add kaniko, multiple mtls CA

salrashid123 · Apr 24, 2023 · 41107bb · 41107bb
1 parent 514baae
commit 41107bb
Show file tree

Hide file tree

Showing 43 changed files with 1,757 additions and 899 deletions.
diff --git a/README.md b/README.md
diff --git a/.goreleaser.yml → app/.goreleaser.yml b/.goreleaser.yml → app/.goreleaser.yml
@@ -24,7 +24,6 @@ builds:
       - v1
     targets:
       - linux_amd64_v1
-    dir: ./app
     binary: confidential_space
     builder: go
     gobinary: go

diff --git a/app/BUILD.bazel b/app/BUILD.bazel
@@ -28,9 +28,15 @@ container_image(
     files = [
         ":main",
         ":config.json",
-        "//certs:tls-ca-chain.pem",
-        "//certs:tee.crt",
-        "//certs:tee.key",               
+        "//certs:root-ca-operator.crt",
+        "//certs:tee-operator.crt",
+        "//certs:tee-operator.key",
+        "//certs:root-ca-collaborator1.crt",
+        "//certs:tee-collaborator1.crt",
+        "//certs:tee-collaborator1.key",
+        "//certs:root-ca-collaborator2.crt",
+        "//certs:tee-collaborator2.crt",
+        "//certs:tee-collaborator2.key",
     ],
     ports = ["8081"],
     repository = "us-central1-docker.pkg.dev/builder-project/repo1/tee",
@@ -42,7 +48,7 @@ go_library(
         "main.go",
         "claims.go",
     ],
-    importpath = "main",
+    importpath = "github.com/salrashid123/confidential_space/app",
     visibility = ["//visibility:private"],
     deps = [
         "@org_golang_x_oauth2//google:go_default_library",

diff --git a/app/Dockerfile b/app/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.19 as build
+FROM golang@sha256:9f2dd04486e84eec72d945b077d568976981d9afed8b4e2aeb08f7ab739292b3 as build
 
 WORKDIR /go/src/app
 COPY . .
@@ -17,9 +17,17 @@ LABEL "tee.launch_policy.log_redirect"="always"
 COPY --from=build /go/bin/server /
 COPY --from=build /go/src/app/config.json /config.json
 
-COPY --from=build /go/src/app/certs/tls-ca-chain.pem /tls-ca-chain.pem
-COPY --from=build /go/src/app/certs/tee.crt /tee.crt
-COPY --from=build /go/src/app/certs/tee.key /tee.key
+COPY --from=build /go/src/app/certs/root-ca-operator.crt /root-ca-operator.crt
+COPY --from=build /go/src/app/certs/tee-operator.crt /tee-operator.crt
+COPY --from=build /go/src/app/certs/tee-operator.key /tee-operator.key
+
+COPY --from=build /go/src/app/certs/root-ca-collaborator1.crt /root-ca-collaborator1.crt
+COPY --from=build /go/src/app/certs/tee-collaborator1.crt /tee-collaborator1.crt
+COPY --from=build /go/src/app/certs/tee-collaborator1.key /tee-collaborator1.key
+
+COPY --from=build /go/src/app/certs/root-ca-collaborator2.crt /root-ca-collaborator2.crt
+COPY --from=build /go/src/app/certs/tee-collaborator2.crt /tee-collaborator2.crt
+COPY --from=build /go/src/app/certs/tee-collaborator2.key /tee-collaborator2.key
 
 EXPOSE 8081
 

diff --git a/app/certs/BUILD.bazel b/app/certs/BUILD.bazel
@@ -1,5 +1,11 @@
 exports_files([
-    "tls-ca-chain.pem",
-    "tee.crt",
-    "tee.key",
-    ])
+    "root-ca-operator.crt",
+    "tee-operator.crt",
+    "tee-operator.key",
+    "root-ca-collaborator1.crt",
+    "tee-collaborator1.crt",
+    "tee-collaborator1.key",
+    "root-ca-collaborator2.crt",
+    "tee-collaborator2.crt",
+    "tee-collaborator2.key",
+    ])
diff --git a/app/certs/root-ca-collaborator1.crt b/app/certs/root-ca-collaborator1.crt
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, O=Collaborator 1, OU=Enterprise, CN=Collaborator 1 Root CA
+        Validity
+            Not Before: Apr 17 12:02:50 2023 GMT
+            Not After : Apr 16 12:02:50 2033 GMT
+        Subject: C=US, O=Collaborator 1, OU=Enterprise, CN=Collaborator 1 Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b3:3b:c1:b5:97:bb:f4:97:03:dd:71:bc:b4:83:
+                    f3:bb:a3:62:e3:f7:b8:ed:3f:e7:ab:28:06:f4:7e:
+                    55:3e:6a:27:7e:4b:bf:4d:df:c2:d8:87:18:23:36:
+                    75:3a:0c:31:4f:96:c6:03:a8:f1:78:c8:10:f1:89:
+                    d6:2b:89:d9:4a:0b:ae:41:d9:62:d0:37:61:e2:ef:
+                    db:34:ab:77:82:ae:81:e2:95:cf:cc:ca:ed:e1:0d:
+                    ae:cb:c1:01:7d:a6:af:6c:6f:bf:35:fe:1b:e1:ea:
+                    d3:56:fa:9f:24:7f:7b:42:2a:f8:16:98:31:51:1b:
+                    0e:d1:f6:62:ad:28:28:ab:ab:a4:1d:20:ba:6a:11:
+                    13:6b:7e:c5:7d:7a:e0:8c:b4:2f:b9:81:7c:73:bf:
+                    37:bd:60:6d:88:9b:42:79:a7:36:e9:58:5d:93:21:
+                    5f:b7:8e:44:85:8b:fa:d0:70:a2:81:45:87:b2:70:
+                    55:08:d2:d4:dc:8f:2c:89:91:ac:4f:6c:c7:45:28:
+                    25:3d:67:49:27:ef:36:fc:de:e2:f1:04:15:50:34:
+                    cd:e4:39:f2:87:bb:72:9d:e0:66:e1:e3:7b:6f:e5:
+                    9a:1b:b5:2b:6b:5b:28:76:c9:7f:e8:f3:9d:a9:80:
+                    88:55:07:58:ad:b5:13:e6:09:75:44:68:02:75:7b:
+                    41:1d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                75:0D:12:CC:DB:33:ED:58:06:8C:AD:ED:0E:9E:2F:00:E9:6F:C1:65
+            X509v3 Authority Key Identifier: 
+                75:0D:12:CC:DB:33:ED:58:06:8C:AD:ED:0E:9E:2F:00:E9:6F:C1:65
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            Authority Information Access: 
+                OCSP - URI:http://localhost:9999/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        94:dc:12:a7:97:bb:2b:88:30:77:97:22:66:7c:6c:a7:ee:87:
+        57:e7:71:9c:4c:3c:5e:09:7c:20:a0:39:43:cc:74:22:b0:80:
+        50:f8:a2:d6:f9:8b:18:96:4b:e8:4e:97:5a:8e:e0:f7:37:b4:
+        42:7e:5e:d4:bc:26:0e:b8:7e:80:b2:7d:00:5b:b4:df:75:fb:
+        d3:5e:cf:ab:25:95:90:75:a7:56:89:74:e5:93:b7:dd:6d:e4:
+        39:6d:29:48:99:69:2a:22:40:39:57:ea:f0:c9:c1:ee:56:ab:
+        0f:ac:96:a5:eb:db:b8:f6:04:45:78:da:ff:05:9d:d7:52:2a:
+        d6:60:6b:57:64:8c:ec:a0:76:3c:f2:95:7a:d9:bf:af:8b:2b:
+        fd:28:05:a1:23:75:e7:bd:a0:ff:fc:35:3a:11:89:bc:72:df:
+        58:b6:7a:39:15:74:5b:d6:36:63:72:11:0b:db:e7:fe:4f:cb:
+        38:84:fa:37:8b:4c:6b:2d:e9:71:54:fa:cc:1b:34:98:67:d3:
+        be:4a:92:f7:00:21:f3:db:39:4a:d2:eb:2c:d1:69:62:0c:13:
+        f3:79:94:f0:23:3f:bd:00:29:13:f7:57:f8:0f:47:b3:13:25:
+        20:a7:70:55:8f:c0:1c:37:ea:66:21:ee:a4:f1:a5:e6:3c:1a:
+        1e:dd:bc:97
+-----BEGIN CERTIFICATE-----
+MIID6zCCAtOgAwIBAgIBATANBgkqhkiG9w0BAQsFADBcMQswCQYDVQQGEwJVUzEX
+MBUGA1UECgwOQ29sbGFib3JhdG9yIDExEzARBgNVBAsMCkVudGVycHJpc2UxHzAd
+BgNVBAMMFkNvbGxhYm9yYXRvciAxIFJvb3QgQ0EwHhcNMjMwNDE3MTIwMjUwWhcN
+MzMwNDE2MTIwMjUwWjBcMQswCQYDVQQGEwJVUzEXMBUGA1UECgwOQ29sbGFib3Jh
+dG9yIDExEzARBgNVBAsMCkVudGVycHJpc2UxHzAdBgNVBAMMFkNvbGxhYm9yYXRv
+ciAxIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzO8G1
+l7v0lwPdcby0g/O7o2Lj97jtP+erKAb0flU+aid+S79N38LYhxgjNnU6DDFPlsYD
+qPF4yBDxidYridlKC65B2WLQN2Hi79s0q3eCroHilc/Myu3hDa7LwQF9pq9sb781
+/hvh6tNW+p8kf3tCKvgWmDFRGw7R9mKtKCirq6QdILpqERNrfsV9euCMtC+5gXxz
+vze9YG2Im0J5pzbpWF2TIV+3jkSFi/rQcKKBRYeycFUI0tTcjyyJkaxPbMdFKCU9
+Z0kn7zb83uLxBBVQNM3kOfKHu3Kd4Gbh43tv5ZobtStrWyh2yX/o852pgIhVB1it
+tRPmCXVEaAJ1e0EdAgMBAAGjgbcwgbQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
+/wQFMAMBAf8wHQYDVR0OBBYEFHUNEszbM+1YBoyt7Q6eLwDpb8FlMB8GA1UdIwQY
+MBaAFHUNEszbM+1YBoyt7Q6eLwDpb8FlMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
+BgEFBQcDAjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9sb2Nh
+bGhvc3Q6OTk5OS8wDQYJKoZIhvcNAQELBQADggEBAJTcEqeXuyuIMHeXImZ8bKfu
+h1fncZxMPF4JfCCgOUPMdCKwgFD4otb5ixiWS+hOl1qO4Pc3tEJ+XtS8Jg64foCy
+fQBbtN91+9Nez6sllZB1p1aJdOWTt91t5DltKUiZaSoiQDlX6vDJwe5Wqw+slqXr
+27j2BEV42v8FnddSKtZga1dkjOygdjzylXrZv6+LK/0oBaEjdee9oP/8NToRibxy
+31i2ejkVdFvWNmNyEQvb5/5PyziE+jeLTGst6XFU+swbNJhn075KkvcAIfPbOUrS
+6yzRaWIME/N5lPAjP70AKRP3V/gPR7MTJSCncFWPwBw36mYh7qTxpeY8Gh7dvJc=
+-----END CERTIFICATE-----
diff --git a/app/certs/root-ca-collaborator2.crt b/app/certs/root-ca-collaborator2.crt
@@ -0,0 +1,86 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, O=Collaborator 2, OU=Enterprise, CN=Collaborator 2 Root CA
+        Validity
+            Not Before: Apr 17 12:13:03 2023 GMT
+            Not After : Apr 16 12:13:03 2033 GMT
+        Subject: C=US, O=Collaborator 2, OU=Enterprise, CN=Collaborator 2 Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a8:62:b9:73:8b:c7:2e:d0:fe:1e:52:90:83:94:
+                    fe:70:61:5a:10:18:85:74:27:7c:38:eb:da:ae:31:
+                    d6:2c:7f:7f:63:7f:af:49:a4:c6:8a:04:35:f4:c4:
+                    c4:df:8d:6d:45:22:1c:eb:d2:18:97:a5:4f:9f:5f:
+                    3e:84:b6:93:ef:8a:b2:8d:1c:37:d3:30:37:68:66:
+                    51:81:b0:82:d1:be:ce:38:13:20:c5:dc:02:3c:8f:
+                    6a:f7:5b:5e:8c:16:a5:d9:30:91:21:e1:82:10:c1:
+                    5b:cf:57:c6:9e:90:30:5e:23:30:e2:18:89:ba:ef:
+                    a6:09:3c:cc:eb:f2:78:1a:d0:f3:a7:ce:4e:08:6e:
+                    f8:43:56:33:c8:c6:1d:40:f0:7a:76:a8:fc:18:1d:
+                    7b:09:eb:1a:8d:f5:56:6c:65:62:a8:f2:49:07:85:
+                    f9:d9:42:df:a7:cf:f8:f1:ae:a7:ed:50:48:a5:9c:
+                    fc:a0:ee:24:70:c2:f1:ae:f1:a9:af:c0:fa:51:f6:
+                    10:fe:f6:9b:a3:8a:5d:1a:4d:bb:7a:25:a1:0e:2b:
+                    0a:d8:ff:68:30:96:0d:5c:6e:39:1b:75:0b:ac:75:
+                    07:14:e6:7d:c2:6a:ce:d6:6a:c0:5d:62:fd:29:50:
+                    1a:e6:5a:14:80:80:37:46:7a:e4:f1:79:d1:14:d2:
+                    f5:ff
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                B2:77:C7:6F:8E:7D:55:E8:82:B5:F1:AC:98:66:85:0D:DF:56:3F:31
+            X509v3 Authority Key Identifier: 
+                B2:77:C7:6F:8E:7D:55:E8:82:B5:F1:AC:98:66:85:0D:DF:56:3F:31
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            Authority Information Access: 
+                OCSP - URI:http://localhost:10000/
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        9e:73:0b:20:a4:2c:7b:41:be:3a:8b:f2:0d:d8:4f:c2:07:b5:
+        a3:df:97:d2:a6:93:1a:94:a9:9e:a5:a2:24:bf:be:85:f1:9c:
+        22:3c:63:42:ee:76:21:85:ac:58:fb:88:aa:3f:dd:d8:51:63:
+        9d:db:5e:76:07:dc:e3:fe:27:0b:ab:d5:0e:88:64:ec:e5:c7:
+        e0:d1:59:d5:de:21:31:79:09:d7:91:1e:34:c2:f9:1c:db:1f:
+        4b:61:a6:12:e9:ba:12:7c:b4:0d:17:5d:16:83:6f:2a:53:e5:
+        58:52:50:da:73:13:d3:cd:5f:26:59:5e:af:5c:9e:83:3f:87:
+        40:44:ae:66:b2:99:fc:2e:28:de:3f:47:1c:8c:f4:ad:40:a7:
+        4b:65:6b:d8:82:14:4d:17:e9:20:59:21:25:47:90:1b:e0:b6:
+        e6:3d:b4:e5:cc:be:9c:44:97:be:84:eb:f4:c2:cd:44:8c:2f:
+        e9:76:9e:bc:67:4a:65:0c:14:27:83:a0:20:e8:71:46:44:80:
+        1e:1a:fb:f2:2a:37:fb:30:58:6f:a7:ff:f9:30:2a:e8:fc:b9:
+        c4:11:b7:82:02:8d:00:51:0f:75:27:6e:01:dd:9e:73:6b:2b:
+        6d:3e:82:dd:46:a0:6c:70:8f:9a:a8:61:74:67:6b:5f:96:03:
+        ea:1e:12:12
+-----BEGIN CERTIFICATE-----
+MIID7DCCAtSgAwIBAgIBATANBgkqhkiG9w0BAQsFADBcMQswCQYDVQQGEwJVUzEX
+MBUGA1UECgwOQ29sbGFib3JhdG9yIDIxEzARBgNVBAsMCkVudGVycHJpc2UxHzAd
+BgNVBAMMFkNvbGxhYm9yYXRvciAyIFJvb3QgQ0EwHhcNMjMwNDE3MTIxMzAzWhcN
+MzMwNDE2MTIxMzAzWjBcMQswCQYDVQQGEwJVUzEXMBUGA1UECgwOQ29sbGFib3Jh
+dG9yIDIxEzARBgNVBAsMCkVudGVycHJpc2UxHzAdBgNVBAMMFkNvbGxhYm9yYXRv
+ciAyIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCoYrlz
+i8cu0P4eUpCDlP5wYVoQGIV0J3w469quMdYsf39jf69JpMaKBDX0xMTfjW1FIhzr
+0hiXpU+fXz6EtpPvirKNHDfTMDdoZlGBsILRvs44EyDF3AI8j2r3W16MFqXZMJEh
+4YIQwVvPV8aekDBeIzDiGIm676YJPMzr8nga0POnzk4IbvhDVjPIxh1A8Hp2qPwY
+HXsJ6xqN9VZsZWKo8kkHhfnZQt+nz/jxrqftUEilnPyg7iRwwvGu8amvwPpR9hD+
+9pujil0aTbt6JaEOKwrY/2gwlg1cbjkbdQusdQcU5n3Cas7WasBdYv0pUBrmWhSA
+gDdGeuTxedEU0vX/AgMBAAGjgbgwgbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
+/wQFMAMBAf8wHQYDVR0OBBYEFLJ3x2+OfVXogrXxrJhmhQ3fVj8xMB8GA1UdIwQY
+MBaAFLJ3x2+OfVXogrXxrJhmhQ3fVj8xMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
+BgEFBQcDAjAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9sb2Nh
+bGhvc3Q6MTAwMDAvMA0GCSqGSIb3DQEBCwUAA4IBAQCecwsgpCx7Qb46i/IN2E/C
+B7Wj35fSppMalKmepaIkv76F8ZwiPGNC7nYhhaxY+4iqP93YUWOd2152B9zj/icL
+q9UOiGTs5cfg0VnV3iExeQnXkR40wvkc2x9LYaYS6boSfLQNF10Wg28qU+VYUlDa
+cxPTzV8mWV6vXJ6DP4dARK5mspn8LijeP0ccjPStQKdLZWvYghRNF+kgWSElR5Ab
+4LbmPbTlzL6cRJe+hOv0ws1EjC/pdp68Z0plDBQng6Ag6HFGRIAeGvvyKjf7MFhv
+p//5MCro/LnEEbeCAo0AUQ91J24B3Z5zayttPoLdRqBscI+aqGF0Z2tflgPqHhIS
+-----END CERTIFICATE-----
diff --git a/app/certs/root-ca-operator.crt b/app/certs/root-ca-operator.crt
@@ -0,0 +1,83 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, O=Operator, OU=Enterprise, CN=Enterprise Root CA
+        Validity
+            Not Before: Apr 15 18:27:20 2023 GMT
+            Not After : Apr 14 18:27:20 2033 GMT
+        Subject: C=US, O=Operator, OU=Enterprise, CN=Enterprise Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b8:8f:5a:f7:09:c2:23:81:ec:c4:38:25:5b:6b:
+                    de:32:b7:b8:7d:4a:13:af:02:93:53:80:d9:7d:c8:
+                    f4:60:e3:7f:c3:23:19:88:3d:dc:e2:56:88:73:80:
+                    29:e6:92:57:45:36:6c:a0:a1:5d:85:93:ef:ce:d4:
+                    a8:d2:bd:6e:8d:79:a1:68:cb:ac:56:55:0d:d1:0e:
+                    b5:e1:8e:8a:c7:e6:c7:8e:aa:09:ce:36:1a:a2:ce:
+                    a6:4a:50:a6:c9:45:32:b8:b6:9f:72:14:1f:c1:87:
+                    3c:10:2e:db:17:e9:fa:2c:52:c3:44:43:aa:0d:4b:
+                    1a:75:d7:c4:6a:45:a4:44:a4:c9:e9:49:64:9e:f9:
+                    0e:af:79:b3:20:e7:5f:81:09:6a:eb:d0:5e:73:de:
+                    d7:68:21:e6:0e:44:ef:b8:58:4e:12:20:b4:13:de:
+                    c5:55:0d:ca:a6:78:e2:3f:0a:a1:9b:ec:2a:08:a4:
+                    b2:08:22:71:55:f4:58:85:fa:de:40:13:fb:fd:99:
+                    2d:55:61:d9:c9:f5:8e:88:2c:5c:a8:6d:cc:03:b3:
+                    35:62:0a:e4:69:51:fb:19:63:2a:5b:a2:eb:f8:d1:
+                    97:b9:f5:f5:05:2d:29:ed:49:72:6c:b9:c5:34:96:
+                    de:2b:e8:2a:6a:ed:44:4e:69:f2:2c:cc:54:d7:c6:
+                    62:b3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                58:88:29:FD:AA:3A:F0:9F:51:CA:FD:F1:6B:FC:D7:F0:8E:67:CF:80
+            X509v3 Authority Key Identifier: 
+                58:88:29:FD:AA:3A:F0:9F:51:CA:FD:F1:6B:FC:D7:F0:8E:67:CF:80
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        40:44:4f:25:53:59:3c:24:d0:0f:67:f6:8d:a0:00:0b:f0:c3:
+        f5:12:f6:e8:4c:e7:43:ea:84:3c:f7:ea:ce:d4:2e:2c:62:8f:
+        ed:01:1f:84:7e:60:28:eb:94:3d:81:ca:1a:60:95:ac:3b:21:
+        c5:f4:a5:a9:44:50:8b:25:95:dc:bf:e7:32:74:18:f2:1a:4f:
+        7e:46:82:3f:da:d4:ee:7f:ed:5a:54:52:a1:d4:3d:95:0e:33:
+        64:ab:d5:fb:55:f3:6d:b7:43:51:4c:dc:a2:16:9f:de:31:8e:
+        f7:d1:7a:5b:9c:01:fa:5a:e6:b9:d5:07:a1:da:d3:a2:be:6c:
+        73:d1:85:3e:b7:fb:c4:4b:76:f1:79:81:0a:9c:a3:90:21:56:
+        86:d1:3b:0f:a0:85:fb:75:e7:ad:93:9f:76:6e:b1:0d:07:14:
+        37:69:ca:0a:ad:52:88:9d:f7:2e:21:11:e0:bf:77:ca:43:ed:
+        f7:52:36:71:89:84:bd:c3:a2:56:bd:59:d0:f4:9d:e9:25:a5:
+        ee:83:b5:01:14:30:ec:25:34:8f:bd:f8:68:d1:1b:86:eb:c8:
+        31:f9:78:7f:d6:a7:9c:96:5a:2a:cb:0a:df:73:ee:f3:5f:4d:
+        4b:3b:fa:b5:af:c2:52:3c:20:85:d8:50:1c:71:a9:55:11:fc:
+        49:78:9c:b0
+-----BEGIN CERTIFICATE-----
+MIIDozCCAougAwIBAgIBATANBgkqhkiG9w0BAQsFADBSMQswCQYDVQQGEwJVUzER
+MA8GA1UECgwIT3BlcmF0b3IxEzARBgNVBAsMCkVudGVycHJpc2UxGzAZBgNVBAMM
+EkVudGVycHJpc2UgUm9vdCBDQTAeFw0yMzA0MTUxODI3MjBaFw0zMzA0MTQxODI3
+MjBaMFIxCzAJBgNVBAYTAlVTMREwDwYDVQQKDAhPcGVyYXRvcjETMBEGA1UECwwK
+RW50ZXJwcmlzZTEbMBkGA1UEAwwSRW50ZXJwcmlzZSBSb290IENBMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuI9a9wnCI4HsxDglW2veMre4fUoTrwKT
+U4DZfcj0YON/wyMZiD3c4laIc4Ap5pJXRTZsoKFdhZPvztSo0r1ujXmhaMusVlUN
+0Q614Y6Kx+bHjqoJzjYaos6mSlCmyUUyuLafchQfwYc8EC7bF+n6LFLDREOqDUsa
+ddfEakWkRKTJ6UlknvkOr3mzIOdfgQlq69Bec97XaCHmDkTvuFhOEiC0E97FVQ3K
+pnjiPwqhm+wqCKSyCCJxVfRYhfreQBP7/ZktVWHZyfWOiCxcqG3MA7M1YgrkaVH7
+GWMqW6Lr+NGXufX1BS0p7UlybLnFNJbeK+gqau1ETmnyLMxU18ZiswIDAQABo4GD
+MIGAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY
+iCn9qjrwn1HK/fFr/NfwjmfPgDAfBgNVHSMEGDAWgBRYiCn9qjrwn1HK/fFr/Nfw
+jmfPgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEL
+BQADggEBAEBETyVTWTwk0A9n9o2gAAvww/US9uhM50PqhDz36s7ULixij+0BH4R+
+YCjrlD2Byhpglaw7IcX0palEUIslldy/5zJ0GPIaT35Ggj/a1O5/7VpUUqHUPZUO
+M2Sr1ftV8223Q1FM3KIWn94xjvfRelucAfpa5rnVB6Ha06K+bHPRhT63+8RLdvF5
+gQqco5AhVobROw+ghft1562Tn3ZusQ0HFDdpygqtUoid9y4hEeC/d8pD7fdSNnGJ
+hL3Dola9WdD0neklpe6DtQEUMOwlNI+9+GjRG4bryDH5eH/Wp5yWWirLCt9z7vNf
+TUs7+rWvwlI8IIXYUBxxqVUR/El4nLA=
+-----END CERTIFICATE-----