mongo 2.15.0 → 2.17.0

data/spec/spec_tests/seed_list_discovery_spec.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'lite_spec_helper'
+
+require 'support/using_hash'
+require 'runners/connection_string'
+
+SEED_LIST_DISCOVERY_TESTS = Dir.glob("#{CURRENT_PATH}/spec_tests/data/seed_list_discovery/**/*.yml").sort
+
+describe 'DNS Seedlist Discovery' do
+  require_external_connectivity
+
+  include Mongo::ConnectionString
+
+  SEED_LIST_DISCOVERY_TESTS.each do |test_path|
+
+    spec = YAML.load(File.read(test_path))
+
+    test = Mongo::ConnectionString::Test.new(spec)
+
+    context(File.basename(test_path)) do
+
+      if test.raise_error?
+        context 'the uri is invalid' do
+
+          let(:valid_errors) do
+            [
+              Mongo::Error::InvalidTXTRecord,
+              Mongo::Error::NoSRVRecords,
+              Mongo::Error::InvalidURI,
+              Mongo::Error::MismatchedDomain,
+              # This is unfortunate. RUBY-2624
+              ArgumentError,
+            ]
+          end
+
+          let(:error) do
+            begin
+              test.client
+            rescue => ex
+            end
+            ex
+          end
+
+          it 'raises an error' do
+            expect(valid_errors).to include(error.class)
+          end
+        end
+
+      else
+
+        context 'the uri is valid' do
+
+          it 'does not raise an exception' do
+            expect(test.uri).to be_a(Mongo::URI::SRVProtocol)
+          end
+
+          if test.seeds
+            # DNS seed list tests specify both seeds and hosts.
+            # To get the hosts, the client must do SDAM (as required in the
+            # spec tests' description), but this isn't testing DNS seed list -
+            # it is testing SDAM. Plus, all of the hosts are always the same.
+            # If seed list is given in the expectations, just test the seed
+            # list and not the expanded hosts.
+            it 'creates a client with the correct seeds' do
+              expect(test.client).to have_hosts(test, test.seeds)
+            end
+          else
+            it 'creates a client with the correct hosts' do
+              expect(test.client).to have_hosts(test, test.hosts)
+            end
+          end
+
+          if test.expected_options
+            it 'creates a client with the correct uri options' do
+              mapped = Mongo::URI::OptionsMapper.new.ruby_to_smc(test.client.options)
+              # Connection string spec tests do not use canonical URI option names
+              actual = Utils.downcase_keys(mapped)
+              expected = Utils.downcase_keys(test.expected_options)
+              # SRV tests use ssl URI option instead of tls one
+              if expected.key?('ssl') && !expected.key?('tls')
+                expected['tls'] = expected.delete('ssl')
+              end
+              # The client object contains auth source in options which
+              # isn't asserted in some tests.
+              if actual.key?('authsource') && !expected.key?('authsource')
+                actual.delete('authsource')
+              end
+              actual.should == expected
+            end
+          end
+
+          if test.non_uri_options
+            it 'creates a client with the correct non-uri options' do
+              opts = UsingHash[test.non_uri_options]
+              if user = opts.use('user')
+                test.client.options[:user].should == user
+              end
+              if password = opts.use('password')
+                test.client.options[:password].should == password
+              end
+              if db = opts.use('db')
+                test.client.database.name.should == db
+              end
+              if auth_source = opts.use('auth_database')
+                Mongo::Auth::User.new(test.client.options).auth_source == auth_source
+              end
+              unless opts.empty?
+                raise "Unhandled keys: #{opts}"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/spec/spec_tests/sessions_unified_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'spec_helper'
+
+require 'runners/unified'
+
+base = "#{CURRENT_PATH}/spec_tests/data/sessions_unified"
+SESSIONS_UNIFIED_TESTS = Dir.glob("#{base}/**/*.yml").sort
+
+describe 'Sessions unified spec tests' do
+  define_unified_spec_tests(base, SESSIONS_UNIFIED_TESTS)
+end

data/spec/spec_tests/uri_options_spec.rb

@@ -52,8 +52,8 @@ describe 'URI options' do
               expect(test.client).to match_auth(test)
             end
 
-            if test.options
-              if test.options['compressors'] && test.options['compressors'].include?('snappy')
+            if opts = test.expected_options
+              if opts['compressors'] && opts['compressors'].include?('snappy')
                 before do
                   unless ENV.fetch('BUNDLE_GEMFILE', '') =~ /snappy/
                     skip "This test requires snappy compression"
@@ -61,7 +61,7 @@ describe 'URI options' do
                 end
               end
 
-              if test.options['compressors'] && test.options['compressors'].include?('zstd')
+              if opts['compressors'] && opts['compressors'].include?('zstd')
                 before do
                   unless ENV.fetch('BUNDLE_GEMFILE', '') =~ /zstd/
                     skip "This test requires zstd compression"
@@ -72,7 +72,7 @@ describe 'URI options' do
               it 'creates a client with the correct options' do
                 mapped = Mongo::URI::OptionsMapper.new.ruby_to_smc(test.client.options)
                 expected = Mongo::ConnectionString.adjust_expected_mongo_client_options(
-                  test.options,
+                  opts,
                 )
                 mapped.should == expected
               end

data/spec/stress/fork_reconnect_stress_spec.rb

@@ -10,11 +10,7 @@ describe 'fork reconnect' do
   # On multi-shard sharded clusters a succeeding write request does not
   # guarantee that the next operation will succeed (since it could be sent to
   # another shard with a dead connection).
-  require_no_multi_shard
-
-  # On Ruby 2.3 $?.exitstatus is sometimes nil after Process.wait returns which
-  # is not supposed to happen.
-  ruby_version_gte '2.4'
+  require_no_multi_mongos
 
   require_stress
 

data/spec/stress/push_monitor_close_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'spec_helper'
+
+# This test repeatedly creates and closes clients across several threads.
+# Its goal is to ensure that the push monitor connections specifically get
+# closed without any errors or warnings being reported to applications.
+#
+# Although the test is specifically meant to test 4.4+ servers (that utilize
+# the push monitor) in non-LB connections, run it everywhere for good measure.
+describe 'Push monitor close test' do
+  require_stress
+
+  let(:options) do
+    SpecConfig.instance.all_test_options
+  end
+
+  before(:all) do
+    # load if necessary
+    ClusterConfig.instance.primary_address
+    ClientRegistry.instance.close_all_clients
+  end
+
+  it 'does not warn/error on cleanup' do
+    Mongo::Logger.logger.should_not receive(:warn)
+
+    threads = 10.times.map do
+      Thread.new do
+        10.times do
+          client = new_local_client([ClusterConfig.instance.primary_address.seed], options)
+          if rand > 0.33
+            client.command(ping: 1)
+            sleep(rand * 3)
+          end
+          client.close
+          STDOUT << '.'
+        end
+      end
+    end
+    threads.each(&:join)
+    puts
+  end
+end

data/spec/support/certificates/atlas-ocsp-ca.crt

@@ -2,117 +2,109 @@ Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number:
-            91:2b:08:4a:cf:0c:18:a7:53:f6:d6:2e:25:a7:5f:5a
+            0a:35:08:d5:5c:29:2b:01:7d:f8:ad:65:c0:0f:f7:e4
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1
+        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
         Validity
-            Not Before: Sep  4 00:00:00 2020 GMT
-            Not After : Sep 15 16:00:00 2025 GMT
-        Subject: C = US, O = Let's Encrypt, CN = R3
+            Not Before: Sep 24 00:00:00 2020 GMT
+            Not After : Sep 23 23:59:59 2030 GMT
+        Subject: C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 RSA Public-Key: (2048 bit)
                 Modulus:
-                    00:bb:02:15:28:cc:f6:a0:94:d3:0f:12:ec:8d:55:
-                    92:c3:f8:82:f1:99:a6:7a:42:88:a7:5d:26:aa:b5:
-                    2b:b9:c5:4c:b1:af:8e:6b:f9:75:c8:a3:d7:0f:47:
-                    94:14:55:35:57:8c:9e:a8:a2:39:19:f5:82:3c:42:
-                    a9:4e:6e:f5:3b:c3:2e:db:8d:c0:b0:5c:f3:59:38:
-                    e7:ed:cf:69:f0:5a:0b:1b:be:c0:94:24:25:87:fa:
-                    37:71:b3:13:e7:1c:ac:e1:9b:ef:db:e4:3b:45:52:
-                    45:96:a9:c1:53:ce:34:c8:52:ee:b5:ae:ed:8f:de:
-                    60:70:e2:a5:54:ab:b6:6d:0e:97:a5:40:34:6b:2b:
-                    d3:bc:66:eb:66:34:7c:fa:6b:8b:8f:57:29:99:f8:
-                    30:17:5d:ba:72:6f:fb:81:c5:ad:d2:86:58:3d:17:
-                    c7:e7:09:bb:f1:2b:f7:86:dc:c1:da:71:5d:d4:46:
-                    e3:cc:ad:25:c1:88:bc:60:67:75:66:b3:f1:18:f7:
-                    a2:5c:e6:53:ff:3a:88:b6:47:a5:ff:13:18:ea:98:
-                    09:77:3f:9d:53:f9:cf:01:e5:f5:a6:70:17:14:af:
-                    63:a4:ff:99:b3:93:9d:dc:53:a7:06:fe:48:85:1d:
-                    a1:69:ae:25:75:bb:13:cc:52:03:f5:ed:51:a1:8b:
-                    db:15
+                    00:c1:4b:b3:65:47:70:bc:dd:4f:58:db:ec:9c:ed:
+                    c3:66:e5:1f:31:13:54:ad:4a:66:46:1f:2c:0a:ec:
+                    64:07:e5:2e:dc:dc:b9:0a:20:ed:df:e3:c4:d0:9e:
+                    9a:a9:7a:1d:82:88:e5:11:56:db:1e:9f:58:c2:51:
+                    e7:2c:34:0d:2e:d2:92:e1:56:cb:f1:79:5f:b3:bb:
+                    87:ca:25:03:7b:9a:52:41:66:10:60:4f:57:13:49:
+                    f0:e8:37:67:83:df:e7:d3:4b:67:4c:22:51:a6:df:
+                    0e:99:10:ed:57:51:74:26:e2:7d:c7:ca:62:2e:13:
+                    1b:7f:23:88:25:53:6f:c1:34:58:00:8b:84:ff:f8:
+                    be:a7:58:49:22:7b:96:ad:a2:88:9b:15:bc:a0:7c:
+                    df:e9:51:a8:d5:b0:ed:37:e2:36:b4:82:4b:62:b5:
+                    49:9a:ec:c7:67:d6:e3:3e:f5:e3:d6:12:5e:44:f1:
+                    bf:71:42:7d:58:84:03:80:b1:81:01:fa:f9:ca:32:
+                    bb:b4:8e:27:87:27:c5:2b:74:d4:a8:d6:97:de:c3:
+                    64:f9:ca:ce:53:a2:56:bc:78:17:8e:49:03:29:ae:
+                    fb:49:4f:a4:15:b9:ce:f2:5c:19:57:6d:6b:79:a7:
+                    2b:a2:27:20:13:b5:d0:3d:40:d3:21:30:07:93:ea:
+                    99:f5
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                B7:6B:A2:EA:A8:AA:84:8C:79:EA:B4:DA:0F:98:B2:C5:95:76:B9:F4
+            X509v3 Authority Key Identifier: 
+                keyid:03:DE:50:35:56:D1:4C:BB:66:F0:A3:E2:1B:1B:C3:97:B2:3D:D1:55
+
             X509v3 Key Usage: critical
                 Digital Signature, Certificate Sign, CRL Sign
             X509v3 Extended Key Usage: 
-                TLS Web Client Authentication, TLS Web Server Authentication
+                TLS Web Server Authentication, TLS Web Client Authentication
             X509v3 Basic Constraints: critical
                 CA:TRUE, pathlen:0
-            X509v3 Subject Key Identifier: 
-                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
-            X509v3 Authority Key Identifier: 
-                keyid:79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E
-
             Authority Information Access: 
-                CA Issuers - URI:http://x1.i.lencr.org/
+                OCSP - URI:http://ocsp.digicert.com
+                CA Issuers - URI:http://cacerts.digicert.com/DigiCertGlobalRootCA.crt
 
             X509v3 CRL Distribution Points: 
 
                 Full Name:
-                  URI:http://x1.c.lencr.org/
+                  URI:http://crl3.digicert.com/DigiCertGlobalRootCA.crl
+
+                Full Name:
+                  URI:http://crl4.digicert.com/DigiCertGlobalRootCA.crl
 
             X509v3 Certificate Policies: 
+                Policy: 2.23.140.1.1
                 Policy: 2.23.140.1.2.1
-                Policy: 1.3.6.1.4.1.44947.1.1.1
+                Policy: 2.23.140.1.2.2
+                Policy: 2.23.140.1.2.3
 
     Signature Algorithm: sha256WithRSAEncryption
-         85:ca:4e:47:3e:a3:f7:85:44:85:bc:d5:67:78:b2:98:63:ad:
-         75:4d:1e:96:3d:33:65:72:54:2d:81:a0:ea:c3:ed:f8:20:bf:
-         5f:cc:b7:70:00:b7:6e:3b:f6:5e:94:de:e4:20:9f:a6:ef:8b:
-         b2:03:e7:a2:b5:16:3c:91:ce:b4:ed:39:02:e7:7c:25:8a:47:
-         e6:65:6e:3f:46:f4:d9:f0:ce:94:2b:ee:54:ce:12:bc:8c:27:
-         4b:b8:c1:98:2f:a2:af:cd:71:91:4a:08:b7:c8:b8:23:7b:04:
-         2d:08:f9:08:57:3e:83:d9:04:33:0a:47:21:78:09:82:27:c3:
-         2a:c8:9b:b9:ce:5c:f2:64:c8:c0:be:79:c0:4f:8e:6d:44:0c:
-         5e:92:bb:2e:f7:8b:10:e1:e8:1d:44:29:db:59:20:ed:63:b9:
-         21:f8:12:26:94:93:57:a0:1d:65:04:c1:0a:22:ae:10:0d:43:
-         97:a1:18:1f:7e:e0:e0:86:37:b5:5a:b1:bd:30:bf:87:6e:2b:
-         2a:ff:21:4e:1b:05:c3:f5:18:97:f0:5e:ac:c3:a5:b8:6a:f0:
-         2e:bc:3b:33:b9:ee:4b:de:cc:fc:e4:af:84:0b:86:3f:c0:55:
-         43:36:f6:68:e1:36:17:6a:8e:99:d1:ff:a5:40:a7:34:b7:c0:
-         d0:63:39:35:39:75:6e:f2:ba:76:c8:93:02:e9:a9:4b:6c:17:
-         ce:0c:02:d9:bd:81:fb:9f:b7:68:d4:06:65:b3:82:3d:77:53:
-         f8:8e:79:03:ad:0a:31:07:75:2a:43:d8:55:97:72:c4:29:0e:
-         f7:c4:5d:4e:c8:ae:46:84:30:d7:f2:85:5f:18:a1:79:bb:e7:
-         5e:70:8b:07:e1:86:93:c3:b9:8f:dc:61:71:25:2a:af:df:ed:
-         25:50:52:68:8b:92:dc:e5:d6:b5:e3:da:7d:d0:87:6c:84:21:
-         31:ae:82:f5:fb:b9:ab:c8:89:17:3d:e1:4c:e5:38:0e:f6:bd:
-         2b:bd:96:81:14:eb:d5:db:3d:20:a7:7e:59:d3:e2:f8:58:f9:
-         5b:b8:48:cd:fe:5c:4f:16:29:fe:1e:55:23:af:c8:11:b0:8d:
-         ea:7c:93:90:17:2f:fd:ac:a2:09:47:46:3f:f0:e9:b0:b7:ff:
-         28:4d:68:32:d6:67:5e:1e:69:a3:93:b8:f5:9d:8b:2f:0b:d2:
-         52:43:a6:6f:32:57:65:4d:32:81:df:38:53:85:5d:7e:5d:66:
-         29:ea:b8:dd:e4:95:b5:cd:b5:56:12:42:cd:c4:4e:c6:25:38:
-         44:50:6d:ec:ce:00:55:18:fe:e9:49:64:d4:4e:ca:97:9c:b4:
-         5b:c0:73:a8:ab:b8:47:c2
+         77:ab:b7:7a:27:3d:ae:bb:f6:7f:e0:5a:56:c9:84:aa:ca:5b:
+         71:17:dd:22:47:fc:4e:9f:ee:d0:c1:a4:04:e1:a3:eb:c5:49:
+         c1:fd:d1:c9:df:8c:af:94:45:2c:46:2a:a3:63:39:20:f9:9e:
+         4a:24:94:41:c8:a9:d9:e2:9c:54:05:06:cb:5c:1c:be:00:1b:
+         0f:a8:5a:ff:19:bb:65:c7:16:af:21:56:dd:61:05:c9:e9:8f:
+         98:76:df:6b:1b:d0:72:0c:50:b9:30:29:7a:bf:60:59:10:66:
+         13:3a:2d:ac:15:11:6c:2d:23:0c:02:3e:05:3b:fe:e5:a1:9c:
+         e2:8a:db:87:d7:4a:e8:5e:e7:48:06:eb:ab:12:9a:f2:af:84:
+         c3:5b:83:4a:99:81:83:ab:00:a1:ca:0a:3c:4c:a2:25:89:2a:
+         22:a7:a4:f3:33:4c:5b:8c:2e:1a:02:97:0f:9d:8f:6d:2d:95:
+         08:fb:4f:da:f1:91:38:25:e1:9c:6e:61:18:87:6a:ce:b1:bb:
+         00:30:6a:9b:b7:af:da:f1:c5:97:fe:8a:78:24:aa:ea:93:80:
+         ba:33:65:7a:bc:a1:77:e9:7f:69:14:0b:00:3f:77:92:b1:4d:
+         5b:73:87:0a:13:d0:9c:c8:f2:4b:39:4f:52:84:49:a6:4c:90:
+         4e:1f:f7:b4
+
 -----BEGIN CERTIFICATE-----
-MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
-WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
-R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
-sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
-NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
-Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
-/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
-AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
-Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
-FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
-AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
-Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
-gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
-PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
-ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
-CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
-lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
-avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
-yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
-yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
-hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
-HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
-MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
-nLRbwHOoq7hHwg==
------END CERTIFICATE-----
+MIIE6jCCA9KgAwIBAgIQCjUI1VwpKwF9+K1lwA/35DANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0yMDA5MjQwMDAwMDBaFw0zMDA5MjMyMzU5NTlaME8xCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxKTAnBgNVBAMTIERpZ2lDZXJ0IFRMUyBS
+U0EgU0hBMjU2IDIwMjAgQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAwUuzZUdwvN1PWNvsnO3DZuUfMRNUrUpmRh8sCuxkB+Uu3Ny5CiDt3+PE0J6a
+qXodgojlEVbbHp9YwlHnLDQNLtKS4VbL8Xlfs7uHyiUDe5pSQWYQYE9XE0nw6Ddn
+g9/n00tnTCJRpt8OmRDtV1F0JuJ9x8piLhMbfyOIJVNvwTRYAIuE//i+p1hJInuW
+raKImxW8oHzf6VGo1bDtN+I2tIJLYrVJmuzHZ9bjPvXj1hJeRPG/cUJ9WIQDgLGB
+Afr5yjK7tI4nhyfFK3TUqNaX3sNk+crOU6JWvHgXjkkDKa77SU+kFbnO8lwZV21r
+eacroicgE7XQPUDTITAHk+qZ9QIDAQABo4IBrjCCAaowHQYDVR0OBBYEFLdrouqo
+qoSMeeq02g+YssWVdrn0MB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFV
+MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
+EgYDVR0TAQH/BAgwBgEB/wIBADB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGG
+GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0aHR0cDovL2Nh
+Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNydDB7BgNV
+HR8EdDByMDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRH
+bG9iYWxSb290Q0EuY3JsMDegNaAzhjFodHRwOi8vY3JsNC5kaWdpY2VydC5jb20v
+RGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMDAGA1UdIAQpMCcwBwYFZ4EMAQEwCAYG
+Z4EMAQIBMAgGBmeBDAECAjAIBgZngQwBAgMwDQYJKoZIhvcNAQELBQADggEBAHer
+t3onPa679n/gWlbJhKrKW3EX3SJH/E6f7tDBpATho+vFScH90cnfjK+URSxGKqNj
+OSD5nkoklEHIqdninFQFBstcHL4AGw+oWv8Zu2XHFq8hVt1hBcnpj5h232sb0HIM
+ULkwKXq/YFkQZhM6LawVEWwtIwwCPgU7/uWhnOKK24fXSuhe50gG66sSmvKvhMNb
+g0qZgYOrAKHKCjxMoiWJKiKnpPMzTFuMLhoClw+dj20tlQj7T9rxkTgl4ZxuYRiH
+as6xuwAwapu3r9rxxZf+ingkquqTgLozZXq8oXfpf2kUCwA/d5KxTVtzhwoT0JzI
+8ks5T1KESaZMkE4f97Q=
+-----END CERTIFICATE-----