evidence(time): RFC 3161 time stamps of the signed records v0.2.1, v0.2.0 and v0.1.5 (DigiCert, 2026-11-03)

evidence/time/digicert-2026-11-03/README.md

@@ -0,0 +1,42 @@
+# Time evidence for three signed cic-primitives release records (2026-11-03)
+
+RFC 3161 time-stamp tokens from the DigiCert public time-stamp authority over the SHA-256 of the three signed release records `v0.2.1`, `v0.2.0` and `v0.1.5`, obtained on 2026-11-03.
+
+**Why now.** Every certificate of the signing chain of these records (Developer CA, Source CA, the developer's certificate; the root a few hours later) ends on 2026-12-31 around 13:22 UTC, and the present verifier judges validity at the moment of checking, so from 2027-01-01 it refuses these records. Evidence that a record existed *before* the chain ended has to be made *before* it ends; a token obtained in 2027 would only show a date after the end. See `docs/P5-TRUST-MODEL-PLAN.md` of cic-primitive-forms (section 4).
+
+| Release | Record SHA-256 | Time stamp (UTC) |
+|---|---|---|
+| v0.2.1 | `e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63` | 2026-11-03 22:07:48 |
+| v0.2.0 | `955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6` | 2026-11-03 22:09:44 |
+| v0.1.5 | `284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456` | 2026-11-03 22:09:45 |
+
+## Check it
+
+From a clone of cic-primitives that has the full history (the records are read from git at their release commits):
+
+```
+bash evidence/time/digicert-2026-11-03/verify.sh --selftest
+```
+
+It reads the time of each stamp **from the token** (the signed time; the manifest value is only compared with it) and runs **every** token check at that time, so a later end of the TSA chain, or the clock of the machine, changes nothing. It checks the trust anchor and the kept CIC certificates against the figures in `manifest.json`, the record against its digest, the token against the request and against the record file, and **that the stamp lies inside the validity of the developer certificate, the Developer CA, the Source CA and the root of the CIC chain**, twice (`openssl verify -attime` over both chains, and plain arithmetic on the dates), and that the kept CIC certificates are the ones the records carry. With `--selftest` it also shows that a record changed by one byte, a wrong anchor, a stamp after the end of the CIC chain, a stamp before it began, a stamp when only some of the CIC certificates are still valid, and a wrong issuer of the developer certificate are all refused. It needs `openssl`, `git` and `python3` with PyYAML, and no network. Exit status 0 only if every check holds.
+
+## What is here
+
+* `manifest.json`: for each release the record (commit, path, SHA-256), the request (SHA-256, nonce), the response (SHA-256, status, serial, policy, time, nonce), and the trust anchor with the sources it was checked against.
+* `<release>/request.tsq`, `response.tsr`, `tsa-chain.pem`: the request that was sent (70 bytes: algorithm, digest, nonce, "send the TSA certificate"), the reply, and the three certificates the reply carries.
+* `cic-chain/`: the four public certificates of the CIC chain that signed the records: developer, Developer CA (**not carried by any record**), Source CA, root. With their validity they are what shows that the stamp was made while the chain was valid.
+* `trust-anchor/DigiCert_Trusted_Root_G4.pem`: the **self-signed** DigiCert Trusted Root G4, SHA-256 `55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88`, valid to 2038-01-15. It was taken from the operating system store (an independent source) and its SHA-256, SHA-1 and serial equal those DigiCert publishes. The reply also carries a *cross-signed* copy of this root (valid to 2031); that one is not used as the anchor.
+
+## What it proves, and what it does not
+
+It proves that each digest existed **no later than** the stated time, according to the DigiCert time-stamp authority, and that the token is bound to the request that was sent (nonce) and to the exact bytes of the record.
+
+It does **not** prove who signed the record, that the signature was valid on that day, that the signer was allowed to sign, that the countersignature authorizes anything, that the release is genuine, or that the records were *signed* at that time rather than only existing. It does not replace a trust anchor for the release chain, a revocation rule or a policy (`docs/P5-TRUST-MODEL-PLAN.md`, conditions C1 to C6); it supplies the one piece that could not be made late: independent evidence of existence before the end of the chain.
+
+## Limits to keep in view
+
+* The trust in the time rests on DigiCert and on the self-signed root above; the trust anchor was checked against the operating system store and against the publisher's page, not against a third independent party.
+* No terms of use for the public endpoint were found (the documentation describes it for code signing and states neither permission nor restriction for other use). Only digests were sent. Another authority needs a new decision.
+* The requests were made over plain HTTP (port 443 did not answer from that machine); the replies are signed, so this does not weaken the check.
+* OpenSSL `ts -verify` was used; the tokens and the anchor are kept so any other RFC 3161 verifier can be applied later.
+* **A second, independent copy of this directory is required by the decision and does not exist yet.** The GitHub repository is one copy; where the second lives is for the owner to name, and it is not recorded here until it exists.

evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMzCCAdmgAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iMwCgYIKoZIzj0EAwIw
+PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV
+BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjI0NloXDTI2MTIzMTEzMjI0Nlow
+QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV
+BAMMEENJQyBEZXZlbG9wZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR7
+529RefaN8Yc+qVHNcNbssh+y5JBlp8lBeRbaWdoP2J0ZzWeHKfehV4Oh04d0J+cd
+HLhMA1Ikelhi9B0xJnMeo4GvMIGsMB0GA1UdDgQWBBRefoIdjM9SpTglU/yD45JZ
+4NiOFzBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkG
+A1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJ
+QyBSb290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIB
+hjAKBggqhkjOPQQDAgNIADBFAiEAzG5v4TbZRsEjcHFPmcx3R8gIv35ckgBYLdg9
+62uygnQCIBpkfZz/HxqFgsi4VGbjWMfg4xSsWyKfyR//DrgD176X
+-----END CERTIFICATE-----

evidence/time/digicert-2026-11-03/cic-chain/developer.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw
+QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV
+BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy
+MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb
+MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D
+AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe
+i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU
+yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS
+WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF
+BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0
+lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW
+-----END CERTIFICATE-----

evidence/time/digicert-2026-11-03/cic-chain/root.pem

@@ -0,0 +1,52 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4100 (0x1004)
+        Signature Algorithm: ecdsa-with-SHA256
+        Issuer: C=HU, O=CentralInfraCore, CN=CIC Root CA
+        Validity
+            Not Before: Mar 19 12:59:30 2026 GMT
+            Not After : Dec 31 23:59:59 2026 GMT
+        Subject: C=HU, O=CentralInfraCore, CN=CIC Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (256 bit)
+                pub:
+                    04:cd:07:56:3a:e7:28:41:c4:99:76:3a:e8:5e:90:
+                    39:54:be:e7:7d:42:ab:65:49:05:f0:f8:84:63:5f:
+                    5f:05:22:56:d1:29:e0:ac:7d:67:e3:cf:ac:8f:9c:
+                    e2:be:71:6f:a8:91:00:e4:6c:af:1f:f2:86:3f:6d:
+                    03:1d:36:c7:f4
+                ASN1 OID: prime256v1
+                NIST CURVE: P-256
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A
+            X509v3 Authority Key Identifier: 
+                keyid:A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A
+                DirName:/C=HU/O=CentralInfraCore/CN=CIC Root CA
+                serial:10:04
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:3
+            X509v3 Key Usage: critical
+                Digital Signature, Certificate Sign, CRL Sign
+    Signature Algorithm: ecdsa-with-SHA256
+    Signature Value:
+        30:45:02:20:51:b0:f6:e5:50:ac:3b:f8:2e:d1:af:7a:7a:b3:
+        42:7b:5d:8e:1d:d0:7d:e0:5c:60:48:42:aa:6b:f0:24:8b:a0:
+        02:21:00:d8:c6:94:12:db:f1:a8:b8:3b:45:46:b9:30:88:36:
+        6c:f3:e2:56:76:02:35:f6:17:0b:b5:3a:7b:80:5d:16:24
+-----BEGIN CERTIFICATE-----
+MIICHDCCAcKgAwIBAgICEAQwCgYIKoZIzj0EAwIwPjELMAkGA1UEBhMCSFUxGTAX
+BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMB4X
+DTI2MDMxOTEyNTkzMFoXDTI2MTIzMTIzNTk1OVowPjELMAkGA1UEBhMCSFUxGTAX
+BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMFkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzQdWOucoQcSZdjroXpA5VL7nfUKrZUkF
+8PiEY19fBSJW0SngrH1n48+sj5zivnFvqJEA5GyvH/KGP20DHTbH9KOBrzCBrDAd
+BgNVHQ4EFgQUokLW7jLfNf78Hmow+zuKIDDGihowZwYDVR0jBGAwXoAUokLW7jLf
+Nf78Hmow+zuKIDDGihqhQqRAMD4xCzAJBgNVBAYTAkhVMRkwFwYDVQQKDBBDZW50
+cmFsSW5mcmFDb3JlMRQwEgYDVQQDDAtDSUMgUm9vdCBDQYICEAQwEgYDVR0TAQH/
+BAgwBgEB/wIBAzAOBgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwIDSAAwRQIgUbD2
+5VCsO/gu0a96erNCe12OHdB94FxgSEKqa/Aki6ACIQDYxpQS2/GouDtFRrkwiDZs
+8+JWdgI19hcLtTp7gF0WJA==
+-----END CERTIFICATE-----

evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMDCCAdagAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iIwCgYIKoZIzj0EAwIw
+PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV
+BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjIzOVoXDTI2MTIzMTEzMjIzOVow
+QDELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFjAUBgNV
+BAMMDUNJQyBTb3VyY2UgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARuSq7+
+gRkRwiZYbZBp8aWzFyK36YMBQ58PwUTtoL6Gzu5QZS2tDGLWvFqDY/BRavqcOfel
+I6y+P9WlhntH4oI6o4GvMIGsMB0GA1UdDgQWBBTXWkl+CqRrqaEpr/fUmVHc6B7I
+OTBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkGA1UE
+BhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBS
+b290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAK
+BggqhkjOPQQDAgNIADBFAiEA25x0lXd37TAiRROTXQtqXNoMiwl0wCZln3m/DMBR
+YcQCID3gc64TnA9Y7QL96lY1nYhAl2NWeMjK8pFXXN2Dymuf
+-----END CERTIFICATE-----

evidence/time/digicert-2026-11-03/manifest.json

@@ -0,0 +1,138 @@
+{
+ "format": 1,
+ "what": "RFC 3161 time-stamp tokens over the SHA-256 of three signed cic-primitives release records, obtained from the DigiCert public time-stamp authority on 2026-11-03, before the certificate chain of those records ends on 2026-12-31. A token shows that the digest existed no later than the time it states; it shows nothing about who signed the record or whether the release is genuine.",
+ "authority": {
+  "name": "DigiCert public RFC 3161 time-stamp authority",
+  "endpoint": "http://timestamp.digicert.com",
+  "transport_note": "plain HTTP (port 443 did not answer from the machine that made the requests); the reply is signed, its integrity does not rest on the transport",
+  "terms_note": "No terms of use for the public endpoint were found: neither the search nor DigiCert's documentation pages state who may use it or restrict its use; they describe it for code signing. Only a SHA-256 digest, an algorithm identifier, a random nonce and a request for the TSA certificate were sent."
+ },
+ "trust_anchor": {
+  "file": "trust-anchor/DigiCert_Trusted_Root_G4.pem",
+  "subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4 (self-signed)",
+  "sha256": "55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88",
+  "sha1": "DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4",
+  "serial": "059B1B579E8E2132E23907BDA777755C",
+  "not_after": "Jan 15 12:00:00 2038 GMT",
+  "verified_against": [
+   {
+    "source": "operating system store, Ubuntu package ca-certificates 20260816ubuntu0.24.04.1, /usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt",
+    "kind": "independent of the reply"
+   },
+   {
+    "source": "https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates, entry DigiCert Trusted Root G4 (self-signed), read on 2026-11-03",
+    "kind": "the publisher's own figures: SHA-256, SHA-1 and serial all equal"
+   }
+  ],
+  "note": "The reply carries a cross-signed DigiCert Trusted Root G4 (issuer DigiCert Assured ID Root CA, valid to 2031-11-09) with the same public key. It is NOT used as the anchor; the self-signed root (valid to 2038-01-15) is."
+ },
+ "stamps": [
+  {
+   "release": "v0.2.1",
+   "record": {
+    "git_commit": "5e8c3219b52399e3e764b0b0bb27de710f5445a4",
+    "path": "release/cic-primitives-v0.2.1.yaml",
+    "sha256": "e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63",
+    "bytes": 79011
+   },
+   "request": {
+    "file": "v0.2.1/request.tsq",
+    "sha256": "22a80e66f9b942f5d71a1acb401a9036927425a9ec8e2b0ed6160b28d6bd29d9",
+    "nonce": "0xEEA25FE7D7899723"
+   },
+   "response": {
+    "file": "v0.2.1/response.tsr",
+    "sha256": "d3f4df0465578294b1a58157919462a0d8ec33fd7411b93417e1f7c24d2b5f65",
+    "status": "Granted",
+    "serial": "0x675CA92462CD68E87963124F1967FD43",
+    "policy_oid": "2.16.840.1.114412.7.1",
+    "stamp_time_utc": "Nov  3 22:07:48 2026 GMT",
+    "nonce": "0xEEA25FE7D7899723"
+   },
+   "tsa_chain_file": "v0.2.1/tsa-chain.pem"
+  },
+  {
+   "release": "v0.2.0",
+   "record": {
+    "git_commit": "960ee0f048d969a85ad20819bc0f2366ad91fa40",
+    "path": "release/cic-primitives-v0.2.0.yaml",
+    "sha256": "955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6",
+    "bytes": 64905
+   },
+   "request": {
+    "file": "v0.2.0/request.tsq",
+    "sha256": "1c2b433880a73cc92e9f3511c1066ccf37c872eb1f1c2d817cceb49a293c0a16",
+    "nonce": "0xF53BC5599CE05F53"
+   },
+   "response": {
+    "file": "v0.2.0/response.tsr",
+    "sha256": "4d43ca701ced71f57d3ef78c881553ead52560b0fd75e67131c5e4fc7a1a456e",
+    "status": "Granted",
+    "serial": "0x2CD213F94B1638FBFF68D10520DE73E2",
+    "policy_oid": "2.16.840.1.114412.7.1",
+    "stamp_time_utc": "Nov  3 22:09:44 2026 GMT",
+    "nonce": "0xF53BC5599CE05F53"
+   },
+   "tsa_chain_file": "v0.2.0/tsa-chain.pem"
+  },
+  {
+   "release": "v0.1.5",
+   "record": {
+    "git_commit": "d59f7d6b5d22751a932b2bc0a522cf8acec1806b",
+    "path": "release/cic-primitives-v0.1.5.yaml",
+    "sha256": "284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456",
+    "bytes": 55002
+   },
+   "request": {
+    "file": "v0.1.5/request.tsq",
+    "sha256": "d403b78ad4f66e53748777753121f33079545c23157a9f4571c66091eeca5fae",
+    "nonce": "0x2CDA40EE6D7CFA7A"
+   },
+   "response": {
+    "file": "v0.1.5/response.tsr",
+    "sha256": "c91b2ad33077fef2806ec11e4ce363d49f102f3426fe7e77f6bd7cf48262ec6e",
+    "status": "Granted",
+    "serial": "0x03F23860CF26B3B2F8645FA478CFAAFC",
+    "policy_oid": "2.16.840.1.114412.7.1",
+    "stamp_time_utc": "Nov  3 22:09:45 2026 GMT",
+    "nonce": "0x2CDA40EE6D7CFA7A"
+   },
+   "tsa_chain_file": "v0.1.5/tsa-chain.pem"
+  }
+ ],
+ "cic_chain": {
+  "developer": {
+   "file": "cic-chain/developer.pem",
+   "subject": "C = HU, O = CentralInfraCore, CN = Gabor Zoltan Sinko",
+   "sha256": "5E:F7:39:DC:91:CF:87:6D:3E:E9:29:DB:94:60:6A:60:A5:80:46:D7:C6:0C:25:EC:93:10:70:83:E9:28:93:03",
+   "not_before": "Mar 20 13:22:59 2026 GMT",
+   "not_after": "Dec 31 13:22:59 2026 GMT",
+   "source": "carried by each of the three records (release.createdBy.certificate); the three records carry the same certificate"
+  },
+  "developer-ca": {
+   "file": "cic-chain/developer-ca.pem",
+   "subject": "C = HU, O = CentralInfraCore, CN = CIC Developer CA",
+   "sha256": "D3:59:D1:47:8F:E9:15:89:FA:02:B7:8A:EC:E3:98:37:DC:0D:60:27:24:B2:6E:0F:4E:4F:86:4B:40:76:F6:6A",
+   "not_before": "Mar 20 13:22:46 2026 GMT",
+   "not_after": "Dec 31 13:22:46 2026 GMT",
+   "source": "NOT carried by the records; a public certificate taken from the owner's local PKI directory (EEC/CICDeveloperCA/CICDeveloperCA2026.pem). That it is the issuer of the developer certificate is shown by openssl verify, not assumed"
+  },
+  "source-ca": {
+   "file": "cic-chain/source-ca.pem",
+   "subject": "C = HU, O = CentralInfraCore, CN = CIC Source CA",
+   "sha256": "27:2B:B9:73:EA:68:4C:C0:00:D6:DF:3E:77:21:25:2C:3C:48:85:BF:93:4E:9A:57:C5:CF:D0:E1:BE:C8:BC:20",
+   "not_before": "Mar 20 13:22:39 2026 GMT",
+   "not_after": "Dec 31 13:22:39 2026 GMT",
+   "source": "carried by each of the three records (cic_countersign.authority.certificate); the same in all three"
+  },
+  "root": {
+   "file": "cic-chain/root.pem",
+   "subject": "C = HU, O = CentralInfraCore, CN = CIC Root CA",
+   "sha256": "7A:87:3A:BB:99:D7:20:D9:77:96:B4:A9:82:30:C4:3A:31:99:3B:7E:67:E3:30:2B:B5:7F:AE:9C:4F:5F:D1:A3",
+   "not_before": "Mar 19 12:59:30 2026 GMT",
+   "not_after": "Dec 31 23:59:59 2026 GMT",
+   "source": "carried by each of the three records (cic_countersign.authority.root_certificate); the same in all three"
+  },
+  "note": "The CIC certificates are public. They are kept because the Developer CA is in none of the records, and because a later check of 'was this signature made while the chain was valid' needs them with the time of the stamp. They are not a trust anchor for the release (docs/P5-TRUST-MODEL-PLAN.md): they say when the chain ended, not whether it may be believed."
+ }
+}

evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
+RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
+Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
+ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
+xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
+ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
+DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
+jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
+CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
+EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
+fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
+uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
+chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
+9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
+ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
+SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
++SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
+fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
+sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
+cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
+0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
+4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
+r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
+/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
+gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
+-----END CERTIFICATE-----