Merge branch 'main' into psk-bindings-example

.github/dependabot.yml

@@ -31,6 +31,7 @@ updates:
   # restricted-MSRV, so don't do batch updates
   - package-ecosystem: "cargo"
     directories:
-      - "/bindings/rust"
+      - "/bindings/rust/standard"
+      - "/bindings/rust/extended"
     schedule:
       interval: "daily"

.github/workflows/bench.yml

@@ -39,15 +39,16 @@ jobs:
         run: cargo criterion --message-format json > criterion_output.log
 
       - name: Configure AWS Credentials
-        if: github.event_name == 'push'
-        uses: aws-actions/[email protected]
+        # Only continue with the workflow to emit metrics on code that has been merged to main.
+        if: github.event_name != 'pull_request'
+        uses: aws-actions/[email protected]
         with:
           role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole
           role-session-name: s2ntlsghabenchsession
           aws-region: us-west-2
 
       - name: Emit CloudWatch metrics
-        if: github.event_name == 'push'
+        if: github.event_name != 'pull_request'
         run: |
           python3 .github/bin/criterion_to_cloudwatch.py \
             --criterion_output_path bindings/rust/standard/bench/criterion_output.log \

.github/workflows/ci_linting.yml

@@ -74,20 +74,25 @@ jobs:
         run: |
           ./codebuild/bin/run_kwstyle.sh
           ./codebuild/bin/cpp_style_comment_linter.sh
-  pepeight:
+  ruff:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
         uses: actions/checkout@v4
-      - name: Run autopep8
-        id: autopep8
-        uses: peter-evans/autopep8@v2
-        with:
-          args: --diff --exit-code .
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Run Ruff formatting check
+        working-directory: tests/integrationv2
+        id: ruff_format
+        run: uv run ruff format --check .
+        continue-on-error: true
+
       - name: Check exit code
-        if: steps.autopep8.outputs.exit-code != 0
+        if: steps.ruff_format.outcome == 'failure'
         run: |
-            echo "Run 'autopep8 --in-place .' to fix"
+            echo "Run 'ruff format .' to fix formatting issues"
             exit 1
   clang-format:
     runs-on: ubuntu-latest
@@ -144,7 +149,7 @@ jobs:
         with:
           route: GET /repos/{repo}/commits/{ref}/statuses?per_page=100
           repo: ${{ github.repository }}
-          ref: ${{ github.event.merge_group.head_sha || github.event.pull_request.head.sha }}
+          ref: ${{ github.event.merge_group.head_sha || github.event.pull_request.head.sha || github.event.after }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: check start_codebuild.sh against statuses

.github/workflows/ci_rust.yml

@@ -306,9 +306,15 @@ jobs:
 
       - uses: camshaft/rust-cache@v1
 
+      - uses: SebRollen/[email protected]
+        id: read_toml
+        with:
+          file: '${{env.ROOT_PATH}}/rust-toolchain.toml'
+          field: 'toolchain.channel'
+
       # Enforce that clippy's msrv matches rust-toolchain
       - name: Check MSRV
-        run: grep $(cat ${{env.ROOT_PATH}}/rust-toolchain) ${{env.ROOT_PATH}}/.clippy.toml
+        run: grep "${{steps.read_toml.outputs.value}}" ${{env.ROOT_PATH}}/.clippy.toml
 
       # We don't need to format the generated files,
       # but if they don't exist other code breaks.
@@ -327,15 +333,22 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: true
+
+      - uses: SebRollen/[email protected]
+        id: read_toml
+        with:
+          file: '${{env.ROOT_PATH}}/rust-toolchain.toml'
+          field: 'toolchain.channel'
+
       # Enforce crate msrv matches rust-toolchain
       - name: Check MSRV of s2n-tls
-        run: grep "rust-version = \"$(cat ${{env.ROOT_PATH}}/rust-toolchain)\"" ${{env.ROOT_PATH}}/s2n-tls/Cargo.toml
+        run: grep "rust-version = \"${{steps.read_toml.outputs.value}}\"" ${{env.ROOT_PATH}}/s2n-tls/Cargo.toml
 
       - name: Check MSRV of s2n-tls-sys
-        run: grep "rust-version = \"$(cat ${{env.ROOT_PATH}}/rust-toolchain)\"" ${{env.ROOT_PATH}}/s2n-tls-sys/templates/Cargo.template
+        run: grep "rust-version = \"${{steps.read_toml.outputs.value}}\"" ${{env.ROOT_PATH}}/s2n-tls-sys/templates/Cargo.template
 
       - name: Check MSRV of s2n-tokio
-        run: grep "rust-version = \"$(cat ${{env.ROOT_PATH}}/rust-toolchain)\"" ${{env.ROOT_PATH}}/s2n-tls-tokio/Cargo.toml
+        run: grep "rust-version = \"${{steps.read_toml.outputs.value}}\"" ${{env.ROOT_PATH}}/s2n-tls-tokio/Cargo.toml
 
   pcaps:
     runs-on: ubuntu-24.04
@@ -410,3 +423,35 @@ jobs:
         run: |
           cargo +${{env.RUST_NIGHTLY_TOOLCHAIN}} minimal-versions check --direct --ignore-private
           cargo +${{env.RUST_NIGHTLY_TOOLCHAIN}} minimal-versions check --direct --ignore-private --all-features
+
+  # compare generated s2n-tls-sys/Cargo.toml with the existing one to check if it's up-to-date
+  # unstable features might be updated in the future, new Cargo.toml should be committed in this case
+  check-generated-cargo-toml:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        id: toolchain
+        run: |
+          rustup toolchain install stable
+          rustup override set stable
+
+      - uses: camshaft/rust-cache@v1
+
+      - name: Generate
+        run: ${{env.ROOT_PATH}}/generate.sh --skip-tests
+
+      - name: Compare Cargo
+        working-directory: ${{env.ROOT_PATH}}/s2n-tls-sys
+        id: diff
+        run: git diff --exit-code Cargo.toml
+        continue-on-error: true
+
+      - name: Failure
+        if: steps.diff.outcome != 'success'
+        run: |
+          echo "A mismatch between the existing s2n-tls-sys/Cargo.toml and the Cargo.toml generated \
+          from s2n-tls-sys/templates/Cargo.template has been found. Please ensure that the committed \
+          Cargo.toml is up-to-date by regenerating it with ${{env.ROOT_PATH}}/generate.sh"
+          exit 1

.github/workflows/usage_guide.yml

@@ -52,7 +52,7 @@ jobs:
           folder: docs/usage-guide/book
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4.0.2
+        uses: aws-actions/configure-aws-credentials@v4.1.0
         if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
         with:
           role-to-assume: arn:aws:iam::024603541914:role/GitHubOIDCRole

CMakeLists.txt

@@ -32,6 +32,8 @@ loaded in an application with an otherwise conflicting libcrypto version." OFF)
 option(S2N_LTO, "Enables link time optimizations when building s2n-tls." OFF)
 option(S2N_STACKTRACE "Enables stacktrace functionality in s2n-tls. Note that this functionality is
 only available on platforms that support execinfo." ON)
+option(S2N_OVERRIDE_LIBCRYPTO_RAND_ENGINE "Allow s2n-tls to override the libcrypto random implementation with the custom
+s2n-tls implementation, when appropriate. Disabling this flag is not recommended. See docs/BUILD.md for details." ON)
 option(COVERAGE "Enable profiling collection for code coverage calculation" OFF)
 option(BUILD_TESTING "Build tests for s2n-tls. By default only unit tests are built." ON)
 option(S2N_INTEG_TESTS "Enable the integrationv2 tests" OFF)
@@ -163,7 +165,7 @@ endif ()
 if(BUILD_TESTING AND BUILD_SHARED_LIBS OR S2N_FUZZ_TEST)
     target_compile_options(${PROJECT_NAME} PRIVATE -fvisibility=default)
 else()
-    target_compile_options(${PROJECT_NAME} PRIVATE -fvisibility=hidden -DS2N_EXPORTS)
+    target_compile_options(${PROJECT_NAME} PRIVATE -fvisibility=hidden -DS2N_EXPORTS=1)
 endif()
 
 if(S2N_LTO)
@@ -195,7 +197,7 @@ target_compile_options(${PROJECT_NAME} PRIVATE -include "${S2N_PRELUDE}")
 # Match on Release, RelWithDebInfo and MinSizeRel
 # See: https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html#variable:CMAKE_BUILD_TYPE
 if(CMAKE_BUILD_TYPE MATCHES Rel)
-    add_definitions(-DS2N_BUILD_RELEASE)
+    add_definitions(-DS2N_BUILD_RELEASE=1)
 endif()
 
 if(NO_STACK_PROTECTOR)
@@ -247,6 +249,11 @@ if (COVERAGE)
     target_link_options(${PROJECT_NAME} PUBLIC -fprofile-instr-generate -fcoverage-mapping)
 endif()
 
+if (NOT S2N_OVERRIDE_LIBCRYPTO_RAND_ENGINE)
+    message(STATUS "Disabling libcrypto RAND engine override")
+    add_definitions(-DS2N_DISABLE_RAND_ENGINE_OVERRIDE=1)
+endif()
+
 # For interning, we need to find the static libcrypto library. Cmake configs
 # can branch on the variable BUILD_SHARED_LIBS to e.g. avoid having to define
 # multiple targets. An example is AWS-LC:
@@ -309,7 +316,7 @@ function(feature_probe_result PROBE_NAME IS_AVAILABLE)
 
     # define the probe if available
     if(NORMALIZED)
-        add_definitions(-D${PROBE_NAME})
+        add_definitions(-D${PROBE_NAME}=1)
     endif()
 endfunction()
 
@@ -419,7 +426,7 @@ if (S2N_INTERN_LIBCRYPTO)
       DEPENDS libcrypto.symbols
     )
     add_dependencies(${PROJECT_NAME} s2n_libcrypto)
-    add_definitions(-DS2N_INTERN_LIBCRYPTO)
+    add_definitions(-DS2N_INTERN_LIBCRYPTO=1)
 
     if ((BUILD_SHARED_LIBS AND BUILD_TESTING) OR NOT BUILD_SHARED_LIBS)
         # if libcrypto needs to be interned, rewrite libcrypto references so use of internal functions will link correctly
@@ -445,9 +452,8 @@ if (S2N_INTERN_LIBCRYPTO)
         # add all of the prefixed symbols to the archive
         add_custom_command(
             TARGET ${PROJECT_NAME} POST_BUILD
-            DEPENDS libcrypto.symbols
             COMMAND
-                bash -c "${CMAKE_AR} -r lib/libs2n.a s2n_libcrypto/*.o"
+                bash -c "${CMAKE_AR} -r $<TARGET_FILE:${PROJECT_NAME}> s2n_libcrypto/*.o"
             VERBATIM
         )
     endif()

api/s2n.h

@@ -1774,7 +1774,7 @@ S2N_API extern int s2n_connection_get_write_fd(struct s2n_connection *conn, int
 S2N_API extern int s2n_connection_use_corked_io(struct s2n_connection *conn);
 
 /**
- * Function pointer for a user provided send callback.
+ * Function pointer for a user provided recv callback.
  */
 typedef int s2n_recv_fn(void *io_context, uint8_t *buf, uint32_t len);
 

api/unstable/crl.h

@@ -187,12 +187,16 @@ struct s2n_cert_validation_info;
  *
  * If the validation performed in the callback is successful, `s2n_cert_validation_accept()` MUST be called to allow
  * `s2n_negotiate()` to continue the handshake. If the validation is unsuccessful, `s2n_cert_validation_reject()`
- * MUST be called, which will cause `s2n_negotiate()` to error. The behavior of `s2n_negotiate()` is undefined if
- * neither `s2n_cert_validation_accept()` or `s2n_cert_validation_reject()` are called.
+ * MUST be called, which will cause `s2n_negotiate()` to error.
+ * 
+ * To use the validation callback asynchronously, return `S2N_SUCCESS` without calling `s2n_cert_validation_accept()`
+ * or `s2n_cert_validation_reject()`. This will pause the handshake, and `s2n_negotiate()` will throw an `S2N_ERR_T_BLOCKED`
+ * error and `s2n_blocked_status` will be set to `S2N_BLOCKED_ON_APPLICATION_INPUT`. Applications should call
+ * `s2n_cert_validation_accept()` or `s2n_cert_validation_reject()` to unpause the handshake before retrying `s2n_negotiate()`.
  *
  * The `info` parameter is passed to the callback in order to call APIs specific to the cert validation callback, like
- * `s2n_cert_validation_accept()` and `s2n_cert_validation_reject()`. The `info` argument is only valid for the
- * lifetime of the callback, and must not be used after the callback has finished.
+ * `s2n_cert_validation_accept()` and `s2n_cert_validation_reject()`. The `info` argument shares the same lifetime as
+ * `s2n_connection`.
  *
  * After calling `s2n_cert_validation_reject()`, `s2n_negotiate()` will fail with a protocol error indicating that
  * the cert has been rejected from the callback. If more information regarding an application's custom validation

bindings/rust-examples/Cargo.toml

@@ -2,6 +2,7 @@
 members = [
     "client-hello-config-resolution", 
     "external-psk",
+    "hyper-server-client",
     "tokio-server-client",
 ]
 resolver = "2"

bindings/rust-examples/certs/ca-cert.pem

@@ -1,12 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB3DCCAWKgAwIBAgIUaAjZTaFhJNRyFtFQut1CdrY7RH0wCgYIKoZIzj0EAwMw
-HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjQwMTI3MDAwODQ4WhgP
-MjIwMzA3MDQwMDA4NDhaMBwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQDDARyb290MHYw
-EAYHKoZIzj0CAQYFK4EEACIDYgAEclmOmfFLoQR+mupZSc7J3IfZ6OV0IphUHWwv
-iH9BvkGh4OX+RZfafa4hw90A5fk0ps520Dt04tHwotLBNkdQcWDJunOhw8ydebIP
-TaP0V8OgxFs+P4kpBkMVNB3H+PK6o2MwYTAdBgNVHQ4EFgQU2ic6pZKpiyOr5aPt
-YhABB9hJC5QwHwYDVR0jBBgwFoAU2ic6pZKpiyOr5aPtYhABB9hJC5QwDwYDVR0T
-AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAgQwCgYIKoZIzj0EAwMDaAAwZQIxAMtZ
-+QqC0LGdqUxdr2woMr6pUNAaZYaxm6APPqyKsjVqNaKadiSueNbbbc+seKJXbwIw
-Zl0HNHzmoNAMkpgx5BCukjL1v07C571diSW4Z/P96t8tUzi/2rUOoFlJYU0B8cib
+MIIB2zCCAWKgAwIBAgIUFGw6MYghVw9GrlpnQwZUmB0HHbwwCgYIKoZIzj0EAwMw
+HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjUwMTI4MjEyNDU2WhgP
+MjIwNDA3MDUyMTI0NTZaMBwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQDDARyb290MHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEAzmebLd0GPptVlLK68gdNVVxmzTqI/ppHwYs
+rn8D+0yUvD2SZj8Pkxq+Ow/gVK16CC2pY9o24xagYRhJ9RUgIrocC9k0c61QquXq
+Sz58dWyajw5/gBGFxryWlaoRiC4uo2MwYTAdBgNVHQ4EFgQUSvDRw0hufm/4UxQS
+m97QrxknijwwHwYDVR0jBBgwFoAUSvDRw0hufm/4UxQSm97QrxknijwwDwYDVR0T
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAgQwCgYIKoZIzj0EAwMDZwAwZAIwCnoD
+mXfz4EZaUBZpfKbYBg6GxdGbpURJkWD4TaYK75JqWSYsQNZQQpCOOBG5zjcGAjAl
+i5bAyEtIJW33HzZUuCpZpc6rhFLv97b4HIRdDd1kgSMYBwUfi371de/H24vuC/s=
 -----END CERTIFICATE-----

bindings/rust-examples/certs/generate.sh

@@ -36,6 +36,15 @@ openssl req  -new -noenc \
         -subj "/C=US/CN=kangaroo" \
         -addext "subjectAltName = DNS:www.kangaroo.com"
 
+echo "generating localhost private key and CSR"
+openssl req -new -noenc \
+        -newkey ec \
+        -pkeyopt ec_paramgen_curve:P-384 \
+        -keyout localhost-key.pem \
+        -out localhost.csr \
+        -subj "/C=US/CN=localhost" \
+        -addext "subjectAltName = DNS:localhost"
+
 echo "generating wombat server certificate and signing it"
 openssl x509 -days 65536 \
         -req -in wombat.csr \
@@ -56,6 +65,16 @@ openssl x509 -days 65536 \
         -out kangaroo-cert.pem \
         -copy_extensions=copyall
 
+echo "generating localhost certificate and signing it"
+openssl x509 -days 65536 \
+        -req -in localhost.csr \
+        -SHA384 \
+        -CA ca-cert.pem \
+        -CAkey ca-key.pem \
+        -CAcreateserial \
+        -out localhost-cert.pem \
+        -copy_extensions=copyall
+
 touch wombat-chain.pem
 cat wombat-cert.pem >> wombat-chain.pem
 cat ca-cert.pem >> wombat-chain.pem
@@ -64,17 +83,24 @@ touch kangaroo-chain.pem
 cat kangaroo-cert.pem >> kangaroo-chain.pem
 cat ca-cert.pem >> kangaroo-chain.pem
 
+touch localhost-chain.pem
+cat localhost-cert.pem >> localhost-chain.pem
+cat ca-cert.pem >> localhost-chain.pem
+
 echo "verifying server certificates"
 openssl verify -CAfile ca-cert.pem wombat-cert.pem
 openssl verify -CAfile ca-cert.pem kangaroo-cert.pem
+openssl verify -CAfile ca-cert.pem localhost-cert.pem
 
 # certificate signing requests are never used after the certs are generated
 rm wombat.csr
 rm kangaroo.csr
+rm localhost.csr
 rm ca-cert.srl
 
 # the private keys of the CA are never needed after signing
 rm ca-key.pem
 rm wombat-cert.pem
 rm kangaroo-cert.pem
+rm localhost-cert.pem
 

bindings/rust-examples/certs/kangaroo-chain.pem

@@ -1,25 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIIB3TCCAWKgAwIBAgIUJhUgxiGTEOtg0JBtu9SrS7PPvo0wCgYIKoZIzj0EAwMw
-HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjQwMTI3MDAwODQ4WhgP
-MjIwMzA3MDQwMDA4NDhaMCAxCzAJBgNVBAYTAlVTMREwDwYDVQQDDAhrYW5nYXJv
-bzB2MBAGByqGSM49AgEGBSuBBAAiA2IABCzesg6GHI5tMP4JuMvpiVHsc+CStyTy
-JQQZ4jyj4fVfgqCcPVo6qJq6DjPepMRkm5tLtFrdavl8/ZZpiCi5vLSymUxliFXD
-9DD8GO5naaBnW2EmuYCcNrB0FJJfKZurVKNfMF0wGwYDVR0RBBQwEoIQd3d3Lmth
-bmdhcm9vLmNvbTAdBgNVHQ4EFgQUNmsIZH0IDGVlSy7V6BYZTE6NX1QwHwYDVR0j
-BBgwFoAU2ic6pZKpiyOr5aPtYhABB9hJC5QwCgYIKoZIzj0EAwMDaQAwZgIxAJzE
-GC8hKsqTmDxI4r7bewI/vjtKyEUf0BDJfRrSLixPySYRTbx950iHMo6kXB0DEwIx
-AO02gaF9weybuklR+DZ/j6EEZk4HlaRvN575vKmdDYIUF4KpFcT/8f85+5klj9Tl
-Hg==
+MIIB3TCCAWKgAwIBAgIUIbygx2K+SoQizZPmr+WpBYAyC+UwCgYIKoZIzj0EAwMw
+HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjUwMTI4MjEyNDU2WhgP
+MjIwNDA3MDUyMTI0NTZaMCAxCzAJBgNVBAYTAlVTMREwDwYDVQQDDAhrYW5nYXJv
+bzB2MBAGByqGSM49AgEGBSuBBAAiA2IABJL7bfoMCdRnkr9f+OMYtZpoJ13hhGH8
+JqSdDQGSy/SfwEo8AbmDEF6tc3HGkCpx0/K1Q5lENshft6y+3n4Qn8q+9uy4aI/c
++fm8FHKbooe748nwxdHo+GczlzJwPR3I9qNfMF0wGwYDVR0RBBQwEoIQd3d3Lmth
+bmdhcm9vLmNvbTAdBgNVHQ4EFgQUaLUgNRONUSKhwjyLrkuYSvOGDoIwHwYDVR0j
+BBgwFoAUSvDRw0hufm/4UxQSm97QrxknijwwCgYIKoZIzj0EAwMDaQAwZgIxAPqf
+TV3w4egUT/MeS4BowJ4//N0NoBr0ohN+Ea2aAv5REiMJXJ/VfScvJMOfcGdzbQIx
+ANO56JKO/54WKd/14Xft0yKiHKCkRaazqngDw9L9jZo5QA1gEcDkWETBzjSdJ4ys
+0w==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIB3DCCAWKgAwIBAgIUaAjZTaFhJNRyFtFQut1CdrY7RH0wCgYIKoZIzj0EAwMw
-HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjQwMTI3MDAwODQ4WhgP
-MjIwMzA3MDQwMDA4NDhaMBwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQDDARyb290MHYw
-EAYHKoZIzj0CAQYFK4EEACIDYgAEclmOmfFLoQR+mupZSc7J3IfZ6OV0IphUHWwv
-iH9BvkGh4OX+RZfafa4hw90A5fk0ps520Dt04tHwotLBNkdQcWDJunOhw8ydebIP
-TaP0V8OgxFs+P4kpBkMVNB3H+PK6o2MwYTAdBgNVHQ4EFgQU2ic6pZKpiyOr5aPt
-YhABB9hJC5QwHwYDVR0jBBgwFoAU2ic6pZKpiyOr5aPtYhABB9hJC5QwDwYDVR0T
-AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAgQwCgYIKoZIzj0EAwMDaAAwZQIxAMtZ
-+QqC0LGdqUxdr2woMr6pUNAaZYaxm6APPqyKsjVqNaKadiSueNbbbc+seKJXbwIw
-Zl0HNHzmoNAMkpgx5BCukjL1v07C571diSW4Z/P96t8tUzi/2rUOoFlJYU0B8cib
+MIIB2zCCAWKgAwIBAgIUFGw6MYghVw9GrlpnQwZUmB0HHbwwCgYIKoZIzj0EAwMw
+HDELMAkGA1UEBhMCVVMxDTALBgNVBAMMBHJvb3QwIBcNMjUwMTI4MjEyNDU2WhgP
+MjIwNDA3MDUyMTI0NTZaMBwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQDDARyb290MHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEAzmebLd0GPptVlLK68gdNVVxmzTqI/ppHwYs
+rn8D+0yUvD2SZj8Pkxq+Ow/gVK16CC2pY9o24xagYRhJ9RUgIrocC9k0c61QquXq
+Sz58dWyajw5/gBGFxryWlaoRiC4uo2MwYTAdBgNVHQ4EFgQUSvDRw0hufm/4UxQS
+m97QrxknijwwHwYDVR0jBBgwFoAUSvDRw0hufm/4UxQSm97QrxknijwwDwYDVR0T
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAgQwCgYIKoZIzj0EAwMDZwAwZAIwCnoD
+mXfz4EZaUBZpfKbYBg6GxdGbpURJkWD4TaYK75JqWSYsQNZQQpCOOBG5zjcGAjAl
+i5bAyEtIJW33HzZUuCpZpc6rhFLv97b4HIRdDd1kgSMYBwUfi371de/H24vuC/s=
 -----END CERTIFICATE-----