fix: set trust anchor when validating certificate path to support intermediate CA certificates (#793)

* Set the trust anchor with the trusted certificates when validating the certificate path

* test: add unit tests for PhpCertificateChainValidator with intermediate CA trust anchor

Add comprehensive tests for certificate chain validation including:
- Validation with self-signed root CA as trust anchor
- Validation when leaf certificate matches trust anchor
- Rejection of invalid certificate chains

The tests include test certificates (root CA, intermediate CA, and leaf certificate)
that simulate real-world scenarios like the Yubico Security Key NFC case.

These tests verify that the bug fix for issue #788 works correctly by ensuring
intermediate CA certificates can be used as trust anchors.

* test: refactor PhpCertificateChainValidatorTest for improved readability and consistency

---------

Co-authored-by: zll600 <3400692417@qq.com>

Author: Spomky

src/webauthn/src/MetadataService/CertificateChain/PhpCertificateChainValidator.php

@@ -184,10 +184,12 @@ private function isRevoked(Certificate $subject): bool
         return false;
     }
 
-    private function validateCertificates(Certificate ...$certificates): bool
+    private function validateCertificates(Certificate $trustAnchor, Certificate ...$certificates): bool
     {
         try {
-            $config = PathValidationConfig::create($this->clock->now(), self::MAX_VALIDATION_LENGTH);
+            $config = PathValidationConfig::create($this->clock->now(), self::MAX_VALIDATION_LENGTH)->withTrustAnchor(
+                $trustAnchor
+            );
             CertificationPath::create(...$certificates)->validate($config);
 
             return true;

tests/library/Unit/PhpCertificateChainValidatorTest.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Webauthn\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpClient\MockHttpClient;
+use Symfony\Component\HttpClient\Response\MockResponse;
+use Webauthn\Exception\CertificateChainException;
+use Webauthn\MetadataService\CertificateChain\PhpCertificateChainValidator;
+
+/**
+ * @internal
+ */
+final class PhpCertificateChainValidatorTest extends TestCase
+{
+    #[Test]
+    public function itValidatesCertificateChainWithSelfSignedRootCA(): void
+    {
+        $leafCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/leaf.pem');
+        $intermediateCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/intermediate-ca.pem');
+        $rootCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/root-ca.pem');
+
+        $httpClient = new MockHttpClient([new MockResponse('')]);
+
+        $validator = PhpCertificateChainValidator::create($httpClient);
+
+        // Test with root CA as trust anchor (self-signed certificate)
+        // The untrusted chain includes leaf and intermediate
+        // This should work with both old and new implementation
+        $validator->check([$leafCert, $intermediateCert], [$rootCert]);
+
+        // If we reach here, validation succeeded
+        static::assertTrue(true);
+    }
+
+    #[Test]
+    public function itAcceptsWhenLeafCertificateMatchesTrustAnchor(): void
+    {
+        $leafCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/leaf.pem');
+
+        $httpClient = new MockHttpClient([new MockResponse('')]);
+
+        $validator = PhpCertificateChainValidator::create($httpClient);
+
+        // When the leaf certificate is the same as the trust anchor, it should be accepted
+        // This is a valid case mentioned in FIDO MDS spec:
+        // "A trust anchor can be [...] even the attestation certificate itself"
+        $validator->check([$leafCert], [$leafCert]);
+
+        // If we reach here, validation succeeded
+        static::assertTrue(true);
+    }
+
+    #[Test]
+    public function itRejectsCertificateChainWithInvalidTrustAnchor(): void
+    {
+        $leafCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/leaf.pem');
+        $rootCert = file_get_contents(__DIR__ . '/../certificates/intermediate-ca/root-ca.pem');
+
+        $httpClient = new MockHttpClient([new MockResponse('')]);
+
+        $validator = PhpCertificateChainValidator::create($httpClient);
+
+        // Leaf certificate cannot be verified with root CA directly (missing intermediate)
+        $this->expectException(CertificateChainException::class);
+        $validator->check([$leafCert], [$rootCert]);
+    }
+}

tests/library/certificates/intermediate-ca/intermediate-ca-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCw8liENXY9lwij
+PflzCi38WoSL1FlrnL1woSht6Z+Jr2zVsyN+pPd8Jyuxzs9BFORUrSVVu7bNXMLj
+y1BCnr1c4/mr93x7CRUEJ3psaLYOUv3Y0lNkW23fQs+mOK5P+DIHiHDWZhu4vka3
+nldhGj4l2hK7TsW3AadZA41fhHcpMNOeG7DwdnlzlK+svpMVoLhntxC+HSq4RYOi
+8Xnnad1qNukhMC3Ml4S533PSlEZl/wDc0mj1+NoShJDdvam9K6grx1UrJCBhE1t2
+s5T4ZggTEJSNSGyBk/827sgkW0XWeQbTYitpBN+7ahbX/bpt2JgF/dk8q4DZ5awa
+E0O/ZbuLAgMBAAECggEAGuTq0UVy8E+Jb45W4MZWUPnNFZez86hCHuFPzMzqg7nX
+F+//YBtgxk0J1h+x3pl3Tut2Nj6uvS3xLUBUtZt8+qZn51xZXjX2LMh3UgzkRu8U
+SCVHqYRAAeQcvY316I+3wu9Y/y1L31uEUhpN+6NKeORZXoDNilBFCEGC9lai6e6S
+NzHjhdj1vlmOekdW7zo28b2xyxwfjpJLAuRwa5f+elZ82/ASuH4VnrMqpSIGDCAa
+1Fg3K0dskfNtsJXzR9lGYQXc6RfuyosfWYF2f5ANOwWms+vw0deuNCfuW0GlRMkq
+ZZA88h9f+ayzA+NjZ11g6tmARPe5iklMz/aFNDTVWQKBgQDXtizUMvcIQI1hqErp
+8p15zvQqYJa4W6SMt8s8le1GP6gpbs3aZWXP0EIrlefXkJXkSFmiYtPxWkOxHQhI
+jmCkX/rUAEiLnrpuqJ8QndcaJLJbS0j4v37hTvPjPw42Haul5s17fwz6ZQ/ZIF1f
+Omft6LXnpSdxpxFcVaMKJTietQKBgQDR/rNmMRxaREqXpxz+eQB26DXEIz08Prex
+upB56ynVexPLOav9zoowj9lVsjwk3VKFtUOdSZm/Bjpa/CmS5Gb70kTi2uiJdute
+IHra7+n3BvDGANTL48nQX25nSzpjuY/mIqnZ34abUcKx3gMdX14M399XOWbZ0aKa
+1LlJVnsZPwKBgEwTQqIfy0GMyo/bc3goiWMxGqlrYRxprZG3LCUU1xaEUsEyA8V3
+Jz3wO7X1a0t6AXL+FSaQ5iBjbiYjkA1OsUSnWOW1p+AdvbBTJa4NjJP6xzAtT/Hy
+T0QUvSyyy0dIlYWv7V4Vg7U3OSyhHmz8QzUDckvc0hliC1xeE177m4lVAoGBALth
+KdWjNuh5DZJbBO0xLa/srqVQyIBsel912RthMtgSVew+jvEQDpEcmtL0EuTWNJ+o
+yiecmDszJHkxjytK8XX8/4jpyxt2aLl6BAY+lCfgIpKcBUXWAawUq6AyKWz5FKVH
+AwathSAtCazLLT5VbcfRMCpVxyfP/udnr9n3+CnjAoGBALQLtbf8V9HvAaigH2FF
+QkdN7ztnZuA0iJuEZ9u2jeFMW1CDFBHFnwAZBf2CwxL2wfch683En7mnyucneNGw
+eQVlvQJpQQ+xIOsN7sEHPso57ujHKulxiPkhLs8K4boUBXmudRKjCwxi3TjY9Qmj
+3n04PYcsqKqZbFhab4A+AzZ8
+-----END PRIVATE KEY-----

tests/library/certificates/intermediate-ca/intermediate-ca.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID2jCCAsKgAwIBAgIUWFUQHAdjSgNC8yyoUL/5gGZtLlswDQYJKoZIhvcNAQEL
+BQAwQDEVMBMGA1UEAwwMVGVzdCBSb290IENBMRowGAYDVQQKDBFUZXN0IE9yZ2Fu
+aXphdGlvbjELMAkGA1UEBhMCVVMwHhcNMjUxMjIwMTA0NDIyWhcNMzUxMjE4MTA0
+NDIyWjBIMR0wGwYDVQQDDBRUZXN0IEludGVybWVkaWF0ZSBDQTEaMBgGA1UECgwR
+VGVzdCBPcmdhbml6YXRpb24xCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAsPJYhDV2PZcIoz35cwot/FqEi9RZa5y9cKEobemfia9s
+1bMjfqT3fCcrsc7PQRTkVK0lVbu2zVzC48tQQp69XOP5q/d8ewkVBCd6bGi2DlL9
+2NJTZFtt30LPpjiuT/gyB4hw1mYbuL5Gt55XYRo+JdoSu07FtwGnWQONX4R3KTDT
+nhuw8HZ5c5SvrL6TFaC4Z7cQvh0quEWDovF552ndajbpITAtzJeEud9z0pRGZf8A
+3NJo9fjaEoSQ3b2pvSuoK8dVKyQgYRNbdrOU+GYIExCUjUhsgZP/Nu7IJFtF1nkG
+02IraQTfu2oW1/26bdiYBf3ZPKuA2eWsGhNDv2W7iwIDAQABo4HDMIHAMBIGA1Ud
+EwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRx1Xr1JpXt
+tkkIKL7H/pi/IdwU6DB7BgNVHSMEdDBygBSJldKjL3680DbPk+D7PmDyzJUifqFE
+pEIwQDEVMBMGA1UEAwwMVGVzdCBSb290IENBMRowGAYDVQQKDBFUZXN0IE9yZ2Fu
+aXphdGlvbjELMAkGA1UEBhMCVVOCFGLYE+O29ketGQMGVQzs2xjfbbKxMA0GCSqG
+SIb3DQEBCwUAA4IBAQA7q/FhhSww2IuI6pz4WB8HFfqAfIYiOJNS/3roEy6hUz2l
+k7UrNsLtt3vGEIjHiDG3QYmR2hCkQpod3cqYuuxeoY+afOOoj251nue//pCMiWhx
+HxkyZGb64/fTkHTx3xdl3iV4xvQukQiR6RQ2M9Gn3v+5G1J4NCa9lh4q5gzu8rb+
+NsNF8TwMovsBoK6Do/MqaaikwvN5oRcsryIMQuAzL5S2RFPKjRDUyxJa4j0qJDpY
+YQ1PGvUzuNyxx/hIDojNwopjLAa+mn+UeNsdPUfWDFWKaSWE3Oszus5dozy9HqxE
+6B427zxE3olDFEcimPuMiEzjERWvbUDF8T01+YnS
+-----END CERTIFICATE-----

tests/library/certificates/intermediate-ca/leaf-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCZmDV6RHWt/WEZ
+y5TdgbsqrdckA7XreTYpPm2acysclepqJzLIXE+MRE8bAEQDDtcRH8fyhyxMdUbp
+1/Nd7BK95Nr44kWS61U04X6MoXmSTq1ZzevZ4nlAxoQJfeCP6di3hwuUl9Dds4Pg
+PMfGyc1oFKmLq1BIZW3RU8WeYI0KFehSA5RsoegnLasiZOku23KSz6J/5fjPHujM
+eQYWc1AepJRdWZyhXa3qYuBfg2JrowvCMG4LMYNQNS3MyiULTk3u7m+vmrZ5BBDC
+z+TN+xygaLwj8SMac4lnXpQUXAqDQ0kkuOlEP5Um/pcNp14BxsenEoUDkq2BC+cB
+PlmxROO1AgMBAAECggEAAOgJysCsLBxubgNKS9tX4irX9e2yrWLP+8LTTUHIO5kz
+4q/8B/wpeQOvLtLb0+PKx55XJPqAu6vGgRtF46RAwQ+gbi8Rp4oNfOwmvcg3KjKe
+KcVCEs1YF1aEkXTFdjv0TDL3EceqkyBb0x8ws57dwDM9A+a9KMw2b3GN3T8nHevc
+VElpxIvjGfl2W4QMs00adNOFsm5+BGqYPevIr3irlcXfWwqUxZpuGJWE+ssqaDHi
+mQXExB9IGnxOIQo/Ugfe0/6S3iTAZoOijhfLcUc40/CxqnEbtP+PW7tozsbqeH0N
+p096GblRRrE5c+QKavITMnIbdd8W1Rh0TXBwWoH4mQKBgQDUhSQPllCn75SUXMI7
+F6tUuSbZsMI8I5hC2h1aXulsnbMr1QAjt5lJEJrUIUrZH78fps95xVvcet/ANXOy
+DwbVXpPTc+G+5flRllEpxl81w+74NnTROKDoNSh+hesexnK3Xl/MMUgc7aGS0Gm3
+PHJJoOznprUi4GZHOsGOeEux+QKBgQC5BM+YuMJXpEb0soBIQLAxwS6kw8L20IUN
+29XkJIViInsrXInqpHZR+flRtBzu/pUf9rrzWig+PNH1uC9SiFDU05q+Lb47vgsy
+h3GiUyANJUXmQgfjRRm3V8OLa992ziymDb/vw8FbbH8s3xYQBrM4AveB6CsEdxY4
+FsByj04unQKBgQCRXAfQSYYdd7duywtnE8dyibnTCB2yuL36a+nL2ENcsXjNsEEK
+LRhBa4QbODJT1G0LnzMmHSG56qmEdIsP7UtFQg1mgkqUIgSoE2KsaizRP5UCXW0F
+dfBJI6Lw93RcdmwclAZ+Se8DKl5rZvYICOY7CkFAKTyYAFi0u7GMWyebMQKBgBxG
+v/N3STxbvvxmy3Q/bq4r+BT2VjWiaLNVhbr4WepFms1lty5FNFATBCeYf1OHVQMt
+kiTfAoeAhBYpsBHNA42DSYMHOqumv89ZI+TLD3ry11v5e3sgdG2w3BHSyrQ9jlVS
+hKMAJ+zxB/6zmYuZeop06Z7Q/MIR8TNhRsg7XpeBAoGBAJt5S0Tj6vjqQ4McOEMz
+JwmXowoLq7iXGmrenwH8YCgsdONtVG4/BUGmmrPlhV5KLMdqKVLCrsL40cf3Tit+
+HcOsSCub4G1xmA2KHkYuyaSafR4QgCdJ7CTiRz5tBcg/CkYm0LN+UJ7IU9WpvXR3
+lKKrSZpLJeBCj177161aQnc+
+-----END PRIVATE KEY-----

tests/library/certificates/intermediate-ca/leaf.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID3TCCAsWgAwIBAgIUMqTVAYhvmkF9PvfKsnwV/aYo8HgwDQYJKoZIhvcNAQEL
+BQAwSDEdMBsGA1UEAwwUVGVzdCBJbnRlcm1lZGlhdGUgQ0ExGjAYBgNVBAoMEVRl
+c3QgT3JnYW5pemF0aW9uMQswCQYDVQQGEwJVUzAeFw0yNTEyMjAxMDQ0MzVaFw0z
+NTEyMTgxMDQ0MzVaMEkxHjAcBgNVBAMMFVRlc3QgTGVhZiBDZXJ0aWZpY2F0ZTEa
+MBgGA1UECgwRVGVzdCBPcmdhbml6YXRpb24xCzAJBgNVBAYTAlVTMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmZg1ekR1rf1hGcuU3YG7Kq3XJAO163k2
+KT5tmnMrHJXqaicyyFxPjERPGwBEAw7XER/H8ocsTHVG6dfzXewSveTa+OJFkutV
+NOF+jKF5kk6tWc3r2eJ5QMaECX3gj+nYt4cLlJfQ3bOD4DzHxsnNaBSpi6tQSGVt
+0VPFnmCNChXoUgOUbKHoJy2rImTpLttyks+if+X4zx7ozHkGFnNQHqSUXVmcoV2t
+6mLgX4Nia6MLwjBuCzGDUDUtzMolC05N7u5vr5q2eQQQws/kzfscoGi8I/EjGnOJ
+Z16UFFwKg0NJJLjpRD+VJv6XDadeAcbHpxKFA5KtgQvnAT5ZsUTjtQIDAQABo4G9
+MIG6MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBRfcxxh
+jUJ7gZsAW8SrGyoCbnfNgTB7BgNVHSMEdDBygBRx1Xr1JpXttkkIKL7H/pi/IdwU
+6KFEpEIwQDEVMBMGA1UEAwwMVGVzdCBSb290IENBMRowGAYDVQQKDBFUZXN0IE9y
+Z2FuaXphdGlvbjELMAkGA1UEBhMCVVOCFFhVEBwHY0oDQvMsqFC/+YBmbS5bMA0G
+CSqGSIb3DQEBCwUAA4IBAQAu9OojYJzpbrQuUca0ySVbIm4K84lhejiy/Zc63Ck+
+DiAtwby881EsciaNruudm/fWC+8vU4VIu5jQvep0YWZD5tf9M+z7AkLO7z1E+0ny
+7gMkO9vT08H69OYxtysBKI5hxMHpPKSZp8AzqrOErFNN/IGEqti6JOOAmrBfT6DH
+rk4eNM3dwEEihKCuuoXWahbLJw83+R7X7ssmO7J4WP3b1CfT2atddRFC6s+pHrf3
+uJ4UIVOv2EgAH1sFfk3FrWLj7Qhf0mp9lCqRgNS3EstuXZ1v9kDcjboQo3yRH5aI
+BeCO0X+0J99Xe7N92VGDaeagqn4lgrgFCW7SE/ptNbgR
+-----END CERTIFICATE-----

tests/library/certificates/intermediate-ca/root-ca-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCJfxLOwtj/zdLw
+0b7vYZHOeL6pxwzE+3jg8OHyd2b4S259+dU9S1jF0zE76Y1JiJr/nFLa75ZDBdqT
+DWV+AXC5qxVBVmsKClYEdTdM7q3JVzMEuQxYZjl+GTHTx0K0wbGpjS698dgTB6pU
+Hz/pGHirDDcnvvuLTcLzf+h5+9szTmMbMdGTEUJJsrYcFuExcXJApk2Y5m4G6QlX
+C3xPhJuV40IuSVlaaVcfAehAf4VPPslOWMn4jFPU0yuH8xSN70/a/zaa/qdDXW16
+qi7rgbrY5D1lAKLc14+BtF/ABkRZfwYZ9/fasS3Wt94roa27rYJ1sMYTuxhDi/qq
+g0cK3krpAgMBAAECggEADx1gX4kRIn65cnZ2OTm2Nfa1S/PZGiLkUQL97aH1WHRv
+WSsgh0BMChQrMIE+QkABfPmt7IojsCq5skpp1qoZHpn5aFE0C1qjRdJuYbdHtK9Q
+qRNgEWwsZAmoPfYExdrYmVFPOvt147KnJV/5jjnd0vzQ595BZ/kEhjDQiS9X84ng
+SkGGFn/UM5tU4U0ymts9UqlXaSiolqu085bgsz5CAnlVdQz1TzDO1cE9iL79JR7t
+rzgtI8NloYaCyNvi7Hi2D+TTTG3GB2WeHxS1zAS8FK3rnq3Jb9eX461zTlgOav81
+LmJfTh48G3ihXxBO/QQscGpaSo/baCAAGZKQ+SsHsQKBgQDCS5CA+/gPw3z8+js8
+VkUNooMu1qCjb56Fwxp05IHZhCLjZ00k4KPh7Kf+gkcbZ7KesFiETuYWWBNwz9dd
+AHy7FVmvy1ECTzierb/bvW6jcpRi43xxY8HbwYh/+bYfcsCfsxVOrXlZFgyV62n3
+D812/QUc6lLnR/Fwcm2jGVs8+QKBgQC1KbKUuu/4h9oky6HOj+1IZNnA1pGlyKsY
+a00Zu0HANXo/E4K0vTXq3XwL5oqtvmoS+RRd/OLp6ypq/7iMp5407ufQFQZTRvok
+6hX4K1wLJd78rn8u7Fw9/qwkt8Vv2FNo6ICkftDj2gcF8AUcgS8qzgIhOaQIGgUE
+sXQp3xipcQKBgQCHErNWCFWO1++3i1rM+oitDvK2CD3LAVkqUtW8t/NRvZvnjbRC
+0+z6rmSn+ffnJHM4AQ64hIVOuVJilgt5u1H7Wb9tCCK8QUjyf4YnBI27EXf5O38S
+8TAfT29O0NH9EPC61WwVs2HuPfbn7q5PNOw5MXNxg7G42foOm25++azFOQKBgQCh
+riITvLZYDx5vwlCZIjg5aNAx2w1HcMzJ0VGRCl8G5HNCge4f0dGh16NSl6DiqNLQ
+Nf2oV/5Hl7pWnfydgyadxS2btnfbsLekZEnRHxlZVaYpyq31ObqlFXmal2wcgmsG
+cKIGrKtO/pFQCkL1ipGG2S5rap7rIBWkd57dk57V8QKBgA7nCB+p8ssSVxAwNqj1
+W+CHNI64VFbQzjwqhUkSXW9WAKe0uGjSKZG8GmIny3eT6keoT3COpzDmIzM9FNqg
+/GoRHTtJSq+nxyRGnQ8eqdDt6UTf61sNGeqkHmRNqXKRwBC0IsHx88O2Ag1k/mKH
+cCsmo1pWTfPGx7Amu+TcOS42
+-----END PRIVATE KEY-----

tests/library/certificates/intermediate-ca/root-ca.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIUYtgT47b2R60ZAwZVDOzbGN9tsrEwDQYJKoZIhvcNAQEL
+BQAwQDEVMBMGA1UEAwwMVGVzdCBSb290IENBMRowGAYDVQQKDBFUZXN0IE9yZ2Fu
+aXphdGlvbjELMAkGA1UEBhMCVVMwHhcNMjUxMjIwMTA0NDA2WhcNMzUxMjE4MTA0
+NDA2WjBAMRUwEwYDVQQDDAxUZXN0IFJvb3QgQ0ExGjAYBgNVBAoMEVRlc3QgT3Jn
+YW5pemF0aW9uMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAIl/Es7C2P/N0vDRvu9hkc54vqnHDMT7eODw4fJ3ZvhLbn351T1LWMXT
+MTvpjUmImv+cUtrvlkMF2pMNZX4BcLmrFUFWawoKVgR1N0zurclXMwS5DFhmOX4Z
+MdPHQrTBsamNLr3x2BMHqlQfP+kYeKsMNye++4tNwvN/6Hn72zNOYxsx0ZMRQkmy
+thwW4TFxckCmTZjmbgbpCVcLfE+Em5XjQi5JWVppVx8B6EB/hU8+yU5YyfiMU9TT
+K4fzFI3vT9r/Npr+p0NdbXqqLuuButjkPWUAotzXj4G0X8AGRFl/Bhn399qxLda3
+3iuhrbutgnWwxhO7GEOL+qqDRwreSukCAwEAAaOBwDCBvTAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUiZXSoy9+vNA2z5Pg+z5g8syV
+In4wewYDVR0jBHQwcoAUiZXSoy9+vNA2z5Pg+z5g8syVIn6hRKRCMEAxFTATBgNV
+BAMMDFRlc3QgUm9vdCBDQTEaMBgGA1UECgwRVGVzdCBPcmdhbml6YXRpb24xCzAJ
+BgNVBAYTAlVTghRi2BPjtvZHrRkDBlUM7NsY322ysTANBgkqhkiG9w0BAQsFAAOC
+AQEAH0lZ+CJs28oNYaBKkP9MPGDN6OuCEcQgo/9imr4tREGcPGMoGw6WcA6tpmks
+pc85L2KlKyWR+fOsv3NDskmLzW0Zybt+UnW5Ykh0HC5ueoBzKKmEhCtvEM0NIyU8
+9GymiNRZnTkU8gZsig6wVqigDl0JUMlXHBUS0lknV/V5njKHS6JB+byToOnVpbHE
+SqsvF6IFUkefyd4kloN40OrEXc+A04qoztLzxQVSIf1XoEaeiS2iwtoYWerFw1SG
+GFRtDYd+TAN3JTHaXA39672dfHaN8sl8Tr++EzRhbNEGqDVD1Icc6DnPk/Vl7GSr
+q/b/e2Pqe/cOtHKvRpiFiK9Lcw==
+-----END CERTIFICATE-----