Merge Sync commit 3f19b5d8

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+<!--
+ Make sure to assign one and only one Type (`T:`) label.
+ Select reviewers if ready for review. Our bot will automatically assign you.
+ -->
+
+## What, How & Why?
+<!-- Describe the changes and give some hints to guide your reviewers if possible. -->
+<!-- Link (via zenhub) to relevant issue this fixes -->
+
+## ☑️ ToDos
+* [ ] 📝 Changelog update
+* [ ] 🚦 Tests (or not relevant)

.vs/launch.vs.json

@@ -0,0 +1,13 @@
+{
+  "version": "0.2.1",
+  "defaults": {},
+  "configurations": [
+    {
+      "type": "default",
+      "project": "CMakeLists.txt",
+      "projectTarget": "test\\realm-sync-tests.exe",
+      "name": "test\\realm-sync-tests.exe",
+      "env":  "UNITTEST_PROGRESS=1\u0000SYSTEMROOT=${env.SYSTEMROOT}"
+    }
+  ]
+}

certificate-authority/HOW_TO_UPDATE.md

@@ -0,0 +1,32 @@
+Do this to recreate all the certificate files:
+
+    openssl req -new -config root-ca.conf -out root-ca/csr.pem -keyout root-ca/key.pem
+    openssl ca -config root-ca.conf -selfsign -in root-ca/csr.pem -out root-ca/crt.pem -extensions root_ca_ext
+
+Answer yes twice. Remove all newly created files.
+
+    openssl req -new -config signing-ca.conf -out signing-ca/csr.pem -keyout signing-ca/key.pem
+    openssl ca -config root-ca.conf -in signing-ca/csr.pem -out signing-ca/crt.pem -extensions signing_ca_ext
+
+Answer yes twice. Remove all newly created files.
+
+    openssl req -new -config dns-checked-server.conf -out certs/dns-checked-server.csr.pem -keyout certs/dns-checked-server.key.pem -subj "/DC=www.example.com/CN=www.example.com"
+    openssl ca -config signing-ca.conf -in certs/dns-checked-server.csr.pem -out certs/dns-checked-server.crt.pem -extensions server_ext -batch
+
+Remove all newly created files.
+
+    openssl req -new -config ip-server.conf -out certs/ip-server.csr.pem -keyout certs/ip-server.key.pem -subj "/DC=www.example.com/CN=www.example.com"
+    openssl ca -config signing-ca.conf -in certs/ip-server.csr.pem -out certs/ip-server.crt.pem -extensions server_ext -batch
+
+Remove all newly created files.
+
+    openssl req -new -config localhost-server.conf -out certs/localhost-server.csr.pem -keyout certs/localhost-server.key.pem -subj "/DC=localhost/CN=localhost"
+    openssl ca -config signing-ca.conf -in certs/localhost-server.csr.pem -out certs/localhost-server.crt.pem -extensions server_ext -batch
+
+Remove all newly created files.
+
+    cat certs/dns-checked-server.crt.pem signing-ca/crt.pem > certs/dns-chain.crt.pem
+    cat certs/ip-server.crt.pem signing-ca/crt.pem > certs/ip-chain.crt.pem
+    cat certs/localhost-server.crt.pem signing-ca/crt.pem > certs/localhost-chain.crt.pem
+
+    openssl x509 -in certs/localhost-chain.crt.pem -outform der -out certs/localhost-chain.crt.cer

certificate-authority/README.md

@@ -0,0 +1,72 @@
+## Certificate authority
+
+The directory certificate-authority contains config files for creating a root certificate authority (CA),
+a signing certificate authority, and various server certificates. 
+
+#### Root certificate authority
+
+The purpose of the root CA is to sign requests for signing CAs. The root is the top of the hierarchy
+and is self signed.
+
+The file root-ca.conf is an OpenSSl config file for creation of a root certificate authority. 
+
+The command
+
+```openssl req -new -config root-ca.conf -out root-ca/csr.pem -keyout root-ca/key.pem```
+
+crestes the private key `key.pem` and a certificate signing request `csr.pem`
+
+
+The next command issues a self signed certificate based on the request above.
+
+```openssl ca -config root-ca.conf -selfsign -in root-ca/csr.pem -out root-ca/crt.pem -extensions root_ca_ext```
+
+
+#### Signing certificate authority
+
+The purpose of the signing CA is to sign requests for server certificates. 
+
+The certificate signing request, and the key, for the signing CA is created as
+
+```openssl req -new -config signing-ca.conf -out signing-ca/csr.pem -keyout signing-ca/key.pem```
+
+The request is signed by the root as
+
+```openssl ca -config root-ca.conf -in signing-ca/csr.pem -out signing-ca/crt.pem -extensions signing_ca_ext```
+
+
+####  Server certificates 
+
+The first server request is for a certificate where the server is identified by the DNS names, 
+`www.example.com`, `server.example.com`,  `www.sub.example.com`, `support.example.com`.
+
+The csr and key is created as
+
+```openssl req -new -config dns-checked-server.conf -out certs/dns-checked-server.csr.pem -keyout certs/dns-checked-server.key.pem```
+
+The signing by the signing-ca is
+
+```openssl ca -config signing-ca.conf -in certs/dns-checked-server.csr.pem -out certs/dns-checked-server.crt.pem -extensions server_ext```
+
+Similar commands are used to create a localhost server certificate and an IP address checked
+certificate.
+
+#### Client side trust of the root certificate.
+
+The root certificate `root-ca/crt.pem` can be installed in clients. As a test it was installed in
+Firefox.
+
+#### Certificate chains
+
+A server must present a certificate and a chain that allows the client to verify the certificate.
+Since the client knows the root certificate but not the signing CA certificate, the server must
+present a chain consisting of the signing CA and its own certificate, e.g.,
+
+```cat dns-checked-server.crt.pem ../signing-ca/crt.pem > dns-chain.crt.pem```
+
+Starting Nginx as a HTTPS server with the certificate `localhost-chain.crt.pem` and the key
+`localhost-server.key.pem`, it is possible to connect Firefox with the root certificate to a HTTPS web page without warnings or exceptions.
+
+## Connection to sync
+
+The certificates presented here can be used to guide the implementation and testing of Sync over TLS.

certificate-authority/certs/dns-chain.crt.pem

@@ -0,0 +1,230 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 17 (0x11)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: DC=io, DC=realm, O=Realm, OU=Realm Test Signing CA, CN=Realm Test Signing CA
+        Validity
+            Not Before: Jan 15 01:00:29 2020 GMT
+            Not After : Apr 19 01:00:29 2022 GMT
+        Subject: DC=www.example.com, CN=www.example.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c6:bc:b0:9e:d9:99:4c:9b:06:19:c5:17:57:5f:
+                    47:c4:9d:29:73:35:e8:10:26:18:fc:c4:7f:d4:89:
+                    ff:55:54:c1:2c:c6:60:1c:63:67:d3:2b:25:9a:ac:
+                    10:92:25:6a:be:42:80:9a:2a:eb:f7:8d:79:2c:08:
+                    44:5b:51:80:5c:51:82:06:ee:76:19:23:79:95:9b:
+                    28:4e:a8:57:27:1f:5d:44:d2:0b:5c:7c:2e:cc:c6:
+                    46:e5:3d:e4:aa:d8:04:50:34:7f:d6:cf:26:89:55:
+                    48:fe:d6:8f:d0:3b:ab:4b:29:3b:bd:2c:31:a3:fd:
+                    28:6e:4b:ed:c9:c7:bc:0d:2c:c1:1c:3f:cc:4f:da:
+                    3e:a6:56:ae:5c:04:0c:5c:cf:22:b4:25:55:5a:e9:
+                    0a:e1:6b:44:09:39:27:fb:c7:6f:9a:63:42:31:06:
+                    da:f8:8b:a8:9b:0d:e0:8f:18:1a:93:ad:44:aa:83:
+                    65:59:e9:67:8d:5d:35:0c:3d:4b:06:cc:06:71:92:
+                    b7:e8:69:be:d9:b4:e2:89:96:30:36:4a:70:6c:27:
+                    b2:90:cd:09:c6:56:fb:85:e2:4f:c1:80:06:93:1d:
+                    5a:7f:e4:d6:43:d7:38:83:06:c3:86:51:fe:55:c0:
+                    c2:c8:75:71:b7:01:75:ca:9c:37:b1:cf:a1:68:f8:
+                    b1:53
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Subject Key Identifier: 
+                71:06:C8:41:C5:40:DC:D9:A3:6E:CB:CD:0C:BF:3A:2E:26:19:53:A1
+            X509v3 Authority Key Identifier: 
+                keyid:D9:4F:89:22:0A:79:00:FF:E8:A9:0B:48:60:61:5A:05:09:63:00:E3
+
+            X509v3 Subject Alternative Name: 
+                DNS:www.example.com, DNS:server.example.com, DNS:www.sub.example.com, DNS:support.example.com
+    Signature Algorithm: sha256WithRSAEncryption
+         78:c3:cf:53:b0:05:1f:bf:45:25:a9:4a:53:5b:cf:6c:66:4a:
+         9d:6e:e5:a3:3e:aa:ca:e0:ae:18:06:5d:25:62:9d:e1:00:10:
+         e5:73:ab:6f:c6:a7:75:2d:a5:9a:ec:40:5a:b6:cf:da:c5:43:
+         53:dc:58:2d:7c:3d:d7:12:e9:db:2c:e9:b4:b7:06:55:d1:cc:
+         28:d3:5c:6c:44:e1:f9:9a:d5:f5:e8:d7:31:5f:cd:79:7a:46:
+         57:0f:fc:ea:1c:63:42:96:ae:56:22:ad:7a:4e:19:9b:9d:b8:
+         8d:5f:93:3c:a2:5e:12:57:b0:0e:7e:ac:e1:69:df:d6:5e:42:
+         64:b1:75:90:e1:a4:eb:63:8c:2d:d2:4b:96:c1:e2:82:66:20:
+         82:3f:b2:21:f2:df:9b:6e:11:d9:1d:35:00:e6:ad:78:9f:d6:
+         49:c1:7c:15:82:b8:17:25:66:51:6f:ed:0b:0b:66:16:f0:37:
+         62:55:03:a2:dc:4f:0b:dd:70:19:8b:61:75:ee:0d:3d:e6:cf:
+         13:47:53:60:10:c2:0a:78:12:f4:07:95:f4:da:d5:5c:62:44:
+         e0:69:bb:76:2a:96:c0:84:23:60:20:9d:3e:1e:3b:b8:c6:e2:
+         ea:49:03:60:40:c7:18:68:2b:bc:69:ee:d3:65:90:aa:e3:65:
+         09:5d:38:a3:88:d6:90:dd:3f:e7:4f:b9:f0:b7:5c:9f:c4:92:
+         97:0d:2c:d9:1f:dc:f5:a6:0a:58:46:35:be:50:20:52:b2:1e:
+         44:c5:83:34:4f:78:e5:9e:80:48:3b:bf:56:63:48:a9:fd:c2:
+         2d:ee:d4:8f:f5:b5:65:56:95:db:ba:2a:a9:34:49:26:33:40:
+         0d:9c:f1:6e:e2:09:aa:40:d1:16:a4:9e:c1:f6:6f:20:2d:c1:
+         ec:2c:a5:38:3d:3a:4f:65:0e:5c:fa:ea:d6:3a:18:e9:24:6c:
+         8b:84:37:22:cf:89:3b:0b:28:e6:26:3b:a8:3d:94:bd:09:5c:
+         c6:90:bb:a4:e9:7b:a0:ff:d6:1a:68:6e:05:ad:ad:75:66:4f:
+         c0:78:3e:05:dd:cf:05:e8:38:30:fd:a2:da:64:09:32:99:75:
+         69:6d:3f:c9:52:69:92:ac:97:b4:e3:20:ca:4c:79:9c:b2:12:
+         77:92:3d:bc:d7:e3:8e:60:69:6f:2e:1f:b0:24:aa:fc:14:0c:
+         27:32:3d:62:94:fb:a8:4c:84:9d:c1:23:b6:49:66:51:0a:59:
+         ed:d8:3b:44:3a:a2:90:9f:4b:04:9e:76:5e:8a:11:f1:5a:d8:
+         f2:24:5e:09:d0:b1:1e:c5:dc:78:09:0e:63:7d:9c:c7:22:3d:
+         7f:3f:de:4d:b8:3e:47:6c
+-----BEGIN CERTIFICATE-----
+MIIFCTCCAvGgAwIBAgIBETANBgkqhkiG9w0BAQsFADB7MRIwEAYKCZImiZPyLGQB
+GRYCaW8xFTATBgoJkiaJk/IsZAEZFgVyZWFsbTEOMAwGA1UECgwFUmVhbG0xHjAc
+BgNVBAsMFVJlYWxtIFRlc3QgU2lnbmluZyBDQTEeMBwGA1UEAwwVUmVhbG0gVGVz
+dCBTaWduaW5nIENBMB4XDTIwMDExNTAxMDAyOVoXDTIyMDQxOTAxMDAyOVowOzEf
+MB0GCgmSJomT8ixkARkWD3d3dy5leGFtcGxlLmNvbTEYMBYGA1UEAwwPd3d3LmV4
+YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrywntmZ
+TJsGGcUXV19HxJ0pczXoECYY/MR/1In/VVTBLMZgHGNn0yslmqwQkiVqvkKAmirr
+9415LAhEW1GAXFGCBu52GSN5lZsoTqhXJx9dRNILXHwuzMZG5T3kqtgEUDR/1s8m
+iVVI/taP0DurSyk7vSwxo/0obkvtyce8DSzBHD/MT9o+plauXAQMXM8itCVVWukK
+4WtECTkn+8dvmmNCMQba+Iuomw3gjxgak61EqoNlWelnjV01DD1LBswGcZK36Gm+
+2bTiiZYwNkpwbCeykM0Jxlb7heJPwYAGkx1af+TWQ9c4gwbDhlH+VcDCyHVxtwF1
+ypw3sc+haPixUwIDAQABo4HXMIHUMA4GA1UdDwEB/wQEAwIFoDAJBgNVHRMEAjAA
+MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUcQbIQcVA
+3NmjbsvNDL86LiYZU6EwHwYDVR0jBBgwFoAU2U+JIgp5AP/oqQtIYGFaBQljAOMw
+WAYDVR0RBFEwT4IPd3d3LmV4YW1wbGUuY29tghJzZXJ2ZXIuZXhhbXBsZS5jb22C
+E3d3dy5zdWIuZXhhbXBsZS5jb22CE3N1cHBvcnQuZXhhbXBsZS5jb20wDQYJKoZI
+hvcNAQELBQADggIBAHjDz1OwBR+/RSWpSlNbz2xmSp1u5aM+qsrgrhgGXSVineEA
+EOVzq2/Gp3UtpZrsQFq2z9rFQ1PcWC18PdcS6dss6bS3BlXRzCjTXGxE4fma1fXo
+1zFfzXl6RlcP/OocY0KWrlYirXpOGZuduI1fkzyiXhJXsA5+rOFp39ZeQmSxdZDh
+pOtjjC3SS5bB4oJmIII/siHy35tuEdkdNQDmrXif1knBfBWCuBclZlFv7QsLZhbw
+N2JVA6LcTwvdcBmLYXXuDT3mzxNHU2AQwgp4EvQHlfTa1VxiROBpu3YqlsCEI2Ag
+nT4eO7jG4upJA2BAxxhoK7xp7tNlkKrjZQldOKOI1pDdP+dPufC3XJ/EkpcNLNkf
+3PWmClhGNb5QIFKyHkTFgzRPeOWegEg7v1ZjSKn9wi3u1I/1tWVWldu6Kqk0SSYz
+QA2c8W7iCapA0RaknsH2byAtwewspTg9Ok9lDlz66tY6GOkkbIuENyLPiTsLKOYm
+O6g9lL0JXMaQu6Tpe6D/1hpobgWtrXVmT8B4PgXdzwXoODD9otpkCTKZdWltP8lS
+aZKsl7TjIMpMeZyyEneSPbzX445gaW8uH7AkqvwUDCcyPWKU+6hMhJ3BI7ZJZlEK
+We3YO0Q6opCfSwSedl6KEfFa2PIkXgnQsR7F3HgJDmN9nMciPX8/3k24Pkds
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: DC=io, DC=realm, O=Realm, OU=Realm Test Root CA, CN=Realm Test Root CA
+        Validity
+            Not Before: Jan 14 10:52:29 2020 GMT
+            Not After : Jan 10 10:52:29 2120 GMT
+        Subject: DC=io, DC=realm, O=Realm, OU=Realm Test Signing CA, CN=Realm Test Signing CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:c3:f4:65:ce:e7:1b:d5:89:d5:3b:81:8b:22:f2:
+                    d3:62:6d:fa:82:bb:fc:1f:a1:ac:6b:bb:ba:9e:ea:
+                    aa:34:d5:e4:cd:10:de:f4:14:69:c1:e6:65:8e:c0:
+                    bc:8e:dd:2b:5c:83:c3:6f:76:da:71:de:f3:10:f7:
+                    8b:61:32:54:02:e2:74:98:89:d4:3a:a6:35:88:97:
+                    c4:67:e1:ea:13:d7:2e:bc:f9:83:f0:80:c0:4d:eb:
+                    aa:31:0d:65:49:36:01:7b:08:00:96:30:d2:3a:53:
+                    9f:03:e5:18:29:55:8d:70:ad:86:fc:00:42:5c:59:
+                    1c:84:45:61:cd:9a:ec:3d:4d:06:0a:9d:42:7c:e6:
+                    3a:2e:04:dd:03:85:20:ff:17:8a:4f:34:20:47:e8:
+                    06:20:ab:1e:fb:30:9f:38:00:a9:98:ee:c8:9f:3c:
+                    4e:48:3e:4b:15:9e:cf:22:9c:9b:4c:8b:f3:a6:e6:
+                    7b:92:55:ce:f6:7b:87:81:dc:8a:f6:d5:6c:a7:41:
+                    53:24:f0:9d:ab:df:b3:db:ce:1d:90:e3:cc:47:c5:
+                    55:cc:10:2d:44:fc:75:5f:e9:0e:30:87:62:7c:32:
+                    4f:23:60:6a:75:f9:b8:7f:cb:c3:fc:6d:1c:ee:10:
+                    aa:fe:08:c7:03:ec:2b:8b:cb:c3:23:c5:ee:cc:c1:
+                    76:82:86:6f:8f:be:07:75:be:c0:25:72:04:5f:7f:
+                    77:08:29:f9:fe:5b:8d:57:4c:6d:8f:85:13:ce:bb:
+                    ee:51:0b:b6:d6:49:c7:67:c1:8f:50:45:ee:7f:9f:
+                    c2:86:27:a5:3e:9a:13:8c:b0:3a:ce:03:5a:57:b2:
+                    63:12:a1:e4:b3:f2:5f:4b:95:21:5d:7e:b3:81:ac:
+                    74:6d:2d:04:22:69:0f:10:a1:73:cc:1e:6f:52:54:
+                    3b:6a:ea:8a:b3:46:14:a8:9a:ef:59:4a:63:3f:98:
+                    06:9b:1c:cc:c9:1a:20:9d:41:89:df:dd:25:72:c4:
+                    91:28:b9:cb:1e:0e:38:e2:74:d2:f8:f0:9f:16:bd:
+                    f2:5c:ff:c6:83:d2:e0:ab:7f:d2:15:57:fa:89:88:
+                    98:c4:62:46:34:0c:92:ea:42:4e:42:ce:7b:84:ad:
+                    c3:72:4e:95:ba:ff:7d:c1:ea:cf:11:ee:43:7b:1a:
+                    db:d3:53:b0:75:2c:11:7d:c6:70:60:7f:ca:0b:c6:
+                    8f:b4:bd:0e:01:77:77:c3:73:7c:2b:15:fb:94:8a:
+                    a1:1d:12:c8:6e:60:72:57:a0:b8:31:4d:3c:f5:e7:
+                    8b:aa:55:61:63:23:5f:fd:d3:b8:f9:63:55:f5:05:
+                    49:99:dd:2a:97:a3:00:ea:c0:66:f2:59:3d:45:aa:
+                    38:9f:9b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Subject Key Identifier: 
+                D9:4F:89:22:0A:79:00:FF:E8:A9:0B:48:60:61:5A:05:09:63:00:E3
+            X509v3 Authority Key Identifier: 
+                keyid:63:16:FA:78:4A:3A:84:A3:A1:41:E6:CF:12:74:82:A9:16:04:E9:7B
+
+    Signature Algorithm: sha256WithRSAEncryption
+         b2:80:9f:bd:2a:6c:eb:6c:fb:0c:75:d7:af:0e:0c:60:d4:a6:
+         02:d2:16:d9:81:3a:3f:b6:a2:77:c2:f3:e8:b7:a4:71:62:4a:
+         e4:75:1b:5e:05:0b:e3:91:0d:10:bd:4c:fd:c4:0e:cb:68:8f:
+         4a:25:df:34:e6:f4:5e:46:80:e0:d4:dc:59:8c:a1:7e:eb:64:
+         e2:01:98:4a:1e:e0:e4:c3:38:b3:f3:4d:81:d2:cb:23:18:f0:
+         5b:62:39:c1:7d:7e:e9:d0:10:dd:3f:42:fc:47:29:ac:36:41:
+         99:c9:02:1a:6d:5c:b7:1e:5c:83:e0:de:42:5b:94:25:23:7f:
+         1e:75:9f:7d:50:3c:8a:8c:8d:8b:ae:28:6f:ae:82:91:df:17:
+         ca:c4:df:ef:64:27:b0:e7:4f:36:b4:9d:e4:7f:86:b3:b3:fe:
+         5c:50:94:82:bd:e7:d2:21:e8:e3:14:4d:f4:bb:cd:7b:b7:b7:
+         90:43:15:d4:94:1c:59:7d:48:48:e6:66:b6:83:25:47:eb:18:
+         fa:72:15:a1:a4:42:c2:a2:9a:c0:af:1b:2e:d4:8a:21:88:b2:
+         0c:ae:a6:d4:91:ab:ca:68:69:de:73:e8:9c:76:7d:cb:d2:a6:
+         99:06:d1:27:bc:12:7e:d4:6c:40:90:96:f3:39:03:a6:ab:d9:
+         41:18:8e:cf:81:cb:67:8e:44:28:cd:58:34:8c:2b:f4:23:31:
+         f2:2b:b3:a7:b4:73:be:d5:9c:5d:ba:47:f9:6b:7a:5b:36:01:
+         ff:7f:2c:93:4e:8c:17:e1:06:1a:11:d7:4d:38:5c:f9:44:0d:
+         26:df:46:d6:4d:a5:b1:cb:07:cb:d4:90:c1:1e:d1:23:a6:dd:
+         67:c9:aa:61:c0:a2:92:8f:aa:cd:e2:43:f8:35:04:ab:7b:98:
+         94:75:d0:b2:8a:07:6c:63:90:70:d6:3f:8b:09:43:21:e3:68:
+         b3:22:e1:d4:61:2d:b6:73:a6:a6:a3:a0:21:2a:2e:0f:6b:20:
+         0f:34:b0:d6:46:d7:a1:1c:84:08:12:88:9c:ac:b9:f2:99:6c:
+         16:5b:a8:9f:b8:57:a5:06:dc:d5:58:e8:f9:7c:e8:82:f8:de:
+         84:d8:68:d3:00:ec:3c:bb:2d:8f:46:a6:9f:05:f3:2f:a6:f0:
+         34:1c:ba:3f:23:28:34:2e:50:06:d4:77:78:07:68:d4:d3:fb:
+         62:9d:ea:5b:28:db:bb:68:3c:68:0b:8d:61:2f:ce:4d:5a:64:
+         c0:52:b7:67:42:14:58:f7:f9:62:28:42:f1:ad:d2:90:c5:c9:
+         af:f3:ac:87:0e:30:9e:5a:02:3d:6c:6c:8d:d4:56:6a:9f:b0:
+         26:c5:f1:4d:59:a6:10:75
+-----BEGIN CERTIFICATE-----
+MIIF0zCCA7ugAwIBAgIBBjANBgkqhkiG9w0BAQsFADB1MRIwEAYKCZImiZPyLGQB
+GRYCaW8xFTATBgoJkiaJk/IsZAEZFgVyZWFsbTEOMAwGA1UECgwFUmVhbG0xGzAZ
+BgNVBAsMElJlYWxtIFRlc3QgUm9vdCBDQTEbMBkGA1UEAwwSUmVhbG0gVGVzdCBS
+b290IENBMCAXDTIwMDExNDEwNTIyOVoYDzIxMjAwMTEwMTA1MjI5WjB7MRIwEAYK
+CZImiZPyLGQBGRYCaW8xFTATBgoJkiaJk/IsZAEZFgVyZWFsbTEOMAwGA1UECgwF
+UmVhbG0xHjAcBgNVBAsMFVJlYWxtIFRlc3QgU2lnbmluZyBDQTEeMBwGA1UEAwwV
+UmVhbG0gVGVzdCBTaWduaW5nIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAw/Rlzucb1YnVO4GLIvLTYm36grv8H6Gsa7u6nuqqNNXkzRDe9BRpweZl
+jsC8jt0rXIPDb3bacd7zEPeLYTJUAuJ0mInUOqY1iJfEZ+HqE9cuvPmD8IDATeuq
+MQ1lSTYBewgAljDSOlOfA+UYKVWNcK2G/ABCXFkchEVhzZrsPU0GCp1CfOY6LgTd
+A4Ug/xeKTzQgR+gGIKse+zCfOACpmO7InzxOSD5LFZ7PIpybTIvzpuZ7klXO9nuH
+gdyK9tVsp0FTJPCdq9+z284dkOPMR8VVzBAtRPx1X+kOMIdifDJPI2Bqdfm4f8vD
+/G0c7hCq/gjHA+wri8vDI8XuzMF2goZvj74Hdb7AJXIEX393CCn5/luNV0xtj4UT
+zrvuUQu21knHZ8GPUEXuf5/ChielPpoTjLA6zgNaV7JjEqHks/JfS5UhXX6zgax0
+bS0EImkPEKFzzB5vUlQ7auqKs0YUqJrvWUpjP5gGmxzMyRognUGJ390lcsSRKLnL
+Hg444nTS+PCfFr3yXP/Gg9Lgq3/SFVf6iYiYxGJGNAyS6kJOQs57hK3Dck6Vuv99
+werPEe5Dexrb01OwdSwRfcZwYH/KC8aPtL0OAXd3w3N8KxX7lIqhHRLIbmByV6C4
+MU089eeLqlVhYyNf/dO4+WNV9QVJmd0ql6MA6sBm8lk9Rao4n5sCAwEAAaNmMGQw
+DgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFNlP
+iSIKeQD/6KkLSGBhWgUJYwDjMB8GA1UdIwQYMBaAFGMW+nhKOoSjoUHmzxJ0gqkW
+BOl7MA0GCSqGSIb3DQEBCwUAA4ICAQCygJ+9KmzrbPsMddevDgxg1KYC0hbZgTo/
+tqJ3wvPot6RxYkrkdRteBQvjkQ0QvUz9xA7LaI9KJd805vReRoDg1NxZjKF+62Ti
+AZhKHuDkwziz802B0ssjGPBbYjnBfX7p0BDdP0L8RymsNkGZyQIabVy3HlyD4N5C
+W5QlI38edZ99UDyKjI2LrihvroKR3xfKxN/vZCew5082tJ3kf4azs/5cUJSCvefS
+IejjFE30u817t7eQQxXUlBxZfUhI5ma2gyVH6xj6chWhpELCoprArxsu1IohiLIM
+rqbUkavKaGnec+icdn3L0qaZBtEnvBJ+1GxAkJbzOQOmq9lBGI7PgctnjkQozVg0
+jCv0IzHyK7OntHO+1Zxdukf5a3pbNgH/fyyTTowX4QYaEddNOFz5RA0m30bWTaWx
+ywfL1JDBHtEjpt1nyaphwKKSj6rN4kP4NQSre5iUddCyigdsY5Bw1j+LCUMh42iz
+IuHUYS22c6amo6AhKi4PayAPNLDWRtehHIQIEoicrLnymWwWW6ifuFelBtzVWOj5
+fOiC+N6E2GjTAOw8uy2PRqafBfMvpvA0HLo/Iyg0LlAG1Hd4B2jU0/tinepbKNu7
+aDxoC41hL85NWmTAUrdnQhRY9/liKELxrdKQxcmv86yHDjCeWgI9bGyN1FZqn7Am
+xfFNWaYQdQ==
+-----END CERTIFICATE-----