mongo 2.13.1 → 2.19.1

data/spec/stress/connection_pool_stress_spec.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 require 'spec_helper'
 
 describe 'Connection pool stress test' do
@@ -137,65 +140,4 @@ describe 'Connection pool stress test' do
       it_behaves_like 'does not raise error'
     end
   end
-
-  context 'when primary pool is disconnected' do
-    let(:threads) do
-      threads = operation_threads
-
-      # thread that disconnects primary's pool
-      threads << Thread.new do
-        sleep 0.2
-        server = client.cluster.next_primary
-        server.pool.disconnect!
-      end
-    end
-
-    it_behaves_like 'does not raise error'
-  end
-
-  context 'when all pools are disconnected' do
-    let(:threads) do
-      threads = operation_threads
-
-      # thread that disconnects each server's pool
-      threads << Thread.new do
-        sleep 0.2
-
-        client.cluster.servers_list.each do |server|
-          if server.description.data_bearing?
-            server.pool.disconnect!
-          end
-        end
-      end
-    end
-
-    it_behaves_like 'does not raise error'
-  end
-
-  context 'when populator connection auth sometimes fails' do
-    let(:threads) { operation_threads }
-
-    it 'does not raise error' do
-      server = client.cluster.next_primary
-
-      # We only want to test connection failure on the populator; connection failures
-      # occurring in the check_out method should raise an error.
-      # The populator calls create_and_add_connection, which calls connection.connect!
-      # and raises if an error occurs (eg, an auth error), so in this test we
-      # randomly raise errors on this method.
-      expect(server.pool).to receive(:create_and_add_connection).at_least(:once).and_wrap_original do |m, *args|
-        if rand < 0.1
-          raise Mongo::Error::SocketError
-        else
-          m.call(*args)
-        end
-      end
-
-      server.pool.clear(stop_populator: false)
-
-      expect do
-        threads.collect { |t| t.join }
-      end.not_to raise_error
-    end
-  end
 end

data/spec/stress/connection_pool_timing_spec.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 require 'spec_helper'
 
 describe 'Connection pool timing test' do
@@ -22,7 +25,7 @@ describe 'Connection pool timing test' do
   end
 
   let(:client) do
-    authorized_client.with(options.merge(monitoring: true))
+    authorized_client.with(options.merge(monitoring_io: true))
   end
 
   let!(:collection) do
@@ -64,11 +67,11 @@ describe 'Connection pool timing test' do
     let(:threads) { operation_threads }
 
     it 'does not error' do
-      start = Time.now
+      start = Mongo::Utils.monotonic_time
       expect {
         threads.collect { |t| t.join }
       }.not_to raise_error
-      puts "[Connection Pool Timing] Duration with no max idle time: #{Time.now - start}"
+      puts "[Connection Pool Timing] Duration with no max idle time: #{Mongo::Utils.monotonic_time - start}"
     end
   end
 
@@ -80,36 +83,11 @@ describe 'Connection pool timing test' do
     let(:threads) { operation_threads }
 
     it 'does not error' do
-      start = Time.now
-      expect {
-        threads.collect { |t| t.join }
-      }.not_to raise_error
-      puts "[Connection Pool Timing] Duration with low max idle time: #{Time.now - start}"
-    end
-  end
-
-  context 'when clear is called periodically' do
-    let(:options) do
-      { max_pool_size: 10, min_pool_size: 5 }
-    end
-
-    let(:threads) do
-      threads = operation_threads
-      threads << Thread.new do
-        10.times do
-          sleep 0.1
-          client.cluster.next_primary.pool.clear
-        end
-      end
-      threads
-    end
-
-    it 'does not error' do
-      start = Time.now
+      start = Mongo::Utils.monotonic_time
       expect {
         threads.collect { |t| t.join }
       }.not_to raise_error
-      puts "[Connection Pool Timing] Duration when clear is called periodically: #{Time.now - start}"
+      puts "[Connection Pool Timing] Duration with low max idle time: #{Mongo::Utils.monotonic_time - start}"
     end
   end
 
@@ -153,9 +131,9 @@ describe 'Connection pool timing test' do
         # when trying to perform operations during primary change
         sleep 1
 
-        @primary_change_start = Time.now
+        @primary_change_start = Mongo::Utils.monotonic_time
         ClusterTools.instance.change_primary
-        @primary_change_end = Time.now
+        @primary_change_end = Mongo::Utils.monotonic_time
 
         # Primary change is complete; execute more operations
         more_threads.collect { |t| t.join }
@@ -166,16 +144,17 @@ describe 'Connection pool timing test' do
     # On JRuby, sometimes the following error is produced indicating
     # possible data corruption or an interpreter bug:
     # RSpec::Expectations::ExpectationNotMetError: expected no Exception, got #<Mongo::Error::OperationFailure: Invalid ns [ruby-driver.] (73) (on localhost:27018, modern retry, attempt 1) (on localhost:27018, modern retry, attempt 1)>
-    it 'does not error', retry: (BSON::Environment.jruby? ? 3 : 1) do
+    retry_test tries: (BSON::Environment.jruby? ? 3 : 1)
+    it 'does not error' do
       threads
-      start = Time.now
+      start = Mongo::Utils.monotonic_time
       expect do
         threads.each do |t|
           t.join
         end
       end.not_to raise_error
       puts "[Connection Pool Timing] Duration before primary change: #{@primary_change_start - start}. "\
-        "Duration after primary change: #{Time.now - @primary_change_end}"
+        "Duration after primary change: #{Mongo::Utils.monotonic_time - @primary_change_end}"
     end
   end
 end

data/spec/stress/fork_reconnect_stress_spec.rb

@@ -1,17 +1,16 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 require 'spec_helper'
 
 describe 'fork reconnect' do
   require_fork
-  only_mri
+  require_mri
 
   # On multi-shard sharded clusters a succeeding write request does not
   # guarantee that the next operation will succeed (since it could be sent to
   # another shard with a dead connection).
-  require_no_multi_shard
-
-  # On Ruby 2.3 $?.exitstatus is sometimes nil after Process.wait returns which
-  # is not supposed to happen.
-  ruby_version_gte '2.4'
+  require_no_multi_mongos
 
   require_stress
 
@@ -28,20 +27,20 @@ describe 'fork reconnect' do
       client['foo'].insert_one(test: 1)
 
       pids = []
-      deadline = Time.now + 5
+      deadline = Mongo::Utils.monotonic_time + 5
       1.upto(10) do
         if pid = fork
           pids << pid
         else
           Utils.wrap_forked_child do
-            while Time.now < deadline
-              client.database.command(ismaster: 1).should be_a(Mongo::Operation::Result)
+            while Mongo::Utils.monotonic_time < deadline
+              client.database.command(hello: 1).should be_a(Mongo::Operation::Result)
             end
           end
         end
       end
 
-      while Time.now < deadline
+      while Mongo::Utils.monotonic_time < deadline
         # Use a read which is retried in case of an error
         client['foo'].find(test: 1).to_a
       end
@@ -52,7 +51,8 @@ describe 'fork reconnect' do
       end
     end
 
-    context 'when parent is operating on client during the fork', retry: 3 do
+    retry_test
+    context 'when parent is operating on client during the fork' do
       # This test intermittently fails in evergreen with pool size of 5,
       # with a number of pending connections in the pool.
       # The reason could be that handshaking is slow or operations are slow
@@ -60,13 +60,13 @@ describe 'fork reconnect' do
       # Sometimes it seems the monitoring connection experiences network
       # errors (despite being a loopback connection) which causes the test
       # to fail as then server selection fails.
-      # The retry: 3 is to deal with network errors on monitoring connection.
+      # The retry_test is to deal with network errors on monitoring connection.
 
       let(:client) { authorized_client.with(max_pool_size: 10,
         wait_queue_timeout: 10, socket_timeout: 2, connect_timeout: 2) }
 
       it 'works' do
-        client.database.command(ismaster: 1).should be_a(Mongo::Operation::Result)
+        client.database.command(hello: 1).should be_a(Mongo::Operation::Result)
 
         threads = []
         5.times do
@@ -78,20 +78,20 @@ describe 'fork reconnect' do
         end
 
         pids = []
-        deadline = Time.now + 5
+        deadline = Mongo::Utils.monotonic_time + 5
         10.times do
           if pid = fork
             pids << pid
           else
             Utils.wrap_forked_child do
-              while Time.now < deadline
-                client.database.command(ismaster: 1).should be_a(Mongo::Operation::Result)
+              while Mongo::Utils.monotonic_time < deadline
+                client.database.command(hello: 1).should be_a(Mongo::Operation::Result)
               end
             end
           end
         end
 
-        while Time.now < deadline
+        while Mongo::Utils.monotonic_time < deadline
           sleep 0.1
         end
 
@@ -103,7 +103,6 @@ describe 'fork reconnect' do
           status.exitstatus.should == 0
         end
       end
-
     end
   end
 end

data/spec/stress/push_monitor_close_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+require 'spec_helper'
+
+# This test repeatedly creates and closes clients across several threads.
+# Its goal is to ensure that the push monitor connections specifically get
+# closed without any errors or warnings being reported to applications.
+#
+# Although the test is specifically meant to test 4.4+ servers (that utilize
+# the push monitor) in non-LB connections, run it everywhere for good measure.
+describe 'Push monitor close test' do
+  require_stress
+
+  let(:options) do
+    SpecConfig.instance.all_test_options
+  end
+
+  before(:all) do
+    # load if necessary
+    ClusterConfig.instance.primary_address
+    ClientRegistry.instance.close_all_clients
+  end
+
+  it 'does not warn/error on cleanup' do
+    Mongo::Logger.logger.should_not receive(:warn)
+
+    threads = 10.times.map do
+      Thread.new do
+        10.times do
+          client = new_local_client([ClusterConfig.instance.primary_address.seed], options)
+          if rand > 0.33
+            client.command(ping: 1)
+            sleep(rand * 3)
+          end
+          client.close
+          STDOUT << '.'
+        end
+      end
+    end
+    threads.each(&:join)
+    puts
+  end
+end

data/spec/support/authorization.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 # Copyright (C) 2009-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,7 +23,7 @@ TEST_COLL = 'test'.freeze
 # An invalid write concern.
 #
 # @since 2.4.2
-INVALID_WRITE_CONCERN = { w: 4 }
+INVALID_WRITE_CONCERN = { w: 4000 }
 
 module Authorization
 

data/spec/support/aws_utils/base.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 module AwsUtils
   class Base
 

data/spec/support/aws_utils/inspector.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 module AwsUtils
   class Inspector < Base
 

data/spec/support/aws_utils/orchestrator.rb

@@ -1,3 +1,8 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+require 'securerandom'
+
 module AwsUtils
   class Orchestrator < Base
 
@@ -10,13 +15,24 @@ module AwsUtils
       resp.credentials
     end
 
+    def assume_role_with_web_identity(role_arn, token_file)
+      token = File.open(token_file).read
+      resp = sts_client.assume_role_with_web_identity(
+        role_arn: role_arn,
+        role_session_name: SecureRandom.uuid,
+        web_identity_token: token,
+        duration_seconds: 900
+      )
+      resp.credentials
+    end
+
     def set_instance_profile(instance_id,
       instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
       instance_profile_arn: nil
     )
       clear_instance_profile(instance_id)
 
-      deadline = Time.now + 30
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30
       begin
         ec2_client.associate_iam_instance_profile(
           iam_instance_profile: {
@@ -26,7 +42,7 @@ module AwsUtils
           instance_id: instance_id,
         )
       rescue Aws::EC2::Errors::RequestLimitExceeded => e
-        if Time.now >= deadline
+        if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
           raise
         end
         STDERR.puts("AWS request limit exceeded: #{e.class}: #{e}, will retry")
@@ -40,13 +56,13 @@ module AwsUtils
         :iam_instance_profile_associations, :instance_id, instance_id)
 
       if assoc
-        deadline = Time.now + 30
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30
         begin
           ec2_client.disassociate_iam_instance_profile(
             association_id: assoc.association_id,
           )
         rescue Aws::EC2::Errors::RequestLimitExceeded => e
-          if Time.now >= deadline
+          if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
             raise
           end
           STDERR.puts("AWS request limit exceeded: #{e.class}: #{e}, will retry")
@@ -285,7 +301,7 @@ CMD
       service_name: AWS_AUTH_ECS_SERVICE_NAME,
       timeout: 20
     )
-      deadline = Time.now + timeout
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
 
       # The AWS SDK waiter seems to immediately fail sometimes right after
       # the service is created, so wait for the service to become active
@@ -310,8 +326,7 @@ CMD
           status = service.status
         end
 
-        now = Time.now
-        if now >= deadline
+        if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
           raise "Service #{service_name} in cluster #{cluster_name} did not become ready in #{timeout} seconds (current status: #{status})"
         end
 

data/spec/support/aws_utils/provisioner.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 module AwsUtils
   class Provisioner < Base
 

data/spec/support/aws_utils.rb

@@ -1,13 +1,17 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 autoload :Byebug, 'byebug'
 autoload :Paint, 'paint'
 
+require 'aws-sdk-core'
+
 module Aws
   autoload :CloudWatchLogs, 'aws-sdk-cloudwatchlogs'
-  autoload :Credentials, 'aws-sdk-core'
   autoload :EC2, 'aws-sdk-ec2'
   autoload :ECS, 'aws-sdk-ecs'
   autoload :IAM, 'aws-sdk-iam'
-  autoload :STS, 'aws-sdk-core'
+  autoload :STS, 'aws-sdk-sts'
 end
 
 module AwsUtils

data/spec/support/background_thread_registry.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
 require 'singleton'
 require 'ostruct'
 
@@ -27,7 +30,8 @@ class BackgroundThreadRegistry
       @records << OpenStruct.new(
         thread: thread,
         object: object,
-        example: $current_example,
+        # When rake spec:prepare is run, the current_example method is not defined
+        example: RSpec.respond_to?(:current_example) ? RSpec.current_example : nil,
       )
     end
   end
@@ -36,14 +40,14 @@ class BackgroundThreadRegistry
     @lock.synchronize do
       alive_thread_records = @records.select { |record| record.thread.alive? }
       if alive_thread_records.any?
-        msg = "Live background threads after closing all clients:"
+        msg = +"Live background threads after closing all clients:"
         alive_thread_records.each do |record|
           msg << "\n  #{record.object}"
           if record.object.respond_to?(:options)
             msg << "\n  with options: #{record.object.options}"
           end
           if record.example
-            msg << "\n  in #{record.example.id} #{record.example.full_description}"
+            msg << "\n  in #{record.example.id}: #{record.example.full_description}"
           else
             msg << "\n  not in an example"
           end
@@ -54,14 +58,3 @@ class BackgroundThreadRegistry
     end
   end
 end
-
-RSpec.configure do |config|
-  config.around do |example|
-    $current_example = example
-    begin
-      example.run
-    ensure
-      $current_example = nil
-    end
-  end
-end

data/spec/support/certificates/README.md

@@ -8,8 +8,9 @@ the x509gen MongoDB tool.
 The file extensions map to content as follows:
 
 - `.key` - private key
-- `.crt` - certificate
-- `.pem` - certificate and private key combined in the same file
+- `.crt` - certificate or a certificate chain
+- `.pem` - certificate (or a certificate chain) and private key combined
+in the same file
 
 The file name fragments have the following meaning:
 

data/spec/support/certificates/atlas-ocsp-ca.crt

@@ -0,0 +1,103 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            0c:f5:bd:06:2b:56:02:f4:7a:b8:50:2c:23:cc:f0:66
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
+        Validity
+            Not Before: Mar 30 00:00:00 2021 GMT
+            Not After : Mar 29 23:59:59 2031 GMT
+        Subject: C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:cc:f7:10:62:4f:a6:bb:63:6f:ed:90:52:56:c5:
+                    6d:27:7b:7a:12:56:8a:f1:f4:f9:d6:e7:e1:8f:bd:
+                    95:ab:f2:60:41:15:70:db:12:00:fa:27:0a:b5:57:
+                    38:5b:7d:b2:51:93:71:95:0e:6a:41:94:5b:35:1b:
+                    fa:7b:fa:bb:c5:be:24:30:fe:56:ef:c4:f3:7d:97:
+                    e3:14:f5:14:4d:cb:a7:10:f2:16:ea:ab:22:f0:31:
+                    22:11:61:69:90:26:ba:78:d9:97:1f:e3:7d:66:ab:
+                    75:44:95:73:c8:ac:ff:ef:5d:0a:8a:59:43:e1:ac:
+                    b2:3a:0f:f3:48:fc:d7:6b:37:c1:63:dc:de:46:d6:
+                    db:45:fe:7d:23:fd:90:e8:51:07:1e:51:a3:5f:ed:
+                    49:46:54:7f:2c:88:c5:f4:13:9c:97:15:3c:03:e8:
+                    a1:39:dc:69:0c:32:c1:af:16:57:4c:94:47:42:7c:
+                    a2:c8:9c:7d:e6:d4:4d:54:af:42:99:a8:c1:04:c2:
+                    77:9c:d6:48:e4:ce:11:e0:2a:80:99:f0:43:70:cf:
+                    3f:76:6b:d1:4c:49:ab:24:5e:c2:0d:82:fd:46:a8:
+                    ab:6c:93:cc:62:52:42:75:92:f8:9a:fa:5e:5e:b2:
+                    b0:61:e5:1f:1f:b9:7f:09:98:e8:3d:fa:83:7f:47:
+                    69:a1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Subject Key Identifier: 
+                74:85:80:C0:66:C7:DF:37:DE:CF:BD:29:37:AA:03:1D:BE:ED:CD:17
+            X509v3 Authority Key Identifier: 
+                4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            Authority Information Access: 
+                OCSP - URI:http://ocsp.digicert.com
+                CA Issuers - URI:http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
+            X509v3 CRL Distribution Points: 
+                Full Name:
+                  URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl
+            X509v3 Certificate Policies: 
+                Policy: 2.16.840.1.114412.2.1
+                Policy: 2.23.140.1.1
+                Policy: 2.23.140.1.2.1
+                Policy: 2.23.140.1.2.2
+                Policy: 2.23.140.1.2.3
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        90:f1:70:cb:28:97:69:97:7c:74:fd:c0:fa:26:7b:53:ab:ad:
+        cd:65:fd:ba:9c:06:9c:8a:d7:5a:43:87:ed:4d:4c:56:5f:ad:
+        c1:c5:b5:05:20:2e:59:d1:ff:4a:f5:a0:2a:d8:b0:95:ad:c9:
+        2e:4a:3b:d7:a7:f6:6f:88:29:fc:30:3f:24:84:bb:c3:b7:7b:
+        93:07:2c:af:87:6b:76:33:ed:00:55:52:b2:59:9e:e4:b9:d0:
+        f3:df:e7:0f:fe:dd:f8:c4:b9:10:72:81:09:04:5f:cf:97:9e:
+        2e:32:75:8e:cf:9a:58:d2:57:31:7e:37:01:81:b2:66:6d:29:
+        1a:b1:66:09:6d:d1:6e:90:f4:b9:fa:2f:01:14:c5:5c:56:64:
+        01:d9:7d:87:a8:38:53:9f:8b:5d:46:6d:5c:c6:27:84:81:d4:
+        7e:8c:8c:a3:9b:52:e7:c6:88:ec:37:7c:2a:fb:f0:55:5a:38:
+        72:10:d8:00:13:cf:4c:73:db:aa:37:35:a8:29:81:69:9c:76:
+        bc:de:18:7b:90:d4:ca:cf:ef:67:03:fd:04:5a:21:16:b1:ff:
+        ea:3f:df:dc:82:f5:eb:f4:59:92:23:0d:24:2a:95:25:4c:ca:
+        a1:91:e6:d4:b7:ac:87:74:b3:f1:6d:a3:99:db:f9:d5:bd:84:
+        40:9f:07:98
+
+-----BEGIN CERTIFICATE-----
+MIIEyDCCA7CgAwIBAgIQDPW9BitWAvR6uFAsI8zwZjANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
+MjAeFw0yMTAzMzAwMDAwMDBaFw0zMTAzMjkyMzU5NTlaMFkxCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxMzAxBgNVBAMTKkRpZ2lDZXJ0IEdsb2Jh
+bCBHMiBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMz3EGJPprtjb+2QUlbFbSd7ehJWivH0+dbn4Y+9lavyYEEV
+cNsSAPonCrVXOFt9slGTcZUOakGUWzUb+nv6u8W+JDD+Vu/E832X4xT1FE3LpxDy
+FuqrIvAxIhFhaZAmunjZlx/jfWardUSVc8is/+9dCopZQ+GssjoP80j812s3wWPc
+3kbW20X+fSP9kOhRBx5Ro1/tSUZUfyyIxfQTnJcVPAPooTncaQwywa8WV0yUR0J8
+osicfebUTVSvQpmowQTCd5zWSOTOEeAqgJnwQ3DPP3Zr0UxJqyRewg2C/Uaoq2yT
+zGJSQnWS+Jr6Xl6ysGHlHx+5fwmY6D36g39HaaECAwEAAaOCAYIwggF+MBIGA1Ud
+EwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFHSFgMBmx9833s+9KTeqAx2+7c0XMB8G
+A1UdIwQYMBaAFE4iVCAYlebjbuYP+vq5Eu0GF485MA4GA1UdDwEB/wQEAwIBhjAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwdgYIKwYBBQUHAQEEajBoMCQG
+CCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKG
+NGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RH
+Mi5jcnQwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29t
+L0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDA9BgNVHSAENjA0MAsGCWCGSAGG/WwC
+ATAHBgVngQwBATAIBgZngQwBAgEwCAYGZ4EMAQICMAgGBmeBDAECAzANBgkqhkiG
+9w0BAQsFAAOCAQEAkPFwyyiXaZd8dP3A+iZ7U6utzWX9upwGnIrXWkOH7U1MVl+t
+wcW1BSAuWdH/SvWgKtiwla3JLko716f2b4gp/DA/JIS7w7d7kwcsr4drdjPtAFVS
+slme5LnQ89/nD/7d+MS5EHKBCQRfz5eeLjJ1js+aWNJXMX43AYGyZm0pGrFmCW3R
+bpD0ufovARTFXFZkAdl9h6g4U5+LXUZtXMYnhIHUfoyMo5tS58aI7Dd8KvvwVVo4
+chDYABPPTHPbqjc1qCmBaZx2vN4Ye5DUys/vZwP9BFohFrH/6j/f3IL16/RZkiMN
+JCqVJUzKoZHm1Lesh3Sz8W2jmdv51b2EQJ8HmA==
+-----END CERTIFICATE-----