Skip to content

Commit d2262fe

Browse files
vieiroadinn
vieiro
authored and
adinn
committed
8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
Backport-of: 907350e9e8e9b66365e9eaa3ae89ddc55cf9731f
1 parent ba7b3c2 commit d2262fe

File tree

8 files changed

+392
-4
lines changed

8 files changed

+392
-4
lines changed

‎src/java.base/share/classes/sun/security/validator/CADistrustPolicy.java‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -67,6 +67,22 @@ void checkDistrust(String variant, X509Certificate[] chain)
6767
}
6868
EntrustTLSPolicy.checkDistrust(chain);
6969
}
70+
},
71+
72+
/**
73+
* Distrust TLS Server certificates anchored by a CAMERFIRMA root CA and
74+
* issued after April 15, 2025. If enabled, this policy is currently
75+
* enforced by the PKIX and SunX509 TrustManager implementations
76+
* of the SunJSSE provider implementation.
77+
*/
78+
CAMERFIRMA_TLS {
79+
void checkDistrust(String variant, X509Certificate[] chain)
80+
throws ValidatorException {
81+
if (!variant.equals(Validator.VAR_TLS_SERVER)) {
82+
return;
83+
}
84+
CamerfirmaTLSPolicy.checkDistrust(chain);
85+
}
7086
};
7187

7288
/**

‎src/java.base/share/classes/sun/security/validator/CamerfirmaTLSPolicy.java‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
/*
2+
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
package sun.security.validator;
26+
27+
import java.security.cert.X509Certificate;
28+
import java.time.LocalDate;
29+
import java.time.Month;
30+
import java.time.ZoneOffset;
31+
import java.util.Date;
32+
import java.util.Map;
33+
import java.util.Set;
34+
35+
import sun.security.util.Debug;
36+
import sun.security.x509.X509CertImpl;
37+
38+
/**
39+
* This class checks if Camerfirma issued TLS Server certificates should be
40+
* restricted.
41+
*/
42+
final class CamerfirmaTLSPolicy {
43+
44+
private static final Debug debug = Debug.getInstance("certpath");
45+
46+
// SHA-256 certificate fingerprints of distrusted roots
47+
private static final Set<String> FINGERPRINTS = Set.of(
48+
// cacerts alias: camerfirmachamberscommerceca
49+
// DN: CN=Chambers of Commerce Root,
50+
// OU=http://www.chambersign.org,
51+
// O=AC Camerfirma SA CIF A82743287, C=EU
52+
"0C258A12A5674AEF25F28BA7DCFAECEEA348E541E6F5CC4EE63B71B361606AC3",
53+
// cacerts alias: camerfirmachambersca
54+
// DN: CN=Chambers of Commerce Root - 2008,
55+
// O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
56+
// L=Madrid (see current address at www.camerfirma.com/address),
57+
// C=EU
58+
"063E4AFAC491DFD332F3089B8542E94617D893D7FE944E10A7937EE29D9693C0",
59+
// cacerts alias: camerfirmachambersignca
60+
// DN: CN=Global Chambersign Root - 2008,
61+
// O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
62+
// L=Madrid (see current address at www.camerfirma.com/address),
63+
// C=EU
64+
"136335439334A7698016A0D324DE72284E079D7B5220BB8FBD747816EEBEBACA"
65+
);
66+
67+
// Any TLS Server certificate that is anchored by one of the Camerfirma
68+
// roots above and is issued after this date will be distrusted.
69+
private static final LocalDate APRIL_15_2025 =
70+
LocalDate.of(2025, Month.APRIL, 15);
71+
72+
/**
73+
* This method assumes the eeCert is a TLS Server Cert and chains back to
74+
* the anchor.
75+
*
76+
* @param chain the end-entity's certificate chain. The end entity cert
77+
* is at index 0, the trust anchor at index n-1.
78+
* @throws ValidatorException if the certificate is distrusted
79+
*/
80+
static void checkDistrust(X509Certificate[] chain)
81+
throws ValidatorException {
82+
X509Certificate anchor = chain[chain.length-1];
83+
String fp = fingerprint(anchor);
84+
if (fp == null) {
85+
throw new ValidatorException("Cannot generate fingerprint for "
86+
+ "trust anchor of TLS server certificate");
87+
}
88+
if (FINGERPRINTS.contains(fp)) {
89+
Date notBefore = chain[0].getNotBefore();
90+
LocalDate ldNotBefore = LocalDate.ofInstant(notBefore.toInstant(),
91+
ZoneOffset.UTC);
92+
// reject if certificate is issued after April 15, 2025
93+
checkNotBefore(ldNotBefore, APRIL_15_2025, anchor);
94+
}
95+
}
96+
97+
private static String fingerprint(X509Certificate cert) {
98+
return X509CertImpl.getFingerprint("SHA-256", cert, debug);
99+
}
100+
101+
private static void checkNotBefore(LocalDate notBeforeDate,
102+
LocalDate distrustDate, X509Certificate anchor)
103+
throws ValidatorException {
104+
if (notBeforeDate.isAfter(distrustDate)) {
105+
throw new ValidatorException
106+
("TLS Server certificate issued after " + distrustDate +
107+
" and anchored by a distrusted legacy Camerfirma root CA: "
108+
+ anchor.getSubjectX500Principal(),
109+
ValidatorException.T_UNTRUSTED_CERT, anchor);
110+
}
111+
}
112+
113+
private CamerfirmaTLSPolicy() {}
114+
}

‎src/java.base/share/conf/security/java.security‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1318,6 +1318,9 @@ jdk.sasl.disabledMechanisms=
13181318
# ENTRUST_TLS : Distrust TLS Server certificates anchored by
13191319
# an Entrust root CA and issued after November 11, 2024.
13201320
#
1321+
# CAMERFIRMA_TLS : Distrust TLS Server certificates anchored by
1322+
# a Camerfirma root CA and issued after April 15, 2025.
1323+
#
13211324
# Leading and trailing whitespace surrounding each value are ignored.
13221325
# Unknown values are ignored. If the property is commented out or set to the
13231326
# empty String, no policies are enforced.
@@ -1329,7 +1332,7 @@ jdk.sasl.disabledMechanisms=
13291332
# jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
13301333
# if this property is not enabled.
13311334
#
1332-
jdk.security.caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS
1335+
jdk.security.caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS,CAMERFIRMA_TLS
13331336

13341337
#
13351338
# FilePermission path canonicalization

‎test/jdk/sun/security/ssl/X509TrustManagerImpl/distrust/Camerfirma.java‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/*
2+
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
import java.io.File;
25+
import java.security.Security;
26+
import java.time.*;
27+
import java.util.*;
28+
import javax.net.ssl.*;
29+
30+
/**
31+
* @test
32+
* @bug 8346587
33+
* @summary Check that TLS Server certificates chaining back to distrusted
34+
* Camerfirma roots are invalid
35+
* @library /test/lib
36+
* @modules java.base/sun.security.validator
37+
* @run main/othervm Camerfirma after policyOn invalid
38+
* @run main/othervm Camerfirma after policyOff valid
39+
* @run main/othervm Camerfirma before policyOn valid
40+
* @run main/othervm Camerfirma before policyOff valid
41+
*/
42+
43+
public class Camerfirma {
44+
45+
private static final String certPath = "chains" + File.separator + "camerfirma";
46+
47+
// Each of the roots have a test certificate chain stored in a file
48+
// named "<root>-chain.pem".
49+
private static String[] rootsToTest = new String[] {
50+
"camerfirmachamberscommerceca", "camerfirmachambersca",
51+
"camerfirmachambersignca"};
52+
53+
// Date after the restrictions take effect
54+
private static final ZonedDateTime DISTRUST_DATE =
55+
LocalDate.of(2025, 04, 16).atStartOfDay(ZoneOffset.UTC);
56+
57+
public static void main(String[] args) throws Exception {
58+
59+
// All of the test certificates are signed with SHA-1 so we need
60+
// to remove the constraint that disallows SHA-1 certificates.
61+
String prop = Security.getProperty("jdk.certpath.disabledAlgorithms");
62+
String newProp = prop.replace(", SHA1 jdkCA & usage TLSServer", "");
63+
Security.setProperty("jdk.certpath.disabledAlgorithms", newProp);
64+
65+
Distrust distrust = new Distrust(args);
66+
67+
X509TrustManager[] tms = new X509TrustManager[]{
68+
distrust.getTMF("PKIX", null),
69+
distrust.getTMF("SunX509", null)
70+
};
71+
72+
Date notBefore = distrust.getNotBefore(DISTRUST_DATE);
73+
distrust.testCertificateChain(certPath, notBefore, tms, rootsToTest);
74+
}
75+
}

‎test/jdk/sun/security/ssl/X509TrustManagerImpl/distrust/Distrust.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2024, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -198,7 +198,13 @@ public boolean[] getIssuerUniqueID() {
198198
public boolean[] getSubjectUniqueID() {
199199
return cert.getSubjectUniqueID();
200200
}
201-
public boolean[] getKeyUsage() { return cert.getKeyUsage(); }
201+
public boolean[] getKeyUsage() {
202+
// Turn on the Digital Signature bit. Some certs that we want
203+
// to use as test certs don't have this bit turned on.
204+
boolean[] withDigitalSignature = cert.getKeyUsage();
205+
withDigitalSignature[0] = true;
206+
return withDigitalSignature;
207+
}
202208
public int getBasicConstraints() { return cert.getBasicConstraints(); }
203209
public byte[] getEncoded() throws CertificateEncodingException {
204210
return cert.getEncoded();

‎test/jdk/sun/security/ssl/X509TrustManagerImpl/distrust/chains/camerfirma/camerfirmachambersca-chain.pem‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
Owner: CN=Camerfirma Corporate Server II - 2015,
2+
L=Madrid (see current address at https://www.camerfirma.com/address),
3+
SERIALNUMBER=A82743287,
4+
O=AC Camerfirma S.A., OU=AC CAMERFIRMA, C=ES
5+
Issuer: CN=Chambers of Commerce Root - 2008,
6+
O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
7+
L=Madrid (see current address at www.camerfirma.com/address), C=EU
8+
Serial number: 621ff31c489ba136
9+
Valid from: Thu Jan 15 01:21:16 PST 2015 until: Tue Dec 15 01:21:16 PST 2037
10+
Certificate fingerprints:
11+
SHA1: FE:72:7A:78:EA:0C:03:35:CD:DA:9C:2E:D7:5F:D4:D4:6F:35:C2:EF
12+
SHA256: 66:EA:E2:70:9B:54:CD:D1:69:31:77:B1:33:2F:F0:36:CD:D0:F7:23:DB:30:39:ED:31:15:55:A6:CB:F5:FF:3E
13+
Signature algorithm name: SHA256withRSA
14+
Subject Public Key Algorithm: 4096-bit RSA key
15+
Version: 3
16+
17+
-----BEGIN CERTIFICATE-----
18+
MIIIkzCCBnugAwIBAgIIYh/zHEiboTYwDQYJKoZIhvcNAQELBQAwga4xCzAJBgNV
19+
BAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQg
20+
d3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIwEAYDVQQFEwlBODI3NDMyODcx
21+
GzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEpMCcGA1UEAxMgQ2hhbWJlcnMg
22+
b2YgQ29tbWVyY2UgUm9vdCAtIDIwMDgwHhcNMTUwMTE1MDkyMTE2WhcNMzcxMjE1
23+
MDkyMTE2WjCB0zELMAkGA1UEBhMCRVMxFjAUBgNVBAsMDUFDIENBTUVSRklSTUEx
24+
GzAZBgNVBAoMEkFDIENhbWVyZmlybWEgUy5BLjESMBAGA1UEBRMJQTgyNzQzMjg3
25+
MUswSQYDVQQHDEJNYWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQgaHR0cHM6
26+
Ly93d3cuY2FtZXJmaXJtYS5jb20vYWRkcmVzcykxLjAsBgNVBAMMJUNhbWVyZmly
27+
bWEgQ29ycG9yYXRlIFNlcnZlciBJSSAtIDIwMTUwggIiMA0GCSqGSIb3DQEBAQUA
28+
A4ICDwAwggIKAoICAQC3ndKNpFufVq9v+15dRoT9oVkgwEfDdsPw0Ly0R+eM5MOk
29+
35zEil/+hqEMbQmcvosAh6I8iAskkXasqh+SMbMIjvXbDyNILeGzsoP0uz3btHM7
30+
oN3yHXDhhd1NGNocP54Wehe9+RE3WP0yEEo+D2YmMwUHuv4KiXtveiPksv+Xkkz5
31+
auqppPMaYlD6y49AEsGY2zOEUI8PO4+tOxUKhvsiMuW817vH3VdmMwOjRe0SdYAi
32+
YLQIiyqJGNdEo3u+fw8UXxaJSRXhmF+jUn5DvdzWWNAxxwAKy95EPlpLQsx/7t2W
33+
2ntoELPHGJk4V+/yA0d2olLEqBADkRtP2HiC0wly+zp7OGmjtfjbqLrVjmo/mLP3
34+
zpmYbpUtubrHiY0rlW6wo5FZLcTUvcAxFjxLWVIELPjnTebOuHvoJTb97rhA1Oqq
35+
woq5FWJHFI9idzXzFLO0LX/4ugI9LZWxmvWW0O4CePtnhp0aNE/GgAw6lMx7bjZe
36+
DXxxQnUDEE/mAqOHRUCnvRUSKVbuBBE0oz5fz3nUwcWVVgrm/jkgqTX4EqnZe+yB
37+
mKV6hFEYV+1oVh7kzNN4Hg7nzGuByS7cCuBEwULFhfUja1Bu9EqgndJ3CV0XCWIA
38+
XVhJnPNPi6y4W11jLJ7XSGSz3sCh21g0Gpgi2pXHGDB65Jc/QJHZ5ZaHCrzFnwID
39+
AQABo4ICjDCCAogwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUY+nw8FYA
40+
aGWwIWwOXNcZCJ0INGUwgeMGA1UdIwSB2zCB2IAU+SSsD7K1+HnA+mCIG8TZTQKe
41+
FxmhgbSkgbEwga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBj
42+
dXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIw
43+
EAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEp
44+
MCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAtIDIwMDiCCQCj2kJ+
45+
pLGu2jB6BggrBgEFBQcBAQRuMGwwQgYIKwYBBQUHMAKGNmh0dHA6Ly93d3cuY2Ft
46+
ZXJmaXJtYS5jb20vY2VydHMvcm9vdF9jaGFtYmVycy0yMDA4LmNydDAmBggrBgEF
47+
BQcwAYYaaHR0cDovL29jc3AuY2FtZXJmaXJtYS5jb20wDgYDVR0PAQH/BAQDAgEG
48+
MCcGA1UdJQQgMB4GCCsGAQUFBwMEBggrBgEFBQcDAgYIKwYBBQUHAwEwPgYDVR0g
49+
BDcwNTAzBgRVHSAAMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vcG9saWN5LmNhbWVy
50+
ZmlybWEuY29tMHgGA1UdHwRxMG8wNaAzoDGGL2h0dHA6Ly9jcmwuY2FtZXJmaXJt
51+
YS5jb20vY2hhbWJlcnNyb290LTIwMDguY3JsMDagNKAyhjBodHRwOi8vY3JsMS5j
52+
YW1lcmZpcm1hLmNvbS9jaGFtYmVyc3Jvb3QtMjAwOC5jcmwwDQYJKoZIhvcNAQEL
53+
BQADggIBAKhqaZwalwf89f4wPqfcE/lrsHdx8+q9RG46ouBXhTJMqXjwstXOZSL4
54+
3Dqs3GaVuMPIM9OG7CK0I93mAt+FWtr49ACFTyPBxPg/knrZ4RHyEto+/6w0WZ9H
55+
owNw0aUg3ZAkhIvMRPVou8PrVukqj2lGKIh3hRdrbHwYwwmKKNlWBoC9gWk3mTYU
56+
zfNt/KTzQCCl5+s6YDa+XInMLWaGd/pE/e++a22vY24cv7kN3NAFMjAMELPwh9ic
57+
zLoPX8B52r+GgwpKY0c0hZdVTii6psLQ+BenyMlh+6lHRBOlTCSRtNi16o7H8fRq
58+
CY2wyQi7N+EmdY1DhvECCi1nLbOnIx1bSAW0cVwPVrjQ/vsAxPNc3SGe/Xnanm3a
59+
zAgFspzeuAhxxG0VKOvtPBnPQNsQ0cK664+IrWRsfa6aYhEfKvfsn5o4HpBWDobf
60+
zrtNbqjjOuiM6JkT+DxXo5UK7t2q75KCJiimTtAuPcZ5wErZISLvZ34BodIHL2xK
61+
b3Vww7K2FE1QaNsuQkGbUk++B9/+vV3H57vzskObdFWeWKSCpxIil4vZwIIH17zn
62+
WU+O2WIY1F0aO9zp3E7qwfmYT4MJ38NF9R7FSlxRlgVc1uUHu/iyUU4N1O6F3VdX
63+
P2Y+tgLFZLYV4kApfXk5l9h94dgKyfVcIpvS6yVpLfONPnlCNOxy
64+
-----END CERTIFICATE-----

‎test/jdk/sun/security/ssl/X509TrustManagerImpl/distrust/chains/camerfirma/camerfirmachamberscommerceca-chain.pem‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
Owner: CN=AC Camerfirma Certificados Camerales,
2+
O=AC Camerfirma SA, SERIALNUMBER=A82743287,
3+
L=Madrid (see current address at www.camerfirma.com/address),
4+
[email protected], C=ES
5+
Issuer: CN=Chambers of Commerce Root, OU=http://www.chambersign.org,
6+
O=AC Camerfirma SA CIF A82743287, C=EU
7+
Serial number: 5
8+
Valid from: Mon Feb 09 07:42:47 PST 2004 until: Thu Feb 09 07:42:47 PST 2034
9+
Certificate fingerprints:
10+
SHA1: 9F:36:B4:BE:9D:AF:1C:91:01:B2:D7:61:58:FB:95:CB:53:82:01:10
11+
SHA256: C7:D8:43:81:E1:1F:7C:57:46:77:1A:F5:B0:50:DC:51:FC:6F:DA:D6:F6:F3:5B:B5:3A:3D:E9:13:82:2E:A0:9E
12+
Signature algorithm name: SHA1withRSA (weak)
13+
Subject Public Key Algorithm: 2048-bit RSA key
14+
Version: 3
15+
16+
-----BEGIN CERTIFICATE-----
17+
MIIFwDCCBKigAwIBAgIBBTANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJFVTEn
18+
MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL
19+
ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMg
20+
b2YgQ29tbWVyY2UgUm9vdDAeFw0wNDAyMDkxNTQyNDdaFw0zNDAyMDkxNTQyNDda
21+
MIHgMQswCQYDVQQGEwJFUzEuMCwGCSqGSIb3DQEJARYfYWNfY2FtZXJmaXJtYV9j
22+
Y0BjYW1lcmZpcm1hLmNvbTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh
23+
ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ
24+
QTgyNzQzMjg3MRkwFwYDVQQKExBBQyBDYW1lcmZpcm1hIFNBMS0wKwYDVQQDEyRB
25+
QyBDYW1lcmZpcm1hIENlcnRpZmljYWRvcyBDYW1lcmFsZXMwggEgMA0GCSqGSIb3
26+
DQEBAQUAA4IBDQAwggEIAoIBAQCjxnvvj01f36lgGhihRYVf1fAPEXsTJKrY4aLQ
27+
cEUSh5szZE7VTtGiyMTMc2uCmnaXafjYHK8Lgmy6T9xxGEZ5OS4x6rgtuPyy13AP
28+
tu3X3Y2kPVLu7ZMw5HoQC64wBj6YcnxTnBwmVW05DjzRXp6OyBIEKEaAB9vv2qEl
29+
fh/Y234FG6Wd/ut1s0ScRZAo+6CSMNQxaY+ryXKD11uWkzWXJa9UZOasG7z4uPqc
30+
Gr4/Hz2/CTLDTgp0xkMJYuzOztpUvOACrxlkS2utKUwVlAikJnboNwf/en94RbHN
31+
zkKc5t0SAbzCf57ueawbzxSdPa+SAC25FNur64FKkfdq5PPjAgEDo4IB5TCCAeEw
32+
EgYDVR0TAQH/BAgwBgEB/wIBCzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3Js
33+
LmNoYW1iZXJzaWduLm9yZy9jaGFtYmVyc3Jvb3QuY3JsMB0GA1UdDgQWBBS2H06d
34+
HGiRLjdyYOFGj1qlKjExuTCBqwYDVR0jBIGjMIGggBTjlPWxTenboSlbV4tNdgZ2
35+
4dGiiqGBhKSBgTB/MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJt
36+
YSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJz
37+
aWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdIIBADAO
38+
BgNVHQ8BAf8EBAMCAYYwKgYDVR0RBCMwIYEfYWNfY2FtZXJmaXJtYV9jY0BjYW1l
39+
cmZpcm1hLmNvbTAnBgNVHRIEIDAegRxjaGFtYmVyc3Jvb3RAY2hhbWJlcnNpZ24u
40+
b3JnMFsGA1UdIARUMFIwUAYLKwYBBAGBhy4KCQEwQTA/BggrBgEFBQcCARYzaHR0
41+
cDovL2Nwcy5jYW1lcmZpcm1hLmNvbS9jcHMvYWNfY2FtZXJmaXJtYV9jYy5odG1s
42+
MA0GCSqGSIb3DQEBBQUAA4IBAQBl8KoPBYL//EBonqQWS0N+hLfxImP1eQ6nac+v
43+
R5QfF/0w+VCTkShfKwHaa6V/W1dPlVwXSECuvXHkX6DYrtxFGGFB6qxuP1rkIpRs
44+
sTkAlpvOx3REiFjIkhsijKd/ijvqxjbMbuYU+EFACK/jQIRoj+LEEZ+haiqbALZB
45+
Iqq/26HTqX0itDosBj6M94YWcIpbTDefQNWCGsSnZcw2+k+az/wAOZT6xAxlnEim
46+
HpDDlgRsmaLrHpDPDoIRYOih0gbJTnn4mKex9Wgr0sZ+XFl03j+bvcXL1tiuQnwb
47+
9dMRDe/OdXABT35W4ZzLbpost65ZW3Tx+oi/bLbmu6pbKCgs
48+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)