Use base64-encoded DER PinnedDomainCert in OwnershipVoucher instead of PEM format.

client/client.go

@@ -28,7 +28,6 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"strings"
 	"time"
 
 	log "github.com/golang/glog"
@@ -55,11 +54,6 @@ var (
 	}
 )
 
-// pemEncodeCert adds the correct PEM headers and footers to a raw certificate block.
-func pemEncodeCert(contents string) string {
-	return strings.Join([]string{"-----BEGIN CERTIFICATE-----", contents, "-----END CERTIFICATE-----"}, "\n")
-}
-
 // validateArtifacts checks the signed artifacts in a GetBootstrapDataResponse. Specifically, it:
 // - Checks that the OV in the response is signed by the manufacturer.
 // - Checks that the serial number in the OV matches the one in the original request.
@@ -73,6 +67,9 @@ func validateArtifacts(serialNumber string, resp *bpb.GetBootstrapDataResponse,
 	}
 
 	parsedOV, err := ownershipvoucher.VerifyAndUnmarshal(resp.GetOwnershipVoucher(), vendorCAPool)
+	if err != nil {
+		return fmt.Errorf("unable to verify ownership voucher: %v", err)
+	}
 	log.Infof("=============================================================================")
 	log.Infof("Validated ownership voucher signed by vendor")
 	log.Infof("=============================================================================")
@@ -89,15 +86,14 @@ func validateArtifacts(serialNumber string, resp *bpb.GetBootstrapDataResponse,
 	}
 	log.Infof("Verified serial number is %v", serialNumber)
 
-	log.Infof("Adding PEM headers and footers to OV")
-	pdCPEM := pemEncodeCert(parsedOV.OV.PinnedDomainCert)
-
 	// Create a new pool with this PDC.
 	log.Infof("Creating a new pool with the PDC")
-	pdcPool := x509.NewCertPool()
-	if !pdcPool.AppendCertsFromPEM([]byte(pdCPEM)) {
-		return err
+	pdc, err := x509.ParseCertificate(parsedOV.OV.PinnedDomainCert)
+	if err != nil {
+		return fmt.Errorf("unable to parse PDC DER to x509 certificate: %v", err)
 	}
+	pdcPool := x509.NewCertPool()
+	pdcPool.AddCert(pdc)
 
 	// Parse the Ownership Certificate.
 	log.Infof("Parsing the OC")

common/ownership_voucher/ownership_voucher.go

@@ -20,7 +20,6 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"strings"
 	"time"
 
 	"go.mozilla.org/pkcs7"
@@ -41,17 +40,10 @@ type Inner struct {
 	ExpiresOn                  string `json:"expires-on"`
 	SerialNumber               string `json:"serial-number"`
 	Assertion                  string `json:"assertion"`
-	PinnedDomainCert           string `json:"pinned-domain-cert"`
+	PinnedDomainCert           []byte `json:"pinned-domain-cert"`
 	DomainCertRevocationChecks bool   `json:"domain-cert-revocation-checks"`
 }
 
-// RemovePemHeaders strips the PEM headers from a certificate so it can be used in an Ownership Voucher.
-func RemovePemHeaders(pemBlock string) string {
-	pemBlock = strings.TrimPrefix(pemBlock, "-----BEGIN CERTIFICATE-----\n")
-	pemBlock = strings.TrimSuffix(pemBlock, "\n-----END CERTIFICATE-----\n")
-	return pemBlock
-}
-
 // VerifyAndUnmarshal unmarshals the contents of an Ownership Voucher
 // and verifies that it has been signed by a signer in the given cert pool.
 func VerifyAndUnmarshal(in []byte, certPool *x509.CertPool) (*OwnershipVoucher, error) {
@@ -74,14 +66,14 @@ func VerifyAndUnmarshal(in []byte, certPool *x509.CertPool) (*OwnershipVoucher,
 }
 
 // New generates an Ownership Voucher which is signed by the vendor's CA.
-func New(serial string, pdcPem []byte, vendorCACert *x509.Certificate, vendorCAPriv *rsa.PrivateKey) ([]byte, error) {
+func New(serial string, pdcDER []byte, vendorCACert *x509.Certificate, vendorCAPriv *rsa.PrivateKey) ([]byte, error) {
 	currentTime := time.Now()
 	ov := OwnershipVoucher{
 		OV: Inner{
-			CreatedOn:        currentTime.String(),
-			ExpiresOn:        currentTime.Add(ovExpiry).String(),
+			CreatedOn:        currentTime.Format(time.RFC3339),
+			ExpiresOn:        currentTime.Add(ovExpiry).Format(time.RFC3339),
 			SerialNumber:     serial,
-			PinnedDomainCert: RemovePemHeaders(string(pdcPem)),
+			PinnedDomainCert: pdcDER,
 		},
 	}
 

common/ownership_voucher/ownership_voucher_test.go

@@ -15,6 +15,7 @@
 package ownershipvoucher
 
 import (
+	"bytes"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
@@ -53,8 +54,12 @@ func TestNew(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	pdcDER, _ := pem.Decode(pdcPub)
+	if pdcDER == nil {
+		t.Fatalf("Could not decode PDC Cert")
+	}
 
-	got, err := New(wantSerial, pdcPub, pubCert, privKey)
+	got, err := New(wantSerial, pdcDER.Bytes, pubCert, privKey)
 	if err != nil {
 		t.Errorf("New err = %v, want nil", err)
 	}
@@ -85,8 +90,13 @@ func TestVerifyAndUnmarshal(t *testing.T) {
 	if err != nil {
 		t.Errorf("VerifyAndUnmarshal err = %v, want nil", err)
 	}
-	if gotPDC, wantPDC := got.OV.PinnedDomainCert, RemovePemHeaders(string(pdcPub)); gotPDC != wantPDC {
-		t.Errorf("got PDC = %v, want %v", gotPDC, wantPDC)
+	wantPDC, _ := pem.Decode(pdcPub)
+	if wantPDC == nil {
+		t.Fatalf("unable to decode PDC Pub")
+	}
+
+	if !bytes.Equal(got.OV.PinnedDomainCert, wantPDC.Bytes) {
+		t.Errorf("got PDC = %v, want %v", got.OV.PinnedDomainCert, wantPDC)
 	}
 	if gotSerial := got.OV.SerialNumber; gotSerial != wantSerial {
 		t.Errorf("got serial = %v, want %v", gotSerial, wantSerial)

common/ownership_voucher/testdata/ov_123A.txt

@@ -1 +1 @@
-MIIRowYJKoZIhvcNAQcCoIIRlDCCEZACAQExDTALBglghkgBZQMEAgEwggjWBgkqhkiG9w0BBwGgggjHBIIIw3siaWV0Zi12b3VjaGVyOnZvdWNoZXIiOnsiY3JlYXRlZC1vbiI6IjIwMjMtMDgtMDkgMjM6NDk6MDYuMjc3MzQ3NCArMDAwMCBVVEMgbT0rMC45MzM0ODc2MDEiLCJleHBpcmVzLW9uIjoiMjAyNC0wOC0wOCAyMzo0OTowNi4yNzczNDc0ICswMDAwIFVUQyBtPSszMTUzNjAwMC45MzM0ODc2MDEiLCJzZXJpYWwtbnVtYmVyIjoiMTIzQSIsImFzc2VydGlvbiI6IiIsInBpbm5lZC1kb21haW4tY2VydCI6Ik1JSUZtVENDQTRHZ0F3SUJBZ0lDQitjd0RRWUpLb1pJaHZjTkFRRUxCUUF3WGpFTE1Ba0dBMVVFQmhNQ1ZWTXhcbkN6QUpCZ05WQkFnVEFrTkJNUll3RkFZRFZRUUhFdzFOYjNWdWRHRnBiaUJXYVdWM01ROHdEUVlEVlFRS0V3WkhcbmIyOW5iR1V4R1RBWEJnTlZCQU1URUVSbGRtbGpaU0JQZDI1bGNpQlFSRU13SGhjTk1qTXdPREE1TWpNME9UQTFcbldoY05Nek13T0RBNU1qTTBPVEExV2pCZU1Rc3dDUVlEVlFRR0V3SlZVekVMTUFrR0ExVUVDQk1DUTBFeEZqQVVcbkJnTlZCQWNURFUxdmRXNTBZV2x1SUZacFpYY3hEekFOQmdOVkJBb1RCa2R2YjJkc1pURVpNQmNHQTFVRUF4TVFcblJHVjJhV05sSUU5M2JtVnlJRkJFUXpDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJcbkFKMlVoNHNYSFE2M0R4NjRobjJrendDSURYSXgraVJSMEF4RHg5b0tnTk1aNTVVd2x3bmY1QjlGb1ZsVmRVbS9cblRFUlpGOVo2cS9PRGdhM0ZKWlZXdE1XZFBKVlZ0ZFJaU2VpUDkycDRpSHk5czNMNEVJUzhpK3NJMXlRNVFGTjZcbmZpTllyM1gwalUvMWFDOG44a3VNR2U4TzN6Wk8zV2FwNVFkVkFaNXpTZlBMa25TR3BrSlN0WUdEM2V4ZFc4OXdcbm5YMkgvOXFPRlFwRnFyZklyMnN4bGYyZ3p6ZGI2VExFcGpKV2R5VWFDUU9SZEFJUWJmYkRXcm5GUGNWR014UDNcbkx4YU9rSHF6d2FMdmhpR21raTNJTnd3Ui9uK2dWMDZnTHpncjh5RGl0Tk00NHArc3ptR2ZrbzR2ZUZUMWZkQ21cbjBFSjNwbkpQb2hMdWZkSjFsQnZ5bWNndDRxZHRGZTZ1UFRMckFqMmtPOEt5L000UFZQWExUMXBHRUxHOXlHRUFcblBtWHVWRERCbGh1c29WdEE4alBCdXBzS09FQ0NOZ0RhS0FZQndibHJ1MUIvLzBEQTU4VEx2ZVpYQ0VLbFJwa2pcbklSSUd0cmg0YVhiK2liZVV3YVVFSWIwUXo1RWVDRjFPS0Z2cDVTL3hTMkJtQ0VpOGxYTktZTjIzMXppM2xKOS9cbnNLeWdJL1p4VnBySnBpRmxsazlEOFVMRGxrcmx5dkxmYVdmS2VvVmhZQm41d1dJZmVTWnhQK0VhRUlBeERkNjZcblN3aGxOQjlYMFM1OTJkTW9jU1VoQ204cXptQXRBZDM3dWxGUXh6SjM1TUlPNFZxSXZub3Nhb1dwSE9mQXRwT0hcbmhsdGE4blVmQTN0Y1ZJNDFGc3JKVEdTcEtqQ05RZThhSGxSZkxMdGRQNVNaQWdNQkFBR2pZVEJmTUE0R0ExVWRcbkR3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBZ1lJS3dZQkJRVUhBd0V3RHdZRFZSMFRcbkFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVU0TGk2aEJneFFrQU1Hb1pWZXBqS2VkclY5aHN3RFFZSktvWklcbmh2Y05BUUVMQlFBRGdnSUJBQ1pLem4waStpeVFZK0svM29kVUFrcEZCcFlHK2xWbjlVZXlaU3YwY2cwejdOdnVcbjhTdEFLTWRJaDFPWWxQNGNEVkNPSWxURmFoN1dUK05CTTdRODM1bS9MZndzOS9MeXpjWGhsNC9EbXVFUFVId1hcbkVOZVoxRmZIRXNlUzRwRVpxQ2hPNGt0NDhNbTc2ZzZJMXR1cGNSR0F2RUt2cUdxVnY0SDRPZk9xM3dyeHFOd0lcbnlyYkRXN1NXS3JONFY0V3E4SUc2bGxzQnRFQ21ySjdmN3l2UGhqZ3pkdUFOeDBkS2tJQkRzRkNPeExEWnFUclJcbkFHN3hVNzQxdTBzelhUd2JQbmw0b0hmQVVRQ3hSa2RaUXVlUVZKeHIzeDB1eUVYL2x4UHZTUFFHRXE2WFo3RnFcbnNnM1hCUlJWZUN0Z292NTNNdmpGSVBTbmtkb1NzZVVOODhQQi94WEhqT2NxaEFYWTNzT3R4WXNadHM2bGFtNHpcbnJtaTRiVSttM0xFVEJWam5iT0lnZ0ZhRDk5RjlYYXFyd2R5ZTVaOEd0OU41bnpBcm5wTEtKUDFNdVR4dWZ5VjVcbllmNU5SZmR1UnhrdGhxRnFwdGgwRUFBYlltdVlPelBTUnUrODRheE5nOTcyN2ZhcWoyaTZZZitQdHVVS0haMzJcbkkzRmEvUldXQ3YxRzJzMit0K3ZvRnJhZVFQOWZBTHJMZ0pvakRaaTNzeml6OGJ3ZVFOMzZyYk9MVGxHN0EybFVcblNqOXJqd2R2RHh6cWIzQjhHR2crYXBFMjRIUTdvZWRDd3Z1UFJiK1o5aWRkaXg1S09kUmNqKy9kNng2dWJ1OWxcbkNnaTE1dTF2QXROaUV5dTdOeitGOENCRkRoWnMrMzJVM2lvS2Q0U0RQSEpsQ1plUVc5OUx0dVEzOTRUaCIsImRvbWFpbi1jZXJ0LXJldm9jYXRpb24tY2hlY2tzIjpmYWxzZX19oIIFozCCBZ8wggOHoAMCAQICAgfnMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEOMAwGA1UEChMFQ2lzY28xHTAbBgNVBAMTFE1hbnVmYWN0dXJlciBSb290IENBMB4XDTIzMDgwOTIzNDkwNVoXDTMzMDgwOTIzNDkwNVowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ4wDAYDVQQKEwVDaXNjbzEdMBsGA1UEAxMUTWFudWZhY3R1cmVyIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCT8XUaoChCJr7MxG5ay5dFJhfzo1OOMMUXij+cUaxaWBBXAsi6B24ka0sRvGeoPZoZiwy9/W5SaNTWC0CRTryDAwbuEnPgvM3aHCn0EydY6nS1O1cHVUHQ/wYEsfiDOc73MoYft0AvCmA1c+HF6YYZD5K4CAayePKfJ5uWSBHA5c7PjekDX2VjiFuI9Yq3R7EWePh3/ImTnF8rsagXoQ/KEWah6xm8LRS+NkqA/CBPON0QK2GGkjt21a7WRsgk5nph9Oaaai9E2kZyEe2+i3Tg4FujePKRgjmqpJBScvqguEWnceOnM/Smoj/M+f0YVt9qbNLLB6qMLBOtXFWpYNk9Vo5sWtDrDPn9m5w4KQrXmaxVMB7eJCAJmywvSKJprUA0vl6F2JPyjsJOEzOEiPHkDHOF37Ly/LDfNIf8hmIxbtaBNoTQXfH7BHKpp+Y2nd399lFFXlq4pBt/QFYSqM11YudFmQxlJvA3VwRl/ki8Ppq2XYOUwklDPHfUkqVPhRLkR7XOEfkkXMjBWqOvdbhn4igaFeUgCw0nwYmos+kmu6CpFL6uw+1hAuO6FBhdQmwVk87Ko9dqspRdMQ8wvmKiQVDfQjERmDTT1ObGdT+lZ0/B+OR8wHIu4yxLDE2hcg66I7e2gCkOGGOnJEJoTOMvtghY/a/kqOeEHn1nmEUrYQIDAQABo2EwXzAOBgNVHQ8BAf8EBAMCAoQwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFDeNjw+UZS+oRo2uSBv+gBCtYEa4MA0GCSqGSIb3DQEBCwUAA4ICAQBebFIcMhgJtV7WJb9BLiHGR7Ju+KxALJJ9qigESLbobaxCuCS1mu6Lf6BOjzUIgViwwpTDYwXRoNKFCIUUif5pLs3gwWwtzA8mE7jB03lR+j/2muNf6DwdMQudB4VSvVOe5IfPtFsr9iDvn1dh98rAdEWoWEYmnFmx3gzLJlhDKNdIiCrQBW8gu/XGRXhi29bLrPYfv1+1fvlYCSkKegN3s48Aj4GKXbYRQzF7VRsr8X48iAz9gD5Bb5YHjpf0DM9YYXwzbltXT9Vk1HMYjCmnG9ysUT3IIdH52NBFDKxHQymMxyjxs8l2AgNYHE64BmqycAHDmDZGcXlwNR4IcEkxSIZc95Om3u/WUk3EgLDpC20fjCsWyq1f173ksSpjwgQ1f68jyUthSxtyYCi/zxVZG9HLEFQiwUvYLcmpHt7aLera3/wJfFLdmZOEVKQjX1IVpkvTSzNoO0+54QQUWOyxsvVv6EHlTnS7GvkwURG1oh+Jv3vWKUO4k1a6wYgCpJ/5ydxgP1O99cQcnB6IuoFgKKYXMtDNKj6sPUWT8uGuKRqb0avwBbZhNVGQUzaaTPrEke/DZIPs0CmdMqJmHNqUpv8lxRGh5iHsziyP+7HtFvz4XOuoFUW8JEIKvapPq5sJ5vEft6B1d40LYu+HrxHdkjY5tVkL3+wuS0pK+JZOxDGCAvkwggL1AgEBMGcwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ4wDAYDVQQKEwVDaXNjbzEdMBsGA1UEAxMUTWFudWZhY3R1cmVyIFJvb3QgQ0ECAgfnMAsGCWCGSAFlAwQCAaBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIzMDgwOTIzNDkwNlowLwYJKoZIhvcNAQkEMSIEIMF+hxaNZNSOUW96hqGA8Fufrgt5xrfo+rllZ2QwUmjyMAsGCSqGSIb3DQEBCwSCAgCQrVnM8lfVNnHx+/UHSO7iCYKMV9m9O7kSP3b66nvfuDvqTclgFrltUhmki0ECXcHVCYXUc4ts9w++T5Ga7sC3hLk/Pw4VD1hOr5IPmE3iZOzZD1JgrIxO9aqYVNW2S8ddUdNf4FQ7MwooCSRXEuJeesoTwmaBhgWpWnmmLz+7GSBZgvAnqZimqJnNxwYe0SycKslSispEjMp2wvHc98sjzUkPXzW5zn4PCNBb+gWTMNNH6Z29v+fZ5iItreeuueNSENoAda7uwdRA2v5PmEakrJzGh1zFOynMZeE5QaczDMVk6XREPBH1TYmNl+n/SMlo0J+7I1Tw2HliHn+x57o9mEWIVZWrapXcpVArAHR/R4NuJkWVY6ApKgN36fdYA5kNRv0ecnBn2H45xzQjjD0WGfHE8Zh61QiAgPQeUB58Sn0wRxZSQgwPXR74bTnYDBE4qDaSTEnOZD93gXxLEgjCxjkWncVjBHF0TGrMrWgYz0zyJSED1TISWy4hnL+eKTA7SOD40ZBfxxVZhU7GhHJYVahkFrhISlYEuWYcd/ZkzJacHKIOPUARL8f7F+CLkAMrq1PRULT0lG15gGA24DflFd3BhSEHQ+/zCt0UZEoVqqrAFbawLCKJyB5d6dIBqQoaVN0xnVwWIIlGnjOClHmDOvE2iQuyZgvTV3wKtPakVA==
+MIIRowYJKoZIhvcNAQcCoIIRlDCCEZACAQExDTALBglghkgBZQMEAgEwggjABgkqhkiG9w0BBwGgggixBIIIrXsiaWV0Zi12b3VjaGVyOnZvdWNoZXIiOnsiY3JlYXRlZC1vbiI6IjIwMjMtMTAtMzAgMDU6MzQ6MzYuODQwNzAzMTI3ICswMDAwIFVUQyBtPSsyLjg0MTIzOTY0MiIsImV4cGlyZXMtb24iOiIyMDI0LTEwLTI5IDA1OjM0OjM2Ljg0MDcwMzEyNyArMDAwMCBVVEMgbT0rMzE1MzYwMDIuODQxMjM5NjQyIiwic2VyaWFsLW51bWJlciI6IjEyM0EiLCJhc3NlcnRpb24iOiIiLCJwaW5uZWQtZG9tYWluLWNlcnQiOiJNSUlGcnpDQ0E1ZWdBd0lCQWdJQ0IrY3dEUVlKS29aSWh2Y05BUUVMQlFBd1hqRUxNQWtHQTFVRUJoTUNWVk14Q3pBSkJnTlZCQWdUQWtOQk1SWXdGQVlEVlFRSEV3MU5iM1Z1ZEdGcGJpQldhV1YzTVE4d0RRWURWUVFLRXdaSGIyOW5iR1V4R1RBWEJnTlZCQU1URUVSbGRtbGpaU0JQZDI1bGNpQlFSRU13SGhjTk1qTXhNRE13TURVek5ETTBXaGNOTXpNeE1ETXdNRFV6TkRNMFdqQmVNUXN3Q1FZRFZRUUdFd0pWVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGakFVQmdOVkJBY1REVTF2ZFc1MFlXbHVJRlpwWlhjeER6QU5CZ05WQkFvVEJrZHZiMmRzWlRFWk1CY0dBMVVFQXhNUVJHVjJhV05sSUU5M2JtVnlJRkJFUXpDQ0FpSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBT1NnSXRVNTNvRERvMWlicDRDakhEcXptSEVFVUQ5NDYzQ2tUaE4wNVhFSDNWQXNjamxlQy8yWCtobXFucDR0dFY1b3MvYVYwZVVKbmp1Zk9kM2VSVkpYRjFZTWI1MmR1V29sKzd4azhMYjVpUzhnQlhzUURJdTA3NTRnRFJpQjVvaG9iSmVXSFR6QUorZ0hkaXZpSHA5T0loUWdDWmRKK3RpY0J2WEFsL3B5Sms1TmcvR202SVR4ZDU2L25JQzM3T20zK1MxOHZlWks3cGNRSi9iOHVrTEQ2VkpFaXhYRXI0ZzFDR3pkSWRDR0hMKzVPd2Z5UnBGR05FTDlQNWpWOGhDNVRjK0NEbVQ0UWJCK3o0STdvTXJ0R3pVWm96VVgvM2d6cVRLaVhwa2JPbXhCOEkxc1M2ODN0MWRFcnUvdXF3UXpONnJVSXZaak8ralQxd0lXM0x3ZnZkKyt6bC9ETkNDMWZNMGhTV0t3ZGc0ZFRUeFM1Q01Xc3VEcFZLcWdqZGZvR0VZQmZpcjYvbzl4bmEzaXBpRjQ3VEV4VVo5bTcwdEs3ZFNNUmpaTGpTVmRxK2t3UWdtNVIvWTNkMnQyanY1VC9sOUlFb2hVRktNdkk2MVRPbEUzS090Ym1rR1VZMmNHZzRoZkduRURYRjdEcGdybjQwYnZCWSs1V2NNNHVUSDhaUkJZVStsRks2WGpnSHNNS0tVdjhTWldPS2p0Q25JazVHQW5aU0R6ZnBCM3VYc2FYRUNDZU1CRTdWbjJidHVCSU9DVkxJajA0S3NsN1p4VlpnTnFsNklwUTBTL1poNnhjaEI0anNWZ1dYTWR1Rk1EVU01Q1dIa3JJcXRLZHc3TUIzdEZEZ3ozcU9kTVpzei82UHJIQlNzOUR1MTBwYldhYStNR0tzb1RBZ01CQUFHamR6QjFNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBZ1lJS3dZQkJRVUhBd0V3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVY0pYSWhMaXZtK2JVek9IT1lIbzBlbS9BTUdrd0ZBWURWUjBSQkEwd0M0SUpiRzlqWVd4b2IzTjBNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUNBUUJPYmV2UmErMWZSTEc1ZFh4N0lmQTd0aEMwYUo1bXVxRFloTDhETkY2a2ZWRVpEbVRCZ3NiaTJINWg0UGRXVHQ5VlFUcHVUNmFHOERZMFM3K2NtdmYvRTIyN292SmpjVkFPbzNMODluaFBJb2M0MDE5MHkrcGE3cXh0QXhzTW1mLzZ3S2lmZGlRT3VKRDZnSld5T3ZpL1FNNHlFYUhVUUxzWEE4NTFBZFhkcmdEcEZkRFYzQkhRbVR3N0lHQi9MMmkrcitnTERXcUo0SStnY0xxMGJvd1hKK3NiSDlmUXBIajZYN3FVSGV3SlFHVWZuZnk5amM1YzB5Tnhnc3AzSFNrUXBtZGdkU20vTkpLZG1rK0loR0FlL3lQZnZYc1NLQytDZDRLbzRiVTRORk95dnU1MGdDOW9OMGtFKzF0TGFhNDBNbklOQUp6dm9nV1BQZXhYUysvMEd0Rk5KZmJqWlJVM0JBTFFHa29RazFOQzNQVEk2NnIxeW9RczdZRHBDbEdzdmNYV1lnWjVGN1V6bTcvUUtxVU5NamZzZTh4eXRONnJDTG80TnFDZzNrdi9HRFA5Wkx1L3RPc3lrcVVYMDhWVXFvM0lKNmhPMXlBaENTTWxKMEVEaU41MnRwclJ5T2o4eGNya2ZqbFUwOEpLS1lpcmZ0SktYNXF3anlYMVdoeDhKTURHM3RYRXkzV1k4OEFaay9YRWRQN3FuMUlocUxqWGNId0dKSnpBNFVLN3FpK0poUUxxQ0xEeEhuSnBNekJVU1Z2YzdxZjg3MFVocGkrcXQxRkRCb21aVVJBZ0EybUJPZHU5d2FXUUU5aFN0a3ZxR2ZmKzBWMnRkdEg3dGtwdVlFOE9OdFk5YUcwYjVjNmJVTGtsNjI1K2tyR3Y0clR5bGxuVDdWK2pZUT09IiwiZG9tYWluLWNlcnQtcmV2b2NhdGlvbi1jaGVja3MiOmZhbHNlfX2gggW5MIIFtTCCA52gAwIBAgICB+cwDQYJKoZIhvcNAQELBQAwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ4wDAYDVQQKEwVDaXNjbzEdMBsGA1UEAxMUTWFudWZhY3R1cmVyIFJvb3QgQ0EwHhcNMjMxMDMwMDUzNDM0WhcNMzMxMDMwMDUzNDM0WjBhMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxDjAMBgNVBAoTBUNpc2NvMR0wGwYDVQQDExRNYW51ZmFjdHVyZXIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANE6NdI+w2KWprti9MF/e8dgG+Fr+uwrA1ljeVC+4kQvmpxUqtRMOHQat5mCseryLIMbruHRlg5TtaM63Ti8++ECtuE/l+J670e6qVc5O5dxCkUa3/O94L6W3tIrwR8WOQMLZDbildPeL1tsR5SlzKtNBY5MjlhomuT4cRmL7Ue/X+q+3Pl/CO2V3Q5OyCaJ5WhCucIo4Hc1IwBcaX/aVQ1+nrZ1IW8c8r0eR6VnEhiC/WdFB+4jvsLA6ICN7Sb/b3oQNH9nt0em68a0hUOS4k+/U7o0+6OulPF890SU8k2aFhbxvmuZFbW7PAHjutxZnl8vvIZaGbmFOx0GBTCgAG6YFHAWBisuE+P1CxlDbGZJgIRGd3kh7ypC4OOVHif3RotTFeWpMN0vhZgrFbByhy9A22wnc9ZRv+P69M1h1ezSnJ5CumPylTDDwWxq5EfpGMlAF7II3FGxv7uYdYfHboDTnGFyr4NfjjEpFJfqwtGhBREim53Fot5aJEoZv6QLqPVdk1pRfCM2k3qbrifqPfoaUMBXA+IzwynrH5V3BEAD3Ws6gN+Q5Ak0LktnvDG0FnLpDtlhc5bTdby/hc/TvpOp7ruFGJ7zOZ3B8HqsnpIavdrC18bSkRyImKY9hUDF+f6F4EsvEH8JzLDolV1rdXtXWBSdE0qvHewJcsRG2NR7AgMBAAGjdzB1MA4GA1UdDwEB/wQEAwIChDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU+u+4A7qK2dn+0IjYkbRsyhCS3VAwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4ICAQBZlcXla7ddZW9eL5BPFlQc839A2vtpCJwxPg0Q8nUmTOcDr9FoYDlF1Y/CdsAu7CZHK44+SZElQcs/dtNpSPHkqEnbChZ3sE7q32JETDnwqDAkY+Gu5FZb1StU8NzzrgW7wIaRSDxKlqLTIB6mFkMwEo0McY6g1wriVNz3jYwlG5UKhGTGRTjq5GKVWktFBY3Q0/NSCJFl+afQUu7Aii4iKOsMxHGKoaC041XrixwNcninfNmpw24BEtvvZaXBKiQiVGcfkunvajv8JMLou6GkjnWRu4yZGQfjYVSzNQfJUs76v72f8iKAZDoPj1xZhPTGSW5dtGhXaM18yCZWnm4AKyHKKfXVWHl5de4w3C1ymlSRNQy/9+dTz4aLY8XkuT/DjLkaR5zU9vlXXJymVT/B9CVLeEY1V+Qj8FF5hRG5CG844LZRcbdL4GMqdAkg7dEd2LvXnVDLGG0ee485E0JqS5HfjpXnX8HAm7acumBfIYSVoJzHZ7nD2b/ZdIRRWM4OEhLIlcMy7dgwPul5WSeVoLtbI/wFCDjLMZ62TaavP2blvDjeeMCu6dM9z4kLfODDNr/NksHmBI+k7KLS4f89QqsLPFOalwnQnt+ErUzCQkpwMwDjRxiX1nIp+8nGpAVtyicwEwK6C2kHMhgAlYERpU0RACDhxMXWAOMDV1gosTGCAvkwggL1AgEBMGcwYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ4wDAYDVQQKEwVDaXNjbzEdMBsGA1UEAxMUTWFudWZhY3R1cmVyIFJvb3QgQ0ECAgfnMAsGCWCGSAFlAwQCAaBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIzMTAzMDA1MzQzNlowLwYJKoZIhvcNAQkEMSIEILHpRHrkDJYBCE25P64H8N+NS9KIX6dNv+GsgiIlczvOMAsGCSqGSIb3DQEBCwSCAgCWYWwfQxlr8OnVJeTe+6gRbiFurOeV9VPQXWjpTHL1ZLYzBkU5f3+Xy9Qqa19D8LIr0VO1W7Qu28og3M4K2sLrDCi50VhThpM+7qOi4qKiGmBkA4qouhedR93Pf98e2qt6pLtqeh+thJ/giF9nd6w2rllOjcTiwbr4zLNbjLPBg+r2FcPzrlfnM1xP6c755VZYXFtF+uPmABWSvwcNyNG2+hy5SUTPeAOEXb5tEfe6ELKCUXbIGxOCQwAM6Bq3heoixVM1WWh7FMgYkPfkVlX13XoLfcALtppmCbgRmxSoeEzi3ZsLwDBIkirbyrTA9FUOX938SmGuLq76bqEgP9X4xF6SiVzUKiRbXIBwW2HWSUtJ6S3QslG/0d2C5wZJ2RSfU++FPyPqbVr1SZl1eE/aluQgbQ966E6ug9UpyP1beGRIjWOR+4qkGEkSLuCDxsxy+KP8icG35gt/Ar0Rlp6tF28YdE0VtUE14mspksJ+tQFoiuieKMM7259asYCkIpe0zRGyeP6macqHWxXh57TwrBpvtOa6jmPQ9JKaupZJTczZwqcUrO5NnHD1Gp2GHaqnVl21ingnXB4AIhL30I72a0KRFjWBFZl4eyJTBId5038XEaRrDVeBBA/RdDsHqAf4xWWg5l4h24oG3qMWQF24VbXkGP/DSelCXi5lTl4GHA==