u4ZdcIgoohn6PxMhMvzlHE9jYpt0RulVAr
+ZpeMWQ3Zk00qHCvccMKAxBrOEK83ITs4cd2Tx96AHAdQ1CC4uKRnxx6YTckLyIUZ
+RB0fcjy5/7HdCWLJ817f/9uzfdgJ0oRDAgMBAAGjPTA7MDkGA1UdEQQyMDCCCWxv
+Y2FsaG9zdIcEfwAAAYIdbG9jYWxob3N0LnRlc3QuYnVpbGQuMTBnZW4uY2MwDQYJ
+KoZIhvcNAQELBQADggEBADosmMxjeBj0LyaS2gT5PRiAgSeFdSN7d9pJksYOKxQ+
+PmikQOnk0sK2xJkSF4hH9sb0YsupExrVftpOVO4M8ekhgo23ZE1jPDPVBrQ9BH/Q
+BO8nRz/knesdRoaAYXslAwvpJEloi6/jDii43QKd+0nUVvF8FmYxtELTDzr+yJ6p
+hSVf4Vd4wyJ3Dx30Mn8QYABzevmRr0dXdF1vIfm6DUPA6ZggL0ctTTs3wwK0Vnz+
+9Udry3llptXN3T5mabEjWdKQcIqVgs96nQKCucL/dlXLV8euQTYJad8IsJoREhvA
+Jc4kn85etVsHtE5OwaG9e00kEzjd1kkhkdHJrMG9/H8=
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAlJpQ+bxoOWjjVB1I2YO3f4xZzVSNuq8T7yWlncTWCvQQxO7n
-tWCBg18/iL1j1zlojSvWhaj2Sm5SbPEDcacuL+KAasNalHpwLF+h6hfl21QkddM6
-jYMilnYhn7VR/7hNM7hsObtomHFQtUFnvfV2+EkeWP7XpFTBFSWxJC8g6lakKS+D
-9MKpExKh85uelW0lxL/ZdA/TH3qH96j4gosNT+hbbjIA4OiKNZF1glY3f/WrXQ9/
-uWFiE+Q4RPg7WPmHI2qqec9r31IrQAxNErCErEDzbvEPNyPwVHz147gLIHcn738q
-vyDuBlAlC0JXGkXKomVx4b9d8XlvZj0iKLnZkwIDAQABAoIBAQCSQhwG4KgYMSLl
-q/kClQBrGkFctabVIfJVw1DxKkWc/EDxA06tFvIB0iJfPEBjGY7Mu2Plo7nc4h5g
-OQqxtuDfomfQLLwfPS7gjbN4CtNh/rvv99k+ZN4LBvPrE/RD4yqhCBgE7m5w876C
-13/61/ijQJwM7a5igESVwsZJndUgrmg5m358QaMCi11upkhk3MnYK93P4S3RTaBs
-pzxjSAbgMJ7vD7NUSe1oXKMBNNMgLbQumOp00q8tsZAOToSGYOQI69q3pONRaB+e
-rrdu7qyDUBQHgZVB+bahtYmpHa0IxVOqAsZqfXNyPDgPRkRDkaoR8pTHbKX6a+a9
-7Gr3ISe5AoGBAOAU94g04TBypSeiufE+4cB5+rXjmYIlTMs0x6KHunZr0XpRlMPv
-y4upZQ+O4eo5rrEc0nAaHP/XvNfcogYzyy4qg7DrGl2Px4+iuoGvj5o/0wILZ2Hy
-ZnWlmJiMctn9Z+MUhMNfLxjEzSly3Y+nZkMYLzNoIgdcqk9jjnw2d3lvAoGBAKnF
-CsY7LNySixPHHAfCQt3rkEEvPQMMPStNp6ct84StYJyCGyOUyjLBjcBrq4/tOc/D
-fpoJDBUMUJj9yrVp3he3x00cXAoneX2ED4jnNMMPm84blr02hSCwU/1ldyKDm34/
-OXlym0UF0nYB2f3hrrwBTic5y2L90PdGfBUD5GgdAoGAcO2gIeCkbEoauXLkypOq
-KdpPY0MkpdYucWpUAbDtY6jKlR5wHp7GscfYypJzgBs50sB3vU8rtjP/U7o5XW7U
-wptiatLRIr3HELgtzhWwBUiNCsa8fzwuLrQZxydg6kMvC93XWq6piY4E5xKgXjk6
-7C1P/FRKcfNdUU0XDbpVU7kCgYBWsbu1zSQ0o1UITYZf4/D3mMK6tt/GParDAU3b
-DpkrqMoMQliPi/zRfIvhtloPDoqWMXPmPzZ/TSGfbwLkL2Lt47iQBSpvOQdOdHDm
-bYNBFShwUSBiEYRcVA8f+H+lDWYLS0gTX9Ywoi9+eaWTg3sSoOwDFf1p2MmsbL8S
-kEFEdQKBgCmc/NESy29MO3j8tH63UbdmD7BeHA36KNmRFzosE9O62eM5xcWsUeE0
-Xd1vC0V8R9J4sF7ZcwfI9q/XW5I6wW4aKWlwCa1yx7A39Ea9UjiASmY7+hx3vn0z
-4XAfT1HvR2ohvZYmhm1HAuYWuUvphquFrOXCxuycAvgcaXQBKR0L
+MIIEowIBAAKCAQEAjfsPOi9lqqUMGtIrP/bIWKMDNZdHbI6iPrQR8FGno/mroYlT
+SJPmv1Tguz3yg+G43xXNBfcegsBBxI9i5ZE/iWRiEwW8UVFvb4NEauU841b/obsU
+XBb+l6VmfF1GVYIYXiFMz+h9c57tM3LJzy4x/hGvlRy5WiNuETprNsIhLJjTncbh
+QSJo7bYLe30RxtIxblhYw+khCiMegoRAL/OruGXXCIKKIZ+j8TITL85RxPY2KbdE
+bpVQK2aXjFkN2ZNNKhwr3HDCgMQazhCvNyE7OHHdk8fegBwHUNQguLikZ8cemE3J
+C8iFGUQdH3I8uf+x3QliyfNe3//bs33YCdKEQwIDAQABAoIBAGY99vc1jobWF+Nw
+mYiUVC3QJc1/xQVdqWRyE8D1bD1e28OVuo23RCFgI/1yXKOv9otfjabQD/6kKDg9
+8T/T2uc7jIyaQsRkWlT5OFmp/rDPw4JZ0A2I2YmmqCjCmpWU+6s9W60UhNKwDaxQ
+6xbw8zs8zS4Z4zgP74EkinSCU5Vi2FJvAE6LNlqZAvPONQzhmaQUI7K4VIjSqTvc
+Ye/aKyuwPlmZQRz1imMRljSBpHbtsNLBCX2ZjNNpRuB7h+yA3X4MEf+1NpymcTOq
+Qm8gZXx3yaezfdoFlZpWGaStyL2bFGKkU9CjXVxXMO6xbzElM9b6ESe/Yfi8KyxE
+X+ZqwOECgYEA6Pm42k8ksBPoZ7aDPOb2zvjsKAySYw5QtR642rf9dcWOnk7vxEBH
+5jtKn0LZ0R7c/N+5dUud9th5MVDXIaW7OhZl42bL+oBfA4oe8p0K9yfUb8Dlyimp
+2Nt9ggCQ8oQUa2HeiNArFm1DVEwS2aeCEtCc79pl50mqy8czX5hoBHkCgYEAnAMr
+k0nN37OWFdRli4UBWkqPX9ExA4/WQ0DaPRlLUz3BToVkf7KtqBMeEd+Rhfj2Cte+
+O85RZFdU12iofPKP85Pv0zTempQFJ8mgZweUbHYWi3RnvVJhee8jzd06iBeZkDc+
+jxDt4yWHW33hvISK2f1B6PNNqqm1IQ/Sw3Vch5sCgYEAy98rui6jxknFiGyYr8TV
+mg0Oa4WE3JX8XmLCFPQJIvR8d2BQRQaTZI/iHzga7/r4G3mUC2beltKcS2GYwOMM
+0iojgznDqjSH8Mr/hgOTQvFh32GINL782L5KOGdScEbQr593Y3X3HqsCzlO78ye4
+lcpkayhNIHbAtY5eEHuIGtECgYBJNU+gWPSrcVkPO1C/LJWa6fvnaYGHe1p+ypLe
+Mt1e3U61avDi31SP1xC4MGHYLSA/rEdPRxx4amacgjb2Etir4xKZ2GhQvv7AUePc
+FPl3/93KaMA5Xcvx7N6vPo21yOU9gD7x4W7PtQ+URjjEPqntauMfzfP3DpW5QvSS
+1aKq2wKBgHBIkdJ2yBrWtCjemSX5KxpWD93g4QglPZumBy58Ta8UtxLXSnV12TJt
+5dFJxGXPP6enOzAqePcTdSsegyfGTnQ3WwnR0nV/1OqL8+JNr2K/QHuvZDryffyX
+rUmvPLTzKsTzULEIZ3uIOfDiJby3w0YG6FFs9yhHJJKIjmpCucfF
 -----END RSA PRIVATE KEY-----
 Certificate:
     Data: