mongo 2.4.1 → 2.14.0

data/spec/support/aws_utils/provisioner.rb

@@ -0,0 +1,360 @@
+module AwsUtils
+  class Provisioner < Base
+
+    def setup_aws_auth_resources
+      security_group_id = ssh_security_group_id
+      if security_group_id.nil?
+        security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+        ).group_id
+      end
+      puts "EC2 Security group: #{security_group_id}"
+      setup_security_group(security_group_id)
+
+      vpc = ec2_client.describe_vpcs(
+        filters: [{
+          name: 'cidr',
+          values: [AWS_AUTH_VPC_CIDR],
+        }],
+      ).vpcs.first
+      if vpc.nil?
+        vpc = ec2_client.create_vpc(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+        ).vpc
+      end
+
+      # The VPC must have an internet gateway and the subnet in the VPC
+      # must have a route to the internet gateway.
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#d0e22943
+      # Internet gateways cannot be named when they are created, therefore
+      # we check if our VPC has a gateway and if not, create an unnamed one
+      # and attach it right away.
+      # https://aws.amazon.com/premiumsupport/knowledge-center/ecs-pull-container-error/
+      igw = ec2_client.describe_internet_gateways(
+        filters: [{
+          name: 'attachment.vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).internet_gateways.first
+      if igw.nil?
+        igw = ec2_client.create_internet_gateway.internet_gateway
+        ec2_client.attach_internet_gateway(
+          internet_gateway_id: igw.internet_gateway_id,
+          vpc_id: vpc.vpc_id,
+        )
+      end
+
+      # https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html#Add_IGW_Routing
+      route_table = ec2_client.describe_route_tables(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).route_tables.first
+      ec2_client.create_route(
+        destination_cidr_block: '0.0.0.0/0',
+        gateway_id: igw.internet_gateway_id,
+        route_table_id: route_table.route_table_id,
+      )
+
+      vpc_security_group_id = ssh_vpc_security_group_id
+      if vpc_security_group_id.nil?
+        vpc_security_group_id = ec2_client.create_security_group(
+          group_name: AWS_AUTH_VPC_SECURITY_GROUP_NAME,
+          description: 'Inbound SSH',
+          vpc_id: vpc.vpc_id,
+        ).group_id
+      end
+      setup_security_group(vpc_security_group_id)
+
+      subnet = ec2_client.describe_subnets(
+        filters: [{
+          name: 'vpc-id',
+          values: [vpc.vpc_id],
+        }],
+      ).subnets.first
+      if subnet.nil?
+        subnet = ec2_client.create_subnet(
+          cidr_block: AWS_AUTH_VPC_CIDR,
+          vpc_id: vpc.vpc_id,
+        ).subnet
+      end
+      puts "VPC: #{vpc.vpc_id}, subnet: #{subnet.subnet_id}, security group: #{vpc_security_group_id}"
+
+      # For testing regular credentials, create an IAM user with no permissions.
+
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        resp = iam_client.create_user(
+          user_name: AWS_AUTH_REGULAR_USER_NAME,
+        )
+        user = resp.user
+      end
+
+      puts "Regular AWS auth unprivileged user: #{user.arn}"
+
+      # Assume role testing
+      # https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/
+      #
+      # The instructions given in the above guide create an intermediate user
+      # who has the ability to assume the role. This script reuses the
+      # regular unprivileged user to be the user that assumes the role.
+      user_policy = detect_object(iam_client.list_policies, :policies, :policy_name, AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME)
+      if user_policy.nil?
+        user_policy_document = {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": [
+                "ec2:Describe*",
+                "iam:ListRoles",
+                "sts:AssumeRole",
+              ],
+              "Resource": "*",
+            },
+          ],
+        }
+        user_policy = iam_client.create_policy(
+          policy_name: AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME,
+          policy_document: user_policy_document.to_json,
+        ).policy
+      end
+
+      iam_client.attach_user_policy(
+        policy_arn: user_policy.arn,
+        user_name: user.user_name,
+      )
+
+      assume_role = detect_object(iam_client.list_roles, :roles, :role_name, AWS_AUTH_ASSUME_ROLE_NAME)
+      if assume_role.nil?
+        aws_account_id = user.arn.split(':')[4]
+        assume_role_policy = {
+          "Version": "2012-10-17",
+          "Statement": {
+            "Effect": "Allow",
+            "Principal": { "AWS": "arn:aws:iam::#{aws_account_id}:root" },
+            "Action": "sts:AssumeRole",
+          },
+        }
+        resp = iam_client.create_role(
+          role_name: AWS_AUTH_ASSUME_ROLE_NAME,
+          assume_role_policy_document: assume_role_policy.to_json,
+          max_session_duration: 12*3600,
+        )
+        assume_role = resp.role
+      end
+      puts "Assume role ARN: #{assume_role.arn}"
+
+      # For testing retrieval of credentials from EC2 link local endpoint,
+      # create an instance profile.
+      ips = iam_client.list_instance_profiles
+      instance_profile = ips.instance_profiles.detect do |instance_profile|
+        instance_profile.instance_profile_name == AWS_AUTH_INSTANCE_PROFILE_NAME
+      end
+      if instance_profile.nil?
+        resp = iam_client.create_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        )
+        instance_profile = resp.instance_profile
+      end
+
+      puts "EC2 instance profile: #{instance_profile.arn}"
+
+      # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role
+      assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": {
+          "Effect": "Allow",
+          "Principal": {"Service": "ec2.amazonaws.com"},
+          "Action": "sts:AssumeRole",
+        },
+      }
+      ec2_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "ec2:Describe*",
+            ],
+            "Resource": "*",
+          },
+        ],
+      }
+      ec2_role = create_role_with_policy(
+        AWS_AUTH_EC2_ROLE_NAME,
+        {
+          assume_role_policy_document: assume_role_policy_document.to_json,
+        },
+        ec2_role_policy_document,
+      )
+      puts "EC2 role ARN: #{ec2_role.arn}"
+
+      instance_profile.roles.each do |role|
+        iam_client.remove_role_from_instance_profile(
+          instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+          role_name: role.role_name,
+        )
+      end
+
+      iam_client.add_role_to_instance_profile(
+        instance_profile_name: AWS_AUTH_INSTANCE_PROFILE_NAME,
+        role_name: AWS_AUTH_EC2_ROLE_NAME,
+      )
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_AWSCLI_Fargate.html
+      puts "ECS cluster name: #{AWS_AUTH_ECS_CLUSTER_NAME}"
+      resp = ecs_client.describe_clusters(
+        clusters: [AWS_AUTH_ECS_CLUSTER_NAME],
+      )
+      cluster = detect_object(resp, :clusters, :cluster_name, AWS_AUTH_ECS_CLUSTER_NAME)
+      if cluster.nil?
+        resp = ecs_client.create_cluster(
+          cluster_name: AWS_AUTH_ECS_CLUSTER_NAME,
+        )
+        cluster = resp.cluster
+      end
+
+      # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      ecs_assume_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Sid": "",
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "ecs-tasks.amazonaws.com",
+            },
+            "Action": "sts:AssumeRole",
+          },
+        ],
+      }
+
+      # The task role itself does not have any permissions.
+      # The example given in https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
+      # allows read-only access to an S3 bucket.
+      ecs_task_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [],
+      }
+      ecs_task_role = create_role_with_policy(
+        AWS_AUTH_ECS_TASK_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+      )
+
+      # Logging to CloudWatch:
+      # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
+      ecs_execution_role_policy_document = {
+        "Version": "2012-10-17",
+        "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents",
+            "logs:DescribeLogStreams",
+          ],
+          "Resource": [
+            "*"
+          ],
+        }],
+      }
+      ecs_execution_role = create_role_with_policy(
+        AWS_AUTH_ECS_EXECUTION_ROLE_NAME,
+        {
+          assume_role_policy_document: ecs_assume_role_policy_document.to_json,
+        },
+        ecs_execution_role_policy_document,
+      )
+
+=begin
+      iam_client.attach_role_policy(
+        role_name: AWS_AUTH_ECS_ROLE_NAME,
+        policy_arn: "arn:aws:iam::aws:policy/AmazonECSTaskExecutionRolePolicy",
+      )
+=end
+
+      log_group = logs_client.describe_log_groups(
+        log_group_name_prefix: AWS_AUTH_ECS_LOG_GROUP,
+      ).log_groups.first
+      unless log_group
+        logs_client.create_log_group(
+          log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        )
+      end
+
+      logs_client.put_retention_policy(
+        log_group_name: AWS_AUTH_ECS_LOG_GROUP,
+        retention_in_days: 1,
+      )
+    end
+
+    def reset_keys
+      user = detect_object(iam_client.list_users, :users, :user_name, AWS_AUTH_REGULAR_USER_NAME)
+      if user.nil?
+        raise 'No user found, please run `aws setup-resources`'
+      end
+
+      iam_client.list_access_keys(
+        user_name: user.user_name,
+      ).to_h[:access_key_metadata].each do |access_key|
+        iam_client.delete_access_key(
+          user_name: user.user_name,
+          access_key_id: access_key[:access_key_id],
+        )
+      end
+
+      resp = iam_client.create_access_key(
+        user_name: user.user_name,
+      )
+      access_key = resp.to_h[:access_key]
+
+      puts "Credentials for regular user (#{AWS_AUTH_REGULAR_USER_NAME}):"
+      puts "AWS_ACCESS_KEY_ID=#{access_key[:access_key_id]}"
+      puts "AWS_SECRET_ACCESS_KEY=#{access_key[:secret_access_key]}"
+      puts
+    end
+
+    private
+
+    def create_role_with_policy(role_name, role_options, role_policy_document = nil)
+      role = detect_object(iam_client.list_roles, :roles, :role_name, role_name)
+      if role.nil?
+        resp = iam_client.create_role({
+          role_name: role_name,
+        }.update(role_options))
+        role = resp.role
+      end
+
+      if role_policy_document
+        iam_client.put_role_policy(
+          role_name: role_name,
+          policy_name: "#{role_name}.policy",
+          policy_document: role_policy_document.to_json,
+        )
+      end
+
+      role
+    end
+
+    def setup_security_group(security_group_id)
+      ec2_client.authorize_security_group_ingress(
+        group_id: security_group_id,
+        ip_permissions: [{
+          from_port: 22,
+          to_port: 22,
+          ip_protocol: 'tcp',
+          ip_ranges: [{
+            cidr_ip: '0.0.0.0/0',
+          }],
+        }],
+      )
+    rescue Aws::EC2::Errors::InvalidPermissionDuplicate
+    end
+  end
+end

data/spec/support/aws_utils.rb

@@ -0,0 +1,62 @@
+autoload :Byebug, 'byebug'
+autoload :Paint, 'paint'
+
+module Aws
+  autoload :CloudWatchLogs, 'aws-sdk-cloudwatchlogs'
+  autoload :Credentials, 'aws-sdk-core'
+  autoload :EC2, 'aws-sdk-ec2'
+  autoload :ECS, 'aws-sdk-ecs'
+  autoload :IAM, 'aws-sdk-iam'
+  autoload :STS, 'aws-sdk-core'
+end
+
+module AwsUtils
+  NAMESPACE = 'mdb-ruby'.freeze
+
+  AWS_AUTH_REGULAR_USER_NAME = "#{NAMESPACE}.aws-auth-regular".freeze
+
+  AWS_AUTH_ASSUME_ROLE_NAME = "#{NAMESPACE}.assume-role".freeze
+
+  AWS_AUTH_SECURITY_GROUP_NAME = "#{NAMESPACE}.ssh".freeze
+
+  AWS_AUTH_VPC_GATEWAY_NAME = NAMESPACE
+
+  AWS_AUTH_VPC_SECURITY_GROUP_NAME = "#{NAMESPACE}.vpc-ssh".freeze
+
+  AWS_AUTH_VPC_CIDR = "10.42.142.64/28".freeze
+
+  AWS_AUTH_EC2_AMI_NAMES = {
+    # https://wiki.debian.org/Cloud/AmazonEC2Image/Buster
+    'debian10' => 'debian-10-amd64-20200210-166',
+    'ubuntu1604' => 'ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20200317',
+  }.freeze
+
+  AWS_AUTH_EC2_INSTANCE_NAME = "#{NAMESPACE}.aws-auth)".freeze
+
+  AWS_AUTH_INSTANCE_PROFILE_NAME = "#{NAMESPACE}.ip".freeze
+
+  AWS_AUTH_ASSUME_ROLE_USER_POLICY_NAME = "#{NAMESPACE}.assume-role-user-policy".freeze
+
+  AWS_AUTH_EC2_ROLE_NAME = "#{NAMESPACE}.ec2-role".freeze
+
+  AWS_AUTH_ECS_CLUSTER_NAME = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_TASK_FAMILY = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_SERVICE_NAME = "#{NAMESPACE}_aws-auth".freeze
+
+  AWS_AUTH_ECS_LOG_GROUP = "/ecs/#{NAMESPACE}/aws-auth-ecs".freeze
+
+  AWS_AUTH_ECS_LOG_STREAM_PREFIX = "task".freeze
+
+  # This role allows ECS tasks access to output logs to CloudWatch.
+  AWS_AUTH_ECS_EXECUTION_ROLE_NAME = "#{NAMESPACE}.ecs-execution-role".freeze
+
+  # This role is assumed by ECS tasks.
+  AWS_AUTH_ECS_TASK_ROLE_NAME = "#{NAMESPACE}.ecs-task-role".freeze
+
+  autoload :Base, 'support/aws_utils/base'
+  autoload :Inspector, 'support/aws_utils/inspector'
+  autoload :Orchestrator, 'support/aws_utils/orchestrator'
+  autoload :Provisioner, 'support/aws_utils/provisioner'
+end

data/spec/support/background_thread_registry.rb

@@ -0,0 +1,67 @@
+require 'singleton'
+require 'ostruct'
+
+module Mongo
+  module BackgroundThread
+
+    alias :start_without_tracking! :start!
+
+    def start!
+      start_without_tracking!.tap do |thread|
+        BackgroundThreadRegistry.instance.register(self, thread)
+      end
+    end
+  end
+end
+
+class BackgroundThreadRegistry
+  include Singleton
+
+  def initialize
+    @lock = Mutex.new
+    @records = []
+  end
+
+  def register(object, thread)
+    @lock.synchronize do
+      @records << OpenStruct.new(
+        thread: thread,
+        object: object,
+        example: $current_example,
+      )
+    end
+  end
+
+  def verify_empty!
+    @lock.synchronize do
+      alive_thread_records = @records.select { |record| record.thread.alive? }
+      if alive_thread_records.any?
+        msg = "Live background threads after closing all clients:"
+        alive_thread_records.each do |record|
+          msg << "\n  #{record.object}"
+          if record.object.respond_to?(:options)
+            msg << "\n  with options: #{record.object.options}"
+          end
+          if record.example
+            msg << "\n  in #{record.example.id} #{record.example.full_description}"
+          else
+            msg << "\n  not in an example"
+          end
+        end
+        raise msg
+      end
+      @records.clear
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.around do |example|
+    $current_example = example
+    begin
+      example.run
+    ensure
+      $current_example = nil
+    end
+  end
+end

data/spec/support/certificates/README.md

@@ -0,0 +1,105 @@
+# Ruby Driver Test TLS Certificates
+
+## File Types
+
+All files in this directory are in the PEM format. They are generated by
+the x509gen MongoDB tool.
+
+The file extensions map to content as follows:
+
+- `.key` - private key
+- `.crt` - certificate
+- `.pem` - certificate and private key combined in the same file
+
+The file name fragments have the following meaning:
+
+- `second-level` - these certificates are signed by the intermediate
+certificates (`client-int.crt` & `server-int.crt`) rather than directly
+by the CA certificates.
+- `int` - these are intermediate certificates used for testing certificate
+chains. The server and the client sides have their own intermediate certificates.
+- `bundle` - these files contain the leaf certificates followed by intermediate
+certificates up to the CA certificates, but do not include the CA certificates.
+
+## Generation
+
+Keep in mind the following important notes:
+
+- In multi-ca.crt, the Ruby driver CA certificate must be last (the first
+certificate must be an unrelated certificate).
+- All server certificates should have `localhost.test.build.10gen.cc` in
+the Subject Alternate Name field for testing SRV monitoring.
+
+## Tools
+
+To inspect a certificate:
+
+    openssl x509 -text -in path.pem
+
+## Manual Testing - openssl
+
+Start a test server using the simple certificate:
+
+    openssl s_server -port 29999 -CAfile ca.crt -cert server.pem -verify 1
+
+Use OpenSSL's test client to test certificate verification using the
+simple certificate:
+
+    openssl s_client -connect :29999 -CAfile ca.crt -cert client.pem \
+        -verify 1 -verify_return_error
+
+Same thing but using the second level certificate with the intermediate
+certificate (server follows chain up to the CA):
+
+    openssl s_client -connect :29999 -CAfile ca.crt \
+        -cert client-second-level-bundle.pem \
+        -verify 1 -verify_return_error
+
+Note however, that even though a client to server connection succeeds using
+the second level client bundle, openssl appears to be incapable to simply
+verify the same certificate chain using the verify command:
+
+    # This fails
+    openssl verify -verbose -CAfile ca.crt -untrusted client-int.crt \
+        client-second-level.pem 
+
+    # Also fails
+    openssl verify -trusted client-int.crt client-second-level.crt
+
+And when the server's certificate uses an intermediate certificate, the
+client seems to be unable to verify it also:
+
+    openssl s_server -port 29999  -CAfile ca.crt -verify 1 \
+        -cert server-second-level-bundle.pem
+
+    # This fails
+    openssl s_client -connect :29999 -CAfile ca.crt -cert client.pem \
+        -verify 1 -verify_return_error
+
+To sum up, openssl's command line tools appear to only handle certificate
+chains provided by the client when the server is verifying them, not the
+other way around and not when trying to standalone verify the chain.
+
+## Manual Testing - mongo
+
+When it comes to `mongod` and `mongo`, certificate chains are supported in
+both directions:
+
+    mongod --sslMode requireSSL \
+        --sslCAFile ca.crt \
+        --sslPEMKeyFile server-second-level-bundle.pem \
+        --sslClientCertificate client.pem
+
+    mongo --host localhost --ssl \
+        --sslCAFile ca.crt \
+        --sslPEMKeyFile client-second-level-bundle.pem
+
+The `--host` option needs to be given to `mongo` because the certificates here
+do not include 127.0.0.1 in subject alternate name.
+
+If the intermediate certificate is not provided, the connection should fail.
+
+    # Expected to fail
+    mongo --host localhost --ssl \
+        --sslCAFile ca.crt \
+        --sslPEMKeyFile client-second-level.pem

data/spec/support/certificates/atlas-ocsp-ca.crt

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
+U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
+nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
+KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
+/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
+kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
+/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6
+Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1
+oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD
+QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
+d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh
+xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB
+CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl
+5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA
+8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC
+2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit
+c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0
+j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
+-----END CERTIFICATE-----
+

data/spec/support/certificates/atlas-ocsp.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOjCCBiKgAwIBAgIQBHwKuME6qrWYg7D7VTlKYjANBgkqhkiG9w0BAQsFADBN
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
+aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgwMjA3MDAwMDAwWhcN
+MjEwNTA3MDAwMDAwWjB7MQswCQYDVQQGEwJVUzERMA8GA1UECBMITmV3IFlvcmsx
+ETAPBgNVBAcTCE5ldyBZb3JrMRYwFAYDVQQKEw1Nb25nb0RCLCBJbmMuMRIwEAYD
+VQQLEwlDbG91ZCBTUkUxGjAYBgNVBAMMESoubW9uZ29kYi1kZXYubmV0MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0oEdsION7ajeosGKBaZ4szN58kFz
+4EHBrgGs7N5X+4weolk4LouU0nUO2SDwjdJL5Kpbb1rUb3satTVAuNj2CDp3LynW
+Zggtf3OCbBHMKmFUMxYiriEGU/BCHo+qKlWj0eM1qRWC/9qjbg5+pvnhYEOYZgMw
+rIjD8V/j/8fO2mfBTpK+5xXeLXaIZKLgFlHWhLueTBONhSjGCHCKuI9xL6lBys3s
+QqsSMZY1weecD4jP8nVxuHpOnwdWOo2BH8d4nh8PowQYSjbrKm2n1cDGnak7oqZ4
+hpR4zjG04zOrLzw9p5uzUj4ofPhsaUC9K4sLAh01PZRnIl9tIvQkp0Xc8QIDAQAB
+o4ID5jCCA+IwHwYDVR0jBBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0O
+BBYEFCN2C7OPPJfzGKESo8DdeuMzXWFLMC0GA1UdEQQmMCSCESoubW9uZ29kYi1k
+ZXYubmV0gg9tb25nb2RiLWRldi5uZXQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBrBgNVHR8EZDBiMC+gLaArhilodHRwOi8v
+Y3JsMy5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2LmNybDAvoC2gK4YpaHR0cDov
+L2NybDQuZGlnaWNlcnQuY29tL3NzY2Etc2hhMi1nNi5jcmwwTAYDVR0gBEUwQzA3
+BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQu
+Y29tL0NQUzAIBgZngQwBAgIwfAYIKwYBBQUHAQEEcDBuMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jYWNl
+cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS5jcnQw
+DAYDVR0TAQH/BAIwADCCAfkGCisGAQQB1nkCBAIEggHpBIIB5QHjAHcApLkJkLQY
+WBSHuxOizGdwCjw1mAT5G9+443fNDsgN3BAAAAFhcQh6hAAABAMASDBGAiEAsBwl
+EUAJoqWKGHlG1Iw+Z9hr3RPPySoPT4PBjWRnWpcCIQC7V9EFENl7Pk6NOwRo1joZ
+OB4UNyZh1YVlQOXyZK0tUgB2AId1v+dZfPiMQ5lfvfNu/1aNR1Y2/0q1YMG06v9e
+oIMPAAABYXEIep0AAAQDAEcwRQIhALvaijTUDDPJgr79QDHN7102E3hpilLEmV02
+D5jbI3efAiB18NNDifebYBRBALyVFZf5TPwMJ4Hb//roHdTf+dqbVwB3ALvZ37wf
+inG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABYXEIehQAAAQDAEgwRgIhAJao
+S5aKuudv9ZA4dUD/gEzdHZsF3M9xsa+KZHZzinT1AiEA1zAQMKp2pa8/Or5soC7M
+HrsykWEXY3lpFCsyQM+RPHUAdwBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkGjbII
+mjfZEwAAAWFxCHyrAAAEAwBIMEYCIQDhtxcQCz916LqV/RKhTNOi39LW4dMPAl7Q
+eWPTaUk3dAIhAOgQiFAYkgJvun9hZk/wWZ8PaZJOGnKnkLdTM3j7ZdTNMA0GCSqG
+SIb3DQEBCwUAA4IBAQB6rK1wA1IsQCZVSXooVt79EgF3JMlgyCRZKTFD1KZtkKG7
+n9YI0Aatw3hvKpo8OV4KC1Iw1Ie6JwbVTczyHApROLSeSHTtxbfiNXmYqNVECSQt
+I+dHAYc38EKCb/XgxqfFra0vJRcCzd1yHLKJ6uERI6cJ7/vkLqJiRScHNh49Py8Y
+Osijdqd0BZnwAdFKpPtmvPNPH9JWu8RlcfWUukJKF1YgzeCjz50DL47Ykqh7C8aA
+T9B5yzkDNBg65zZSeDnX6FFo0ZC8BMxqN+kCyk3favP3NP8FBmkEZPqY0wMh3Xsd
+OdSNdcGPBlN4MiTOIkWW6JrZl6y/hQ83ktYG8wwY
+-----END CERTIFICATE-----