tmzf5455/yourdev-session-pki
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit: yourdev-session-pki package

Browse Source 
Debian package for PKI-based session authentication with Orange AD.
- Direct PKINIT auth via pam_exec + kinit (bypasses SSSD certmap)
- GDM smartcard login with SafeNet eToken / Thales
- Automatic Kerberos TGT via PKINIT
- Compatible with orange-yourdev-login package
This commit is contained in:
Tallagrand Thierry
2026-05-15 18:54:50 +02:00
commit 8686a76b06
12 changed files with 755 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
.gitignore vendored Executable file
View File

@@ -0,0 +1,19 @@
# Build artifacts
*.deb
# OS files
.DS_Store
Thumbs.db
# Debug diagnostics (may contain sensitive data like PINs)
docs/diagnostics/
docs/*.conf
docs/*.pem
# Editor temp files
*~
*.swp
*.swo
# Logs (keep docs/ structure but ignore individual logs from root)
*.log

5
debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/conffiles Normal file
View File

@@ -0,0 +1,5 @@
/etc/krb5.conf
/etc/pam.d/gdm-smartcard-pkinit
/etc/sssd/pki/sssd_auth_ca_db.pem
/etc/sssd/conf.d/yourdev-smartcard.conf
/etc/dconf/db/gdm.d/02-smartcard-enable

15
debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/control Normal file
View File

@@ -0,0 +1,15 @@
Package: yourdev-session-pki
Version: 1.0.0
Architecture: all
Maintainer: Tallagrand Thierry <thierry.tallagrand@orange.com>
Installed-Size: 128
Depends: sssd, sssd-krb5, krb5-user, libpam-sss, opensc, p11-kit, openssl, ca-certificates, dconf-cli, libpam-modules
Recommends: gdm3, gnome-keyring, pinentry-gnome3
Section: admin
Priority: optional
Homepage: https://ad.francetelecom.fr
Description: YourDev PKI-based session authentication for Orange AD
Configure SSSD, Kerberos (PKINIT), and PAM for smartcard
(Safenet eToken / Thales) and password-based login with
automatic Kerberos ticket (TGT) generation via AD.FRANCETELECOM.FR.
Supports GDM, SSH, and console login with both methods.

60
debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/postinst Executable file
View File

@@ -0,0 +1,60 @@
#!/bin/sh
set -e
case "$1" in
configure)
# Remove any certmap we previously added to sssd.conf
if [ -f /etc/sssd/sssd.conf ]; then
sed -i '/### certmap tmzf5455 yourdev-session-pki/d' /etc/sssd/sssd.conf 2>/dev/null || true
sed -i '/^\[certmap\/ad\.francetelecom\.fr\/tmzf5455\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
sed -i '/^\[certmap\/ad\.francetelecom\.fr\]/,/^$/d' /etc/sssd/sssd.conf 2>/dev/null || true
fi
# Disable our old pam-auth-update profile (try_cert_auth approach)
if command -v pam-auth-update >/dev/null 2>&1; then
pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true
fi
# Register our new GDM smartcard PAM service as the GDM alternative
if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then
update-alternatives --install /etc/pam.d/gdm-smartcard gdm-smartcard \
/etc/pam.d/gdm-smartcard-pkinit 60 2>/dev/null || true
update-alternatives --set gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true
fi
# Ensure SSSD CA bundle permissions
if [ -f /etc/sssd/pki/sssd_auth_ca_db.pem ]; then
chown root:sssd /etc/sssd/pki/sssd_auth_ca_db.pem 2>/dev/null || true
fi
# Ensure conf.d permissions
for f in /etc/sssd/conf.d/*.conf; do
[ -f "$f" ] && chown root:sssd "$f" 2>/dev/null && chmod 0640 "$f" 2>/dev/null || true
done
if [ -f /etc/sssd/sssd.conf ]; then
chown root:sssd /etc/sssd/sssd.conf 2>/dev/null || true
chmod 0600 /etc/sssd/sssd.conf 2>/dev/null || true
fi
# Compile dconf database for GDM smartcard setting
if command -v dconf >/dev/null 2>&1; then
dconf update 2>/dev/null || true
fi
# Restart SSSD
if command -v systemctl >/dev/null 2>&1; then
systemctl restart sssd 2>/dev/null || true
fi
;;
abort-upgrade|abort-remove|abort-deconfigure)
;;
*)
echo "postinst called with unknown argument '$1'" >&2
exit 1
;;
esac
exit 0

36
debian-pkg/yourdev-session-pki_1.0_all/DEBIAN/prerm Executable file
View File

@@ -0,0 +1,36 @@
#!/bin/sh
set -e
case "$1" in
remove|purge)
# Remove our GDM smartcard PAM alternative
if [ -f /etc/pam.d/gdm-smartcard-pkinit ]; then
update-alternatives --remove gdm-smartcard /etc/pam.d/gdm-smartcard-pkinit 2>/dev/null || true
fi
# Remove our old pam-auth-update profile if lingering
if command -v pam-auth-update >/dev/null 2>&1; then
pam-auth-update --package --remove yourdev-smartcard 2>/dev/null || true
fi
# Recompile dconf after removing our override
if command -v dconf >/dev/null 2>&1; then
dconf update 2>/dev/null || true
fi
# Restart SSSD
if command -v systemctl >/dev/null 2>&1; then
systemctl restart sssd 2>/dev/null || true
fi
;;
upgrade|failed-upgrade)
;;
*)
echo "prerm called with unknown argument '$1'" >&2
exit 1
;;
esac
exit 0

2
debian-pkg/yourdev-session-pki_1.0_all/etc/dconf/db/gdm.d/02-smartcard-enable Normal file
View File

@@ -0,0 +1,2 @@
[org/gnome/login-screen]
enable-smartcard-authentication=true

50
debian-pkg/yourdev-session-pki_1.0_all/etc/krb5.conf Normal file
View File

@@ -0,0 +1,50 @@
[libdefaults]
default_realm = AD.FRANCETELECOM.FR
kdc_timesync = 1
ccache_type = 4
default_ccache_name = FILE:/tmp/krb5cc_%{uid}
forwardable = true
proxiable = true
rdns = false
ignore_acceptor_hostname = true
dns_lookup_kdc = false
dns_lookup_realm = false
udp_preference_limit = 1
fcc-mit-ticketflags = true
[realms]
AD.FRANCETELECOM.FR = {
kdc = opadya31.bagnolet.francetelecom.fr
kdc = sfebuo31.intranet-paris.francetelecom.fr
kdc = opadyx51.rouen.francetelecom.fr
kdc = sfebua31.bagnolet.francetelecom.fr
kdc = opadyx81.rouen.francetelecom.fr
kpasswd_server = opadya31.bagnolet.francetelecom.fr
kpasswd_server = sfebuo31.intranet-paris.francetelecom.fr
kpasswd_server = opadyx51.rouen.francetelecom.fr
kpasswd_server = sfebua31.bagnolet.francetelecom.fr
kpasswd_server = opadyx81.rouen.francetelecom.fr
pkinit_anchors = DIR:/usr/share/ca-certificates/orange
pkinit_identities = PKCS11:/usr/lib/libeToken.so:certid=61757468
pkinit_eku_checking = none
pkinit_kdc_hostname = opadya31.bagnolet.francetelecom.fr
pkinit_kdc_hostname = sfebuo31.intranet-paris.francetelecom.fr
pkinit_kdc_hostname = opadyx51.rouen.francetelecom.fr
pkinit_kdc_hostname = sfebua31.bagnolet.francetelecom.fr
pkinit_kdc_hostname = opadyx81.rouen.francetelecom.fr
pkinit_kdc_hostname = vipadyappli.itn.intraorange
}
[domain_realm]
.ad.francetelecom.fr = AD.FRANCETELECOM.FR
ad.francetelecom.fr = AD.FRANCETELECOM.FR

21
debian-pkg/yourdev-session-pki_1.0_all/etc/pam.d/gdm-smartcard-pkinit Executable file
View File

@@ -0,0 +1,21 @@
#%PAM-1.0
# GDM smartcard PAM service using direct PKINIT via pam_exec + kinit
# Bypasses SSSD certmap. Falls back to common-auth (password) if
# no smartcard or PKINIT fails.
auth [success=done default=ignore] pam_exec.so expose_authtok /usr/lib/yourdev-session-pki/pkinit-auth.sh
auth substack common-auth
auth requisite pam_nologin.so
auth optional pam_gnome_keyring.so
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required pam_loginuid.so
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
session optional pam_keyinit.so force revoke
session required pam_limits.so
session required pam_env.so readenv=1
session required pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
@include common-session
session optional pam_gnome_keyring.so auto_start
@include common-password

17
debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/conf.d/yourdev-smartcard.conf Normal file
View File

@@ -0,0 +1,17 @@
# Smartcard auth is handled by pam_exec + kinit (PKINIT) directly,
# bypassing SSSD certmap (which proved unreliable with SafeNet
# tokens having multiple certs). See gdm-smartcard-pkinit PAM service.
# SSSD is only used for password auth and NSS user lookups.
[pam]
pam_cert_auth = false
pam_cert_db_path = /etc/sssd/pki/sssd_auth_ca_db.pem
p11_child_timeout = 60
offline_credentials_expiration = 0
[domain/ad.francetelecom.fr]
local_auth_policy = enable:smartcard
access_provider = permit
krb5_validate = false
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U

477
debian-pkg/yourdev-session-pki_1.0_all/etc/sssd/pki/sssd_auth_ca_db.pem Normal file
View File

@@ -0,0 +1,477 @@
-----BEGIN CERTIFICATE-----
MIIE+zCCA+OgAwIBAgIIBGg2MTPB7kMwDQYJKoZIhvcNAQELBQAwcTELMAkGA1UE
BhMCUEwxHzAdBgNVBAoMFlRlbGVrb211bmlrYWNqYSBQb2xza2ExJzAlBgNVBAsM
HlNpZ25ldCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEYMBYGA1UEAwwPU2lnbmV0
IC0gUm9vdENBMB4XDTIxMTEwNTEzMzAwNloXDTI3MTEwNTIzNTk1OVowfjELMAkG
A1UEBhMCUEwxJTAjBgNVBAoTHEdydXBhIFRFTEVLT01VTklLQUNKQSBQT0xTS0Ex
JDAiBgNVBAsTG0NlbnRydW0gQ2VydHlmaWthY2ppIFNpZ25ldDEiMCAGA1UECxMZ
Q0EgVEVMRUtPTVVOSUtBQ0pBIFBPTFNLQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALk4AMc6KJs69f7/kE84kLJ76yuvRY45v2AmaPE5OE+SF5zMCgqm
KbyRNtXJ1U6Bg7N9D0GgrxFMxsjN13Vy1X+E78PV9H7jphS2V7UaARs5oWwi3Zsg
ni5vH4TAHfiXk9bx2GE2o2UbMUFVbdpNLITykTjd4UtdL5qAieecunEo0Fm2tczN
oklb8jvZ3R+7A6qJdTHAs8CAFL0Ilm0Ts5sX7spN6gLCYnsIBi524oNNcfbpUp5D
pAYbxoaPHCZSmpZ2sucfTQbiPVVSN+TR0Z+H2YrwQNZ9BbG6+kv2+klUc/yLu0G5
qH4wskSeGFPSvCjibtZnl/peCIi2UEXBXeMCAwEAAaOCAYgwggGEMB8GA1UdIwQY
MBaAFGwXuoQSQgNAo9RaDV24X5aAOHuYMIHpBgNVHSAEgeEwgd4wgdsGBFUdIAAw
gdIwgZYGCCsGAQUFBwICMIGJDIGGQ2VydHlmaWthdCB3eXN0YXdpb255IHpnb2Ru
aWUgeiBkb2t1bWVudGVtOiAiUG9saXR5a2EgQ2VydHlmaWthY2ppIFJvb3RDQSIu
IENlcnR5ZmlrYXQgd3lzdGF3aW9ueSBwcnpleiBSb290Q0EgdyBoaWVyYXJjaGlp
IENDIFNpZ25ldC4wNwYIKwYBBQUHAgEWK2h0dHA6Ly93d3cuc2lnbmV0LnBsL2Rv
Y3MvcGNfcm9vdGNhXzFfMi5wZGYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
BAMCAQYwHQYDVR0OBBYEFALuPOxcqUP1A0iWe9LOJVkfMF8/MDUGA1UdHwQuMCww
KqAooCaGJGh0dHA6Ly9jcmwuc2lnbmV0LnBsL2JwdHAvcm9vdGNhLmNybDANBgkq
hkiG9w0BAQsFAAOCAQEAoLdEVqDQ/YQo9kD/IFczT02GDqfF/5hh32NeTxYSQBT9
nbBgHYi62oZeDfj2klaJql81fQ13o7TwXSSLgcgucC5LQbT8b+2NuuB7fDL2VPVG
YPFTRzX7QTgwljOQ6LbfdE+gkwj9qLY1l2PUyezr8jl4oCP6zSkTRQbk4MmHxj41
nUWgytLfftA1zj3qKG3B15Z/EclHviabYxR1ZcbQDR7fjYI/Vo2MChdRkR017kn9
SaiP2HAZRR0bF8+x3XBQLJxdiRuZ+MjHs9U6uI9pi53xqgYfJyn3wGWFenyT8tDp
i7x8TXRplDLc+6iaiPIv+mBckYE7ifEB/WWgkGh0cA==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE3DCCA8SgAwIBAgIBBjANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa
MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5
ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0x
MTA2MDgxMTQ3MjRaFw0zMTA2MDgxMTQ3MjRaMHExCzAJBgNVBAYTAkZSMRowGAYD
VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx
LTArBgNVBAMMJEdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQTEtNDCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMS2+MMff2qJUBNpEW1kW7B1
hWrYfFX7BZzQ4MCJ2BOY9H9BC3D+vkYE2VT5kfECK1ed5Uc8zHZZbEY2x+7Ijds/
17roYe3C7KQH/h1bgn1RdRi3Fbo6wUfND4SUhwoSX++5VDG6QNNFGRoV8RyLMjPF
8+4Zoj6Y+Y9Q6KVcgqgqg4CJtl+ZIZj0EwYoRHtEqrO36fwJFGCfP0rmywY+FFHw
dzBxT1SSWSA5nQwVzOtgLG2DQrxfnjjTmRau3Y2zsqE+OI6dHEskH6mFm1PHKEDZ
aA+sBb6KNbxw9pZC6JbjBnLl1SZblNDq/Beog0/asb4lyvtKSDDdTlkGFLz2/PUC
AwEAAaOCAYQwggGAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G
A1UdDgQWBBTPPQy3A4PB4UPbBUmalZ1EcghgxDB0BgNVHSMEbTBrgBQaklPIzzMb
tvKlYH3iryQSQbCaYKFQgU5DTj1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBD
QSwgT1U9MDAwMiAzODAxMjk4NjYsIE89RnJhbmNlIFRlbGVjb20gU0EsIEM9RlKC
AQAwfAYDVR0fBHUwczAzoDGgL4YtaHR0cDovL3BraS1jcmwuaXRuLmZ0Z3JvdXAv
Y3JsL2lnY2dmdF9yY2EuY3JsMDygOqA4hjZodHRwOi8vaWdjZ2Z0LXJjYS5mcmFu
Y2V0ZWxlY29tLmNvbS9jcmwvaWdjZ2Z0X3JjYS5jcmwwSgYDVR0gBEMwQTA/Bgcq
gXoBEAwCMDQwMgYIKwYBBQUHAgEWJmh0dHA6Ly9pZ2NnZnQtcmNhLmZyYW5jZXRl
bGVjb20uY29tL3BjMA0GCSqGSIb3DQEBBQUAA4IBAQAbkqwmpM7EngYTEHUdyRlv
RUO2RxNk8+D8YklwWOd5XNnMa7jvXtP1hcV7FxwyoNssI8iEROg1EnQmVemBKSEj
eWvyg9wcwUWcSOPjPke77Qi1k8pUOwz33Q3fwtlITz4Y3vd1/yu6O8SsKgA4Azui
QVZc7SxsKnGQZ4mXmiSkTCGX0q6f8fEWoa7l+qlMTBfH7GAq0JukecO5azXl2lhV
OvF1c7JMtMoK0sATwyf4UFJ2e9Vn6wHiz6FDLVE5mLG4Dh1NnwABBm3QKyy/xGnc
C8/x4/Kgg29uMi968M7Vwr9G5PYY0pDa+NA0GOYnwvlsIlW88mFwvd9gNw0m5weB
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDxzCCAq+gAwIBAgIBADANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa
MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5
ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w
NTExMTQxMjM0MDZaFw0zNTExMTQxMjM0MDZaMGoxCzAJBgNVBAYTAkZSMRowGAYD
VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx
JjAkBgNVBAMMHUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBSb290IENBMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtA8YdZv14dIsqPCqFCrNFWnqO3LOXcvu
KB0MzwqqSx3uzBy+OEqDHePhs421ugmFQH/RfAnylCxGfdYIVlgJYu6ZEh/+afOn
Nh1EnWVMXcaPlD7gHW7Ij3ucQB89+dM/6JqyzmwBi+iuo5aMGpFir3O0JHWaLsqw
BsKWT28G3N/q29Wg1Ed4AFGmYxcMKfFrZ2z6JF3k47iK49RiYqBeqlAoxrd7UIGl
kucy+2fAD1oYPBmC0oSMIfFYRharnMFtCWpUJq5/wPej3Pcmrw/jvRFKsjak4e6S
WYtXf3vlQQIh+PTUp7sNp0us+wPf6+uHtlPYXKRlF35jxBTNKwv/uQIDAQABo3gw
djAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUGpJT
yM8zG7bypWB94q8kEkGwmmAwHwYDVR0jBBgwFoAUGpJTyM8zG7bypWB94q8kEkGw
mmAwEwYDVR0gBAwwCjAIBgYqgXoBEAwwDQYJKoZIhvcNAQEFBQADggEBAIMRzhkM
gV5pABMVzwM6K6eH7z2SEvNxYKtX/vsTfMak0siH6CezmtJ9aXymUZ2fLeZW8yfv
kAfn/0MuD7nbsVW3xGS45w+/SWwlpPDCv1zTtFbX3tYfAUyQSgk7k70y0XzSQKqb
3oNyIScC3wtGULozZNcbmF6q07GmzwqrIekOO2/ZIXYNBIy1V9cS6s9kVsS0Rp7L
fri2nErebYWADZJFljznbgizwWidKaDqVLDzBj8/QtXCs7SukkJPKLwEm5nkJ3F/
mJTKzNRwM8loENOfD+ntUc6VLtdaU0GaIVbAGGVtm7UBr6OmFEmtwn9/zBQPt1fz
x3LOxGxVqztwfdw=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE4DCCA8igAwIBAgIBAjANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa
MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5
ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w
NjA5MDUxMjU0MDFaFw0yNjA5MDUxMjU0MDFaMIGYMQswCQYDVQQGEwJGUjEaMBgG
A1UECgwRRnJhbmNlIFRlbGVjb20gU0ExJDAiBgNVBAsMG1dlc3Rlcm5FVSBNaWRk
bGVFYXN0IEFmcmljYTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYxLjAsBgNVBAMM
JUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxLTIwggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7n/lycHAbcwyCiqlzIum+iQRPFi38CCrU
ifOX6DJUrKzGzhCQQ4MjODrLwloR7QhC2i4lKFX2y9xjziIRc2a1uw4PiLIqMgm4
PLVfZiIuXWgjz8/wGMjOax9GnqZ1pHbmJd1O7Rklzyyqre87DYtnF8BlEJf+dMh5
YjC8MnjayGtF2hDR9LBSNU7ZXpKDyn1HpkuGj5CMo92K4dzUEw3qvopnr+uY9YqD
zNwcLwyWEYCWUgSr9r1Cz8HCmP/8DTTBPcTBsrAV93ybVNs1ZFcfHraJL8nkJzJU
JcIjX6iAhiDSvU/qg+F1fEkjIJ+GkawbM+/h4mouKnCa/xGmptVxAgMBAAGjggFg
MIIBXDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU
PgLTDgmJZoDWzj29s+hrBk37H+gwdAYDVR0jBG0wa4AUGpJTyM8zG7bypWB94q8k
EkGwmmChUIFOQ049R3JvdXBlIEZyYW5jZSBUZWxlY29tIFJvb3QgQ0EsIE9VPTAw
MDIgMzgwMTI5ODY2LCBPPUZyYW5jZSBUZWxlY29tIFNBLCBDPUZSggEAMIGOBgNV
HR8EgYYwgYMwQ6BBoD+GPWh0dHA6Ly9pZ2NnZnQtcmNhLWh0dHAuc2kuZnJhbmNl
dGVsZWNvbS5mci9jcmwvaWdjZ2Z0X3JjYS5jcmwwPKA6oDiGNmh0dHA6Ly9pZ2Nn
ZnQtcmNhLmZyYW5jZXRlbGVjb20uY29tL2NybC9pZ2NnZnRfcmNhLmNybDATBgNV
HSAEDDAKMAgGBiqBegEQDDANBgkqhkiG9w0BAQUFAAOCAQEAPGchIGG+ri3/9RvN
EbtZ60WiCMLs5lwJx2TVp6FwXH8EEX/fwfNR3rlPDXC79er9xFBR1TqbFVD5+NA3
uURRqH7Y4sKrySGIXbkYZaXUm82r6cmTiWGW2Esc2X39MFp4LrWRXro5JwoYkr05
So5lc/gOBvBSZtMJutCUPSBwypSy6eapEjHdQZRc3vXNnjxiTkDOtYICoqWlyb4G
/m0wixZitwX5HfpzbKw/2ezrIFnfzlqCuKVPwgNYGss1mCPUmdHQgbEUyNPe4Hpz
dWg3xTXVhaHgT8vgWHMuQQnKeMKrjrZH10BhOoxO4qjLlmlzmR5DpTgmo17ZeFtv
xrWCTQ==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEujCCA6KgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa
MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5
ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w
ODAzMjcxMjI3MTZaFw0yODAzMjcxMjI3MTZaMHIxCzAJBgNVBAYTAkZSMRowGAYD
VQQKDBFGcmFuY2UgVGVsZWNvbSBTQTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYx
LjAsBgNVBAMMJUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxLTMw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4e9io9+N6GaAulogpA4a/
qr8RwlzIJuSaIkh/F1yEBPP/djcRmwSlWDSFtTGAp70+KuVK5Wpvnv3+7GKXRo31
dTEvqLpOxVHqdw43aSR7pn3IZtD854QLMj18YtBgtQJ1GfrZB3M6Ugn1vsWwlrqq
8PCr6axDBSlifteYKq71liI598vfvEvV/5zdq2+NiiQZ7qQCCNnFAIByesdfV0wi
yPDhdf/X3YI67v7sCONeX/BR+CPGz+BSAOSSCH8ZdrHuS223LMnvQdk0kCb9jS9v
a793odL9rQftatnZe7y3v2jc9B3CzKLCctqiArTCA4hg4ojrBDhQpzawl1UBN3EV
AgMBAAGjggFhMIIBXTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd
BgNVHQ4EFgQUVQAWKPzeE+CJ5b2mNy8Gsem4SwkwdAYDVR0jBG0wa4AUGpJTyM8z
G7bypWB94q8kEkGwmmChUIFOQ049R3JvdXBlIEZyYW5jZSBUZWxlY29tIFJvb3Qg
Q0EsIE9VPTAwMDIgMzgwMTI5ODY2LCBPPUZyYW5jZSBUZWxlY29tIFNBLCBDPUZS
ggEAMIGOBgNVHR8EgYYwgYMwQ6BBoD+GPWh0dHA6Ly9pZ2NnZnQtcmNhLWh0dHAu
c2kuZnJhbmNldGVsZWNvbS5mci9jcmwvaWdjZ2Z0X3JjYS5jcmwwPKA6oDiGNmh0
dHA6Ly9pZ2NnZnQtcmNhLmZyYW5jZXRlbGVjb20uY29tL2NybC9pZ2NnZnRfcmNh
LmNybDAUBgNVHSAEDTALMAkGByqBegEQDAIwDQYJKoZIhvcNAQEFBQADggEBAB7O
+qftsm5TDoJriHAAIYcKWtdbrh3cfDziaCV5QI9MF/LSIgzikisr4nqCKYJLXrMH
EZxH6EsgvSnsBpGLvc7n/6ClZhaaRt5sljCxB+vMlHA2rzw3y1RiqXuHB5vRvT0X
aCqkwON39uepQi/WzZyjBUFwEma1xHO4awilcjrW6JvNJ2b182+DR09xU7LZBk/C
ilLMA+8TpkBKBMBiviyz/L59n5+3baQwBtQs9gcA9gE5d67/sA/w7Zv5FBYTJWw1
ayEkYjrC2MB+skbQEGfg3Br04HGqoJ+wRFxP/V6G0i1an83g9W2gzEkEbWj+JY15
6soOCd9jtEq6BSQhgaw=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE3jCCA8agAwIBAgIBATANBgkqhkiG9w0BAQUFADBqMQswCQYDVQQGEwJGUjEa
MBgGA1UECgwRRnJhbmNlIFRlbGVjb20gU0ExFzAVBgNVBAsMDjAwMDIgMzgwMTI5
ODY2MSYwJAYDVQQDDB1Hcm91cGUgRnJhbmNlIFRlbGVjb20gUm9vdCBDQTAeFw0w
NTExMTcxMTA5MzlaFw0yNTExMTcxMTA5MzlaMIGWMQswCQYDVQQGEwJGUjEaMBgG
A1UECgwRRnJhbmNlIFRlbGVjb20gU0ExJDAiBgNVBAsMG1dlc3Rlcm5FVSBNaWRk
bGVFYXN0IEFmcmljYTEXMBUGA1UECwwOMDAwMiAzODAxMjk4NjYxLDAqBgNVBAMM
I0dyb3VwZSBGcmFuY2UgVGVsZWNvbSBJbnRlcm5hbCBDQSAxMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsPMrb/9/950vF5H63795Vqp8uBndVfHlTk+w
dFsXyTKn1j27tGqHOFknEYaiIQB+tRpn2un9wFavqNz6bYyeOfZDKfwAmnkafAxc
1u4jRZv0H3ZPNVfXVS1x7G2MFlN+94/5LMdUpppN77KuH1mqXgDi33bO9CjuEVj/
2FUpjqwBVTIqleJfX+mvhvC69rTmZFml/t729xxOpgxt5Wt2OlQ6VaYqEq8+tSj2
/KS8joO07oYSMTikzTXnxHA8BSsfc31SWsfjx4+sxmxc3RhDFnscBkot0l5IAFev
wiTbQhx1xNjqa1nN9CYgmNfBpLz60YDtVwUqsdMQyGpvlqRIfwIDAQABo4IBYDCC
AVwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDYc
M2fTE1z6W5/qi7pEZnRG8Xd4MHQGA1UdIwRtMGuAFBqSU8jPMxu28qVgfeKvJBJB
sJpgoVCBTkNOPUdyb3VwZSBGcmFuY2UgVGVsZWNvbSBSb290IENBLCBPVT0wMDAy
IDM4MDEyOTg2NiwgTz1GcmFuY2UgVGVsZWNvbSBTQSwgQz1GUoIBADCBjgYDVR0f
BIGGMIGDMEOgQaA/hj1odHRwOi8vaWdjZ2Z0LXJjYS1odHRwLnNpLmZyYW5jZXRl
bGVjb20uZnIvY3JsL2lnY2dmdF9yY2EuY3JsMDygOqA4hjZodHRwOi8vaWdjZ2Z0
LXJjYS5mcmFuY2V0ZWxlY29tLmNvbS9jcmwvaWdjZ2Z0X3JjYS5jcmwwEwYDVR0g
BAwwCjAIBgYqgXoBEAwwDQYJKoZIhvcNAQEFBQADggEBAJbffeIqjhQ2R/8EHw1O
hENVtQf8bP5N8cAbgWYItzUVr72/CoX6DlTsnrqDta+NO9o6PwBQ6Yb4sTfBGYka
fpbqmV0BFxGh62Y8EcnQrlA8Iz0JMAPw1OTc1p9BaylkSLLUGvzAXDfcZ4ms7ONQ
a96Dc5ZFGwMrj9rNxkYubhae1VeWOXVPJanaC5xP07gVdCxXa3tFjnTOwqFlajZa
3m+/85ritv83yyGqtkCHFiDrpaoiFtccRVsXNCWYvKe6lc78rEtPvMHr4KHn5LNz
x6FDBGiBwqaEjgteCUpCglblDDwb7vn7T2rCfjUM9Y1G29JI1JKRp6t9xoCzy0r7
CuU=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFsDCCA5igAwIBAgIBADANBgkqhkiG9w0BAQ0FADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE2MDUwMjExMzgwN1oX
DTQxMDUwMjExMzgwN1owXTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSMwIQYDVQQDDBpPcmFuZ2UgSW50ZXJu
YWwgRzIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOCL
6xok2VzVyHsl9RucKjtEALfI1Cx9uu1AbflfsVP4YEpOHtDW4yfr39uSB9NvjVRJ
8LPteLbsuCHaaDM6D4urluhjS73C2vorMEElgCCG1sjHa0pXDLVG7H9CegqlyZtn
vbzquJbYsCZaywBYx4pVoe0JvPJKI7/nvE2IdI0Ue9Pr4v0nUiJhzZG1S04mDw4E
MlTvW60lFLqnqXDA0itIJfpAwbAFqw1xsvFxXBnC/vUUbQctOi7je8YC/p5w0aoJ
o2wGkgDw2bGpO1VaeyfxTtyf41RUC2wuV9bO2vhV1aWf0vp59zybMlL/pMTmiaoa
rVQr8aE/RGujn/mMqzT4JVmiCmD5bPy2OVKJnch7L/RNI/LropF17lPzpXboqk8M
2K2+T7AxIJ0voanaxPXdZFElhxCg/XW04OaVrN4dO1x3njjR2MNizFhe79NZ7LEd
efltcg11IXC6dKtCgs0/GLu6I6nYuSLRq6N5nwAs017IJw1RSFT2SYS6g6JjiAT+
mr3dqXBSsNwRBug8oPxm82VNUHNcj/LqNYr8EEDqICd8PtRbEA6pSXMzxqO2zcRE
DprWOUpL47Y5CKpcG5R+stezHgXM8ArsmT2A05+CQ3vey6pp/10q80gZ11iJDIqv
GVVQvcvBqQ+0Eo2Rr5Kv9lPbzIvshxr6gSeEHo8nAgMBAAGjezB5MA8GA1UdEwEB
/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTGON+k2onDjBtKS2UH
Ja+z1LZHgjAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z1LZHgjAWBgNVHSAE
DzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQ0FAAOCAgEAHm5FZlDv+2pzV7f4
hfEDYWwFn2Lbqyn/Y8BsiyfvTX11AYOw41OeFLrk3FFM6+iLb14DXQcTwHjBux+2
htH4T3jyPeBmsnRzuxsb61TqYO1TnId8zzroyPTT+MHABmETyUf9uuSispNgJJXk
YYxpVPVLUZNtSuoDuVkjHJOQ0NRTB+1XzfShuSwI4vtttlhRg6qVvgjnyP2tR8BY
wkHWI+iHM8VUwoZYIyk3zRbFTdqWEyebUAm2aJ7LguroMTZ71ZxvD/LJfHybj8Hb
rm2Tk+Dq5gvBiggfgs23lx2uWBJbMa8F7I7JH/+YsvwXmlQSkDPDcUopKestiKVb
fAhY1NRDqMlwkOLLrGxPjAKCDYwVkxz0pkLnWDiDRNpLlDpJ6x3+dOX34vi+K3dq
wl73JXdXo4NEXswVsVM8fD+cdHluS74pemMf/7olUfd60YYC+6RwQRyP/4I0WaNs
6D4B8R3rc/X1obgvx6NfF55mFEwW3yhxRLjux5sYEBfkT8tTllVcRUwJCQumLUS9
rnrCMsDkBfI/ZN+ITBcWi6cAyOcsIOk4up9aUvNJTMKUlEybDNN8cDp9+vLonN2h
YMg1IfJ+IZs6x3rDr5MXuWTks34hEJidpmOTmOyy/QPHCK0BGRmUoYJr4CHS4FL2
BtsnCPyUUO4gppjywfYrotQ2gTQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGPTCCBCWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE2MDUwMzEzMjA0NFoX
DTM2MDUwMzEzMjA0NFowXzELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSUwIwYDVQQDDBxPcmFuZ2UgSW50ZXJu
YWwgRzIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
mPYx/p4jDiGaWI25AolfgwC2p/fI209Jjx++FfKnFb9OfFC66Wuny2ziA+2uuPXW
OI118DGfhfS45dyf/BYo2v70kMiIvZI1FN5pcaCDpYSTxGmWxcaiVm8BIzFIT7HQ
gK61jYeJrsTrzoUYAgZVnF+pZZgb04Sy+SdVctNWVKKuXfx59XiXqpq2WSwULb8Z
lYHsFWUkjJxpaPYYzth1BPoxbYdTcf2alyoCsphDuKySMkClDSFWqAZVXJmdAQ2H
wEUvgLt7cpAYCPXas+9VOceTIG8XAZu53goML52l7ueHqY435ZCOeZOLFqmNUEGY
9zV1K/4jJDyo0K5/K6xzcgRgs1KyWjT/2lJAsEG7j7P1r1KtYpjZy1860JB9nM8w
YP0O6sKlHod2jCQObAznrKRNnYUUGYlkdXp/M6MejSPrQtoua/NtSn5h9FBHymvw
GBYtljx3srsQTO6pwxE653h/4QouIZ3Kf7Twmw6CLS53ZsleplpBcZ4zm6K68Do/
8ZRvfnIr1hk980LmIzf4aevALx/eCVB4HzspzOVq8CExCVg5BXdV4j9BSHmH6rV8
PYAMdxXLzyt9uWMOVgQjJnWg4q6H8RcjJ/1NkAGoCOgFuaJu0f/jSyokfHr3Crio
FZ7zpZ67cs7Dyz4ZfsEDV1om7WjsiQzR4tZSp6swXXMCAwEAAaOCAQQwggEAMA8G
A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS8PeSkx7yL
MQtV4sMHoqL429e7cDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z1LZHgjCB
hAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3JvdXAvY3Js
L29yYW5nZWludGVybmFsZzItcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9wa2kub3Jh
bmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMi1yb290LmNybDAWBgNVHSAEDzAN
MAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEAQzrAaBHlbm8sFTNaLCm9
0imjsDrpCriwTAV3sxaFMXxuoQOIN7frc+tulEq1ATZNicbiRqHJq9BnIc1MGu/A
hzxvFMBAjBnj8/wqAY0GsFr52axYQHwgANs9OIuSw8oz3/z1/6T/42JtK+WlIS/r
malTSJqa2CEe/fRVQJp5YcO0U1mIVHatcMq7Z9YVY6K8A7hb7qSs7GO36U7hStFt
72s5++fdG+s5IDi2l6CMTZmelbhjsxJL/A9u8yrFJxniAHs5+ikwO+MoL2ZBC+0A
Jt8Xtjye32//LGAyvai1jJ4U501wjBvvdbul1xVARV/sHrYSE+hvDEtfHcSn92H4
zC9C2ANMGGxykbDLWbVfqmGW5Iz4UWCEv6n451QckMJNJI7743qeUc0AHdMtPDtx
+ItAxpaUIXINR9Lqo3erWefYLSne7vi86QdqCvwHWpzjuIJ9DXOT5qRCN0M859AA
ZFRBQn5zjPO1tyvtwb9/0o1AjL5NAMc88qQAmxkiC9/QzDL7LYxjKgkwCWx+DfJF
/2Xe9zb3zGvT6xOjIELMQhNwnU37EMe4hSnn4dJBf0yNq4g3Rt3MmFFCDy6YE3PG
rtfQ/CUwLPJb9Bqroqe4ryYPsVKpKe+71fEOKS8iHlFSggGZucZ63WKSyiBS1sJt
V5qME0d/UK4/+4FTP7FcXmc=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGRjCCBC6gAwIBAgIBBDANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTcwNVoX
DTM3MDgxMTA5NTcwNVowaDELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MS4wLAYDVQQDDCVPcmFuZ2UgSW50ZXJu
YWwgRzIgU3RhdGlvbiBDbGFzcyAxIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEA0zTTkJoHZayvCP9YGGf4F+K9yjw5eGgAxUx/52c2eDdEk/FEnftb
0Oq2dTXPLW7SAMlSDn0clX3KhDyzxhYVGk7kJoceqNlzXtq5P4grueYU2X+rAuq2
i/Wk9slSKq7C3KjO3n4YnRdwaM/THxIUxv8sWhNKlEd/HqmKnvsEd5ECPZFBWT35
Mn+OwwwgZXep3/7ecN2Z59sHHfxzVh5AbysbPNnjfozYjmVaqjv25HcdTiCC8Sn5
GayGc85EEdTIFEoNXv54TFzUfxpMCYh4lN6xbn4rr4E20Rw3khGCTtu6us8d7keJ
SJquUTsL2PsoDSfIZanZpGUqgB7A1/ubYFoiQw2tjikySEVOMWVP2u6p3w0zpkf2
PuvUNC2Qk7sYiYuJw51DKSXIbAhkz+cC+Hae1JiOCctRUmbVIymnpIXEF1c45STW
8qVZVJgZN/b5ULQGFBJKQH7RgPcnybEQXim65MhnL4KjD3L0AOdYvyl6GV3/bmej
NeOZulVj4SPVdXaDildLMMz+7vXkSXqvgk7KNSIwg6RD2fWDrXa5u4TYF3I3NjMK
lUE1JeJr0YzEopmD5UzHQ5EDukjo5DAiPUmfWUe0gJx85kBILT57ePmrTIHNVPaq
lbnEU5U54vD6/D0oRI9TPU+FFzdDmOIdzl2l267sHIk8V+LBnCfZjUMCAwEAAaOC
AQQwggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW
BBRn1VS0P5PW86c7JQiSN/g0nJv+SDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UH
Ja+z1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0
Z3JvdXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6
Ly9wa2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAW
BgNVHSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEALt+3wUXb
yAnoEEy9N9Gs9fz6wUfW4r1cGrsfqKimBeTemGQ2iwbBeKdhs5Mlu62cGwTqo2Tn
4m67UdWy7+lujq369hpOWixrkcwHmNFScFCzlSJnB7RvvsfbyvrA2Qm9FcPL9E6W
iXNPspn9Mvmst7/sdRQX6ULAHsnEn2KFaTs+J7/IMkzJDG5aMU6HIRXLeIx7L0o4
vvC1h2q+JqopqF0RnkKGqH4DUGHnw2Hy9Ki4KqmsCbkbcnl/3yjxLvYO42ZZGgQD
KDVHWxozAT1gxC8HKOeIA+kTesX/23stwBhsn/YSleGIqOKFyLHpSesD2lg9fAa6
pTZbRPlVa33PkWDzFz2Izo5JM7st9mvlhP/1FxcWhIw3xXn+XLbO9RrRdpuXVNgw
/kM61L0b0KMecioE3g7qJRWcHSEYZ5pmLGZ9QQfXXrZagc0hNBfOd6zCOmWNfeOj
VJJYu1Ev6lTB2UmH4IzVQA+03C91oGV3jAdVt1orwvmPKH1Tf/jy63e2XXHWrBcz
hiE/fT4nP2tWlYYJtlryiu5pln0Iba87iQfzJsVdgK/dW3IINacvgVwQlcjsAKjK
NtuemeExQnG+8s5VByy2av0SlgIXBWUCaKsOvkznKTbaDnOSOz4jd8FgN6E02p8N
06MlsL0D1nMoUsUywY/HS8wryPH1m3NxrjI=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGRjCCBC6gAwIBAgIBBTANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTc1NloX
DTM3MDgxMTA5NTc1NlowaDELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MS4wLAYDVQQDDCVPcmFuZ2UgSW50ZXJu
YWwgRzIgU3RhdGlvbiBDbGFzcyAyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEAldzKWyrLkFVhylw+a6TICDuBv7hPU+f7yz9aA46p4/ZNgAS627xs
LdqMyVLgSVgPQBbXWTc4ZNs5cY58T6lZwynJ0t6O8D4KEyGQuse7ETgpSL81VlMW
5XS8LMLCOBNlUAbq6K06bCk0PEEoY2Miyvt5Bjb6RTxlNKs9Blroe9At2YmIsfJU
3wx4HPhLGzfA/UQpEnek/zeV66F9KRpv6SzOiUc8rXNvxO15iXVlbBkaCXvm+XfR
W8qYC9j/LnHFMj86FkH3a3WQ4KqvGiI6tiK1DxS9X74bQO116KZ8evs9AClNwO6O
PZSNC8G80sxhrmEE9c5oaVwDVtQLn85iptvkAvPGO50qeXIIB1qSvDPvQMnhD1gu
1tEfS3/Dd32gFrkgPD1uwXjm8TzTOoaPsabvj/ScUvrraOFK3+9UPC+aBKcLrE9j
nO9VPRyJN59wJNQtyiW349v/M5oNBGHZP5T2JfzzmQ1aEQukTzWgUplg+AKMpQgD
0KgMZ2TirLY61ltpEkSBQCHsSPo3W+2ZjxIckFtoOBDtWCQ7N1DFB0ciyu0OL1fw
0F3QOUxyYQjNpUTLSJyHp5IP/FgUIBt+YP/E4N61UAOYAYEt4vLTfw37wB4PBPE3
B2EAPYgy5Eljm/RRQ4saP9c3ThMh44XN8ELvvRMy+FIWPIEDEBkGpPcCAwEAAaOC
AQQwggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW
BBRxqVpYginpDHEuxO8WaLyKFhRBNTAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UH
Ja+z1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0
Z3JvdXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6
Ly9wa2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAW
BgNVHSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEAEaJVLJ+I
bixQyvKI7vtdh0+16POulFXalWeNE/bDxuxcwCAB2EIRzZrFJtfM/sPi9WZDe0Ff
h40k585E+Sqd0pWQKc+ycVBfVbpWsTMt93x3nOkM6c1HRwr2Jx0MdrZ6/m9qLVnL
F/6pow7YsvnO/f13VwmuLnhR82aAVOllvfiaU/MSub55A0FmD61UZf8mUU2TNyfs
FDWnA7Ic5ClqbJQk5fal9CXTZ1roXFfVInfMX08JRD5gG1hjKDNC1AGVsgvH2QIb
3QMyGzEKStisKQpeNubJMrS0F7tZs62uyaYMv7y7CfJF0FoXMf6EynzrrCR4sjP9
PgPrPihW5ad5qX+DmMT8a0QfPIgM+CdCsNo+FCULzkqZveDv7icAzpDALtNwjnLk
yN1bCSSgr8Bew6rwqDOjkpMqAY54Kkon39Zue6YdlT2n5oiafYsTaQf2lrUDs+HO
Iwdpfytlz00YmXEFUmxZDWuK16Vn9/59yVO6kkwpLwlQnHJ9zoaTKx1mOXRHv0OV
bp109UjB+kYjkSEQ0yZ6EKZ4K3zi8oPckocKekziZ5GjM4/mXf1dfaP8ZMk/0DG9
wkRHfQq3L1sJYZQZDmWu4GKvvBmUm4hxv6jDslP1p2Slt0ZgrTa/RjzKlwOY6pGp
fHa68wKv4lLXwxJ1c+1iSbgsVdzTuKwZuPA=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGQzCCBCugAwIBAgIBAzANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTUzNFoX
DTM3MDgxMTA5NTUzNFowZTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSswKQYDVQQDDCJPcmFuZ2UgSW50ZXJu
YWwgRzIgVXNlciBDbGFzcyAxIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEAt1JU0r5fWdFriaEucReLerE6/oWhPVpv7R/f5A9M11Fe+rieCKaN0XYr
7LLsWY/lOykn6Es//YXaoQxAChv6imm+0yMz53DGr41WZQb0XxpVbVx+XamxsinQ
A6xs33UgoOrcbGSPqlRIWAaQ9+uVqQa0S2tErdjv2b8ZpWyzqyhnnJ+MquEtn+ee
1Kx46oQeIlXQAjRcPjGm2x9uefAS+V6U3bk4/Iaq1QFSaw33B7NLMlfgUI30SwsK
K9SUbiKvqzWHFAHQ6+pOtK6j1UG6IpKFdZXRjHYOa+Yj+fwIWKiwAQV+9g4R/UDV
Y2vjl9NT8G0okWN6AdTLbvREe9RTei3ZzSYdrPGrD4GrKRKqJFHyof74pQ596Q6v
XHS+vH911Qb2tqPbC7jC6sQqR5MainX9jhMr1doJSbxbzxPLCL18Wppqh9L2rkGQ
BM7ZYsf15edb9/4MYudvpvfsJpHTEpGG2VtnOpBe9kDvqssUZXfGsrG2FN1hq4hs
zeV+rihyBf03kBIxr0BO+0lkyIgbPQIM2RnLG0Of93po8CFQ8bS4SLuhxMfaPaxs
RGvIIWvRYJ+S6Ac/PqTO0WRJgAwr8qiPbnGyeH5b20XaXrfXbdnxEWriXp4hoiDI
cBf9jmV6QH9b08D0dA400VzkshPYAkgQV0veYW1Ofc+DdKPrsl8CAwEAAaOCAQQw
ggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTL
/Af0LFnJKLTq+umVJJtzYDs6GzAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z
1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3Jv
dXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9w
a2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAWBgNV
HSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEArs0W32Uxwm3X
6c+Dg+zJD+pFu110pPYuQLgy7IoEipm4WsZf3wlrYx65W+iHKU3V6PipnMCabq+6
HKWYcuAvTaXv6mS8piJMGX9IOmnZ20BrnrktGoNzOfTsA5m9Qtd6u0ezeCXIunu7
ROQQ24OO1tuBsbeIR0D5aeXCEpWEukZXg2F3zn++Jh6H0XHUs+QwwUAHAFcaruTl
8HEoJfYJZDXz7OpgC92bnKxF3G4gm1J5W/Pq/e5PClhPePwdDV/IgAi91bIHcAn0
qlGXbh253NbPq5UOveCWagz2r6sjSViOvsbAQ2raPpmKqc4ZActArug+ABheIQLD
wtyJ7uSCRRGfY0PHq/yKmSWab3b9yrUawZLYspQrdYuGqR9QzfltqQ5PSX8XSsvX
y9EbKZJMCBsNfJyBiwascUwySIwxqJa34DfYRL2nTWJj/zLQBHYSWPaUCn7e9zbT
LpqKQmMYrIcrxVogsOyEZvja/vbIEJ/o1GSbQs3ubTDRY1PAJ19alh7Oaav9LP6O
iBQa1yu5Macmar8ga/EGd5JMWNoNGHvOq7d+ijEqTXpXjbPca1gWC4TDtwLUKdS0
3XAbHGz7/Rh+x1+y/KKESqAqZzS3KzLhD+nfYH7TsJgciab7HzCuRyb6BTlZ35C5
oSsxYh6OpLTDBtDJatgLS5VsKS2cQXk=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGQzCCBCugAwIBAgIBBjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJGUjEP
MA0GA1UECgwGT3JhbmdlMRgwFgYDVQQLDA9GUiA4OSAzODAxMjk4NjYxIzAhBgNV
BAMMGk9yYW5nZSBJbnRlcm5hbCBHMiBSb290IENBMB4XDTE3MDgxMTA5NTg0OFoX
DTM3MDgxMTA5NTg0OFowZTELMAkGA1UEBhMCRlIxDzANBgNVBAoMBk9yYW5nZTEY
MBYGA1UECwwPRlIgODkgMzgwMTI5ODY2MSswKQYDVQQDDCJPcmFuZ2UgSW50ZXJu
YWwgRzIgVXNlciBDbGFzcyAyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEAznLKFmxJHjdDY7RshXVY6exXmsEZkSSRE80MVRSCn60KCJTS4Vdz6RzG
tox2vofkVaJRl1dZ8pC/Qgl8XC3SMWP0wJspTmbHl9FZrScCzLWLCaaWGKdWuaWx
GE8Gv93XFvzoHXJwcILDW1lR3pOJRdy2RM7wfOFCogZsaPxPXj8KjjhRPlrMuouS
nTKa+oRxE3v+z482Z6tocqCyNiwFGLO/5RZmgOZ7/vUx9+xEpLyw+hVsmnU4jpnD
brzcFy3W7LORfPq3a88PyVP5OnrLeC1dEV1uZwiMphIeoGJAN4B9rRRezYF0N6QV
YyaSW1hT+FcWit0uk5c28W7nIJcXK5kxOcx6/LezaAnpJMf6lwtWEYqv6t7kritE
pvGmkhLZRhQq+NkGuAyTtoFX13YUVs9QpQTW5/WSnoZGg5RFMm8FqnuhEkjVWl6S
rhIPuU8+m4mLhfcP9CQC3WWFphhoY0F9Yqg/xl63ZPO+JnnWWfxa9iHqrQg995uP
QHn+IDjr1HAjCTNwIbBme29ogCcsODBZR/fnJURp2W0WBwq2G6M8frpW5vKBESvO
UpgyVsNYAygP1cnPVIaDr8L0ua2qx60YTflHn8K3V2GkUnYIM4sHkF60zRcC1V5Y
LgcLUq5PJ1KYrTOdohXE4Y0LuWGTF5/mHzGDb9ylNeD1H/rmf20CAwEAAaOCAQQw
ggEAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTs
7DHr1umvFzVzvp1sVPfoxKcvxDAfBgNVHSMEGDAWgBTGON+k2onDjBtKS2UHJa+z
1LZHgjCBhAYDVR0fBH0wezA+oDygOoY4aHR0cDovL3BraS1jcmwuaXRuLmZ0Z3Jv
dXAvY3JsL29yYW5nZWludGVybmFsZzJfcm9vdC5jcmwwOaA3oDWGM2h0dHA6Ly9w
a2kub3JhbmdlLmNvbS9jcmwvb3JhbmdlaW50ZXJuYWxnMl9yb290LmNybDAWBgNV
HSAEDzANMAsGCSqBegEQDAoBATANBgkqhkiG9w0BAQsFAAOCAgEADAcFAtKfz90C
FKStHL5300T9swrgMtembXWtEHxgxB+V4Ou8ob62uB3ZpTXF1++etMc2PSfurTnw
5zR/X2qbVIMkGuZeAANXYd6au5S9BV0HY2lkzAO2PfyF+I2Uf5X61X48YwDbnf/l
l6iQskGIGEVlA3plsjEvC4xoSIEiFMjhWynUCumyw291cJfSkDExCALHdw8wIK4T
TBltpZzIa/YcJYBrShqGTu4+cyd2O6A0ghTCXDIYYzZfq2O9zrUc8SlheKKJCvw0
Shpf6xIoi9Ith0FXsehygWOCV2Frk+pm8kXGzcqOKpNgVLVv66XQXWZwlF16i7qV
odLJUIZQ9j6oqr1Gu1a78HODtUFMluO0Obfb+/1D1aJw3MQqXgs7PJ5X4/pPlvcy
WwxJ1hL1Sn46TOGJC6sI8TEiiesWaGAGpRZ0CZ7w+Tukr0mlfuhup7t/MiMDotvD
P2hc0NITihxrFqiB6yFHa5g7RqEKKEOfoowm9LJZ/m/h9/baaHVmToRXZzMkGL80
dHqMo1xDmjM/ViStcUP0UHE/FYpMnA6gRpXqHN7vQMC66M7s05stVLQx8bhNmq6B
JwCo+z23uzkQM66xu9osTV1AAX2O6+dyktOW7zsUYfJeWNVYu56C1eQ+XfhREULx
LHB9eC5xUSBUcmlong6GmSQ5IOZJqKI=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGpTCCBI2gAwIBAgIIBDnfF83l0JYwDQYJKoZIhvcNAQENBQAwajELMAkGA1UE
BhMCUEwxGzAZBgNVBAoTEk9yYW5nZSBQb2xza2EgUy5BLjEkMCIGA1UECxMbQ2Vu
dHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRgwFgYDVQQDEw9TaWduZXQgUm9vdCBD
QTIwHhcNMjAwMjEzMTQwMDQyWhcNMzUwMjEzMjM1OTU5WjBrMQswCQYDVQQGEwJQ
TDEbMBkGA1UEChMST3JhbmdlIFBvbHNrYSBTLkEuMSQwIgYDVQQLExtDZW50cnVt
IENlcnR5ZmlrYWNqaSBTaWduZXQxGTAXBgNVBAMTEE9yYW5nZSBQb2xza2EgQ0Ew
ggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDBK0k4NsfaftxdL40YVvcg
hDe1goXiQMDKSy8PBQ9BBbxooeqx7Igdb+kxQUfXLU54sZ8fOhMtskvffnbBtjsw
bKR2nAknqxwEQpZuAGXuhP6oEf7Izr6C8n3qsEIhqNTG93KJodjw9Ij+2Exr/i2Y
93a/IseoqflyzHuBBf/H0Tw2TGMdo9oCFqe9Q0tBPPguIxvBANRi5YJqkm4uIVCT
ettIbOdKc7kgdwgqGEFEAtzULSnCwGqA7Hmc82afuX99Bzm4OyVksn5x/f2RkXEK
HOWP4ukRUTXzRPpq0LaAAp+Izej1xFaDgNArLytGrt+qSDQrMbn28+05B+jXSJDu
zW2c0+lApNTSw8targAchyPk/MO37ORwoI6cYMiDE7Ly4mOP+l9ZN7IPNdP+DWnW
ktWqgPqnDBKxbbV00Bg+CGVSEGGApC1I+GNHNV95KoNJEmXd3pHACipUaRGG4EHL
ws4NvL+q5ympZoLlmogDNXmK5DjoZMyR6toGL2LweBsCAwEAAaOCAcwwggHIMB8G
A1UdIwQYMBaAFJflYNyFirffCEyxsJOwJRg6UrKIMIGyBgNVHSAEgaowgacwgaQG
BFUdIAAwgZswNQYIKwYBBQUHAgEWKWh0dHBzOi8vd3d3LnNpZ25ldC5wbC9kb2Nz
L3BjX3Jvb3RjYTIucGRmMGIGCCsGAQUFBwICMFYMVENlcnR5ZmlrYXQgd3lzdGF3
aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0eWthIENlcnR5ZmlrYWNq
aSBTaWduZXQgUm9vdCBDQTIiLjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE
AwIBBjAdBgNVHQ4EFgQUPn3mjIeXe/C311zFwSwpwqeAJtowNgYDVR0fBC8wLTAr
oCmgJ4YlaHR0cDovL2NybC5zaWduZXQucGwvYnB0cC9yb290Y2EyLmNybDB4Bggr
BgEFBQcBAQRsMGowJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwY2EyLnNpZ25ldC5w
bDBCBggrBgEFBQcwAoY2aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3NpdG9yeS9y
b290Y2Evcm9vdGNhMl9kZXIuY3J0MA0GCSqGSIb3DQEBDQUAA4ICAQAm9swq6UsC
kFM2Jbqk2XDZEi5Rt4gxAJrMQuP4OxUHFW6oyIQlybXPxqVuwwunZHtmnSPrKCxo
CtHDDEwlQa2Ezg8AOS7eE8CQ4l0BGjSRgD8MrRmtD9TKqtck2JWa2V4JgIk+FcOX
ahjhuNO6aDEfHtGdRt70P257bi+JH+1CeERW0ecJLwnI1CzIRuA8q4qTi8mWBAfq
EMaLd5nTqIfXEwplg1x0LF1QN8DzwWKKKN5varh/muI4Hqx7GOCPWxrIRqXQO/qB
hV/H+Kvhc0vF6z6NYmfQng0u2FRGcCSfZy1XbsXNF/QmfrbqYgEjZz4GZ1xsxfgI
Q37wfKaBhIgBptYcfWOHf6ddQQlk8zxKQFEycx3rXa0/yJ5555egyLMAvovmcAOY
nHtBCSNEQnePi4rnC0Jh3GOl3slFHEkTwZuFehyag95Yfq0EEI58Zd+oZPJuGVR7
YNFWCA/c2RvWobjXFDb1gXS/ALOtpUgjh5ZD6Gu7ZIuC9v6NLJLW1WylgarHJX0f
wXzwGH+fgfYVmWfYJ1Wsi0fLoLiZLv/LkhGCAgXxxvvwNIr9TDwDG5bW11CiGmlV
QFekfBGmhK0Yp6vjRrLZXJu2vmBy/xr6X0W6JwxEC5tK8AIz2sJdXuWieqNz+jOd
p0qUsSCoEJd6ks0rwy8A92uZhq7DORO5VQ==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEzzCCA7egAwIBAgIEO6ocGTANBgkqhkiG9w0BAQUFADBxMQswCQYDVQQGEwJQTDEfMB0GA1UE
ChMWVFAgSW50ZXJuZXQgU3AuIHogby5vLjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2Fjamkg
U2lnbmV0MRswGQYDVQQDExJDQyBTaWduZXQgLSBSb290Q0EwHhcNMDEwOTIwMTY0MjE5WhcNMjYw
OTIxMTU0MjE5WjBxMQswCQYDVQQGEwJQTDEfMB0GA1UEChMWVFAgSW50ZXJuZXQgU3AuIHogby5v
LjEkMCIGA1UECxMbQ2VudHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRswGQYDVQQDExJDQyBTaWdu
ZXQgLSBSb290Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrr2vydnNpELfGW3Ks
ARiDhJvwDtUe4AbWev+OfMc3+vA29nX8ZmIwno3gmItjo5DbUCCRiCMq5c9epcGu+kg4a3BJChVX
REl8gVh0ST15rr3RKrSc4VgsvQzl0ZUraeQLl8JoRT5PLsUj3qwF78jUCQVckiiLVcnGfZtFCm+D
CJXliQBDMB9XFAUEiO/DtEBs0B7wJGx7lgJeJpQUcGiaOPjcJDYOk7rNAYmmD2gWeSlepufO8luU
YG/YDxTC4mqhRqfa4MnVO5dqy+ICj2UvUpHbZDB0KfGRibgBYeQP1kuqgIzJN4UqknVAJb0aMBSP
l+9k2fAUdchx1njlbdcbAgMBAAGjggFtMIIBaTAPBgNVHRMBAf8EBTADAQH/MIIBBAYDVR0gBIH8
MIH5MIH2Bg0rBgEEAb4/AgEKAQEAMIHkMIGaBggrBgEFBQcCAjCBjRqBikNlcnR5ZmlrYXQgd3lz
dGF3aW9ueSB6Z29kbmllIHogZG9rdW1lbnRlbTogIlBvbGl0eWthIENlcnR5ZmlrYWNqaSBkbGEg
Um9vdENBIi4gQ2VydHlmaWthdCB3eXN0YXdpb255IHByemV6IFJvb3RDQSB3IGhpZXJhcmNoaWkg
Q0MgU2lnbmV0LjBFBggrBgEFBQcCARY5aHR0cDovL3d3dy5zaWduZXQucGwvcmVwb3p5dG9yaXVt
L2Rva3VtZW50eS9wY19yb290Y2EudHh0MB0GA1UdDgQWBBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAf
BgNVHSMEGDAWgBTAm8UjDQLhpk5Iax8A6eOaFBuxrzAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcN
AQEFBQADggEBAGnY5QmYqnnO9OqFOWZxxb25UHRnaRF6IV9aaGit5BZufZj2Tq3v8L3SgE34GOoI
cdRMMG5JEpEU4mN/Ef3oY6Eo+7HfqaPHI4KFmbDSPiK5s+wmf+bQSm0Yq5/h4ZOdcAESlLQeLSt1
CQk2JoKQJ6pyAf6xJBgWEIlm4RXE4J3324PUiOp83kW6MDvaa1xY976WyInr4rwoLgxVl11LZeKW
ha0RJJxJgw/NyWpKG7LWCm1fglF8JH51vZNndGYq1iKtfnrIOvLZq6bzaCiZm1EurD8HE6P7pmAB
KK6o3C2OXlNfNIgwkDN/cDqk5TYsTkrpfriJPdxXBH8hQOkW89g=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFmDCCA4CgAwIBAgIIAviguJXwzEswDQYJKoZIhvcNAQENBQAwajELMAkGA1UE
BhMCUEwxGzAZBgNVBAoTEk9yYW5nZSBQb2xza2EgUy5BLjEkMCIGA1UECxMbQ2Vu
dHJ1bSBDZXJ0eWZpa2FjamkgU2lnbmV0MRgwFgYDVQQDEw9TaWduZXQgUm9vdCBD
QTIwHhcNMjAwMjEzMTMzNDAxWhcNNDUwMjEzMTMzNDAxWjBqMQswCQYDVQQGEwJQ
TDEbMBkGA1UEChMST3JhbmdlIFBvbHNrYSBTLkEuMSQwIgYDVQQLExtDZW50cnVt
IENlcnR5ZmlrYWNqaSBTaWduZXQxGDAWBgNVBAMTD1NpZ25ldCBSb290IENBMjCC
AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOa3R+smsx3kTtDzscXFSz/n
Ap2TjCf4An/l7f+R3e+veOVwlJDtbpZsfSTRC9bdLOMvbfFDN3BqAw/GEk9AuMtk
CmHsHWgqtoIZL/Bolka23FLRUJy87UjE2ApFn4PudTDJooaWJHS4wBU7vpRkXKk+
OUqIxay47lIAEYb4Uerlsv91clXogCbPym/mbowfaQk9fyj1on2j4jOuomanBsw8
GP3STCcCKEMusFGtPTu+NQGhjFdlXuDl+m3+Uu2AePUsBbh7FskEOuDZHNYCS6j8
uG1pK1QmDHWOnWP6Bo/adBCLFJ55anTuhFoj6LHXuc1X2icjW/by80u0e4jMPUYR
vc0XShV0rTtkB0+PmsOm8SzsuZ8WLGIMpzfORUC8kHztpbbULceP4QQft/LObSmc
OSInL5c2O1oXGOI1dnbtTbdp4Cy9/tLNyzDBdhQjynuZkhwWXI/eVINYHDXAfbp/
B9LmAl41npo6Qu/dDxOZZWFk0uPgZUJ85cs2LKNyFveCsjgn0ybuF6oMjGU0crjT
zWWpilfoO44SDo7NElnnyyboT3NCZgcYLihZuR9e1xMckN7Vh4ccm2e/NLvHfwqV
ujG81IjgIO//2EqM+uqdshDctrpgVmK34Y3RU2Is2sb2MvLEFQpOeqmQBfAeyO50
DOKDj6bu5GimHWBs7QCPAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P
AQH/BAQDAgEGMB0GA1UdDgQWBBSX5WDchYq33whMsbCTsCUYOlKyiDANBgkqhkiG
9w0BAQ0FAAOCAgEAPcKw5tq5orY95RRYIrZcSrOuWCG8MDHhFca9wR/M2dOdGt5R
QoOXqceNXx72SWzjiK50jlJ8GPP6BiYd4Mns9ZOd+cxij4LGqLPDdXDCt1QKe5jT
6x4v8DP7vjJcSebeS97kjYSs3JhGyFddEMlSo+wQq9J7RvcIy7aG4SpK/Blh3ZVf
/9uemhbYIdKfYFVLXrQ5xEd5UDZ/IPxwAWeYCatWj1L7cAOX/PIr+oxM1IxxwubO
or+ssC6nDSC/xU1tRMbatjcKJCDt70Xa1/yr6AABcxem5nMeusc2SYE6QASCN3Wi
kL/Jw4SY4VBJaFou31aFIOmzkZqfP6hRC5Juv3PAmaKfD0w5Z+igWRb9jaMGUceu
zzngNa9WOjhFyA7PvzeMhYhrdtgJT76UyUK1muBjD+tzNA5nYXSnqMTsy5b40Jv0
BJbpdvR3IgrItjrI7/g5wB3nocvQhHCjPo9NsG7+dc+u5u654ONWJolP/ZoNXOlJ
1NGzcVwGuiB55+t/8KQbSQiXoqx0qr2qwEdsrrVmXsCDVhbVEXfsnnlXdml0RkAG
aLYl/lFO/HM05gXS0bwTuFzlK0yjrThLDavqhLXBjzRdcZdtnDRfauRmsYK5IRsL
EGZbMXDuIWJeeMlvZbf9JtJ1UE6GUnUmgj9E6IsFqQC3fBVBHpyhh7XlEjc=
-----END CERTIFICATE-----

51
debian-pkg/yourdev-session-pki_1.0_all/usr/lib/yourdev-session-pki/pkinit-auth.sh Executable file
View File

@@ -0,0 +1,51 @@
#!/bin/sh
# pkinit-auth.sh - Called by pam_exec.so expose_authtok
# Reads PIN from stdin, runs kinit with PKINIT to get TGT.
# If PAM_USER is empty, extracts UID from certificate on token.
MODULE=/usr/lib/libeToken.so
REALM=AD.FRANCETELECOM.FR
# Read PIN from stdin (passed by pam_exec expose_authtok)
read -r PIN || true
# Get username from PAM, or extract from certificate on token
USER="${PAM_USER}"
if [ -z "${USER}" ]; then
# Try reading the auth cert (public object, may work without PIN)
for SLOT in 0 1 2; do
RAW=$(pkcs11-tool --module "${MODULE}" --slot ${SLOT} --read-object --type cert --id 61757468 2>/dev/null)
if [ -n "${RAW}" ]; then
USER=$(echo "${RAW}" | openssl x509 -subject -noout 2>/dev/null | \
sed 's/.*UID *= *\([^,]*\).*/\1/' | tr '[:upper:]' '[:lower:]')
[ -n "${USER}" ] && break
fi
done
fi
if [ -z "${USER}" ]; then
logger -t pkinit-auth "ERROR: cannot determine username"
exit 1
fi
# Check if token is connected
if ! p11tool --list-tokens 2>/dev/null | grep -q "libeToken"; then
logger -t pkinit-auth "No token detected, fallback to password"
exit 1
fi
logger -t pkinit-auth "PKINIT attempt for ${USER}@${REALM}"
# Attempt kinit via PKINIT with the PIN
echo "${PIN}" | kinit -X "X509_user_identity=PKCS11:${MODULE}:certid=61757468" \
"${USER}@${REALM}" 2>/dev/null
RESULT=$?
if [ ${RESULT} -eq 0 ]; then
logger -t pkinit-auth "SUCCESS: TGT obtained for ${USER}"
exit 0
fi
logger -t pkinit-auth "FAILED (exit ${RESULT}), fallback to password"
exit 1

2
docs/01-smartcard Normal file
View File

@@ -0,0 +1,2 @@
[org/gnome/login-screen]
enable-smartcard-authentication=false