Merge pull request #7 from SignPath/slsa-attestations

adds slsa attestations page

Author: paulsavoie

docs/_data/menus/documentation.yml

@@ -57,6 +57,12 @@
 - text: Origin Verification
   path: origin-verification
 
+- text: SLSA Attestations
+  path: slsa-attestations
+  items:
+    - text: Definitions
+      path: definitions
+
 - separator: true
 
 - text: PowerShell cmdlets

docs/_data/tables/artifact-configuration.yml

@@ -2,7 +2,7 @@ signing-file-elements:
   headers:
     element: Element
     isComposite: "[Container format](#containers)"
-    directive: Signing directives
+    directive: Directives
     extensions: Extensions
     description: Description
     _attributes:
@@ -87,9 +87,11 @@ signing-file-elements:
       description: "Debian package files (available for Advanced Code Signing)"
     - element: "[`<zip-file>`](syntax#zip-file-element)"
       isComposite: "Yes"
-      directive: "[`<jar-sign>`](#jar-sign)"
+      directive: |
+        [`<jar-sign>`](#jar-sign)
+        [`<create-provenance-file>`](#create-provenance-file)
       extensions: ".zip"
-      description: "Use ZIP archives to sign multiple files at once. (ZIP archives can also be signed and verified using the [JAR format](#jar-sign).)"
+      description: "Use ZIP archives to sign multiple files at once or to add additional files, like [SLSA provenance attestations](#create-provenance-file) (ZIP archives can also be signed and verified using the [JAR format](#jar-sign).)"
     - element: "`<office-oxml-file>`"
       isComposite: "No"
       directive: "[`<office-macro-sign>`](#office-macro-sign)"
@@ -129,6 +131,12 @@ signing-file-elements:
         Create enveloped signatures ([DSSE](#dsse-sign) or [S/MIME](#smime-sign))
         and detached signatures ([CMS/PKCS #7](#create-cms-signature), [GPG/OpenPGP](#create-gpg-signature), [raw](#create-raw-signature))
          for arbitrary files (available for Advanced Code Signing).
+    - element: "*"
+      isComposite: "No"
+      directive: "[`<include-in-provenance>`](#create-provenance-file)"
+      extensions: "*"
+      description: |
+        A reference to any file can be included in a provenance created by the [`<create-provenance-file>`](#create-provenance-file) directive.
 
 signing-method-categories:
   headers:

docs/_sass/resources.scss

@@ -192,6 +192,19 @@ main > section.resources-section {
 			}
 		}
 
+		blockquote.quote {
+				background: $light-grey-background-color;
+				border-left: 10px solid $blockquote-line-color;
+				margin: 1.5em 10px;
+				padding: 0.5em 10px;
+				quotes: "\201C""\201D""\2018""\2019";
+				font-style: italic;
+
+				& > p {
+					margin: 0px;
+				}
+			}
+
 		/** HIGHLIGHTS **/
 		blockquote.panel {
 			border: 1px solid $grey-border-color;

docs/artifact-configuration/reference.md

@@ -749,6 +749,88 @@ The restrictions can be applied to file elements, [file set elements](syntax#fil
 | `<msi-file>` | MSI properties: `subject`, `author`                                                                                     | [MSI file restrictions](examples#msi-and-pe-restriction)
 | `<xml-file>` | Root element name and namespace: `root-element-name`, `root-element-namespace`                                          | [SBOM restrictions](examples#sbom-restriction)
 
+## SLSA attestations {#create-provenance-file}
+
+SignPath can create SLSA attestations for any of the supported build systems. See the [definition](/origin-verification/slsa-attestations) for more details.
+
+Creating a SLSA attestation requires multiple directives:
+
+* `<include-in-provenance>` to include a reference to a file in the generated provenance.
+* `<create-provenance-file>` inside a root level `<zip-file>` to create a SLSA provenance.
+* `<create-verification-summary-file>` to create a SLSA verification summary.
+* `<create-attestation-signature>` to sign the provenance and turn them into a SLSA attestation or SLSA verification summary attestation (VSA).
+
+The parameters for all these directives, except `<include-in-provenance>`, which does not have any, are listed below.
+
+
+| Directive                            | Parameter          | Description
+|-----------                           |-----------         |-------------------------------------------------
+| `<create-provenance-file>`           | `output-file-name` | Name of the output file to hold the provenance information.
+| `<create-verification-summary-file>` | `output-file-name` | Name of the output file to hold the verification summary information.
+| `<create-attestation-signature>`     | `type`             | The signature type. Currently supported are [`cms`](#create-cms-signature) and [`dsse`](#dsse-sign).
+| `<create-attestation-signature>`     | `output-file-name` | Name of the output file to hold the attestation signature.
+
+#### Example
+
+~~~ xml
+<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
+  <zip-file>
+    <pe-file path="myApp.exe">
+      <include-in-provenance />
+    </pe-file>
+    <create-provenance-file output-file-name="slsa-attestation.in-toto.jsonl">
+      <create-attestation-signature type="cms" output-file-name="${file.name}.cms.pem" />
+      <create-verification-summary-file output-file-name="slsa-vsa.json">
+         <create-attestation-signature type="dsse" output-file-name="slsa-vsa.dsse.json" />
+       </create-verification-summary-file>
+    </create-provenance-file>
+  </zip-file>
+</artifact-configuration>
+~~~
+
+#### Verification of SLSA verification summaries (VSA) {#slsa-vsa-verification}
+
+To verify a SLSA verification summary attestation (VSA), you need:
+
+* The verification summary attestation file (e.g. `slsa-vsa.dsse.json` in the example above)
+* The attestation signer certificate. For SLSA attestations created by SignPath, you can download [SignPath_SLSA.pem] for fully supported systems and [SignPath_SLSA-Beta.pem], which is a self-signed certificate, for all systems with preview support (See the [definition](/origin-verification/slsa-attestations) for a list of all supported systems).
+* The publisher certificate
+
+{:.panel.info}
+> **`resource-uri`**
+>
+> SLSA specifies a `resource-uri` field with the intention of allowing a consumer to ensure that the software artifact was obtained from a trusted source. SignPath populates this field with information from the publisher certificate, in the form of
+>
+> `urn:x-software-publisher:verified=<true|false>;certificate-fingerprint=<publisher-cert-fingerprint>;subject=<publisher-cert-subject>`
+>
+> The values are defined as follows:
+> * `verified`: `true` if the publisher certificate was issued by a trusted certificate authority (CA)
+> * `certificate-fingerprint`: The SHA-1 fingerprint of the X.509 publisher certificate.
+> * `subject`: The subject of the X.509 publisher certificate.
+
+To verify the verification summary attestation, the official [slsa-verifier](https://github.com/slsa-framework/slsa-verifier) tool can be used:
+
+The following steps are required to verify a SLSA provenance attestation generated by SignPath:
+
+~~~bash
+# 1. Verify the Attestation Signer certificate
+## on Windows
+certutil -verify SignPath_SLSA.pem
+## on Linux
+openssl verify -untrusted SignPath_SLSA.pem SignPath_SLSA.pem
+
+# 2. Extract the public key of the Attestation Signer certificate
+openssl x509 -pubkey -noout -in SignPath_SLSA.pem > SignPath_SLSA.pubkey.pem
+
+# 3. Verify the SLSA verification summary attestation
+slsa-verifier verify-vsa \
+  --subject-digest "sha256:$artifactHash" \
+  --attestation-path /path/to/slsa-vsa.dsse.json \
+  --verifier-id https://signpath.io \
+  --public-key-path SignPath_SLSA.pubkey.pem \
+  --resource-uri "urn:x-software-publisher:verified=true;certificate-fingerprint=$publisherFingerprint;subject=$publisherSubject" \
+  --verified-level SLSA_BUILD_LEVEL_3
+~~~
 
 **Footnotes:**
 
@@ -757,3 +839,5 @@ The restrictions can be applied to file elements, [file set elements](syntax#fil
 [DSSE]: https://github.com/secure-systems-lab/dsse
 [RFC 5652]: https://datatracker.ietf.org/doc/html/rfc5652
 [Secure Systems Lab]: https://ssl.engineering.nyu.edu/
+[SignPath_SLSA.pem]: /assets/other/SignPath_SLSA.pem
+[SignPath_SLSA-Beta.pem]: /assets/other/SignPath_SLSA-Beta.pem

docs/assets/other/SignPath_SLSA-Beta.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF1TCCA72gAwIBAgIJAJ1gIqQz7KIdMA0GCSqGSIb3DQEBCwUAMIGPMQ8wDQYD
+VQQHEwZWaWVubmExDzANBgNVBAgTBlZpZW5uYTELMAkGA1UEBhMCQVQxGjAYBgNV
+BAsTEVNMU0EgQXR0ZXN0YXRpb25zMRYwFAYDVQQKEw1TaWduUGF0aCBHbWJIMSow
+KAYDVQQDEyFTaWduUGF0aCBTTFNBIEF0dGVzdGF0aW9ucyAoQmV0YSkwHhcNMjUx
+MTA1MDAwMDAwWhcNMjgxMTA1MDAwMDAwWjCBjzEPMA0GA1UEBxMGVmllbm5hMQ8w
+DQYDVQQIEwZWaWVubmExCzAJBgNVBAYTAkFUMRowGAYDVQQLExFTTFNBIEF0dGVz
+dGF0aW9uczEWMBQGA1UEChMNU2lnblBhdGggR21iSDEqMCgGA1UEAxMhU2lnblBh
+dGggU0xTQSBBdHRlc3RhdGlvbnMgKEJldGEpMIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAuOrYgOVstvmTUyw0AGHIYV6MMIy3CLBdjbiqjtKUsT57j2nw
+7EemW7IHe+c8EQPH2TZHPtnYpjn5iTFnj0JWbtUziceb6pQeOCPqOlUrpT0UCBiT
+4l4VtN4gXptTq/5BYqLC/dKzcEIk5ppeG98f6ENFQHyG0GhrwK/MO2bszzgWmrS9
+Uf0Z918PauEzcwpzp5G4I0bvBwBkW59q7E951IMX7P0bANNT/6kSccEWyD4KbZdN
+SbCyV05CUcHcsVhNJimV4/WD/msZ8klzE1nG4BgFism6rAPk22zXvzWN7Gh+VxiY
+yXrIVS+iA2eWmJ8oza3iKoB8uFJF2pr8PL6dJv6s8VaR1vW3C/0V3hYxdVL2IKrY
+ZaKUbYxN3pbSx8qAzWtvfayWwesKjcqjzq2ZxvUW4JrvyUtVLaRHMOg+g9rzwVrs
+BQApUOrnzM6viXYaMwGatN+uv9XpMATky/G2bgNjwBrM+50/OzyjD5aoER7UJu/3
+aHQBGN838W7KfwiFs2TcJCP+Z9qyBEtEUxQ2a06D76UDgTfzMcgp0pkuK94dkvyL
+/pps1MlrkaEeCn7np+RBdx/ScJUOR6F9LKLCy1epFGnVT0hHueOgmrPkJyQQO5uB
+h1rR0/6Igrd4jUCe4NTDL2V1m1zVkQTZzaU+fUMTyWx8IL6Z7stZvxp667UCAwEA
+AaMyMDAwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
+BQUHAwMwDQYJKoZIhvcNAQELBQADggIBADO+i0aP2XkAXEeNMwHOQs58yGy5G1wG
+k6KgfMbsYE5lqF33xSlXyThfRnMKIcAavAY97tlXyJTcRgH/ec/Sg8mxlZS86vHt
+Rm07iXD/G9KDO7VLnZtiQOSmIa4rifP/yNZd0zAjJOvp6pI4NT1lJsGDFgovFIe4
+A5Y4gbrBlZXUfviDKP5BPHg5dNDb8wCSnpG2Cx3b1gpFPSJWZygQ3H/S6BXjIxDb
+Av/hP7EB61Uibn1B280XCVvDpPdb5IJNwLhlzOM+jXHIW2c65bTDqHz6degPO+XA
+lxrAjqlxQG1dSflgcfYRHBRnqsyFn2IJ5qvxOGhkpG+OBpQcdcOY/kvqmk239F/9
+CCecZXmRruoLylWBsIx0R8cXyTU4VCNYvr+vjg16P0q9u9fcWzlqDWdefTZWAdmc
+ZhGDqWSHb+awPMrMtC1mHr2xfi9m8SRE5gvzHAFVyEsDmpcoM+P0jErOwTj5W1Go
+Nqqo0tfMHt9ttcYfZGhC1GafCqA2X/4KPj4fTHixY/UkBMN6iwsi5ab5cGfdIjqX
+lI0c/JRux9Gnm7TEmWojPdPjIFhq7H9CieZ8qOLg4wluXq/x6qekfF6aKQThMPct
+hUAB92TIWBWgPt91MHzIERS03KPuCG48u4o/RLrVbOs0Ai24tdvi6CZiQwRJ3M3U
+2kxW+aJS1uzJ
+-----END CERTIFICATE-----

docs/assets/other/SignPath_SLSA.pem

@@ -0,0 +1,114 @@
+-----BEGIN CERTIFICATE-----
+MIIH1zCCBb+gAwIBAgIQCM0Pe34U/+ALMb37hATDZzANBgkqhkiG9w0BAQsFADBp
+MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT
+OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMjU2
+IDIwMjEgQ0ExMB4XDTI2MDMwMzAwMDAwMFoXDTI3MDMwMjIzNTk1OVowgd8xEzAR
+BgsrBgEEAYI3PAIBAxMCQVQxFTATBgsrBgEEAYI3PAIBAhMEV2llbjEVMBMGCysG
+AQQBgjc8AgEBEwRXaWVuMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEQ
+MA4GA1UEBRMHNDc1NTA2ejELMAkGA1UEBhMCQVQxDTALBgNVBAcTBFdpZW4xFjAU
+BgNVBAoTDVNpZ25QYXRoIEdtYkgxHTAbBgNVBAsTFFNvZnR3YXJlIEF0dGVzdGF0
+aW9uMRYwFAYDVQQDEw1TaWduUGF0aCBHbWJIMIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAxbl80nXwyVpMtRumJ2a/880agLIs4ulE/LrUFujmuV+SRNsP
+znGvqKdCWY+kuE+pU4Vn9UnIaMvhsDGScMtjnQ0UzQHrNXo/fVO4Obdalvg76yVt
+yqn/LG+8uPaoLQch98RWj+KjE+5zNykpuKKqPGmVH0t2zLERcxGjUfqyUsY1nfUL
+Bk2rqjn/1kLVRjLM18P6ir1TAggeXjpBSvvYLSrAKMN7lxcaBawIkO+UEJggBfXv
+XEv6zu8KyFAyvuS0ByZ+cEgFTayhnnX5gNHaQIIdqinMpUnkl+7fswuyGxvu21ka
+nrf2tj3a5VRxf0BjWzCFPWvM4fwLfVMav5+R1RQiuL/cIZNCEeWc1Nr+VZlV9DO/
+xc2VcHMxBHJKiLFTokb1cD0+Cg3HhbnbUWVp72TZsEXJsWDeLzO0eOI3Mqo3ebkX
+2YYVwLqo5UxgDK/zBtV+U5sG/aotmgveCD90L3EfSGkcV6bLuqvHf8/vpp+P1SXw
+qj49LiQ0ild+JnrkQtggm2kLqHvY5KK+SdjfN8EpFv/eTqmD71nUsfk0X8Dl/Eq3
+bum0SHJJ+eZXh9bOg+NWPsxmbWVJbKqMv4SI0D5TAwtW6+csG5VMaI2ZHV5ucsY1
+8542hinFbSw88cXX4KwaDZqpPTVe2a1ceuchEkxRKe4nYsBm5FQmD96klYUCAwEA
+AaOCAgIwggH+MB8GA1UdIwQYMBaAFLxrImWdjGjm5h4F8dhyJdS44EjAMB0GA1Ud
+DgQWBBSD/YY30asY6Gi2bZNmtbwkwO9OhjA9BgNVHSAENjA0MDIGBWeBDAEDMCkw
+JwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8B
+Af8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGg
+T4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29k
+ZVNpZ25pbmdSU0E0MDk2U0hBMjU2MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9j
+cmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNB
+NDA5NlNIQTI1NjIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRw
+Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2ln
+bmluZ1JTQTQwOTZTSEEyNTYyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3
+DQEBCwUAA4ICAQCbjo7S3DVsHTAnrC2cQqZKbgdqNmbzmaPRA0NR2xmzYySHoCWR
+sxM29NqjlKjEMZ6uqBasb5LzfGs8PSgLg7vTjiP4hulr/pwficm3TRDAf2EKcP9M
+VQOrzE2T3vy95MMFGR5Mz8Xl43N7y5ErZj/KoU6WE/22TpFVgZY1TbZklIDE6MxM
+hlNCYsNmKLHeTBMinJSDzPT1lrxiPIMmHEVd11DzBRYzihXCgBitvE3Zapmi27el
+V4vaEogXuSJCApg7cYNFwWtSe/6viPTUymjxeyXASfrD1ZUD6LIZEETNObxtnJHv
+tK6/ohEDPh36ZcXDPWlLZq8T0+f7TEWffd4mzDVmOEVjJHSTRQs1HzDlSVtW6sDD
+/rGtfCbrPU103u30CBEWFsukwQ0eaelGTvQJa12Ah7fq8595SbzL+eYCZL2O2npE
+F1Hf65PUsbovNhctGj30fHrWL4UPowjJkJ8MGZy1S8lz6txaOlshWkhx1ADuibu2
+GNGypwmFDrZDsTBjExfy3svpbU5XtwZLEuMJHz2F87LXOZopa0JEGmJKTbK1jxur
+adI5Le7Fw3Glm0hk3hR2LYdI0HRmnINbtieRfA3ww+SpXeoZa0826iNwNz0RTwI0
+uZ1VLbigxtvrJVVMun4T6e6oNaiXdhgocd+nWlnmL9w6Vp3sALf/qJSBkQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGsDCCBJigAwIBAgIQDk1n9kMWySo7ehfMRpdqjzANBgkqhkiG9w0BAQsFADBi
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
+RzQwHhcNMjEwNzI4MDAwMDAwWhcNMzYwNzI3MjM1OTU5WjBpMQswCQYDVQQGEwJV
+UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy
+dXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMjU2IDIwMjEgQ0ExMIIC
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAri4MfdPvaOOECPqbDE3zNg/n
+sfM0MoNGVGJf6ogVscpox00cZPOiAXZwGLyPm/HmSxmNCDxKUqFWE1LIVTzCYcNt
+kqCv+MNCZoHxIY1mERdsU+sYYfADDDHpi10op0br0SrrrEuf6+uuXRxhpZ7xgopt
+T/WhDG3vqXjabJPsKCDcEsnElut6Nm8XHHV+CcnZpbwle4OCcnrgLerBEHu+iIEj
+gCts01n+1b1abmrFXzJ3aC/iXP/6HIqYs7sdAUU8C7WcLflXm3xzec6yltqyKEyx
+cvgdBMTapqmw7pkFrm8l56JYpctFHJtdyFsroL6lojC8yS3j5z05+SgaAjSMI8Qf
+al5WAy2Jii/EvnPZf1azgUvzYkfKgYEy5kA5c+3j9ZuKifb7EPp4pvkXHZJ6KzJh
+abuRgXqjObO9YtRk5LnZgvwHJ74T/vFTYO47h2wOqv/JaZd8K5/IAiSop/JTjlHB
+stkJfnAb6iH1UUKKgMhpNCpSkM9s2xzQQmZ44RGIRDs+AHm5lER4Z2OohQ+nMP/g
+UjvnouZ2XZuI+yn2EBbtRDkBr9YRru28bpsKNCALgFmNzoxR7rs6FaQBzEsgDj80
+u6F04YlFIQwp9U8iWTljWWMX+p8OJ7Q1LXAPQl/aSZmlf+WLXQcr8x0qU+v7Xi1T
+VSBZpvRMa0s941GE0WkCAwEAAaOCAVkwggFVMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+HQYDVR0OBBYEFLxrImWdjGjm5h4F8dhyJdS44EjAMB8GA1UdIwQYMBaAFOzX44LS
+cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF
+BQcDAzB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp
+Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu
+Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy
+aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j
+cmwwHAYDVR0gBBUwEzAHBgVngQwBAzAIBgZngQwBBAEwDQYJKoZIhvcNAQELBQAD
+ggIBAEnyvKd58wdZXmcA+X7z6oYDbVHvIUfZ06j7ceH8uVBtYIDZHk5oVHGzVui4
+wx3D97fdWCqsFL+B59Z9jZcTPdrIlmstIiLkystVOrkyDRsOoiI/6O/nuvxOS+iS
+o+9MLMiU/rUB9YrzLL+USwFeIitwL4CRhdf+Zuar/NYsy1qU8cHV04pGIdie2mPK
+fLa5TqRhA1BElbYPcakAoWKx//O1B04BYiVAbU9dEr2n+pItB2/QzjaIm9tNbcry
+eXW8skjjVMp8AP6t/y9x0XchZ5pVbTABf/qVT3ffxsyzgyL7HyWgC/fVR7rbgVoX
+9Bw/GmHw/xidbZdYWBceThHp1mR2MJtbA6wr3l9c+FguOMF51v9QV45/nhGCQJLc
+nOgdM2wbz13Y7udRoF1pbBfDdBqyo1m9Ztl8NDyUnGp8+ujPUu+egIgPy3Z8hSCP
+bLKQNSMsgRSdcrX+Kd+OOzZKpDvH2EJwzNRqizJLL+luO4AKf8NKIlTXHFbGGaXh
+mNXB6PSUL2XobkwHmA9ZLV6AQ5G3S1gBMYnLBbbjEmuMYzWpT/4WWydXvGZGkCgw
+MqHKVHkOp4Rxy31w8JJBVyp2NTvdr5JXNlrb1U0dJU1Ie0bNkXxvw5vVvv0jhgSL
+d2cMpodm6dMlNU5TWt2QtLrUKtfNvcLKeF6wG2ayii6COsXo
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
+RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
+Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
+ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
+xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
+ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
+DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
+jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
+CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
+EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
+fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
+uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
+chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
+9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
+ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
+SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
++SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
+fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
+sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
+cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
+0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
+4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
+r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
+/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
+gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
+-----END CERTIFICATE-----