commit 8686a76b06c93319bc57dab954da91abe19636f7 Author: Tallagrand Thierry Date: Fri May 15 18:54:50 2026 +0200 Initial commit: yourdev-session-pki package Debian package for PKI-based session authentication with Orange AD. - Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap) - GDM smartcard login with SafeNet eToken / Thales - Automatic Kerberos TGT via PKINIT - Compatible with orange-yourdev-login package diff --git a/.gitignore b/.gitignore new file mode 100755 index 0000000..d8057f4 --- /dev/null +++ b/.gitignore @@ -0,0 +1,19 @@ +# Build artifacts +*.deb + +# OS files +.DS_Store +Thumbs.db + +# Debug diagnostics (may contain sensitive data like PINs) +docs/diagnostics/ +docs/*.conf +docs/*.pem + +# Editor temp files +*~ +*.swp +*.swo + +# Logs (keep docs/ structure but ignore individual logs from root) +*.log diff --git a/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/conffiles b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/conffiles new file mode 100644 index 0000000..6ce102a --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/conffiles @@ -0,0 +1,5 @@ +/etc/krb5.conf +/etc/pam.d/gdm-smartcard-pkinit +/etc/sssd/pki/sssd_auth_ca_db.pem +/etc/sssd/conf.d/yourdev-smartcard.conf +/etc/dconf/db/gdm.d/02-smartcard-enable diff --git a/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/control b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/control new file mode 100644 index 0000000..e79fc4e --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/control @@ -0,0 +1,15 @@ +Package: yourdev-session-pki +Version: 1.0.0 +Architecture: all +Maintainer: Tallagrand Thierry +Installed-Size: 128 +Depends: sssd, sssd-krb5, krb5-user, libpam-sss, opensc, p11-kit, openssl, ca-certificates, dconf-cli, libpam-modules +Recommends: gdm3, gnome-keyring, pinentry-gnome3 +Section: admin +Priority: optional +Homepage: https://ad.francetelecom.fr +Description: YourDev PKI-based session authentication for Orange AD + Configure SSSD, Kerberos (PKINIT), and PAM for smartcard + (Safenet eToken / Thales) and password-based login with + automatic Kerberos ticket (TGT) generation via AD.FRANCETELECOM.FR. + Supports GDM, SSH, and console login with both methods. diff --git a/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst new file mode 100755 index 0000000..7937817 --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst @@ -0,0 +1,60 @@ +#!/bin/sh +set -e + +case "$1" in + configure) + # Remove any certmap we previously added to sssd.conf + if [ -f /etc/sssd/sssd.conf ]; then + sed -i '/### certmap tmzf5455 yourdev-session-pki/d' /etc/sssd/sssd.conf 2>/dev/null || true + sed -i '/^\[certmap\/ad\.francetelecom\.fr\/tmzf5455\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true + sed -i '/^\[certmap\/ad\.francetelecom\.fr\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true + fi + + # Disable our old pam-auth-update profile (try_cert_auth approach) + if command -v pam-auth-update >/dev/null 2>&1; then + pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true + fi + + # Register our new GDM smartcard PAM service as the GDM alternative + if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then + update-alternatives --install /etc/pam.d/gdm-smartcard gdm-smartcard \ + /etc/pam.d/gdm-smartcard-pkinit 60 2>/dev/null || true + update-alternatives --set gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true + fi + + # Ensure SSSD CA bundle permissions + if [ -f /etc/sssd/pki/sssd_auth_ca_db.pem ]; then + chown root:sssd /etc/sssd/pki/sssd_auth_ca_db.pem 2>/dev/null || true + fi + + # Ensure conf.d permissions + for f in /etc/sssd/conf.d/*.conf; do + [ -f "$f" ] && chown root:sssd "$f" 2>/dev/null && chmod 0640 "$f" 2>/dev/null || true + done + + if [ -f /etc/sssd/sssd.conf ]; then + chown root:sssd /etc/sssd/sssd.conf 2>/dev/null || true + chmod 0600 /etc/sssd/sssd.conf 2>/dev/null || true + fi + + # Compile dconf database for GDM smartcard setting + if command -v dconf >/dev/null 2>&1; then + dconf update 2>/dev/null || true + fi + + # Restart SSSD + if command -v systemctl >/dev/null 2>&1; then + systemctl restart sssd 2>/dev/null || true + fi + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + ;; + + *) + echo "postinst called with unknown argument '$1'" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/prerm b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/prerm new file mode 100755 index 0000000..c05a1b1 --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/prerm @@ -0,0 +1,36 @@ +#!/bin/sh +set -e + +case "$1" in + remove|purge) + # Remove our GDM smartcard PAM alternative + if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then + update-alternatives --remove gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true + fi + + # Remove our old pam-auth-update profile if lingering + if command -v pam-auth-update >/dev/null 2>&1; then + pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true + fi + + # Recompile dconf after removing our override + if command -v dconf >/dev/null 2>&1; then + dconf update 2>/dev/null || true + fi + + # Restart SSSD + if command -v systemctl >/dev/null 2>&1; then + systemctl restart sssd 2>/dev/null || true + fi + ;; + + upgrade|failed-upgrade) + ;; + + *) + echo "prerm called with unknown argument '$1'" >&2 + exit 1 + ;; +esac + +exit 0 diff --git a/debian-pkg/yourdev-session-pki_1.0_all/etc/dconf/db/gdm.d/02-smartcard-enable b/debian-pkg/yourdev-session-pki_1.0_all/etc/dconf/db/gdm.d/02-smartcard-enable new file mode 100644 index 0000000..5e1053c --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/etc/dconf/db/gdm.d/02-smartcard-enable @@ -0,0 +1,2 @@ +[org/gnome/login-screen] +enable-smartcard-authentication=true diff --git a/debian-pkg/yourdev-session-pki_1.0_all/etc/krb5.conf b/debian-pkg/yourdev-session-pki_1.0_all/etc/krb5.conf new file mode 100644 index 0000000..4e15b51 --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/etc/krb5.conf @@ -0,0 +1,50 @@ +[libdefaults] + default_realm = AD.FRANCETELECOM.FR + + kdc_timesync = 1 + ccache_type = 4 + default_ccache_name = FILE:/tmp/krb5cc_%{uid} + + forwardable = true + proxiable = true + rdns = false + ignore_acceptor_hostname = true + + dns_lookup_kdc = false + dns_lookup_realm = false + + udp_preference_limit = 1 + + fcc-mit-ticketflags = true + +[realms] + AD.FRANCETELECOM.FR = { + kdc = opadya31.bagnolet.francetelecom.fr + kdc = sfebuo31.intranet-paris.francetelecom.fr + kdc = opadyx51.rouen.francetelecom.fr + kdc = sfebua31.bagnolet.francetelecom.fr + kdc = opadyx81.rouen.francetelecom.fr + + kpasswd_server = opadya31.bagnolet.francetelecom.fr + kpasswd_server = sfebuo31.intranet-paris.francetelecom.fr + kpasswd_server = opadyx51.rouen.francetelecom.fr + kpasswd_server = sfebua31.bagnolet.francetelecom.fr + kpasswd_server = opadyx81.rouen.francetelecom.fr + + pkinit_anchors = DIR:/usr/share/ca-certificates/orange + + pkinit_identities = PKCS11:/usr/lib/libeToken.so:certid=61757468 + + pkinit_eku_checking = none + + pkinit_kdc_hostname = opadya31.bagnolet.francetelecom.fr + pkinit_kdc_hostname = sfebuo31.intranet-paris.francetelecom.fr + pkinit_kdc_hostname = opadyx51.rouen.francetelecom.fr + pkinit_kdc_hostname = sfebua31.bagnolet.francetelecom.fr + pkinit_kdc_hostname = opadyx81.rouen.francetelecom.fr + pkinit_kdc_hostname = vipadyappli.itn.intraorange + } + +[domain_realm] + .ad.francetelecom.fr = AD.FRANCETELECOM.FR + ad.francetelecom.fr = AD.FRANCETELECOM.FR diff --git a/debian-pkg/yourdev-session-pki_1.0_all/etc/pam.d/gdm-smartcard-pkinit b/debian-pkg/yourdev-session-pki_1.0_all/etc/pam.d/gdm-smartcard-pkinit new file mode 100755 index 0000000..b5daccb --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/etc/pam.d/gdm-smartcard-pkinit @@ -0,0 +1,21 @@ +#%PAM-1.0 +# GDM smartcard PAM service using direct PKINIT via pam_exec + kinit +# Bypasses SSSD certmap. Falls back to common-auth (password) if +# no smartcard or PKINIT fails. +auth [success=done default=ignore] pam_exec.so expose_authtok /usr/lib/yourdev-session-pki/pkinit-auth.sh +auth substack common-auth +auth requisite pam_nologin.so +auth optional pam_gnome_keyring.so + +@include common-account + +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +session optional pam_keyinit.so force revoke +session required pam_limits.so +session required pam_env.so readenv=1 +session required pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale +@include common-session +session optional pam_gnome_keyring.so auto_start +@include common-password diff --git a/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/conf.d/yourdev-smartcard.conf b/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/conf.d/yourdev-smartcard.conf new file mode 100644 index 0000000..ed3cea1 --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/conf.d/yourdev-smartcard.conf @@ -0,0 +1,17 @@ +# Smartcard auth is handled by pam_exec + kinit (PKINIT) directly, +# bypassing SSSD certmap (which proved unreliable with SafeNet +# tokens having multiple certs). See gdm-smartcard-pkinit PAM service. +# SSSD is only used for password auth and NSS user lookups. + +[pam] +pam_cert_auth = false +pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem +p11_child_timeout = 60 +offline_credentials_expiration = 0 + +[domain/ad.francetelecom.fr] +local_auth_policy = enable:smartcard +access_provider = permit +krb5_validate = false +krb5_ccachedir = /tmp +krb5_ccname_template = FILE:%d/krb5cc_%U diff --git a/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/pki/sssd_auth_ca_db.pem b/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/pki/sssd_auth_ca_db.pem new file mode 100644 index 0000000..842bef9 --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/pki/sssd_auth_ca_db.pem @@ -0,0 +1,477 @@ +-----BEGIN CERTIFICATE----- +MIIE+zCCA+OgAwIBAgIIBGg2MTPB7kMwDQYJKoZIhvcNAQELBQAwcTELMAkGA1UE +BhMCUEwxHzAdBgNVBAoMFlRlbGVrb211bmlrYWNqYSBQb2xza2ExJzAlBgNVBAsM +HlNpZ25ldCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEYMBYGA1UEAwwPU2lnbmV0 +IC0gUm9vdENBMB4XDTIxMTEwNTEzMzAwNloXDTI3MTEwNTIzNTk1OVowfjELMAkG +A1UEBhMCUEwxJTAjBgNVBAoTHEdydXBhIFRFTEVLT01VTklLQUNKQSBQT0xTS0Ex +JDAiBgNVBAsTG0NlbnRydW0gQ2VydHlmaWthY2ppIFNpZ25ldDEiMCAGA1UECxMZ +Q0EgVEVMRUtPTVVOSUtBQ0pBIFBPTFNLQTCCASIwDQYJKoZIhvcNAQEBBQADggEP +ADCCAQoCggEBALk4AMc6KJs69f7/kE84kLJ76yuvRY45v2AmaPE5OE+SF5zMCgqm +KbyRNtXJ1U6Bg7N9D0GgrxFMxsjN13Vy1X+E78PV9H7jphS2V7UaARs5oWwi3Zsg +ni5vH4TAHfiXk9bx2GE2o2UbMUFVbdpNLITykTjd4UtdL5qAieecunEo0Fm2tczN +oklb8jvZ3R+7A6qJdTHAs8CAFL0Ilm0Ts5sX7spN6gLCYnsIBi524oNNcfbpUp5D +pAYbxoaPHCZSmpZ2sucfTQbiPVVSN+TR0Z+H2YrwQNZ9BbG6+kv2+klUc/yLu0G5 +qH4wskSeGFPSvCjibtZnl/peCIi2UEXBXeMCAwEAAaOCAYgwggGEMB8GA1UdIwQY +MBaAFGwXuoQSQgNAo9RaDV24X5aAOHuYMIHpBgNVHSAEgeEwgd4wgdsGBFUdIAAw +gdIwgZYGCCsGAQUFBwICMIGJDIGGQ2VydHlmaWthdCB3eXN0YXdpb255IHpnb2Ru +aWUgeiBkb2t1bWVudGVtOiAiUG9saXR5a2EgQ2VydHlmaWthY2ppIFJvb3RDQSIu +IENlcnR5ZmlrYXQgd3lzdGF3aW9ueSBwcnpleiBSb290Q0EgdyBoaWVyYXJjaGlp +IENDIFNpZ25ldC4wNwYIKwYBBQUHAgEWK2h0dHA6Ly93d3cuc2lnbmV0LnBsL2Rv +Y3MvcGNfcm9vdGNhXzFfMi5wZGYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E +BAMCAQYwHQYDVR0OBBYEFALuPOxcqUP1A0iWe9LOJVkfMF8/MDUGA1UdHwQuMCww +KqAooCaGJGh0dHA6Ly9jcmwuc2lnbmV0LnBsL2JwdHAvcm9vdGNhLmNybDANBgkq +hkiG9w0BAQsFAAOCAQEAoLdEVqDQ/YQo9kD/IFczT02GDqfF/5hh32NeTxYSQBT9 +nbBgHYi62oZeDfj2klaJql81fQ13o7TwXSSLgcgucC5LQbT8b+2NuuB7fDL2VPVG +YPFTRzX7QTgwljOQ6LbfdE+gkwj9qLY1l2PUyezr8jl4oCP6zSkTRQbk4MmHxj41 +nUWgytLfftA1zj3qKG3B15Z/EclHviabYxR1ZcbQDR7fjYI/Vo2MChdRkR017kn9 +SaiP2HAZRR0bF8+x3XBQLJxdiRuZ+MjHs9U6uI9pi53xqgYfJyn3wGWFenyT8tDp +i7x8TXRplDLc+6iaiPIv+mBckYE7ifEB/WWgkGh0cA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE3DCCA8SgAwIBAgIBBjANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa +MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5 +ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0x +MTA2MDgxMTQ3MjRaFw0zMTA2MDgxMTQ3MjRaMHExCzAJBgNVBAYTAkZSMRowGAYD +VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx +LTArBgNVBAMMJEdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQTEtNDCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMS2+MMff2qJUBNpEW1kW7B1 +hWrYfFX7BZzQ4MCJ2BOY9H9BC3D+vkYE2VT5kfECK1ed5Uc8zHZZbEY2x+7Ijds/ +17roYe3C7KQH/h1bgn1RdRi3Fbo6wUfND4SUhwoSX++5VDG6QNNFGRoV8RyLMjPF +8+4Zoj6Y+Y9Q6KVcgqgqg4CJtl+ZIZj0EwYoRHtEqrO36fwJFGCfP0rmywY+FFHw +dzBxT1SSWSA5nQwVzOtgLG2DQrxfnjjTmRau3Y2zsqE+OI6dHEskH6mFm1PHKEDZ +aA+sBb6KNbxw9pZC6JbjBnLl1SZblNDq/Beog0/asb4lyvtKSDDdTlkGFLz2/PUC +AwEAAaOCAYQwggGAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G +A1UdDgQWBBTPPQy3A4PB4UPbBUmalZ1EcghgxDB0BgNVHSMEbTBrgBQaklPIzzMb +tvKlYH3iryQSQbCaYKFQgU5DTj1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBD +QSwgT1U9MDAwMiAzODAxMjk4NjYsIE89RnJhbmNlIFRlbGVjb20gU0EsIEM9RlKC +AQAwfAYDVR0fBHUwczAzoDGgL4YtaHR0cDovL3BraS1jcmwuaXRuLmZ0Z3JvdXAv +Y3JsL2lnY2dmdF9yY2EuY3JsMDygOqA4hjZodHRwOi8vaWdjZ2Z0LXJjYS5mcmFu +Y2V0ZWxlY29tLmNvbS9jcmwvaWdjZ2Z0X3JjYS5jcmwwSgYDVR0gBEMwQTA/Bgcq +gXoBEAwCMDQwMgYIKwYBBQUHAgEWJmh0dHA6Ly9pZ2NnZnQtcmNhLmZyYW5jZXRl +bGVjb20uY29tL3BjMA0GCSqGSIb3DQEBBQUAA4IBAQAbkqwmpM7EngYTEHUdyRlv +RUO2RxNk8+D8YklwWOd5XNnMa7jvXtP1hcV7FxwyoNssI8iEROg1EnQmVemBKSEj +eWvyg9wcwUWcSOPjPke77Qi1k8pUOwz33Q3fwtlITz4Y3vd1/yu6O8SsKgA4Azui +QVZc7SxsKnGQZ4mXmiSkTCGX0q6f8fEWoa7l+qlMTBfH7GAq0JukecO5azXl2lhV +OvF1c7JMtMoK0sATwyf4UFJ2e9Vn6wHiz6FDLVE5mLG4Dh1NnwABBm3QKyy/xGnc +C8/x4/Kgg29uMi968M7Vwr9G5PYY0pDa+NA0GOYnwvlsIlW88mFwvd9gNw0m5weB +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDxzCCAq+gAwIBAgIBADANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa +MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5 +ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w +NTExMTQxMjM0MDZaFw0zNTExMTQxMjM0MDZaMGoxCzAJBgNVBAYTAkZSMRowGAYD +VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx +JjAkBgNVBAMMHUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBSb290IENBMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtA8YdZv14dIsqPCqFCrNFWnqO3LOXcvu +KB0MzwqqSx3uzBy+OEqDHePhs421ugmFQH/RfAnylCxGfdYIVlgJYu6ZEh/+afOn +Nh1EnWVMXcaPlD7gHW7Ij3ucQB89+dM/6JqyzmwBi+iuo5aMGpFir3O0JHWaLsqw +BsKWT28G3N/q29Wg1Ed4AFGmYxcMKfFrZ2z6JF3k47iK49RiYqBeqlAoxrd7UIGl +kucy+2fAD1oYPBmC0oSMIfFYRharnMFtCWpUJq5/wPej3Pcmrw/jvRFKsjak4e6S +WYtXf3vlQQIh+PTUp7sNp0us+wPf6+uHtlPYXKRlF35jxBTNKwv/uQIDAQABo3gw +djAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUGpJT +yM8zG7bypWB94q8kEkGwmmAwHwYDVR0jBBgwFoAUGpJTyM8zG7bypWB94q8kEkGw +mmAwEwYDVR0gBAwwCjAIBgYqgXoBEAwwDQYJKoZIhvcNAQEFBQADggEBAIMRzhkM +gV5pABMVzwM6K6eH7z2SEvNxYKtX/vsTfMak0siH6CezmtJ9aXymUZ2fLeZW8yfv +kAfn/0MuD7nbsVW3xGS45w+/SWwlpPDCv1zTtFbX3tYfAUyQSgk7k70y0XzSQKqb +3oNyIScC3wtGULozZNcbmF6q07GmzwqrIekOO2/ZIXYNBIy1V9cS6s9kVsS0Rp7L +fri2nErebYWADZJFljznbgizwWidKaDqVLDzBj8/QtXCs7SukkJPKLwEm5nkJ3F/ +mJTKzNRwM8loENOfD+ntUc6VLtdaU0GaIVbAGGVtm7UBr6OmFEmtwn9/zBQPt1fz +x3LOxGxVqztwfdw= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE4DCCA8igAwIBAgIBAjANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa +MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5 +ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w +NjA5MDUxMjU0MDFaFw0yNjA5MDUxMjU0MDFaMIGYMQswCQYDVQQGEwJGUjEaMBgG +A1UECgwRRnJhbmNlIFRlbGVjb20gU0ExJDAiBgNVBAsMG1dlc3Rlcm5FVSBNaWRk +bGVFYXN0IEFmcmljYTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYxLjAsBgNVBAMM +JUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxLTIwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7n/lycHAbcwyCiqlzIum+iQRPFi38CCrU +ifOX6DJUrKzGzhCQQ4MjODrLwloR7QhC2i4lKFX2y9xjziIRc2a1uw4PiLIqMgm4 +PLVfZiIuXWgjz8/wGMjOax9GnqZ1pHbmJd1O7Rklzyyqre87DYtnF8BlEJf+dMh5 +YjC8MnjayGtF2hDR9LBSNU7ZXpKDyn1HpkuGj5CMo92K4dzUEw3qvopnr+uY9YqD +zNwcLwyWEYCWUgSr9r1Cz8HCmP/8DTTBPcTBsrAV93ybVNs1ZFcfHraJL8nkJzJU +JcIjX6iAhiDSvU/qg+F1fEkjIJ+GkawbM+/h4mouKnCa/xGmptVxAgMBAAGjggFg +MIIBXDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU +PgLTDgmJZoDWzj29s+hrBk37H+gwdAYDVR0jBG0wa4AUGpJTyM8zG7bypWB94q8k +EkGwmmChUIFOQ049R3JvdXBlIEZyYW5jZSBUZWxlY29tIFJvb3QgQ0EsIE9VPTAw +MDIgMzgwMTI5ODY2LCBPPUZyYW5jZSBUZWxlY29tIFNBLCBDPUZSggEAMIGOBgNV +HR8EgYYwgYMwQ6BBoD+GPWh0dHA6Ly9pZ2NnZnQtcmNhLWh0dHAuc2kuZnJhbmNl +dGVsZWNvbS5mci9jcmwvaWdjZ2Z0X3JjYS5jcmwwPKA6oDiGNmh0dHA6Ly9pZ2Nn +ZnQtcmNhLmZyYW5jZXRlbGVjb20uY29tL2NybC9pZ2NnZnRfcmNhLmNybDATBgNV +HSAEDDAKMAgGBiqBegEQDDANBgkqhkiG9w0BAQUFAAOCAQEAPGchIGG+ri3/9RvN +EbtZ60WiCMLs5lwJx2TVp6FwXH8EEX/fwfNR3rlPDXC79er9xFBR1TqbFVD5+NA3 +uURRqH7Y4sKrySGIXbkYZaXUm82r6cmTiWGW2Esc2X39MFp4LrWRXro5JwoYkr05 +So5lc/gOBvBSZtMJutCUPSBwypSy6eapEjHdQZRc3vXNnjxiTkDOtYICoqWlyb4G +/m0wixZitwX5HfpzbKw/2ezrIFnfzlqCuKVPwgNYGss1mCPUmdHQgbEUyNPe4Hpz +dWg3xTXVhaHgT8vgWHMuQQnKeMKrjrZH10BhOoxO4qjLlmlzmR5DpTgmo17ZeFtv +xrWCTQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEujCCA6KgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa +MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5 +ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w +ODAzMjcxMjI3MTZaFw0yODAzMjcxMjI3MTZaMHIxCzAJBgNVBAYTAkZSMRowGAYD +VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx +LjAsBgNVBAMMJUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxLTMw +ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4e9io9+N6GaAulogpA4a/ +qr8RwlzIJuSaIkh/F1yEBPP/djcRmwSlWDSFtTGAp70+KuVK5Wpvnv3+7GKXRo31 +dTEvqLpOxVHqdw43aSR7pn3IZtD854QLMj18YtBgtQJ1GfrZB3M6Ugn1vsWwlrqq +8PCr6axDBSlifteYKq71liI598vfvEvV/5zdq2+NiiQZ7qQCCNnFAIByesdfV0wi +yPDhdf/X3YI67v7sCONeX/BR+CPGz+BSAOSSCH8ZdrHuS223LMnvQdk0kCb9jS9v +a793odL9rQftatnZe7y3v2jc9B3CzKLCctqiArTCA4hg4ojrBDhQpzawl1UBN3EV +AgMBAAGjggFhMIIBXTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd +BgNVHQ4EFgQUVQAWKPzeE+CJ5b2mNy8Gsem4SwkwdAYDVR0jBG0wa4AUGpJTyM8z +G7bypWB94q8kEkGwmmChUIFOQ049R3JvdXBlIEZyYW5jZSBUZWxlY29tIFJvb3Qg +Q0EsIE9VPTAwMDIgMzgwMTI5ODY2LCBPPUZyYW5jZSBUZWxlY29tIFNBLCBDPUZS +ggEAMIGOBgNVHR8EgYYwgYMwQ6BBoD+GPWh0dHA6Ly9pZ2NnZnQtcmNhLWh0dHAu +c2kuZnJhbmNldGVsZWNvbS5mci9jcmwvaWdjZ2Z0X3JjYS5jcmwwPKA6oDiGNmh0 +dHA6Ly9pZ2NnZnQtcmNhLmZyYW5jZXRlbGVjb20uY29tL2NybC9pZ2NnZnRfcmNh +LmNybDAUBgNVHSAEDTALMAkGByqBegEQDAIwDQYJKoZIhvcNAQEFBQADggEBAB7O ++qftsm5TDoJriHAAIYcKWtdbrh3cfDziaCV5QI9MF/LSIgzikisr4nqCKYJLXrMH +EZxH6EsgvSnsBpGLvc7n/6ClZhaaRt5sljCxB+vMlHA2rzw3y1RiqXuHB5vRvT0X +aCqkwON39uepQi/WzZyjBUFwEma1xHO4awilcjrW6JvNJ2b182+DR09xU7LZBk/C +ilLMA+8TpkBKBMBiviyz/L59n5+3baQwBtQs9gcA9gE5d67/sA/w7Zv5FBYTJWw1 +ayEkYjrC2MB+skbQEGfg3Br04HGqoJ+wRFxP/V6G0i1an83g9W2gzEkEbWj+JY15 +6soOCd9jtEq6BSQhgaw= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE3jCCA8agAwIBAgIBATANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa +MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5 +ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w +NTExMTcxMTA5MzlaFw0yNTExMTcxMTA5MzlaMIGWMQswCQYDVQQGEwJGUjEaMBgG +A1UECgwRRnJhbmNlIFRlbGVjb20gU0ExJDAiBgNVBAsMG1dlc3Rlcm5FVSBNaWRk +bGVFYXN0IEFmcmljYTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYxLDAqBgNVBAMM +I0dyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsPMrb/9/950vF5H63795Vqp8uBndVfHlTk+w +dFsXyTKn1j27tGqHOFknEYaiIQB+tRpn2un9wFavqNz6bYyeOfZDKfwAmnkafAxc +1u4jRZv0H3ZPNVfXVS1x7G2MFlN+94/5LMdUpppN77KuH1mqXgDi33bO9CjuEVj/ +2FUpjqwBVTIqleJfX+mvhvC69rTmZFml/t729xxOpgxt5Wt2OlQ6VaYqEq8+tSj2 +/KS8joO07oYSMTikzTXnxHA8BSsfc31SWsfjx4+sxmxc3RhDFnscBkot0l5IAFev +wiTbQhx1xNjqa1nN9CYgmNfBpLz60YDtVwUqsdMQyGpvlqRIfwIDAQABo4IBYDCC +AVwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDYc +M2fTE1z6W5/qi7pEZnRG8Xd4MHQGA1UdIwRtMGuAFBqSU8jPMxu28qVgfeKvJBJB +sJpgoVCBTkNOPUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBSb290IENBLCBPVT0wMDAy +IDM4MDEyOTg2NiwgTz1GcmFuY2UgVGVsZWNvbSBTQSwgQz1GUoIBADCBjgYDVR0f +BIGGMIGDMEOgQaA/hj1odHRwOi8vaWdjZ2Z0LXJjYS1odHRwLnNpLmZyYW5jZXRl +bGVjb20uZnIvY3JsL2lnY2dmdF9yY2EuY3JsMDygOqA4hjZodHRwOi8vaWdjZ2Z0 +LXJjYS5mcmFuY2V0ZWxlY29tLmNvbS9jcmwvaWdjZ2Z0X3JjYS5jcmwwEwYDVR0g +BAwwCjAIBgYqgXoBEAwwDQYJKoZIhvcNAQEFBQADggEBAJbffeIqjhQ2R/8EHw1O +hENVtQf8bP5N8cAbgWYItzUVr72/CoX6DlTsnrqDta+NO9o6PwBQ6Yb4sTfBGYka +fpbqmV0BFxGh62Y8EcnQrlA8Iz0JMAPw1OTc1p9BaylkSLLUGvzAXDfcZ4ms7ONQ +a96Dc5ZFGwMrj9rNxkYubhae1VeWOXVPJanaC5xP07gVdCxXa3tFjnTOwqFlajZa +3m+/85ritv83yyGqtkCHFiDrpaoiFtccRVsXNCWYvKe6lc78rEtPvMHr4KHn5LNz +x6FDBGiBwqaEjgteCUpCglblDDwb7vn7T2rCfjUM9Y1G29JI1JKRp6t9xoCzy0r7 +CuU= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFsDCCA5igAwIBAgIBADANBgkqhkiG9w0BAQ0FADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE2MDUwMjExMzgwN1oX +DTQxMDUwMjExMzgwN1owXTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSMwIQYDVQQDDBpPcmFuZ2UgSW50ZXJu +YWwgRzIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOCL +6xok2VzVyHsl9RucKjtEALfI1Cx9uu1AbflfsVP4YEpOHtDW4yfr39uSB9NvjVRJ +8LPteLbsuCHaaDM6D4urluhjS73C2vorMEElgCCG1sjHa0pXDLVG7H9CegqlyZtn +vbzquJbYsCZaywBYx4pVoe0JvPJKI7/nvE2IdI0Ue9Pr4v0nUiJhzZG1S04mDw4E +MlTvW60lFLqnqXDA0itIJfpAwbAFqw1xsvFxXBnC/vUUbQctOi7je8YC/p5w0aoJ +o2wGkgDw2bGpO1VaeyfxTtyf41RUC2wuV9bO2vhV1aWf0vp59zybMlL/pMTmiaoa +rVQr8aE/RGujn/mMqzT4JVmiCmD5bPy2OVKJnch7L/RNI/LropF17lPzpXboqk8M +2K2+T7AxIJ0voanaxPXdZFElhxCg/XW04OaVrN4dO1x3njjR2MNizFhe79NZ7LEd +efltcg11IXC6dKtCgs0/GLu6I6nYuSLRq6N5nwAs017IJw1RSFT2SYS6g6JjiAT+ +mr3dqXBSsNwRBug8oPxm82VNUHNcj/LqNYr8EEDqICd8PtRbEA6pSXMzxqO2zcRE +DprWOUpL47Y5CKpcG5R+stezHgXM8ArsmT2A05+CQ3vey6pp/10q80gZ11iJDIqv +GVVQvcvBqQ+0Eo2Rr5Kv9lPbzIvshxr6gSeEHo8nAgMBAAGjezB5MA8GA1UdEwEB +/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTGON+k2onDjBtKS2UH +Ja+z1LZHgjAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z1LZHgjAWBgNVHSAE +DzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQ0FAAOCAgEAHm5FZlDv+2pzV7f4 +hfEDYWwFn2Lbqyn/Y8BsiyfvTX11AYOw41OeFLrk3FFM6+iLb14DXQcTwHjBux+2 +htH4T3jyPeBmsnRzuxsb61TqYO1TnId8zzroyPTT+MHABmETyUf9uuSispNgJJXk +YYxpVPVLUZNtSuoDuVkjHJOQ0NRTB+1XzfShuSwI4vtttlhRg6qVvgjnyP2tR8BY +wkHWI+iHM8VUwoZYIyk3zRbFTdqWEyebUAm2aJ7LguroMTZ71ZxvD/LJfHybj8Hb +rm2Tk+Dq5gvBiggfgs23lx2uWBJbMa8F7I7JH/+YsvwXmlQSkDPDcUopKestiKVb +fAhY1NRDqMlwkOLLrGxPjAKCDYwVkxz0pkLnWDiDRNpLlDpJ6x3+dOX34vi+K3dq +wl73JXdXo4NEXswVsVM8fD+cdHluS74pemMf/7olUfd60YYC+6RwQRyP/4I0WaNs +6D4B8R3rc/X1obgvx6NfF55mFEwW3yhxRLjux5sYEBfkT8tTllVcRUwJCQumLUS9 +rnrCMsDkBfI/ZN+ITBcWi6cAyOcsIOk4up9aUvNJTMKUlEybDNN8cDp9+vLonN2h +YMg1IfJ+IZs6x3rDr5MXuWTks34hEJidpmOTmOyy/QPHCK0BGRmUoYJr4CHS4FL2 +BtsnCPyUUO4gppjywfYrotQ2gTQ= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGPTCCBCWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE2MDUwMzEzMjA0NFoX +DTM2MDUwMzEzMjA0NFowXzELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSUwIwYDVQQDDBxPcmFuZ2UgSW50ZXJu +YWwgRzIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +mPYx/p4jDiGaWI25AolfgwC2p/fI209Jjx++FfKnFb9OfFC66Wuny2ziA+2uuPXW +OI118DGfhfS45dyf/BYo2v70kMiIvZI1FN5pcaCDpYSTxGmWxcaiVm8BIzFIT7HQ +gK61jYeJrsTrzoUYAgZVnF+pZZgb04Sy+SdVctNWVKKuXfx59XiXqpq2WSwULb8Z +lYHsFWUkjJxpaPYYzth1BPoxbYdTcf2alyoCsphDuKySMkClDSFWqAZVXJmdAQ2H +wEUvgLt7cpAYCPXas+9VOceTIG8XAZu53goML52l7ueHqY435ZCOeZOLFqmNUEGY +9zV1K/4jJDyo0K5/K6xzcgRgs1KyWjT/2lJAsEG7j7P1r1KtYpjZy1860JB9nM8w +YP0O6sKlHod2jCQObAznrKRNnYUUGYlkdXp/M6MejSPrQtoua/NtSn5h9FBHymvw +GBYtljx3srsQTO6pwxE653h/4QouIZ3Kf7Twmw6CLS53ZsleplpBcZ4zm6K68Do/ +8ZRvfnIr1hk980LmIzf4aevALx/eCVB4HzspzOVq8CExCVg5BXdV4j9BSHmH6rV8 +PYAMdxXLzyt9uWMOVgQjJnWg4q6H8RcjJ/1NkAGoCOgFuaJu0f/jSyokfHr3Crio +FZ7zpZ67cs7Dyz4ZfsEDV1om7WjsiQzR4tZSp6swXXMCAwEAAaOCAQQwggEAMA8G +A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS8PeSkx7yL +MQtV4sMHoqL429e7cDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z1LZHgjCB +hAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3JvdXAvY3Js +L29yYW5nZWludGVybmFsZzItcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9wa2kub3Jh +bmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMi1yb290LmNybDAWBgNVHSAEDzAN +MAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEAQzrAaBHlbm8sFTNaLCm9 +0imjsDrpCriwTAV3sxaFMXxuoQOIN7frc+tulEq1ATZNicbiRqHJq9BnIc1MGu/A +hzxvFMBAjBnj8/wqAY0GsFr52axYQHwgANs9OIuSw8oz3/z1/6T/42JtK+WlIS/r +malTSJqa2CEe/fRVQJp5YcO0U1mIVHatcMq7Z9YVY6K8A7hb7qSs7GO36U7hStFt +72s5++fdG+s5IDi2l6CMTZmelbhjsxJL/A9u8yrFJxniAHs5+ikwO+MoL2ZBC+0A +Jt8Xtjye32//LGAyvai1jJ4U501wjBvvdbul1xVARV/sHrYSE+hvDEtfHcSn92H4 +zC9C2ANMGGxykbDLWbVfqmGW5Iz4UWCEv6n451QckMJNJI7743qeUc0AHdMtPDtx ++ItAxpaUIXINR9Lqo3erWefYLSne7vi86QdqCvwHWpzjuIJ9DXOT5qRCN0M859AA +ZFRBQn5zjPO1tyvtwb9/0o1AjL5NAMc88qQAmxkiC9/QzDL7LYxjKgkwCWx+DfJF +/2Xe9zb3zGvT6xOjIELMQhNwnU37EMe4hSnn4dJBf0yNq4g3Rt3MmFFCDy6YE3PG +rtfQ/CUwLPJb9Bqroqe4ryYPsVKpKe+71fEOKS8iHlFSggGZucZ63WKSyiBS1sJt +V5qME0d/UK4/+4FTP7FcXmc= +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIGRjCCBC6gAwIBAgIBBDANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTcwNVoX +DTM3MDgxMTA5NTcwNVowaDELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MS4wLAYDVQQDDCVPcmFuZ2UgSW50ZXJu +YWwgRzIgU3RhdGlvbiBDbGFzcyAxIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A +MIICCgKCAgEA0zTTkJoHZayvCP9YGGf4F+K9yjw5eGgAxUx/52c2eDdEk/FEnftb +0Oq2dTXPLW7SAMlSDn0clX3KhDyzxhYVGk7kJoceqNlzXtq5P4grueYU2X+rAuq2 +i/Wk9slSKq7C3KjO3n4YnRdwaM/THxIUxv8sWhNKlEd/HqmKnvsEd5ECPZFBWT35 +Mn+OwwwgZXep3/7ecN2Z59sHHfxzVh5AbysbPNnjfozYjmVaqjv25HcdTiCC8Sn5 +GayGc85EEdTIFEoNXv54TFzUfxpMCYh4lN6xbn4rr4E20Rw3khGCTtu6us8d7keJ +SJquUTsL2PsoDSfIZanZpGUqgB7A1/ubYFoiQw2tjikySEVOMWVP2u6p3w0zpkf2 +PuvUNC2Qk7sYiYuJw51DKSXIbAhkz+cC+Hae1JiOCctRUmbVIymnpIXEF1c45STW +8qVZVJgZN/b5ULQGFBJKQH7RgPcnybEQXim65MhnL4KjD3L0AOdYvyl6GV3/bmej +NeOZulVj4SPVdXaDildLMMz+7vXkSXqvgk7KNSIwg6RD2fWDrXa5u4TYF3I3NjMK +lUE1JeJr0YzEopmD5UzHQ5EDukjo5DAiPUmfWUe0gJx85kBILT57ePmrTIHNVPaq +lbnEU5U54vD6/D0oRI9TPU+FFzdDmOIdzl2l267sHIk8V+LBnCfZjUMCAwEAAaOC +AQQwggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW +BBRn1VS0P5PW86c7JQiSN/g0nJv+SDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UH +Ja+z1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0 +Z3JvdXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6 +Ly9wa2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAW +BgNVHSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEALt+3wUXb +yAnoEEy9N9Gs9fz6wUfW4r1cGrsfqKimBeTemGQ2iwbBeKdhs5Mlu62cGwTqo2Tn +4m67UdWy7+lujq369hpOWixrkcwHmNFScFCzlSJnB7RvvsfbyvrA2Qm9FcPL9E6W +iXNPspn9Mvmst7/sdRQX6ULAHsnEn2KFaTs+J7/IMkzJDG5aMU6HIRXLeIx7L0o4 +vvC1h2q+JqopqF0RnkKGqH4DUGHnw2Hy9Ki4KqmsCbkbcnl/3yjxLvYO42ZZGgQD +KDVHWxozAT1gxC8HKOeIA+kTesX/23stwBhsn/YSleGIqOKFyLHpSesD2lg9fAa6 +pTZbRPlVa33PkWDzFz2Izo5JM7st9mvlhP/1FxcWhIw3xXn+XLbO9RrRdpuXVNgw +/kM61L0b0KMecioE3g7qJRWcHSEYZ5pmLGZ9QQfXXrZagc0hNBfOd6zCOmWNfeOj +VJJYu1Ev6lTB2UmH4IzVQA+03C91oGV3jAdVt1orwvmPKH1Tf/jy63e2XXHWrBcz +hiE/fT4nP2tWlYYJtlryiu5pln0Iba87iQfzJsVdgK/dW3IINacvgVwQlcjsAKjK +NtuemeExQnG+8s5VByy2av0SlgIXBWUCaKsOvkznKTbaDnOSOz4jd8FgN6E02p8N +06MlsL0D1nMoUsUywY/HS8wryPH1m3NxrjI= +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIGRjCCBC6gAwIBAgIBBTANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTc1NloX +DTM3MDgxMTA5NTc1NlowaDELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MS4wLAYDVQQDDCVPcmFuZ2UgSW50ZXJu +YWwgRzIgU3RhdGlvbiBDbGFzcyAyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A +MIICCgKCAgEAldzKWyrLkFVhylw+a6TICDuBv7hPU+f7yz9aA46p4/ZNgAS627xs +LdqMyVLgSVgPQBbXWTc4ZNs5cY58T6lZwynJ0t6O8D4KEyGQuse7ETgpSL81VlMW +5XS8LMLCOBNlUAbq6K06bCk0PEEoY2Miyvt5Bjb6RTxlNKs9Blroe9At2YmIsfJU +3wx4HPhLGzfA/UQpEnek/zeV66F9KRpv6SzOiUc8rXNvxO15iXVlbBkaCXvm+XfR +W8qYC9j/LnHFMj86FkH3a3WQ4KqvGiI6tiK1DxS9X74bQO116KZ8evs9AClNwO6O +PZSNC8G80sxhrmEE9c5oaVwDVtQLn85iptvkAvPGO50qeXIIB1qSvDPvQMnhD1gu +1tEfS3/Dd32gFrkgPD1uwXjm8TzTOoaPsabvj/ScUvrraOFK3+9UPC+aBKcLrE9j +nO9VPRyJN59wJNQtyiW349v/M5oNBGHZP5T2JfzzmQ1aEQukTzWgUplg+AKMpQgD +0KgMZ2TirLY61ltpEkSBQCHsSPo3W+2ZjxIckFtoOBDtWCQ7N1DFB0ciyu0OL1fw +0F3QOUxyYQjNpUTLSJyHp5IP/FgUIBt+YP/E4N61UAOYAYEt4vLTfw37wB4PBPE3 +B2EAPYgy5Eljm/RRQ4saP9c3ThMh44XN8ELvvRMy+FIWPIEDEBkGpPcCAwEAAaOC +AQQwggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW +BBRxqVpYginpDHEuxO8WaLyKFhRBNTAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UH +Ja+z1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0 +Z3JvdXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6 +Ly9wa2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAW +BgNVHSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEAEaJVLJ+I +bixQyvKI7vtdh0+16POulFXalWeNE/bDxuxcwCAB2EIRzZrFJtfM/sPi9WZDe0Ff +h40k585E+Sqd0pWQKc+ycVBfVbpWsTMt93x3nOkM6c1HRwr2Jx0MdrZ6/m9qLVnL +F/6pow7YsvnO/f13VwmuLnhR82aAVOllvfiaU/MSub55A0FmD61UZf8mUU2TNyfs +FDWnA7Ic5ClqbJQk5fal9CXTZ1roXFfVInfMX08JRD5gG1hjKDNC1AGVsgvH2QIb +3QMyGzEKStisKQpeNubJMrS0F7tZs62uyaYMv7y7CfJF0FoXMf6EynzrrCR4sjP9 +PgPrPihW5ad5qX+DmMT8a0QfPIgM+CdCsNo+FCULzkqZveDv7icAzpDALtNwjnLk +yN1bCSSgr8Bew6rwqDOjkpMqAY54Kkon39Zue6YdlT2n5oiafYsTaQf2lrUDs+HO +Iwdpfytlz00YmXEFUmxZDWuK16Vn9/59yVO6kkwpLwlQnHJ9zoaTKx1mOXRHv0OV +bp109UjB+kYjkSEQ0yZ6EKZ4K3zi8oPckocKekziZ5GjM4/mXf1dfaP8ZMk/0DG9 +wkRHfQq3L1sJYZQZDmWu4GKvvBmUm4hxv6jDslP1p2Slt0ZgrTa/RjzKlwOY6pGp +fHa68wKv4lLXwxJ1c+1iSbgsVdzTuKwZuPA= +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIGQzCCBCugAwIBAgIBAzANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTUzNFoX +DTM3MDgxMTA5NTUzNFowZTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSswKQYDVQQDDCJPcmFuZ2UgSW50ZXJu +YWwgRzIgVXNlciBDbGFzcyAxIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEAt1JU0r5fWdFriaEucReLerE6/oWhPVpv7R/f5A9M11Fe+rieCKaN0XYr +7LLsWY/lOykn6Es//YXaoQxAChv6imm+0yMz53DGr41WZQb0XxpVbVx+XamxsinQ +A6xs33UgoOrcbGSPqlRIWAaQ9+uVqQa0S2tErdjv2b8ZpWyzqyhnnJ+MquEtn+ee +1Kx46oQeIlXQAjRcPjGm2x9uefAS+V6U3bk4/Iaq1QFSaw33B7NLMlfgUI30SwsK +K9SUbiKvqzWHFAHQ6+pOtK6j1UG6IpKFdZXRjHYOa+Yj+fwIWKiwAQV+9g4R/UDV +Y2vjl9NT8G0okWN6AdTLbvREe9RTei3ZzSYdrPGrD4GrKRKqJFHyof74pQ596Q6v +XHS+vH911Qb2tqPbC7jC6sQqR5MainX9jhMr1doJSbxbzxPLCL18Wppqh9L2rkGQ +BM7ZYsf15edb9/4MYudvpvfsJpHTEpGG2VtnOpBe9kDvqssUZXfGsrG2FN1hq4hs +zeV+rihyBf03kBIxr0BO+0lkyIgbPQIM2RnLG0Of93po8CFQ8bS4SLuhxMfaPaxs +RGvIIWvRYJ+S6Ac/PqTO0WRJgAwr8qiPbnGyeH5b20XaXrfXbdnxEWriXp4hoiDI +cBf9jmV6QH9b08D0dA400VzkshPYAkgQV0veYW1Ofc+DdKPrsl8CAwEAAaOCAQQw +ggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTL +/Af0LFnJKLTq+umVJJtzYDs6GzAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z +1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3Jv +dXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9w +a2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAWBgNV +HSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEArs0W32Uxwm3X +6c+Dg+zJD+pFu110pPYuQLgy7IoEipm4WsZf3wlrYx65W+iHKU3V6PipnMCabq+6 +HKWYcuAvTaXv6mS8piJMGX9IOmnZ20BrnrktGoNzOfTsA5m9Qtd6u0ezeCXIunu7 +ROQQ24OO1tuBsbeIR0D5aeXCEpWEukZXg2F3zn++Jh6H0XHUs+QwwUAHAFcaruTl +8HEoJfYJZDXz7OpgC92bnKxF3G4gm1J5W/Pq/e5PClhPePwdDV/IgAi91bIHcAn0 +qlGXbh253NbPq5UOveCWagz2r6sjSViOvsbAQ2raPpmKqc4ZActArug+ABheIQLD +wtyJ7uSCRRGfY0PHq/yKmSWab3b9yrUawZLYspQrdYuGqR9QzfltqQ5PSX8XSsvX +y9EbKZJMCBsNfJyBiwascUwySIwxqJa34DfYRL2nTWJj/zLQBHYSWPaUCn7e9zbT +LpqKQmMYrIcrxVogsOyEZvja/vbIEJ/o1GSbQs3ubTDRY1PAJ19alh7Oaav9LP6O +iBQa1yu5Macmar8ga/EGd5JMWNoNGHvOq7d+ijEqTXpXjbPca1gWC4TDtwLUKdS0 +3XAbHGz7/Rh+x1+y/KKESqAqZzS3KzLhD+nfYH7TsJgciab7HzCuRyb6BTlZ35C5 +oSsxYh6OpLTDBtDJatgLS5VsKS2cQXk= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGQzCCBCugAwIBAgIBBjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP +MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV +BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTg0OFoX +DTM3MDgxMTA5NTg0OFowZTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY +MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSswKQYDVQQDDCJPcmFuZ2UgSW50ZXJu +YWwgRzIgVXNlciBDbGFzcyAyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEAznLKFmxJHjdDY7RshXVY6exXmsEZkSSRE80MVRSCn60KCJTS4Vdz6RzG +tox2vofkVaJRl1dZ8pC/Qgl8XC3SMWP0wJspTmbHl9FZrScCzLWLCaaWGKdWuaWx +GE8Gv93XFvzoHXJwcILDW1lR3pOJRdy2RM7wfOFCogZsaPxPXj8KjjhRPlrMuouS +nTKa+oRxE3v+z482Z6tocqCyNiwFGLO/5RZmgOZ7/vUx9+xEpLyw+hVsmnU4jpnD +brzcFy3W7LORfPq3a88PyVP5OnrLeC1dEV1uZwiMphIeoGJAN4B9rRRezYF0N6QV +YyaSW1hT+FcWit0uk5c28W7nIJcXK5kxOcx6/LezaAnpJMf6lwtWEYqv6t7kritE +pvGmkhLZRhQq+NkGuAyTtoFX13YUVs9QpQTW5/WSnoZGg5RFMm8FqnuhEkjVWl6S +rhIPuU8+m4mLhfcP9CQC3WWFphhoY0F9Yqg/xl63ZPO+JnnWWfxa9iHqrQg995uP +QHn+IDjr1HAjCTNwIbBme29ogCcsODBZR/fnJURp2W0WBwq2G6M8frpW5vKBESvO +UpgyVsNYAygP1cnPVIaDr8L0ua2qx60YTflHn8K3V2GkUnYIM4sHkF60zRcC1V5Y +LgcLUq5PJ1KYrTOdohXE4Y0LuWGTF5/mHzGDb9ylNeD1H/rmf20CAwEAAaOCAQQw +ggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTs +7DHr1umvFzVzvp1sVPfoxKcvxDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z +1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3Jv +dXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9w +a2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAWBgNV +HSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEADAcFAtKfz90C +FKStHL5300T9swrgMtembXWtEHxgxB+V4Ou8ob62uB3ZpTXF1++etMc2PSfurTnw +5zR/X2qbVIMkGuZeAANXYd6au5S9BV0HY2lkzAO2PfyF+I2Uf5X61X48YwDbnf/l +l6iQskGIGEVlA3plsjEvC4xoSIEiFMjhWynUCumyw291cJfSkDExCALHdw8wIK4T +TBltpZzIa/YcJYBrShqGTu4+cyd2O6A0ghTCXDIYYzZfq2O9zrUc8SlheKKJCvw0 +Shpf6xIoi9Ith0FXsehygWOCV2Frk+pm8kXGzcqOKpNgVLVv66XQXWZwlF16i7qV +odLJUIZQ9j6oqr1Gu1a78HODtUFMluO0Obfb+/1D1aJw3MQqXgs7PJ5X4/pPlvcy +WwxJ1hL1Sn46TOGJC6sI8TEiiesWaGAGpRZ0CZ7w+Tukr0mlfuhup7t/MiMDotvD +P2hc0NITihxrFqiB6yFHa5g7RqEKKEOfoowm9LJZ/m/h9/baaHVmToRXZzMkGL80 +dHqMo1xDmjM/ViStcUP0UHE/FYpMnA6gRpXqHN7vQMC66M7s05stVLQx8bhNmq6B +JwCo+z23uzkQM66xu9osTV1AAX2O6+dyktOW7zsUYfJeWNVYu56C1eQ+XfhREULx +LHB9eC5xUSBUcmlong6GmSQ5IOZJqKI= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGpTCCBI2gAwIBAgIIBDnfF83l0JYwDQYJKoZIhvcNAQENBQAwajELMAkGA1UE +BhMCUEwxGzAZBgNVBAoTEk9yYW5nZSBQb2xza2EgUy5BLjEkMCIGA1UECxMbQ2Vu +dHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRgwFgYDVQQDEw9TaWduZXQgUm9vdCBD +QTIwHhcNMjAwMjEzMTQwMDQyWhcNMzUwMjEzMjM1OTU5WjBrMQswCQYDVQQGEwJQ +TDEbMBkGA1UEChMST3JhbmdlIFBvbHNrYSBTLkEuMSQwIgYDVQQLExtDZW50cnVt +IENlcnR5ZmlrYWNqaSBTaWduZXQxGTAXBgNVBAMTEE9yYW5nZSBQb2xza2EgQ0Ew +ggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDBK0k4NsfaftxdL40YVvcg +hDe1goXiQMDKSy8PBQ9BBbxooeqx7Igdb+kxQUfXLU54sZ8fOhMtskvffnbBtjsw +bKR2nAknqxwEQpZuAGXuhP6oEf7Izr6C8n3qsEIhqNTG93KJodjw9Ij+2Exr/i2Y +93a/IseoqflyzHuBBf/H0Tw2TGMdo9oCFqe9Q0tBPPguIxvBANRi5YJqkm4uIVCT +ettIbOdKc7kgdwgqGEFEAtzULSnCwGqA7Hmc82afuX99Bzm4OyVksn5x/f2RkXEK +HOWP4ukRUTXzRPpq0LaAAp+Izej1xFaDgNArLytGrt+qSDQrMbn28+05B+jXSJDu +zW2c0+lApNTSw8targAchyPk/MO37ORwoI6cYMiDE7Ly4mOP+l9ZN7IPNdP+DWnW +ktWqgPqnDBKxbbV00Bg+CGVSEGGApC1I+GNHNV95KoNJEmXd3pHACipUaRGG4EHL +ws4NvL+q5ympZoLlmogDNXmK5DjoZMyR6toGL2LweBsCAwEAAaOCAcwwggHIMB8G +A1UdIwQYMBaAFJflYNyFirffCEyxsJOwJRg6UrKIMIGyBgNVHSAEgaowgacwgaQG +BFUdIAAwgZswNQYIKwYBBQUHAgEWKWh0dHBzOi8vd3d3LnNpZ25ldC5wbC9kb2Nz +L3BjX3Jvb3RjYTIucGRmMGIGCCsGAQUFBwICMFYMVENlcnR5ZmlrYXQgd3lzdGF3 +aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0eWthIENlcnR5ZmlrYWNq +aSBTaWduZXQgUm9vdCBDQTIiLjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIBBjAdBgNVHQ4EFgQUPn3mjIeXe/C311zFwSwpwqeAJtowNgYDVR0fBC8wLTAr +oCmgJ4YlaHR0cDovL2NybC5zaWduZXQucGwvYnB0cC9yb290Y2EyLmNybDB4Bggr +BgEFBQcBAQRsMGowJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwY2EyLnNpZ25ldC5w +bDBCBggrBgEFBQcwAoY2aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3NpdG9yeS9y +b290Y2Evcm9vdGNhMl9kZXIuY3J0MA0GCSqGSIb3DQEBDQUAA4ICAQAm9swq6UsC +kFM2Jbqk2XDZEi5Rt4gxAJrMQuP4OxUHFW6oyIQlybXPxqVuwwunZHtmnSPrKCxo +CtHDDEwlQa2Ezg8AOS7eE8CQ4l0BGjSRgD8MrRmtD9TKqtck2JWa2V4JgIk+FcOX +ahjhuNO6aDEfHtGdRt70P257bi+JH+1CeERW0ecJLwnI1CzIRuA8q4qTi8mWBAfq +EMaLd5nTqIfXEwplg1x0LF1QN8DzwWKKKN5varh/muI4Hqx7GOCPWxrIRqXQO/qB +hV/H+Kvhc0vF6z6NYmfQng0u2FRGcCSfZy1XbsXNF/QmfrbqYgEjZz4GZ1xsxfgI +Q37wfKaBhIgBptYcfWOHf6ddQQlk8zxKQFEycx3rXa0/yJ5555egyLMAvovmcAOY +nHtBCSNEQnePi4rnC0Jh3GOl3slFHEkTwZuFehyag95Yfq0EEI58Zd+oZPJuGVR7 +YNFWCA/c2RvWobjXFDb1gXS/ALOtpUgjh5ZD6Gu7ZIuC9v6NLJLW1WylgarHJX0f +wXzwGH+fgfYVmWfYJ1Wsi0fLoLiZLv/LkhGCAgXxxvvwNIr9TDwDG5bW11CiGmlV +QFekfBGmhK0Yp6vjRrLZXJu2vmBy/xr6X0W6JwxEC5tK8AIz2sJdXuWieqNz+jOd +p0qUsSCoEJd6ks0rwy8A92uZhq7DORO5VQ== +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIEzzCCA7egAwIBAgIEO6ocGTANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE +ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg +U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDEwOTIwMTY0MjE5WhcNMjYw +OTIxMTU0MjE5WjBxMQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v +LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRswGQYDVQQDExJDQyBTaWdu +ZXQgLSBSb290Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrr2vydnNpELfGW3Ks +ARiDhJvwDtUe4AbWev+OfMc3+vA29nX8ZmIwno3gmItjo5DbUCCRiCMq5c9epcGu+kg4a3BJChVX +REl8gVh0ST15rr3RKrSc4VgsvQzl0ZUraeQLl8JoRT5PLsUj3qwF78jUCQVckiiLVcnGfZtFCm+D +CJXliQBDMB9XFAUEiO/DtEBs0B7wJGx7lgJeJpQUcGiaOPjcJDYOk7rNAYmmD2gWeSlepufO8luU +YG/YDxTC4mqhRqfa4MnVO5dqy+ICj2UvUpHbZDB0KfGRibgBYeQP1kuqgIzJN4UqknVAJb0aMBSP +l+9k2fAUdchx1njlbdcbAgMBAAGjggFtMIIBaTAPBgNVHRMBAf8EBTADAQH/MIIBBAYDVR0gBIH8 +MIH5MIH2Bg0rBgEEAb4/AgEKAQEAMIHkMIGaBggrBgEFBQcCAjCBjRqBikNlcnR5ZmlrYXQgd3lz +dGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0eWthIENlcnR5ZmlrYWNqaSBkbGEg +Um9vdENBIi4gQ2VydHlmaWthdCB3eXN0YXdpb255IHByemV6IFJvb3RDQSB3IGhpZXJhcmNoaWkg +Q0MgU2lnbmV0LjBFBggrBgEFBQcCARY5aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3p5dG9yaXVt +L2Rva3VtZW50eS9wY19yb290Y2EudHh0MB0GA1UdDgQWBBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAf +BgNVHSMEGDAWgBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcN +AQEFBQADggEBAGnY5QmYqnnO9OqFOWZxxb25UHRnaRF6IV9aaGit5BZufZj2Tq3v8L3SgE34GOoI +cdRMMG5JEpEU4mN/Ef3oY6Eo+7HfqaPHI4KFmbDSPiK5s+wmf+bQSm0Yq5/h4ZOdcAESlLQeLSt1 +CQk2JoKQJ6pyAf6xJBgWEIlm4RXE4J3324PUiOp83kW6MDvaa1xY976WyInr4rwoLgxVl11LZeKW +ha0RJJxJgw/NyWpKG7LWCm1fglF8JH51vZNndGYq1iKtfnrIOvLZq6bzaCiZm1EurD8HE6P7pmAB +KK6o3C2OXlNfNIgwkDN/cDqk5TYsTkrpfriJPdxXBH8hQOkW89g= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFmDCCA4CgAwIBAgIIAviguJXwzEswDQYJKoZIhvcNAQENBQAwajELMAkGA1UE +BhMCUEwxGzAZBgNVBAoTEk9yYW5nZSBQb2xza2EgUy5BLjEkMCIGA1UECxMbQ2Vu +dHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRgwFgYDVQQDEw9TaWduZXQgUm9vdCBD +QTIwHhcNMjAwMjEzMTMzNDAxWhcNNDUwMjEzMTMzNDAxWjBqMQswCQYDVQQGEwJQ +TDEbMBkGA1UEChMST3JhbmdlIFBvbHNrYSBTLkEuMSQwIgYDVQQLExtDZW50cnVt +IENlcnR5ZmlrYWNqaSBTaWduZXQxGDAWBgNVBAMTD1NpZ25ldCBSb290IENBMjCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOa3R+smsx3kTtDzscXFSz/n +Ap2TjCf4An/l7f+R3e+veOVwlJDtbpZsfSTRC9bdLOMvbfFDN3BqAw/GEk9AuMtk +CmHsHWgqtoIZL/Bolka23FLRUJy87UjE2ApFn4PudTDJooaWJHS4wBU7vpRkXKk+ +OUqIxay47lIAEYb4Uerlsv91clXogCbPym/mbowfaQk9fyj1on2j4jOuomanBsw8 +GP3STCcCKEMusFGtPTu+NQGhjFdlXuDl+m3+Uu2AePUsBbh7FskEOuDZHNYCS6j8 +uG1pK1QmDHWOnWP6Bo/adBCLFJ55anTuhFoj6LHXuc1X2icjW/by80u0e4jMPUYR +vc0XShV0rTtkB0+PmsOm8SzsuZ8WLGIMpzfORUC8kHztpbbULceP4QQft/LObSmc +OSInL5c2O1oXGOI1dnbtTbdp4Cy9/tLNyzDBdhQjynuZkhwWXI/eVINYHDXAfbp/ +B9LmAl41npo6Qu/dDxOZZWFk0uPgZUJ85cs2LKNyFveCsjgn0ybuF6oMjGU0crjT +zWWpilfoO44SDo7NElnnyyboT3NCZgcYLihZuR9e1xMckN7Vh4ccm2e/NLvHfwqV +ujG81IjgIO//2EqM+uqdshDctrpgVmK34Y3RU2Is2sb2MvLEFQpOeqmQBfAeyO50 +DOKDj6bu5GimHWBs7QCPAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P +AQH/BAQDAgEGMB0GA1UdDgQWBBSX5WDchYq33whMsbCTsCUYOlKyiDANBgkqhkiG +9w0BAQ0FAAOCAgEAPcKw5tq5orY95RRYIrZcSrOuWCG8MDHhFca9wR/M2dOdGt5R +QoOXqceNXx72SWzjiK50jlJ8GPP6BiYd4Mns9ZOd+cxij4LGqLPDdXDCt1QKe5jT +6x4v8DP7vjJcSebeS97kjYSs3JhGyFddEMlSo+wQq9J7RvcIy7aG4SpK/Blh3ZVf +/9uemhbYIdKfYFVLXrQ5xEd5UDZ/IPxwAWeYCatWj1L7cAOX/PIr+oxM1IxxwubO +or+ssC6nDSC/xU1tRMbatjcKJCDt70Xa1/yr6AABcxem5nMeusc2SYE6QASCN3Wi +kL/Jw4SY4VBJaFou31aFIOmzkZqfP6hRC5Juv3PAmaKfD0w5Z+igWRb9jaMGUceu +zzngNa9WOjhFyA7PvzeMhYhrdtgJT76UyUK1muBjD+tzNA5nYXSnqMTsy5b40Jv0 +BJbpdvR3IgrItjrI7/g5wB3nocvQhHCjPo9NsG7+dc+u5u654ONWJolP/ZoNXOlJ +1NGzcVwGuiB55+t/8KQbSQiXoqx0qr2qwEdsrrVmXsCDVhbVEXfsnnlXdml0RkAG +aLYl/lFO/HM05gXS0bwTuFzlK0yjrThLDavqhLXBjzRdcZdtnDRfauRmsYK5IRsL +EGZbMXDuIWJeeMlvZbf9JtJ1UE6GUnUmgj9E6IsFqQC3fBVBHpyhh7XlEjc= +-----END CERTIFICATE----- diff --git a/debian-pkg/yourdev-session-pki_1.0_all/usr/lib/yourdev-session-pki/pkinit-auth.sh b/debian-pkg/yourdev-session-pki_1.0_all/usr/lib/yourdev-session-pki/pkinit-auth.sh new file mode 100755 index 0000000..ffe36bf --- /dev/null +++ b/debian-pkg/yourdev-session-pki_1.0_all/usr/lib/yourdev-session-pki/pkinit-auth.sh @@ -0,0 +1,51 @@ +#!/bin/sh + +# pkinit-auth.sh - Called by pam_exec.so expose_authtok +# Reads PIN from stdin, runs kinit with PKINIT to get TGT. +# If PAM_USER is empty, extracts UID from certificate on token. + +MODULE=/usr/lib/libeToken.so +REALM=AD.FRANCETELECOM.FR + +# Read PIN from stdin (passed by pam_exec expose_authtok) +read -r PIN || true + +# Get username from PAM, or extract from certificate on token +USER="${PAM_USER}" +if [ -z "${USER}" ]; then + # Try reading the auth cert (public object, may work without PIN) + for SLOT in 0 1 2; do + RAW=$(pkcs11-tool --module "${MODULE}" --slot ${SLOT} --read-object --type cert --id 61757468 2>/dev/null) + if [ -n "${RAW}" ]; then + USER=$(echo "${RAW}" | openssl x509 -subject -noout 2>/dev/null | \ + sed 's/.*UID *= *\([^,]*\).*/\1/' | tr '[:upper:]' '[:lower:]') + [ -n "${USER}" ] && break + fi + done +fi + +if [ -z "${USER}" ]; then + logger -t pkinit-auth "ERROR: cannot determine username" + exit 1 +fi + +# Check if token is connected +if ! p11tool --list-tokens 2>/dev/null | grep -q "libeToken"; then + logger -t pkinit-auth "No token detected, fallback to password" + exit 1 +fi + +logger -t pkinit-auth "PKINIT attempt for ${USER}@${REALM}" + +# Attempt kinit via PKINIT with the PIN +echo "${PIN}" | kinit -X "X509_user_identity=PKCS11:${MODULE}:certid=61757468" \ + "${USER}@${REALM}" 2>/dev/null + +RESULT=$? +if [ ${RESULT} -eq 0 ]; then + logger -t pkinit-auth "SUCCESS: TGT obtained for ${USER}" + exit 0 +fi + +logger -t pkinit-auth "FAILED (exit ${RESULT}), fallback to password" +exit 1 diff --git a/docs/01-smartcard b/docs/01-smartcard new file mode 100644 index 0000000..8070286 --- /dev/null +++ b/docs/01-smartcard @@ -0,0 +1,2 @@ +[org/gnome/login-screen] +enable-smartcard-authentication=false