Merge pull request #113 from stouset/client-ssl-certificates

Client SSL Certificates

lib/reel/ssl_server.rb

@@ -15,13 +15,21 @@ def initialize(server, options = {}, &callback)
       # Ideally we can encapsulate this rather than making Ruby OpenSSL a
       # mandatory part of the Reel API. It would be nice to support
       # alternatives (e.g. Puma's MiniSSL)
-      ssl_context      = OpenSSL::SSL::SSLContext.new
-      ssl_context.cert = OpenSSL::X509::Certificate.new options.fetch(:cert)
-      ssl_context.key  = OpenSSL::PKey::RSA.new options.fetch(:key)
+      ssl_context         = OpenSSL::SSL::SSLContext.new
+      ssl_context.cert    = OpenSSL::X509::Certificate.new options.fetch(:cert)
+      ssl_context.key     = OpenSSL::PKey::RSA.new options.fetch(:key)
 
-      # We don't presently support verifying client certificates
-      # TODO: support client certificates!
-      ssl_context.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      ssl_context.ca_file = options[:ca_file]
+      ssl_context.ca_path = options[:ca_path]
+
+      # if verify_mode isn't explicitly set, verify peers if we've
+      # been provided CA information that would enable us to do so
+      ssl_context.verify_mode = case
+        when options.include?(:verify_mode) then options[:verify_mode]
+        when options.include?(:ca_file)     then OpenSSL::SSL::VERIFY_PEER
+        when options.include?(:ca_path)     then OpenSSL::SSL::VERIFY_PEER
+        else                                     OpenSSL::SSL::VERIFY_NONE
+      end
 
       # wrap an SSLServer around the Reel::Server we've been given
       ssl_server = Celluloid::IO::SSLServer.new(server, ssl_context)

spec/fixtures/ca.crt

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgDCCA2igAwIBAgIJAPs+Pcx3Ws69MA0GCSqGSIb3DQEBBQUAMIGGMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5j
+aXNjbzESMBAGA1UEChMJQ2VsbHVsb2lkMRcwFQYDVQQDEw5jYS5leGFtcGxlLmNv
+bTEdMBsGCSqGSIb3DQEJARYOY2FAZXhhbXBsZS5jb20wHhcNMTMxMTA3MjMwMjMz
+WhcNNDEwMzI0MjMwMjMzWjCBhjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlm
+b3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUNlbGx1bG9p
+ZDEXMBUGA1UEAxMOY2EuZXhhbXBsZS5jb20xHTAbBgkqhkiG9w0BCQEWDmNhQGV4
+YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA48syWpTE
+uZexHJJKTgfdTA/eXkUEh6QM/NcclLARJVT5YWlfQigOAkSowBTIBlsxiMPPUITY
+kBEbWNz6mlVYehQlxISG6gc1b90S+aj+hWPX9oWvQUrUboQZZtgxZf817MElxP5G
+JAtNKlGGj6gKYyM/4ir8TXRJ9SHta4xeVrrqm7/pdh5uaE3cBAJv0usRK/uQxh1N
+woGAq6iCpwImnjx6SNrs1MoJo/F2nmdEcODaCLTVTY08hp/v+cVPCONMEvuJRUnu
+O7ytR6ym1/3MufHg3Xv6OwnfXqh/czZ6tD+ncH5bAHnmZOvT2OA8y68yxTnIshcT
+wE7x+RBDRMCBhwIDAQABo4HuMIHrMB0GA1UdDgQWBBSqhnwm0V/WWAQcB9xXM7W6
+s2gtrDCBuwYDVR0jBIGzMIGwgBSqhnwm0V/WWAQcB9xXM7W6s2gtrKGBjKSBiTCB
+hjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
+biBGcmFuY2lzY28xEjAQBgNVBAoTCUNlbGx1bG9pZDEXMBUGA1UEAxMOY2EuZXhh
+bXBsZS5jb20xHTAbBgkqhkiG9w0BCQEWDmNhQGV4YW1wbGUuY29tggkA+z49zHda
+zr0wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEA0MMwHKw76n3Y+ybJ
+WkOf9Qpu2/FDsQ0aMc5a/Z0cvrEx6xqcNDRmov+ikNClaClgfXG4gb+xWor8Y4fD
+jpyaLL5X3G7ThseDjH6575UT1KjJ0team4XCx6zpLoKzLDW2sM1tAnNAXMGEnZ1R
+HsJQdHuVTVekwuLcnrfnrfm395CLfMaOUaJw4ZsJmKyoHM03/80LNme+bjVJ+vh+
+1vE2t2c86WprrNQIryseqwz08DAuSPjezuIsSd5sARuOw3ggC3xhEkVJDJY2lIMh
+gxi384M84LBbGjvQdKbdxkWcvfD5hgEva9I8I2yXVyRoQrUWHnVRlL87PUmkRvLT
+HC7SFg==
+-----END CERTIFICATE-----

spec/fixtures/ca.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA48syWpTEuZexHJJKTgfdTA/eXkUEh6QM/NcclLARJVT5YWlf
+QigOAkSowBTIBlsxiMPPUITYkBEbWNz6mlVYehQlxISG6gc1b90S+aj+hWPX9oWv
+QUrUboQZZtgxZf817MElxP5GJAtNKlGGj6gKYyM/4ir8TXRJ9SHta4xeVrrqm7/p
+dh5uaE3cBAJv0usRK/uQxh1NwoGAq6iCpwImnjx6SNrs1MoJo/F2nmdEcODaCLTV
+TY08hp/v+cVPCONMEvuJRUnuO7ytR6ym1/3MufHg3Xv6OwnfXqh/czZ6tD+ncH5b
+AHnmZOvT2OA8y68yxTnIshcTwE7x+RBDRMCBhwIDAQABAoIBAHQ038434JfxW6gA
+tSlTd8Bqw/0BZosv1HRT5L+xhj2uOL5J/A+K0YK0tgWvVE9xzDZB9gvUiYoNQA84
+RBvheA5nItE67nyLCuazOA/m91jjE3QuxLYhT3fFqhO+LI0lAcRy0CrLsMqIfWge
+SPAWQJ5MiDV/ylBVB7mnAjCAXkwNfi3LYuoBa5tX9HmN7kDFpqN0KyFav/3Bsij5
+JUwxAHjWbSH61TLjA4WpvyKTARW3uhInjwj+CMRszfyH//h7lwFba5YbebXjfdFP
+PsOS8lc/puqrjf7ZS/lPcL8xTElrcDr5oMtOBEoU+y2W+Gz5tpNQHCRIpq71CwEv
+/VdicoECgYEA/CyGXfVv3GULb4BQbKJqIKa17uv9nVDxc3VUoelhN40WshKOt4zd
+03x0or1f/LymEijj2K/rKt6T1kbKIrw1FFG7HiFdX1AUBkP4q1gDBoGohSsOdcRQ
+pFIdz9ViOn5F5+iJrRT3yDhJAL0kG/YSfqwsaafQqPzpgY9Ig3uIb0cCgYEA5z/5
+4tBKT6ps0ppLyK8NqpRtSK5ZWiy+N4kbNKEgaXOkRxZUXJBlRGoMe/E+wDLHsDza
+X3jwkFUCXXRM2PihwYWdZjCWo6ktorZzNd0fceAXkgeCi+FigfTweqe2zjq1s8BU
+FrNGo/06lC2JWKHVbke5hcBeyjRVPp/8Jnzm+8ECgYAG8/dUeeL2sbaKAYC2Lhg9
+BDu59bnNb6DorRCDUlsC3BoHGOnkd7baEPFqV0xhPJZbo9L8c4VJbk+nNdZ29LeF
+8ub04rifWybiMVeW6dtTf5m06kYAy0Pp8/WseFa4BClLRqcdJZnbZGnm4lAvkS5b
+XcXvt9fSAP8zOk8miO5vGwKBgQDbBuxumKwZwqip3Ly0yqDeFRFhSsmUsFZGEZV0
+BrzFRGOvdQXYWmegIfXLGtc9gZtDYI/Q56KqgenojDQROYUz35MSbCjxwFZaDAcZ
+WGPlHsQUawqJ5KLBxjZTZjCuKktZgmviyFC7GCj4mhzBlx6pAkRE28ysJl8rHqrb
+5Wd9wQKBgQCX6cLNz8HzBzJDBcZN/0ipqdSSNj4GCVaZCD2S+2uqAvwEud/0slRo
+1Pgi9o9BXSq6TGnXX6zcoWWXbMnlC2Oq61FFI+Q0+DnHxwwhasrULKTmeHzLN84s
+QMUVu3CbaokYg2VBKPiyW2sLE3KOBViO1cQFBFvcPIMwoB9BzeG6ig==
+-----END RSA PRIVATE KEY-----

spec/fixtures/client.crt

@@ -1,22 +1,83 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=California, L=San Francisco, O=Celluloid, CN=ca.example.com/emailAddress=ca@example.com
+        Validity
+            Not Before: Nov  7 23:23:12 2013 GMT
+            Not After : Nov  7 23:23:12 2014 GMT
+        Subject: C=US, ST=California, O=Celluloid, CN=client.example.com/emailAddress=client@example.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d5:eb:3c:e9:90:02:17:e0:58:a3:9f:2b:57:f3:
+                    81:a0:1d:bf:21:61:d3:49:02:7f:bd:83:9e:d7:1a:
+                    ba:ad:00:7e:81:94:ba:00:34:59:78:9f:ff:b2:9c:
+                    44:30:06:a9:6b:36:77:ec:b4:fa:df:ee:c3:de:cf:
+                    2b:67:b5:25:72:b9:f4:84:f8:b1:94:18:12:40:fe:
+                    3c:a3:40:23:1c:11:ef:3e:e1:b7:ce:0b:66:61:0a:
+                    9b:e7:23:67:4a:34:ac:2c:98:cf:83:c9:6b:3f:3d:
+                    59:7b:5c:40:19:17:63:f8:89:0f:1e:18:b5:45:8e:
+                    98:7e:28:0f:c3:ef:d7:07:90:87:86:b7:81:44:03:
+                    8c:49:5a:a2:9f:f8:a8:df:b7:1a:35:70:1a:8b:c7:
+                    67:54:8a:e7:11:2f:bb:6f:6b:78:a7:80:0a:98:4a:
+                    cf:e2:f3:68:ca:2c:69:63:ed:f7:51:33:2b:4e:c7:
+                    ce:cd:86:cd:f9:45:6a:6e:eb:a9:7b:86:fa:5e:b7:
+                    1d:ed:db:05:36:a1:b2:8e:cc:a8:52:e3:27:1a:67:
+                    60:29:b4:40:cd:5c:a6:81:4d:0e:65:7a:34:91:c4:
+                    50:42:a5:84:2d:aa:69:1d:d1:b3:06:fd:3e:59:7d:
+                    70:b8:e5:ac:63:f5:ad:ab:8f:c0:0a:65:cb:7e:98:
+                    b0:b3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                74:EA:7C:F5:79:ED:5A:ED:B3:95:13:1C:5A:1A:C8:2E:63:12:EF:5D
+            X509v3 Authority Key Identifier: 
+                keyid:AA:86:7C:26:D1:5F:D6:58:04:1C:07:DC:57:33:B5:BA:B3:68:2D:AC
+
+    Signature Algorithm: sha1WithRSAEncryption
+        38:9d:aa:2c:40:cf:a2:79:0e:17:a1:4b:07:0e:8f:c9:8b:5f:
+        8c:d4:34:14:00:e0:df:7d:9a:a4:d2:ec:b2:3f:ca:a4:e5:31:
+        03:17:74:3e:03:56:69:3d:d0:c4:fc:e9:11:62:63:3d:02:24:
+        37:f0:50:bf:c1:4e:a8:6f:e3:7d:24:16:9e:2d:cf:93:f3:c2:
+        ba:4a:76:f4:09:d9:44:44:80:19:5a:16:f5:b4:8c:13:bf:0a:
+        19:e9:2b:6f:e0:eb:d6:8a:f3:b3:1d:ba:46:51:7c:44:df:11:
+        af:59:a1:2b:d4:58:6d:a8:28:47:26:7a:af:84:30:0f:a0:91:
+        0b:94:f0:2a:a5:9e:2b:19:af:0c:16:34:fd:49:0c:ee:8d:31:
+        00:9f:b8:00:dc:9b:9f:38:b0:c0:c1:37:37:96:9a:18:07:b0:
+        c6:50:ff:28:3b:f7:84:8e:d5:b3:df:97:4f:91:c0:91:a4:af:
+        f8:a0:ef:83:0c:37:1b:2c:aa:57:66:1c:cf:89:28:5e:b9:33:
+        ab:87:35:78:e7:10:64:90:22:35:e8:02:cf:61:71:52:5a:84:
+        3a:1e:8a:71:cb:c2:63:32:c4:e8:d6:1b:ff:d5:18:18:50:b7:
+        c6:8c:c2:32:eb:7e:5e:44:b0:e2:03:5d:30:07:6b:ae:09:83:
+        a3:26:f1:78
 -----BEGIN CERTIFICATE-----
-MIIDmjCCAoICCQDwZ8yE/0n4PjANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMC
-VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
-EjAQBgNVBAoTCUNlbGx1bG9pZDEbMBkGA1UEAxMSY2xpZW50LmV4YW1wbGUuY29t
-MSEwHwYJKoZIhvcNAQkBFhJjbGllbnRAZXhhbXBsZS5jb20wHhcNMTIxMTI1MTkx
-NjI2WhcNMjIxMTIzMTkxNjI2WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
-bGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUNlbGx1
-bG9pZDEbMBkGA1UEAxMSY2xpZW50LmV4YW1wbGUuY29tMSEwHwYJKoZIhvcNAQkB
-FhJjbGllbnRAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDV6zzpkAIX4FijnytX84GgHb8hYdNJAn+9g57XGrqtAH6BlLoANFl4n/+y
-nEQwBqlrNnfstPrf7sPezytntSVyufSE+LGUGBJA/jyjQCMcEe8+4bfOC2ZhCpvn
-I2dKNKwsmM+DyWs/PVl7XEAZF2P4iQ8eGLVFjph+KA/D79cHkIeGt4FEA4xJWqKf
-+Kjftxo1cBqLx2dUiucRL7tva3ingAqYSs/i82jKLGlj7fdRMytOx87Nhs35RWpu
-66l7hvpetx3t2wU2obKOzKhS4ycaZ2AptEDNXKaBTQ5lejSRxFBCpYQtqmkd0bMG
-/T5ZfXC45axj9a2rj8AKZct+mLCzAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAHzr
-b4VTktAi+8baGRJCXupt0Ari8ffoWhsYerELFLQF7K2sluxOqCsGEEF21e99fZxP
-lisLi0DIQ7cNlOGjRJ3xaydE74Fsry3xBNKoR8I7OMr9VFsrC54tc0x7NQ7bRHy6
-kCjSwKN4I2KWJjQ8yf8mIalmUKOmb/hirzna8io4CiDeJGZ1XNAQ9dl1RHRW442G
-GTu2ofAtU8TlzilZyclMY/lN7whw7sKP+pPr6fpAOJZsR64IzbBcWHHjJhx70XOx
-jnd5FB1oXnuupgPqEKmatSCytrue8GTkanB8VZ6+Zd/4XgTkie3UtCZW8R+NL/Lo
-us/+Ks3WIDyYdPSPnbE=
+MIID8zCCAtugAwIBAgIBATANBgkqhkiG9w0BAQUFADCBhjELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQ
+BgNVBAoTCUNlbGx1bG9pZDEXMBUGA1UEAxMOY2EuZXhhbXBsZS5jb20xHTAbBgkq
+hkiG9w0BCQEWDmNhQGV4YW1wbGUuY29tMB4XDTEzMTEwNzIzMjMxMloXDTE0MTEw
+NzIzMjMxMlowdjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEjAQ
+BgNVBAoTCUNlbGx1bG9pZDEbMBkGA1UEAxMSY2xpZW50LmV4YW1wbGUuY29tMSEw
+HwYJKoZIhvcNAQkBFhJjbGllbnRAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDV6zzpkAIX4FijnytX84GgHb8hYdNJAn+9g57XGrqt
+AH6BlLoANFl4n/+ynEQwBqlrNnfstPrf7sPezytntSVyufSE+LGUGBJA/jyjQCMc
+Ee8+4bfOC2ZhCpvnI2dKNKwsmM+DyWs/PVl7XEAZF2P4iQ8eGLVFjph+KA/D79cH
+kIeGt4FEA4xJWqKf+Kjftxo1cBqLx2dUiucRL7tva3ingAqYSs/i82jKLGlj7fdR
+MytOx87Nhs35RWpu66l7hvpetx3t2wU2obKOzKhS4ycaZ2AptEDNXKaBTQ5lejSR
+xFBCpYQtqmkd0bMG/T5ZfXC45axj9a2rj8AKZct+mLCzAgMBAAGjezB5MAkGA1Ud
+EwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmlj
+YXRlMB0GA1UdDgQWBBR06nz1ee1a7bOVExxaGsguYxLvXTAfBgNVHSMEGDAWgBSq
+hnwm0V/WWAQcB9xXM7W6s2gtrDANBgkqhkiG9w0BAQUFAAOCAQEAOJ2qLEDPonkO
+F6FLBw6PyYtfjNQ0FADg332apNLssj/KpOUxAxd0PgNWaT3QxPzpEWJjPQIkN/BQ
+v8FOqG/jfSQWni3Pk/PCukp29AnZRESAGVoW9bSME78KGekrb+Dr1orzsx26RlF8
+RN8Rr1mhK9RYbagoRyZ6r4QwD6CRC5TwKqWeKxmvDBY0/UkM7o0xAJ+4ANybnziw
+wME3N5aaGAewxlD/KDv3hI7Vs9+XT5HAkaSv+KDvgww3GyyqV2Ycz4koXrkzq4c1
+eOcQZJAiNegCz2FxUlqEOh6KccvCYzLE6NYb/9UYGFC3xozCMut+XkSw4gNdMAdr
+rgmDoybxeA==
 -----END CERTIFICATE-----

spec/fixtures/client.unsigned.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDmjCCAoICCQDwZ8yE/0n4PjANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMC
+VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
+EjAQBgNVBAoTCUNlbGx1bG9pZDEbMBkGA1UEAxMSY2xpZW50LmV4YW1wbGUuY29t
+MSEwHwYJKoZIhvcNAQkBFhJjbGllbnRAZXhhbXBsZS5jb20wHhcNMTIxMTI1MTkx
+NjI2WhcNMjIxMTIzMTkxNjI2WjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
+bGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUNlbGx1
+bG9pZDEbMBkGA1UEAxMSY2xpZW50LmV4YW1wbGUuY29tMSEwHwYJKoZIhvcNAQkB
+FhJjbGllbnRAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDV6zzpkAIX4FijnytX84GgHb8hYdNJAn+9g57XGrqtAH6BlLoANFl4n/+y
+nEQwBqlrNnfstPrf7sPezytntSVyufSE+LGUGBJA/jyjQCMcEe8+4bfOC2ZhCpvn
+I2dKNKwsmM+DyWs/PVl7XEAZF2P4iQ8eGLVFjph+KA/D79cHkIeGt4FEA4xJWqKf
++Kjftxo1cBqLx2dUiucRL7tva3ingAqYSs/i82jKLGlj7fdRMytOx87Nhs35RWpu
+66l7hvpetx3t2wU2obKOzKhS4ycaZ2AptEDNXKaBTQ5lejSRxFBCpYQtqmkd0bMG
+/T5ZfXC45axj9a2rj8AKZct+mLCzAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAHzr
+b4VTktAi+8baGRJCXupt0Ari8ffoWhsYerELFLQF7K2sluxOqCsGEEF21e99fZxP
+lisLi0DIQ7cNlOGjRJ3xaydE74Fsry3xBNKoR8I7OMr9VFsrC54tc0x7NQ7bRHy6
+kCjSwKN4I2KWJjQ8yf8mIalmUKOmb/hirzna8io4CiDeJGZ1XNAQ9dl1RHRW442G
+GTu2ofAtU8TlzilZyclMY/lN7whw7sKP+pPr6fpAOJZsR64IzbBcWHHjJhx70XOx
+jnd5FB1oXnuupgPqEKmatSCytrue8GTkanB8VZ6+Zd/4XgTkie3UtCZW8R+NL/Lo
+us/+Ks3WIDyYdPSPnbE=
+-----END CERTIFICATE-----

spec/fixtures/server.crt

@@ -1,22 +1,82 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=California, L=San Francisco, O=Celluloid, CN=ca.example.com/emailAddress=ca@example.com
+        Validity
+            Not Before: Nov  7 23:33:55 2013 GMT
+            Not After : Nov  7 23:33:55 2014 GMT
+        Subject: C=US, ST=California, O=Celluloid, CN=127.0.0.1/emailAddress=server@example.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:a9:2e:cd:d7:83:4d:11:b6:81:b8:f9:22:9a:68:
+                    d7:f0:e8:3b:de:f5:dd:0a:92:0d:02:35:f5:3c:02:
+                    cc:4e:81:32:14:d5:0b:bc:b3:e6:f3:2a:4a:9e:eb:
+                    a3:5f:09:ae:93:f1:53:e9:93:d5:5b:22:51:76:38:
+                    d7:60:63:8a:3c:9a:e5:75:ab:e9:92:ea:3d:87:0c:
+                    0b:56:3e:20:e3:3f:ef:58:3b:01:9f:fc:34:f7:2e:
+                    14:9b:83:c9:3e:6a:52:f6:72:a7:bb:07:55:cd:52:
+                    c3:45:12:f4:3e:c9:02:e5:8f:d3:16:29:be:e7:6d:
+                    80:cc:f1:aa:9d:bf:8e:8a:1a:80:e3:f6:ff:6b:7e:
+                    6e:10:88:ac:08:07:ab:bf:2a:84:06:db:66:05:ee:
+                    c4:f8:3b:8e:23:53:fb:b6:d3:17:26:de:b5:75:12:
+                    58:34:80:2f:d4:3f:f6:2a:9e:e3:0f:09:96:1c:2b:
+                    f6:7d:bd:81:ad:0c:9e:86:f0:e6:03:70:f6:52:64:
+                    17:64:aa:57:df:85:80:6c:b1:28:f7:47:bb:13:0a:
+                    aa:21:e2:6b:34:f2:e9:1c:1b:27:1b:bd:43:be:71:
+                    6a:cf:2a:79:b2:4a:c1:9a:09:8b:46:92:9e:d0:b0:
+                    7d:5e:73:b4:06:03:4d:61:64:bd:b2:2f:c0:ae:24:
+                    c5:1b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                B3:4D:7D:A4:A3:AC:8D:B7:7A:F6:EC:6E:25:60:CE:64:D2:2E:AC:AC
+            X509v3 Authority Key Identifier: 
+                keyid:AA:86:7C:26:D1:5F:D6:58:04:1C:07:DC:57:33:B5:BA:B3:68:2D:AC
+
+    Signature Algorithm: sha1WithRSAEncryption
+        2b:fa:71:6f:e8:27:af:93:b8:2c:15:53:9d:00:15:25:0d:db:
+        33:ac:83:a7:a6:10:b0:d3:ca:7c:57:ae:d9:ca:4f:92:92:fe:
+        bd:3e:7d:59:af:33:59:1e:01:31:7c:01:7f:43:66:f3:96:84:
+        d6:20:e2:6d:69:61:eb:28:e9:b4:0c:9d:59:76:04:44:a1:0e:
+        76:7e:b5:d8:a8:30:7c:2a:82:63:ee:dc:34:56:26:e7:08:65:
+        7b:0e:31:33:f9:06:4a:51:4e:1a:e5:1a:5e:51:3c:d0:00:b2:
+        6a:6d:3c:c3:80:77:34:1a:0d:51:20:fc:5b:0b:e3:68:a0:3e:
+        72:10:b2:f7:7e:5d:a3:40:96:46:fe:e6:24:59:57:30:ab:6e:
+        00:e4:eb:92:87:23:8e:17:d7:03:bf:59:04:82:52:05:76:fb:
+        d3:da:a2:a0:05:41:97:71:6d:29:04:ad:1a:f3:49:38:dc:8b:
+        cb:34:fe:5b:b4:0b:c4:18:e5:52:a7:20:d6:2d:6a:b0:cd:6f:
+        17:87:8a:4f:6b:8f:43:50:ab:7b:2c:db:a3:be:09:24:a9:64:
+        6e:c4:13:16:e9:83:bf:a3:45:a9:f1:27:85:ce:f7:70:0c:37:
+        2f:25:8a:1e:b0:76:70:69:83:d2:ec:69:aa:ee:86:7e:4c:c9:
+        71:d7:5c:37
 -----BEGIN CERTIFICATE-----
-MIIDmjCCAoICCQD+dJ16wNIKnzANBgkqhkiG9w0BAQUFADCBjjELMAkGA1UEBhMC
-VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
-EjAQBgNVBAoTCUNlbGx1bG9pZDEbMBkGA1UEAxMSc2VydmVyLmV4YW1wbGUuY29t
-MSEwHwYJKoZIhvcNAQkBFhJzZXJ2ZXJAZXhhbXBsZS5jb20wHhcNMTIxMTI1MTkx
-NjAwWhcNMjIxMTIzMTkxNjAwWjCBjjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
-bGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQBgNVBAoTCUNlbGx1
-bG9pZDEbMBkGA1UEAxMSc2VydmVyLmV4YW1wbGUuY29tMSEwHwYJKoZIhvcNAQkB
-FhJzZXJ2ZXJAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQCpLs3Xg00RtoG4+SKaaNfw6Dve9d0Kkg0CNfU8AsxOgTIU1Qu8s+bzKkqe
-66NfCa6T8VPpk9VbIlF2ONdgY4o8muV1q+mS6j2HDAtWPiDjP+9YOwGf/DT3LhSb
-g8k+alL2cqe7B1XNUsNFEvQ+yQLlj9MWKb7nbYDM8aqdv46KGoDj9v9rfm4QiKwI
-B6u/KoQG22YF7sT4O44jU/u20xcm3rV1Elg0gC/UP/YqnuMPCZYcK/Z9vYGtDJ6G
-8OYDcPZSZBdkqlffhYBssSj3R7sTCqoh4ms08ukcGycbvUO+cWrPKnmySsGaCYtG
-kp7QsH1ec7QGA01hZL2yL8CuJMUbAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBABE4
-gYVSdC87NhpA49k0vcLLU7v7mU3a3no/vu1CIqQxzx8/xh26Qi3aGb1s9MgHpF2Z
-NiB1irXER2tyz/F3qCi8OCo7eNsndmDjj4GnkBjEPTtqRxH9imRWw4bJyqwqFHcu
-1kczCZa+2VFQFEL4ErGycPFKM59ppTcJ0IxbK7PCGzO75TRQoAl52+3Aob+oejPP
-qFbiqNlV1T3EKa5yLdvOC5sLrEcfm3iMxmOtNVzp9OBhjXfm8Q1zgYs4VyJXzLMK
-wf956w2YEbpTAAzNc53zly/Jhr4MnFsa9Mn1oYp9Rfjzw/qJtXw+a3PtEKrO4XNe
-TsKHsAkj8XvUrhliiNQ=
+MIID6jCCAtKgAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBhjELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEjAQ
+BgNVBAoTCUNlbGx1bG9pZDEXMBUGA1UEAxMOY2EuZXhhbXBsZS5jb20xHTAbBgkq
+hkiG9w0BCQEWDmNhQGV4YW1wbGUuY29tMB4XDTEzMTEwNzIzMzM1NVoXDTE0MTEw
+NzIzMzM1NVowbTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEjAQ
+BgNVBAoTCUNlbGx1bG9pZDESMBAGA1UEAxMJMTI3LjAuMC4xMSEwHwYJKoZIhvcN
+AQkBFhJzZXJ2ZXJAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCpLs3Xg00RtoG4+SKaaNfw6Dve9d0Kkg0CNfU8AsxOgTIU1Qu8s+bz
+Kkqe66NfCa6T8VPpk9VbIlF2ONdgY4o8muV1q+mS6j2HDAtWPiDjP+9YOwGf/DT3
+LhSbg8k+alL2cqe7B1XNUsNFEvQ+yQLlj9MWKb7nbYDM8aqdv46KGoDj9v9rfm4Q
+iKwIB6u/KoQG22YF7sT4O44jU/u20xcm3rV1Elg0gC/UP/YqnuMPCZYcK/Z9vYGt
+DJ6G8OYDcPZSZBdkqlffhYBssSj3R7sTCqoh4ms08ukcGycbvUO+cWrPKnmySsGa
+CYtGkp7QsH1ec7QGA01hZL2yL8CuJMUbAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ
+YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud
+DgQWBBSzTX2ko6yNt3r27G4lYM5k0i6srDAfBgNVHSMEGDAWgBSqhnwm0V/WWAQc
+B9xXM7W6s2gtrDANBgkqhkiG9w0BAQUFAAOCAQEAK/pxb+gnr5O4LBVTnQAVJQ3b
+M6yDp6YQsNPKfFeu2cpPkpL+vT59Wa8zWR4BMXwBf0Nm85aE1iDibWlh6yjptAyd
+WXYERKEOdn612KgwfCqCY+7cNFYm5whlew4xM/kGSlFOGuUaXlE80ACyam08w4B3
+NBoNUSD8WwvjaKA+chCy935do0CWRv7mJFlXMKtuAOTrkocjjhfXA79ZBIJSBXb7
+09qioAVBl3FtKQStGvNJONyLyzT+W7QLxBjlUqcg1i1qsM1vF4eKT2uPQ1Creyzb
+o74JJKlkbsQTFumDv6NFqfEnhc73cAw3LyWKHrB2cGmD0uxpqu6GfkzJcddcNw==
 -----END CERTIFICATE-----