test: fix ssl/tls settings for servers (#165)

Author: supercaracal

bin/gen_cert.sh

@@ -9,10 +9,10 @@ set -o pipefail
 readonly NAME='redis-rb'
 readonly EXPIRATION_DAYS='109500'
 readonly SBJ='/C=US/ST=Georgia/L=Atlanta/O=redis-rb/OU=redis-cluster-client/CN=127.0.0.1'
-readonly SAN1='localhost'
-readonly SAN2='endpoint.example.com'
 readonly CERT_DIR="$(dirname $(realpath $0))/../test/ssl_certs"
 readonly WORK_DIR=$(mktemp -d)
+readonly SAN=(localhost node1 node2 node3 node4 node5 node6 node7 node8 node9)
+readonly SAN_TXT=$(echo ${SAN[@]} | sed -e 's# #,DNS:#g' | xargs -I{} echo "DNS:{}")
 
 cd ${WORK_DIR}
 mkdir -p ${CERT_DIR} ./demoCA ./demoCA/certs ./demoCA/crl ./demoCA/newcerts ./demoCA/private
@@ -32,7 +32,7 @@ openssl req\
   -sha256\
   -out ${CERT_DIR}/${NAME}-ca.crt\
   -subj "${SBJ}"\
-  -addext "subjectAltName = DNS:${SAN1},DNS:${SAN2}"
+  -addext "subjectAltName = ${SAN_TXT}"
 
 openssl x509\
   -in ${CERT_DIR}/${NAME}-ca.crt\
@@ -46,7 +46,7 @@ openssl req\
   -nodes\
   -out ./${NAME}-cert.req\
   -subj "${SBJ}"\
-  -addext "subjectAltName = DNS:${SAN1},DNS:${SAN2}"
+  -addext "subjectAltName = ${SAN_TXT}"
 
 openssl ca\
   -days ${EXPIRATION_DAYS}\

compose.ssl.yaml

@@ -18,15 +18,26 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node1
     restart: "${RESTART_POLICY:-always}"
     healthcheck:
       test:
-        - "CMD-SHELL"
+        - "CMD"
         - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6379"
+        - "--no-raw"
         - "--tls"
-        - "--cert=/etc/ssl/private/redis-rb-cert.crt"
-        - "--key=/etc/ssl/private/redis-rb-cert.key"
-        - "--cacert=/etc/ssl/private/redis-rb-ca.crt"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
         - "ping"
       interval: "7s"
       timeout: "5s"
@@ -52,6 +63,29 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node2
+    healthcheck:
+      test:
+        - "CMD"
+        - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6380"
+        - "--no-raw"
+        - "--tls"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
+        - "ping"
+      interval: "7s"
+      timeout: "5s"
+      retries: 10
     ports:
       - "6380:6380"
   node3:
@@ -71,6 +105,29 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node3
+    healthcheck:
+      test:
+        - "CMD"
+        - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6381"
+        - "--no-raw"
+        - "--tls"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
+        - "ping"
+      interval: "7s"
+      timeout: "5s"
+      retries: 10
     ports:
       - "6381:6381"
   node4:
@@ -90,6 +147,29 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node4
+    healthcheck:
+      test:
+        - "CMD"
+        - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6382"
+        - "--no-raw"
+        - "--tls"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
+        - "ping"
+      interval: "7s"
+      timeout: "5s"
+      retries: 10
     ports:
       - "6382:6382"
   node5:
@@ -109,6 +189,29 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node5
+    healthcheck:
+      test:
+        - "CMD"
+        - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6383"
+        - "--no-raw"
+        - "--tls"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
+        - "ping"
+      interval: "7s"
+      timeout: "5s"
+      retries: 10
     ports:
       - "6383:6383"
   node6:
@@ -128,6 +231,29 @@ services:
       --tls-ca-cert-file     /etc/ssl/private/redis-rb-ca.crt
       --tls-cluster          yes
       --tls-replication      yes
+      --replica-announce-ip  node6
+    healthcheck:
+      test:
+        - "CMD"
+        - "redis-cli"
+        - "-h"
+        - "127.0.0.1"
+        - "-p"
+        - "6384"
+        - "--no-raw"
+        - "--tls"
+        - "--sni"
+        - "localhost"
+        - "--cert"
+        - "/etc/ssl/private/redis-rb-cert.crt"
+        - "--key"
+        - "/etc/ssl/private/redis-rb-cert.key"
+        - "--cacert"
+        - "/etc/ssl/private/redis-rb-ca.crt"
+        - "ping"
+      interval: "7s"
+      timeout: "5s"
+      retries: 10
     ports:
       - "6384:6384"
   clustering:

test/ssl_certs/redis-rb-ca.crt

@@ -1,24 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIID/TCCAuWgAwIBAgIUXbhH9AuyfBymiToIKZ3U93jwiEYwDQYJKoZIhvcNAQEL
+MIIEKDCCAxCgAwIBAgIUQ4fcBhPuBH8/dhxQYWk3VGtV6jUwDQYJKoZIhvcNAQEL
 BQAwdzELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExEDAOBgNVBAcMB0F0
 bGFudGExETAPBgNVBAoMCHJlZGlzLXJiMR0wGwYDVQQLDBRyZWRpcy1jbHVzdGVy
-LWNsaWVudDESMBAGA1UEAwwJMTI3LjAuMC4xMCAXDTIyMDYxODA0NTMzMloYDzIz
-MjIwNDA3MDQ1MzMyWjB3MQswCQYDVQQGEwJVUzEQMA4GA1UECAwHR2VvcmdpYTEQ
+LWNsaWVudDESMBAGA1UEAwwJMTI3LjAuMC4xMCAXDTIyMTAwODAzMTcwOVoYDzIz
+MjIwNzI4MDMxNzA5WjB3MQswCQYDVQQGEwJVUzEQMA4GA1UECAwHR2VvcmdpYTEQ
 MA4GA1UEBwwHQXRsYW50YTERMA8GA1UECgwIcmVkaXMtcmIxHTAbBgNVBAsMFHJl
 ZGlzLWNsdXN0ZXItY2xpZW50MRIwEAYDVQQDDAkxMjcuMC4wLjEwggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBtlByRAXnEW14evpwbwO3O1mKbDkBeU6B
-clhOC8SXPGhK+y3WEgWvQRGMVvzSr9HOrVll14wP769kUUFQOPRFYG8jqOzrXlRM
-scjYRQsVDqQhkCjImZX8W73qZYnOzxoZ11YoZhally3zQhLyH9G5QKX0YTVs/EvB
-vwGWTroAhvDSSglrnTIeWk49Z2g1mFanzfYpbx4rsWghSTrWia30b1f0UjVbTSaG
-PeLR+E064POISQGGTkxJ9gDTN5JuQBYAsqfzUpHakh2Qa+wiFcIBq6XxyCP28fM3
-zyMPdodtRkVO4hD4wH2Weq4nvbSzg39S/YxOhowjlXE62K95HmodAgMBAAGjfzB9
-MB0GA1UdDgQWBBQYCsR4xAnGrJNlsfAA5IIzPxU9mjAfBgNVHSMEGDAWgBQYCsR4
-xAnGrJNlsfAA5IIzPxU9mjAPBgNVHRMBAf8EBTADAQH/MCoGA1UdEQQjMCGCCWxv
-Y2FsaG9zdIIUZW5kcG9pbnQuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggEB
-AArh6jvcndnrz4F18IJK/jMmTf3pGRv21knDW8D6BYTm58SiCGNv8G7bRqhtKB1l
-46L3HlhgglrfhUTJofNHmFkvnOWE5kFzvmPmnQs7BdmQHHU4MQ+vpy5dqBg+TWg0
-5E5PXkHFoiZC03Lk/FyvwdeavpOZzr82EVRpLBu+HDUcc8ahWEu7jhJpyG4onLYc
-3gxfOhpvA+MLnmaTZDzbiSeIIgbAo40xG71jYzZ07OJPzyoUSP0+0g9tRQndwFCp
-2nooUeFAeWH7cTQw+U93ujdoA81KVJOGl8Tl55CDB9imCZojpgeUhQeZh5/AmsfF
-FodibLs8LQ0OPS8xsoxlbYc=
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxkiVbVfVVyJtGwxQbzvfXMJ+J3VRZCqIS
+/S5UshqkmThn2e4ZvrQYJqEax55KSQqW87wTMZg83s+tDM4mPbDgk5Xg6P2fvfQH
+TvrF5kVDmrAjq+qvVUoijPrnoTiWXNv+h1J13UJjRhVo3co3W7jSZQvIsPwOs7Ir
+LBXor3EwQjNoFLI+T9vDfVW47zXz9eHwuPt5um4XM9ODpR8jWSUdYrI5vEjNlbUn
+7AR/oSarRLKEyvZaXPHfT0yNARSUmoYSS2EOnhGtOV3nCQEQZKv+hETFPKkHoKor
+L/6DKuaAt5lNOz1ykq4EISfYKh/8OxxJ8QXH/Nj9gpdHJnAZjgy/AgMBAAGjgakw
+gaYwHQYDVR0OBBYEFAtY+UXH5hu9LpScPBHNy5SHU2JwMB8GA1UdIwQYMBaAFAtY
++UXH5hu9LpScPBHNy5SHU2JwMA8GA1UdEwEB/wQFMAMBAf8wUwYDVR0RBEwwSoIJ
+bG9jYWxob3N0ggVub2RlMYIFbm9kZTKCBW5vZGUzggVub2RlNIIFbm9kZTWCBW5v
+ZGU2ggVub2RlN4IFbm9kZTiCBW5vZGU5MA0GCSqGSIb3DQEBCwUAA4IBAQAlsNBL
+jMp1QSU/S4ot3pFUJTZ2iJohcTJlR5yvWqikMVve2kwWtIlDglmg+JSlZ3DqBdOR
+AF6tvrXBNF4XlPFmB3C2dS3NWqaOwT0J20GVs5+jyF2cqZUWx+5szg+5afVlBVIX
+CNyGFUwJrIq6nVaCEclg8f7nIp9WycYRlHrkF3euntDZY5cj5f2/fywTtRiWYd3N
+ez+BWa1z/PFJ9JyVgi4aet5cqlEpHPV1bkIsi8HObgfFgg7pR1fE2VsW0nhIYzVi
+NOhl9jTKB1TYz0IM9VEogqhlEQHj0JLPoZDgZ8AGvPwt7LkxtgPQ0yOc/ZyHoaaU
+2igVxvCoy5Xjcrhl
 -----END CERTIFICATE-----

test/ssl_certs/redis-rb-cert.crt

@@ -2,82 +2,82 @@ Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number:
-            5d:b8:47:f4:0b:b2:7c:1c:a6:89:3a:08:29:9d:d4:f7:78:f0:88:47
+            43:87:dc:06:13:ee:04:7f:3f:76:1c:50:61:69:37:54:6b:55:ea:36
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=Georgia, L=Atlanta, O=redis-rb, OU=redis-cluster-client, CN=127.0.0.1
         Validity
-            Not Before: Jun 18 04:53:32 2022 GMT
-            Not After : Apr  7 04:53:32 2322 GMT
+            Not Before: Oct  8 03:17:10 2022 GMT
+            Not After : Jul 28 03:17:10 2322 GMT
         Subject: C=US, ST=Georgia, O=redis-rb, OU=redis-cluster-client, CN=127.0.0.1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 RSA Public-Key: (2048 bit)
                 Modulus:
-                    00:e7:a4:ea:8a:6b:e1:ea:5d:dc:af:71:dd:1e:7b:
-                    51:a9:02:98:a4:87:b1:c8:37:9d:14:92:e3:00:34:
-                    c6:a4:f5:e9:bb:8e:ad:0e:df:29:20:d8:88:9e:51:
-                    0c:3e:48:a9:b5:7d:a8:18:62:69:53:c5:d0:ad:63:
-                    61:13:9e:d1:79:49:d5:26:ef:d4:de:3a:89:4d:1f:
-                    db:10:02:53:ab:6a:72:da:c4:ef:de:ac:fb:1b:ee:
-                    80:7a:6a:08:22:b1:93:81:94:60:46:08:61:8f:cd:
-                    66:dc:ef:8a:d4:44:b1:23:38:29:a9:66:5a:3f:c3:
-                    90:44:f2:19:02:13:4f:85:20:ce:65:0c:69:03:fa:
-                    e6:8d:ae:c1:7b:7e:e4:c6:f3:a8:dc:d7:87:a3:1c:
-                    3d:88:2d:c1:08:62:bb:7e:cf:7e:10:7a:1e:a6:61:
-                    a6:61:f7:9c:07:7c:dc:ca:32:fb:b5:45:9e:d8:fd:
-                    6d:55:29:de:ad:c8:cf:7b:60:fc:18:40:8a:86:ec:
-                    4c:55:99:73:22:89:cd:4e:bb:30:4d:69:f4:b3:b9:
-                    22:87:6d:d0:d5:bf:a0:ce:60:bf:6c:d0:08:04:bd:
-                    4d:69:e7:c1:e1:4c:36:16:9a:cf:eb:df:d3:83:28:
-                    d9:8a:df:fc:03:3e:e6:94:d8:19:60:aa:77:74:49:
-                    a9:15
+                    00:d6:4f:ad:73:24:2f:c8:0d:19:6b:39:a4:f3:9a:
+                    8a:c6:8e:cf:6c:bf:2a:63:90:ee:ed:52:3b:fe:41:
+                    eb:dd:04:99:bc:39:35:66:b6:70:66:d7:d7:55:1d:
+                    3d:71:33:a1:3a:d6:e5:45:51:43:36:da:bc:62:99:
+                    85:38:07:c4:20:97:58:6f:39:1c:9e:a2:3b:e9:ae:
+                    5f:b5:79:18:53:9a:dd:b5:9a:2a:9a:8f:e1:76:2c:
+                    a7:2f:a0:1e:59:8d:99:2a:d2:92:e3:a8:77:d1:4f:
+                    50:14:dd:43:e4:cf:3c:84:b6:ad:01:2f:b0:ff:b2:
+                    af:08:56:73:39:09:48:7e:b4:a8:41:c4:e5:a3:0b:
+                    0b:1f:a6:ab:27:cd:b5:6c:5a:a8:45:ed:e5:6e:76:
+                    49:58:9c:ce:77:fb:81:6a:37:91:67:8c:78:b6:ef:
+                    73:29:da:bb:c2:19:84:97:2b:c4:ed:b5:52:b9:47:
+                    64:70:9c:ac:af:5b:20:e3:1c:da:2c:ca:9c:26:32:
+                    af:72:06:4d:d0:a3:6e:3d:48:e5:00:08:68:0f:1b:
+                    81:74:16:fe:d1:32:78:c8:16:56:04:88:c1:3f:da:
+                    a5:a9:3b:13:2a:c8:ae:ee:c0:ef:ab:45:a7:f7:1a:
+                    6b:e0:fb:2a:fa:40:98:75:a1:04:10:97:40:65:54:
+                    15:09
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: 
                 CA:FALSE
             Netscape Comment: 
                 OpenSSL Generated Certificate
             X509v3 Subject Key Identifier: 
-                B7:60:DA:08:B2:14:27:F4:CC:F3:E4:22:0D:4D:52:11:27:A0:ED:E8
+                02:53:41:2F:20:D1:67:C8:7C:64:B8:BE:3E:0A:E7:9C:CC:D3:F2:1C
             X509v3 Authority Key Identifier: 
-                keyid:18:0A:C4:78:C4:09:C6:AC:93:65:B1:F0:00:E4:82:33:3F:15:3D:9A
+                keyid:0B:58:F9:45:C7:E6:1B:BD:2E:94:9C:3C:11:CD:CB:94:87:53:62:70
 
     Signature Algorithm: sha256WithRSAEncryption
-         44:00:7b:97:3f:9c:07:95:a7:3f:89:8f:7e:b3:b0:42:6a:b8:
-         19:56:4b:17:50:0f:a1:a7:b6:6f:49:b8:55:ce:3b:3b:c8:47:
-         25:d3:99:bb:da:6c:a5:b9:02:84:97:78:43:6e:33:25:a7:a5:
-         ee:81:bd:b9:21:be:53:a0:ea:2b:e3:32:1f:31:8b:70:87:84:
-         88:29:f2:3c:19:73:8b:e8:6c:8f:83:0d:0c:95:b4:29:48:62:
-         81:d4:cd:89:21:53:2c:99:2c:d5:fb:f1:a6:4a:58:14:5e:b9:
-         6d:68:f5:42:e6:47:3b:59:78:2a:b3:ee:01:6c:7d:8d:59:8a:
-         07:7e:c8:90:95:46:46:11:98:3c:9f:9e:16:1a:ee:3d:23:e5:
-         54:65:50:72:d2:bc:c4:b7:39:b3:53:85:1d:71:c5:d6:3d:a8:
-         18:b5:ff:f1:33:29:2e:9f:56:b7:52:59:ee:b7:86:74:39:46:
-         83:f4:12:f6:22:b5:ca:1d:64:44:dd:e4:8d:d8:8a:7b:6d:df:
-         ae:d7:91:61:01:03:5c:41:3a:12:1a:98:ee:a9:60:14:83:af:
-         5f:8e:1d:9e:ae:b0:21:ce:17:48:33:9e:c4:5b:16:f2:cc:15:
-         04:ea:99:ca:9e:f6:c1:13:58:b9:c3:a0:11:bc:7f:06:ac:48:
-         e9:ac:4f:b9
+         04:88:63:a4:0d:93:df:2d:a3:56:e2:e6:31:2a:53:6b:bc:dc:
+         d2:b5:1c:81:e6:c9:dc:44:78:27:9e:76:b2:60:bc:ae:96:6f:
+         33:19:df:08:24:fb:cd:ae:6a:e0:56:63:dd:a8:ed:c9:93:7e:
+         ae:9a:14:16:e9:16:20:fe:4f:00:82:6c:32:39:95:58:8d:22:
+         97:a9:76:79:45:aa:90:8e:c8:78:08:92:eb:ab:14:c9:5a:b0:
+         04:c7:81:00:81:2c:f0:1c:f7:54:e4:d5:db:b3:b9:bf:a2:6a:
+         70:45:8b:2d:f1:fb:20:d6:ef:ea:80:15:d8:db:07:65:7d:f6:
+         69:dc:cf:21:00:24:01:40:10:b2:c2:4f:c4:12:70:50:d3:18:
+         37:89:fc:80:99:21:20:bb:1a:6c:44:f1:f2:31:03:4c:5d:b8:
+         1a:ec:2e:43:53:9b:8a:af:c1:7c:08:e8:a2:6a:44:37:d8:78:
+         6f:f5:14:4e:1c:16:66:b3:69:ec:aa:4c:d3:8c:55:b7:0c:a2:
+         69:c2:cc:0c:d0:27:f1:14:d4:16:51:8f:c4:f1:74:47:fc:d7:
+         1d:d0:03:41:7a:cb:c2:c7:99:9c:ca:4b:3f:ac:4a:7d:77:3b:
+         b9:bb:7b:73:3f:0f:1b:e6:52:c2:d8:3f:88:be:d3:42:5f:f5:
+         cc:b5:99:f5
 -----BEGIN CERTIFICATE-----
-MIID5zCCAs+gAwIBAgIUXbhH9AuyfBymiToIKZ3U93jwiEcwDQYJKoZIhvcNAQEL
+MIID5zCCAs+gAwIBAgIUQ4fcBhPuBH8/dhxQYWk3VGtV6jYwDQYJKoZIhvcNAQEL
 BQAwdzELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExEDAOBgNVBAcMB0F0
 bGFudGExETAPBgNVBAoMCHJlZGlzLXJiMR0wGwYDVQQLDBRyZWRpcy1jbHVzdGVy
-LWNsaWVudDESMBAGA1UEAwwJMTI3LjAuMC4xMCAXDTIyMDYxODA0NTMzMloYDzIz
-MjIwNDA3MDQ1MzMyWjBlMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHR2VvcmdpYTER
+LWNsaWVudDESMBAGA1UEAwwJMTI3LjAuMC4xMCAXDTIyMTAwODAzMTcxMFoYDzIz
+MjIwNzI4MDMxNzEwWjBlMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHR2VvcmdpYTER
 MA8GA1UECgwIcmVkaXMtcmIxHTAbBgNVBAsMFHJlZGlzLWNsdXN0ZXItY2xpZW50
 MRIwEAYDVQQDDAkxMjcuMC4wLjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDnpOqKa+HqXdyvcd0ee1GpApikh7HIN50UkuMANMak9em7jq0O3ykg2Iie
-UQw+SKm1fagYYmlTxdCtY2ETntF5SdUm79TeOolNH9sQAlOranLaxO/erPsb7oB6
-aggisZOBlGBGCGGPzWbc74rURLEjOCmpZlo/w5BE8hkCE0+FIM5lDGkD+uaNrsF7
-fuTG86jc14ejHD2ILcEIYrt+z34Qeh6mYaZh95wHfNzKMvu1RZ7Y/W1VKd6tyM97
-YPwYQIqG7ExVmXMiic1OuzBNafSzuSKHbdDVv6DOYL9s0AgEvU1p58HhTDYWms/r
-39ODKNmK3/wDPuaU2Blgqnd0SakVAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZI
+AoIBAQDWT61zJC/IDRlrOaTzmorGjs9svypjkO7tUjv+QevdBJm8OTVmtnBm19dV
+HT1xM6E61uVFUUM22rximYU4B8Qgl1hvORyeojvprl+1eRhTmt21miqaj+F2LKcv
+oB5ZjZkq0pLjqHfRT1AU3UPkzzyEtq0BL7D/sq8IVnM5CUh+tKhBxOWjCwsfpqsn
+zbVsWqhF7eVudklYnM53+4FqN5FnjHi273Mp2rvCGYSXK8TttVK5R2RwnKyvWyDj
+HNosypwmMq9yBk3Qo249SOUACGgPG4F0Fv7RMnjIFlYEiME/2qWpOxMqyK7uwO+r
+Raf3Gmvg+yr6QJh1oQQQl0BlVBUJAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZI
 AYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQW
-BBS3YNoIshQn9Mzz5CINTVIRJ6Dt6DAfBgNVHSMEGDAWgBQYCsR4xAnGrJNlsfAA
-5IIzPxU9mjANBgkqhkiG9w0BAQsFAAOCAQEARAB7lz+cB5WnP4mPfrOwQmq4GVZL
-F1APoae2b0m4Vc47O8hHJdOZu9pspbkChJd4Q24zJael7oG9uSG+U6DqK+MyHzGL
-cIeEiCnyPBlzi+hsj4MNDJW0KUhigdTNiSFTLJks1fvxpkpYFF65bWj1QuZHO1l4
-KrPuAWx9jVmKB37IkJVGRhGYPJ+eFhruPSPlVGVQctK8xLc5s1OFHXHF1j2oGLX/
-8TMpLp9Wt1JZ7reGdDlGg/QS9iK1yh1kRN3kjdiKe23frteRYQEDXEE6EhqY7qlg
-FIOvX44dnq6wIc4XSDOexFsW8swVBOqZyp72wRNYucOgEbx/BqxI6axPuQ==
+BBQCU0EvINFnyHxkuL4+CueczNPyHDAfBgNVHSMEGDAWgBQLWPlFx+YbvS6UnDwR
+zcuUh1NicDANBgkqhkiG9w0BAQsFAAOCAQEABIhjpA2T3y2jVuLmMSpTa7zc0rUc
+gebJ3ER4J552smC8rpZvMxnfCCT7za5q4FZj3ajtyZN+rpoUFukWIP5PAIJsMjmV
+WI0il6l2eUWqkI7IeAiS66sUyVqwBMeBAIEs8Bz3VOTV27O5v6JqcEWLLfH7INbv
+6oAV2NsHZX32adzPIQAkAUAQssJPxBJwUNMYN4n8gJkhILsabETx8jEDTF24Guwu
+Q1Obiq/BfAjoompEN9h4b/UUThwWZrNp7KpM04xVtwyiacLMDNAn8RTUFlGPxPF0
+R/zXHdADQXrLwseZnMpLP6xKfXc7ubt7cz8PG+ZSwtg/iL7TQl/1zLWZ9Q==
 -----END CERTIFICATE-----