From petar.kozic at mint.rs Mon May 20 14:33:46 2019
Content-Type: multipart/mixed; boundary="===============5069900976163822988=="
MIME-Version: 1.0
From: =?utf-8?q?Petar_Kozi=C4=87_=3Cpetar=2Ekozic_at_mint=2Ers=3E?=
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: cert validation failed
Date: Mon, 20 May 2019 10:33:23 -0400
Message-ID: <CAA1-vMETovP6jWNimyFYZFbRAgeN89y6ijNTZiwyChv+6QSTdA@mail.gmail.com>
In-Reply-To: daf18756-bb7c-e994-1078-f30036fdef8d@redhat.com

--===============5069900976163822988==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Thank you very much for everything.
I tried curl and curl on https:// works, a get html response with whole
body

<!DOCTYPE html>
<html>
<head>
    <meta charset=3D"utf-8">
    <title>IPA: Identity Policy Audit</title>
    <script type=3D"text/javascript" src=3D"../ui/js/libs/loader.js"></scri=
pt>
    <script type=3D"text/javascript">
        var dojoConfig =3D {
            baseUrl: "../ui/js",
            has: {
                'dojo-firebug': false,
                'dojo-debug-messages': true
            },
            parseOnLoad: false,
            async: true,
            packages: [ =E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6
=E2=80=A6..

<div class=3D"container-fluid">
    <div class=3D"row">
    <div class=3D"col-sm-12">
    <div id=3D"unauthorized-msg">
    <noscript>

        <h1>Unable to verify your Kerberos credentials</h1>
        <p>
            Please make sure that you have valid Kerberos tickets
(obtainable via <strong>kinit</strong>), and that you have configured your
browser correctly.
        </p>

        <h2>Browser configuration</h2>

        <div id=3D"first-time">
            <p>
                If this is your first time, please <a
href=3D"ssbrowser.html">configure your browser</a>. =E2=80=A6=E2=80=A6=E2=
=80=A6=E2=80=A6..

=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6=E2=80=A6

I don=E2=80=99t have idea. Looks like I will update all this VPS to Ubuntu =
18.04
because there everything works.



On May 20, 2019 at 4:23:56 PM, Rob Crittenden (rcritten(a)redhat.com) wrote:

Petar Kozi=C4=87 wrote:
> I just try that:
>
> cp ca.crt /usr/local/share/ca-certificates/
> update-ca-certificates
>
> Updating certificates in /etc/ssl/certs... 1 added, 0 removed; done.
> Running hooks in /etc/ca-certificates/update.d....
> updates of cacerts keystore disabled.
> done.
>
> Looks like update something, but again same error. In above command I
> copied ca.crt from IPA if you think on that.
> Thank you on your time.

That's about the extent of my Ubuntu knowledge.

It's hard to parse the output. Was that one file added or one
certificate added? LE definitely has a chain.

You should be able to independently confirm that the trust is ok using
something like curl:

$ curl https://ipa.example.com/ipa

If the connection fails then the right LE roots are not available on the
system.

rob

>
> On May 20, 2019 at 4:03:32 PM, Rob Crittenden (rcritten(a)redhat.com
> <mailto:rcritten(a)redhat.com>) wrote:
>
>> Petar Kozi=C4=87 via FreeIPA-users wrote:
>> > @Rob, sorry for duplicate mail, I forget to do reply to all
>> >
>> >
>> > No, there is X1 and X3. I have whole chain in ca.crt
>> >
>> > Where you think that I can install this let=E2=80=99s encrypt root on =
client
>> > side, because on server I already have it in chain?
>> >
>> > On IPA I installed on this way.
>> > https://blog.soholabs.org/lets-encrypt-and-the-freeipa-web-gui/
>>
>> The older ipa-client-install don't handle cert chains well. You can try
>> to add the roots to the global trust before running the installer via:
>>
>> $ sudo cp ca.crt /usr/local/share/ca-certificates/
>> $ sudo update-ca-certificates
>>
>> rob
>>
>> >
>> > On May 20, 2019 at 3:28:50 PM, Rob Crittenden (rcritten(a)redhat.com
<mailto:rcritten(a)redhat.com>
>> > <mailto:rcritten(a)redhat.com <mailto:rcritten(a)redhat.com>>) wrote:
>> >
>> >> Petar Kozi=C4=87 via FreeIPA-users wrote:
>> >> > Here is the log files. I just want to inform you that I have that
>> >> > problem now also on Ubuntu 14.40 and Debian 8.
>> >> > On Ubuntu ipa client version is 3.3, maybe problem is there.
>> >> >
>> >> > In mean time I enrolled several more Ubuntu 18.04 instances without
>> >> > problem.
>> >> >
>> >> > On this Debian 8 and Ubuntu 14.40 I just try with options
=E2=80=94ca-cert-file
>> >> > which I copied from master but same error.
>> >> >
>> >>
>> >> I have no visibility into what CA file you used but you're missing
>> >> either the X3 subca or the X1 root.
>> >>
>> >> You can get them from https://letsencrypt.org/certificates/
>> >>
>> >> Look at the ca.crt you used and see how many certificates are in
there.
>> >> I'm assuming there is only one. You can try concatenating the X1 and
X3
>> >> certs into that and things should work.
>> >>
>> >> rob
>> >
>> >
>> > _______________________________________________
>> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users(a)lists.fedorahosted.org>
>> > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave(a)lists.fedorahosted.org>
>> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users(a)lists.fedoraho=
sted.org
>>
>> >
>>

--===============5069900976163822988==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"

PGh0bWw+PGhlYWQ+PHN0eWxlPmJvZHl7Zm9udC1mYW1pbHk6SGVsdmV0aWNhLEFyaWFsO2ZvbnQt
c2l6ZToxM3B4fTwvc3R5bGU+PC9oZWFkPjxib2R5PjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5Okhl
bHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweCI+VGhhbmsgeW91IHZlcnkgbXVjaCBmb3IgZXZl
cnl0aGluZy48L2Rpdj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EsQXJpYWw7Zm9u
dC1zaXplOjEzcHgiPkkgdHJpZWQgY3VybCBhbmQgY3VybCBvbiBodHRwczovLyB3b3JrcywgYSBn
ZXQgaHRtbCByZXNwb25zZSB3aXRoIHdob2xlIGJvZHnCoDwvZGl2PjxkaXYgc3R5bGU9ImZvbnQt
ZmFtaWx5OkhlbHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweCI+PGJyPjwvZGl2PjxkaXYgc3R5
bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYSxBcmlhbDtmb250LXNpemU6MTNweCI+PGRpdiBzdHls
ZT0ibWFyZ2luOjBweCI+Jmx0OyFET0NUWVBFIGh0bWwmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFy
Z2luOjBweCI+Jmx0O2h0bWwmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+Jmx0O2hl
YWQmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgJmx0O21ldGEgY2hhcnNl
dD0mcXVvdDt1dGYtOCZxdW90OyZndDs8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDC
oCAmbHQ7dGl0bGUmZ3Q7SVBBOiBJZGVudGl0eSBQb2xpY3kgQXVkaXQmbHQ7L3RpdGxlJmd0Ozwv
ZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPsKgIMKgICZsdDtzY3JpcHQgdHlwZT0mcXVvdDt0
ZXh0L2phdmFzY3JpcHQmcXVvdDsgc3JjPSZxdW90Oy4uL3VpL2pzL2xpYnMvbG9hZGVyLmpzJnF1
b3Q7Jmd0OyZsdDsvc2NyaXB0Jmd0OzwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPsKgIMKg
ICZsdDtzY3JpcHQgdHlwZT0mcXVvdDt0ZXh0L2phdmFzY3JpcHQmcXVvdDsmZ3Q7PC9kaXY+PGRp
diBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAgwqAgdmFyIGRvam9Db25maWcgPSB7PC9kaXY+
PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAgwqAgwqAgwqAgYmFzZVVybDogJnF1b3Q7
Li4vdWkvanMmcXVvdDssPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAgwqAg
wqAgwqAgaGFzOiB7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAgwqAgwqAg
wqAgwqAgwqAgJiMzOTtkb2pvLWZpcmVidWcmIzM5OzogZmFsc2UsPC9kaXY+PGRpdiBzdHlsZT0i
bWFyZ2luOjBweCI+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgJiMzOTtkb2pvLWRlYnVnLW1lc3Nh
Z2VzJiMzOTs6IHRydWU8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDCoCDC
oCDCoCB9LDwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPsKgIMKgIMKgIMKgIMKgIMKgIHBh
cnNlT25Mb2FkOiBmYWxzZSw8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDC
oCDCoCDCoCBhc3luYzogdHJ1ZSw8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDC
oCDCoCDCoCDCoCBwYWNrYWdlczogWyDigKbigKbigKbigKY8L2Rpdj48ZGl2IHN0eWxlPSJtYXJn
aW46MHB4Ij7igKYuLjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPjxicj48L2Rpdj48ZGl2
IHN0eWxlPSJtYXJnaW46MHB4Ij48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij4mbHQ7ZGl2IGNsYXNz
PSZxdW90O2NvbnRhaW5lci1mbHVpZCZxdW90OyZndDs8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46
MHB4Ij7CoCDCoCAmbHQ7ZGl2IGNsYXNzPSZxdW90O3JvdyZxdW90OyZndDs8L2Rpdj48ZGl2IHN0
eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCAmbHQ7ZGl2IGNsYXNzPSZxdW90O2NvbC1zbS0xMiZxdW90
OyZndDs8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCAmbHQ7ZGl2IGlkPSZxdW90
O3VuYXV0aG9yaXplZC1tc2cmcXVvdDsmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+
wqAgwqAgJmx0O25vc2NyaXB0Jmd0OzwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPjxicj48
L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDCoCAmbHQ7aDEmZ3Q7VW5hYmxl
IHRvIHZlcmlmeSB5b3VyIEtlcmJlcm9zIGNyZWRlbnRpYWxzJmx0Oy9oMSZndDs8L2Rpdj48ZGl2
IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDCoCAmbHQ7cCZndDs8L2Rpdj48ZGl2IHN0eWxl
PSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDCoCDCoCDCoCBQbGVhc2UgbWFrZSBzdXJlIHRoYXQgeW91
IGhhdmUgdmFsaWQgS2VyYmVyb3MgdGlja2V0cyAob2J0YWluYWJsZSB2aWEgJmx0O3N0cm9uZyZn
dDtraW5pdCZsdDsvc3Ryb25nJmd0OyksIGFuZCB0aGF0IHlvdSBoYXZlIGNvbmZpZ3VyZWQgeW91
ciBicm93c2VyIGNvcnJlY3RseS48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDC
oCDCoCAmbHQ7L3AmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+PGJyPjwvZGl2Pjxk
aXYgc3R5bGU9Im1hcmdpbjowcHgiPsKgIMKgIMKgIMKgICZsdDtoMiZndDtCcm93c2VyIGNvbmZp
Z3VyYXRpb24mbHQ7L2gyJmd0OzwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowcHgiPjxicj48L2Rp
dj48ZGl2IHN0eWxlPSJtYXJnaW46MHB4Ij7CoCDCoCDCoCDCoCAmbHQ7ZGl2IGlkPSZxdW90O2Zp
cnN0LXRpbWUmcXVvdDsmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAg
wqAgwqAgwqAgJmx0O3AmZ3Q7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjBweCI+wqAgwqAgwqAg
wqAgwqAgwqAgwqAgwqAgSWYgdGhpcyBpcyB5b3VyIGZpcnN0IHRpbWUsIHBsZWFzZSAmbHQ7YSBo
cmVmPSZxdW90O3NzYnJvd3Nlci5odG1sJnF1b3Q7Jmd0O2NvbmZpZ3VyZSB5b3VyIGJyb3dzZXIm
bHQ7L2EmZ3Q7LiDigKbigKbigKbigKYuLjwvZGl2PjwvZGl2PjwvZGl2PiA8YnI+IDxkaXYgY2xh
c3M9ImdtYWlsX3NpZ25hdHVyZSI+PGRpdiBzdHlsZT0iZm9udC1zaXplOjE0cHg7bGluZS1oZWln
aHQ6bm9ybWFsO21hcmdpbjowcHg7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMjUzLDI1MywyNTMpIj7i
gKbigKbigKbigKbigKY8L2Rpdj48ZGl2IHN0eWxlPSJmb250LXNpemU6MTRweDtsaW5lLWhlaWdo
dDpub3JtYWw7bWFyZ2luOjBweDtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTMsMjUzLDI1MykiPjxi
cj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LXNpemU6MTRweDtsaW5lLWhlaWdodDpub3JtYWw7bWFy
Z2luOjBweDtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTMsMjUzLDI1MykiPkkgZG9u4oCZdCBoYXZl
IGlkZWEuIExvb2tzIGxpa2UgSSB3aWxsIHVwZGF0ZSBhbGwgdGhpcyBWUFMgdG8gVWJ1bnR1IDE4
LjA0IGJlY2F1c2UgdGhlcmUgZXZlcnl0aGluZyB3b3Jrcy48L2Rpdj48ZGl2IHN0eWxlPSJmb250
LXNpemU6MTRweDtsaW5lLWhlaWdodDpub3JtYWw7bWFyZ2luOjBweDtiYWNrZ3JvdW5kLWNvbG9y
OnJnYigyNTMsMjUzLDI1MykiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LXNpemU6MTRweDts
aW5lLWhlaWdodDpub3JtYWw7bWFyZ2luOjBweDtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTMsMjUz
LDI1MykiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJmb250LXNpemU6MTRweDtsaW5lLWhlaWdodDpu
b3JtYWw7bWFyZ2luOjBweDtiYWNrZ3JvdW5kLWNvbG9yOnJnYigyNTMsMjUzLDI1MykiPjxicj48
L2Rpdj48L2Rpdj48cCBjbGFzcz0iYWlybWFpbF9vbiI+T24gTWF5IDIwLCAyMDE5IGF0IDQ6MjM6
NTYgUE0sIFJvYiBDcml0dGVuZGVuICg8YSBocmVmPSJtYWlsdG86cmNyaXR0ZW5AcmVkaGF0LmNv
bSI+cmNyaXR0ZW5AcmVkaGF0LmNvbTwvYT4pIHdyb3RlOjwvcD4gPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSIgY2xhc3M9ImNsZWFuX2JxIj48c3Bhbj48ZGl2PjxkaXY+PC9kaXY+PGRpdj5QZXRhciBL
b3ppxIcgd3JvdGU6Cjxicj4mZ3Q7IEkganVzdCB0cnkgdGhhdDoKPGJyPiZndDsgIAo8YnI+Jmd0
OyBjcCBjYS5jcnQgL3Vzci9sb2NhbC9zaGFyZS9jYS1jZXJ0aWZpY2F0ZXMvCjxicj4mZ3Q7IHVw
ZGF0ZS1jYS1jZXJ0aWZpY2F0ZXMKPGJyPiZndDsgIAo8YnI+Jmd0OyBVcGRhdGluZyBjZXJ0aWZp
Y2F0ZXMgaW4gL2V0Yy9zc2wvY2VydHMuLi4gMSBhZGRlZCwgMCByZW1vdmVkOyBkb25lLgo8YnI+
Jmd0OyBSdW5uaW5nIGhvb2tzIGluIC9ldGMvY2EtY2VydGlmaWNhdGVzL3VwZGF0ZS5kLi4uLgo8
YnI+Jmd0OyB1cGRhdGVzIG9mIGNhY2VydHMga2V5c3RvcmUgZGlzYWJsZWQuCjxicj4mZ3Q7IGRv
bmUuCjxicj4mZ3Q7ICAKPGJyPiZndDsgTG9va3MgbGlrZSB1cGRhdGUgc29tZXRoaW5nLCBidXQg
YWdhaW4gc2FtZSBlcnJvci4gSW4gYWJvdmUgY29tbWFuZCBJCjxicj4mZ3Q7IGNvcGllZCBjYS5j
cnQgZnJvbSBJUEEgaWYgeW91IHRoaW5rIG9uIHRoYXQuCjxicj4mZ3Q7IFRoYW5rIHlvdSBvbiB5
b3VyIHRpbWUuCjxicj4KPGJyPlRoYXQmIzM5O3MgYWJvdXQgdGhlIGV4dGVudCBvZiBteSBVYnVu
dHUga25vd2xlZGdlLgo8YnI+Cjxicj5JdCYjMzk7cyBoYXJkIHRvIHBhcnNlIHRoZSBvdXRwdXQu
IFdhcyB0aGF0IG9uZSBmaWxlIGFkZGVkIG9yIG9uZQo8YnI+Y2VydGlmaWNhdGUgYWRkZWQ/IExF
IGRlZmluaXRlbHkgaGFzIGEgY2hhaW4uCjxicj4KPGJyPllvdSBzaG91bGQgYmUgYWJsZSB0byBp
bmRlcGVuZGVudGx5IGNvbmZpcm0gdGhhdCB0aGUgdHJ1c3QgaXMgb2sgdXNpbmcKPGJyPnNvbWV0
aGluZyBsaWtlIGN1cmw6Cjxicj4KPGJyPiQgY3VybCA8YSBocmVmPSJodHRwczovL2lwYS5leGFt
cGxlLmNvbS9pcGEiPmh0dHBzOi8vaXBhLmV4YW1wbGUuY29tL2lwYTwvYT4KPGJyPgo8YnI+SWYg
dGhlIGNvbm5lY3Rpb24gZmFpbHMgdGhlbiB0aGUgcmlnaHQgTEUgcm9vdHMgYXJlIG5vdCBhdmFp
bGFibGUgb24gdGhlCjxicj5zeXN0ZW0uCjxicj4KPGJyPnJvYgo8YnI+Cjxicj4mZ3Q7ICAKPGJy
PiZndDsgT24gTWF5IDIwLCAyMDE5IGF0IDQ6MDM6MzIgUE0sIFJvYiBDcml0dGVuZGVuICg8YSBo
cmVmPSJtYWlsdG86cmNyaXR0ZW5AcmVkaGF0LmNvbSI+cmNyaXR0ZW5AcmVkaGF0LmNvbTwvYT4K
PGJyPiZndDsgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86cmNyaXR0ZW5AcmVkaGF0LmNvbSI+
cmNyaXR0ZW5AcmVkaGF0LmNvbTwvYT4mZ3Q7KSB3cm90ZToKPGJyPiZndDsgIAo8YnI+Jmd0OyZn
dDsgUGV0YXIgS296acSHIHZpYSBGcmVlSVBBLXVzZXJzIHdyb3RlOgo8YnI+Jmd0OyZndDsgJmd0
OyBAUm9iLCBzb3JyeSBmb3IgZHVwbGljYXRlIG1haWwsIEkgZm9yZ2V0IHRvIGRvIHJlcGx5IHRv
IGFsbAo8YnI+Jmd0OyZndDsgJmd0OyAgIAo8YnI+Jmd0OyZndDsgJmd0OyAgIAo8YnI+Jmd0OyZn
dDsgJmd0OyBObywgdGhlcmUgaXMgWDEgYW5kIFgzLiBJIGhhdmUgd2hvbGUgY2hhaW4gaW4gY2Eu
Y3J0Cjxicj4mZ3Q7Jmd0OyAmZ3Q7ICAgCjxicj4mZ3Q7Jmd0OyAmZ3Q7IFdoZXJlIHlvdSB0aGlu
ayB0aGF0IEkgY2FuIGluc3RhbGwgdGhpcyBsZXTigJlzIGVuY3J5cHQgcm9vdCBvbiBjbGllbnQK
PGJyPiZndDsmZ3Q7ICZndDsgc2lkZSwgYmVjYXVzZSBvbiBzZXJ2ZXIgSSBhbHJlYWR5IGhhdmUg
aXQgaW4gY2hhaW4/Cjxicj4mZ3Q7Jmd0OyAmZ3Q7ICAgCjxicj4mZ3Q7Jmd0OyAmZ3Q7IE9uIElQ
QSBJIGluc3RhbGxlZCBvbiB0aGlzIHdheS4KPGJyPiZndDsmZ3Q7ICZndDsgPGEgaHJlZj0iaHR0
cHM6Ly9ibG9nLnNvaG9sYWJzLm9yZy9sZXRzLWVuY3J5cHQtYW5kLXRoZS1mcmVlaXBhLXdlYi1n
dWkvIj5odHRwczovL2Jsb2cuc29ob2xhYnMub3JnL2xldHMtZW5jcnlwdC1hbmQtdGhlLWZyZWVp
cGEtd2ViLWd1aS88L2E+Cjxicj4mZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsgVGhlIG9sZGVyIGlwYS1j
bGllbnQtaW5zdGFsbCBkb24mIzM5O3QgaGFuZGxlIGNlcnQgY2hhaW5zIHdlbGwuIFlvdSBjYW4g
dHJ5Cjxicj4mZ3Q7Jmd0OyB0byBhZGQgdGhlIHJvb3RzIHRvIHRoZSBnbG9iYWwgdHJ1c3QgYmVm
b3JlIHJ1bm5pbmcgdGhlIGluc3RhbGxlciB2aWE6Cjxicj4mZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsg
JCBzdWRvIGNwIGNhLmNydCAvdXNyL2xvY2FsL3NoYXJlL2NhLWNlcnRpZmljYXRlcy8KPGJyPiZn
dDsmZ3Q7ICQgc3VkbyB1cGRhdGUtY2EtY2VydGlmaWNhdGVzCjxicj4mZ3Q7Jmd0Owo8YnI+Jmd0
OyZndDsgcm9iCjxicj4mZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsgJmd0OyAgIAo8YnI+Jmd0OyZndDsg
Jmd0OyBPbiBNYXkgMjAsIDIwMTkgYXQgMzoyODo1MCBQTSwgUm9iIENyaXR0ZW5kZW4gKDxhIGhy
ZWY9Im1haWx0bzpyY3JpdHRlbkByZWRoYXQuY29tIj5yY3JpdHRlbkByZWRoYXQuY29tPC9hPiAm
bHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpyY3JpdHRlbkByZWRoYXQuY29tIj5yY3JpdHRlbkBy
ZWRoYXQuY29tPC9hPiZndDsKPGJyPiZndDsmZ3Q7ICZndDsgJmx0O21haWx0bzo8YSBocmVmPSJt
YWlsdG86cmNyaXR0ZW5AcmVkaGF0LmNvbSI+cmNyaXR0ZW5AcmVkaGF0LmNvbTwvYT4gJmx0O21h
aWx0bzo8YSBocmVmPSJtYWlsdG86cmNyaXR0ZW5AcmVkaGF0LmNvbSI+cmNyaXR0ZW5AcmVkaGF0
LmNvbTwvYT4mZ3Q7Jmd0Oykgd3JvdGU6Cjxicj4mZ3Q7Jmd0OyAmZ3Q7ICAgCjxicj4mZ3Q7Jmd0
OyAmZ3Q7Jmd0OyBQZXRhciBLb3ppxIcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6Cjxicj4mZ3Q7
Jmd0OyAmZ3Q7Jmd0OyAmZ3Q7IEhlcmUgaXMgdGhlIGxvZyBmaWxlcy4gSSBqdXN0IHdhbnQgdG8g
aW5mb3JtIHlvdSB0aGF0IEkgaGF2ZSB0aGF0Cjxicj4mZ3Q7Jmd0OyAmZ3Q7Jmd0OyAmZ3Q7IHBy
b2JsZW0gbm93IGFsc28gb24gVWJ1bnR1IDE0LjQwIGFuZCBEZWJpYW4gOC4KPGJyPiZndDsmZ3Q7
ICZndDsmZ3Q7ICZndDsgT24gVWJ1bnR1IGlwYSBjbGllbnQgdmVyc2lvbiBpcyAzLjMsIG1heWJl
IHByb2JsZW0gaXMgdGhlcmUuCjxicj4mZ3Q7Jmd0OyAmZ3Q7Jmd0OyAmZ3Q7ICAgIAo8YnI+Jmd0
OyZndDsgJmd0OyZndDsgJmd0OyBJbiBtZWFuIHRpbWUgSSBlbnJvbGxlZCBzZXZlcmFsIG1vcmUg
VWJ1bnR1IDE4LjA0IGluc3RhbmNlcyB3aXRob3V0Cjxicj4mZ3Q7Jmd0OyAmZ3Q7Jmd0OyAmZ3Q7
IHByb2JsZW0uwqAKPGJyPiZndDsmZ3Q7ICZndDsmZ3Q7ICZndDsgICAgCjxicj4mZ3Q7Jmd0OyAm
Z3Q7Jmd0OyAmZ3Q7IE9uIHRoaXMgRGViaWFuIDggYW5kIFVidW50dSAxNC40MCBJIGp1c3QgdHJ5
IHdpdGggb3B0aW9ucyDigJRjYS1jZXJ0LWZpbGUKPGJyPiZndDsmZ3Q7ICZndDsmZ3Q7ICZndDsg
d2hpY2ggSSBjb3BpZWQgZnJvbSBtYXN0ZXIgYnV0IHNhbWUgZXJyb3IuCjxicj4mZ3Q7Jmd0OyAm
Z3Q7Jmd0OyAmZ3Q7ICAgIAo8YnI+Jmd0OyZndDsgJmd0OyZndDsKPGJyPiZndDsmZ3Q7ICZndDsm
Z3Q7IEkgaGF2ZSBubyB2aXNpYmlsaXR5IGludG8gd2hhdCBDQSBmaWxlIHlvdSB1c2VkIGJ1dCB5
b3UmIzM5O3JlIG1pc3NpbmcKPGJyPiZndDsmZ3Q7ICZndDsmZ3Q7IGVpdGhlciB0aGUgWDMgc3Vi
Y2Egb3IgdGhlIFgxIHJvb3QuCjxicj4mZ3Q7Jmd0OyAmZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsgJmd0
OyZndDsgWW91IGNhbiBnZXQgdGhlbSBmcm9tIDxhIGhyZWY9Imh0dHBzOi8vbGV0c2VuY3J5cHQu
b3JnL2NlcnRpZmljYXRlcy8iPmh0dHBzOi8vbGV0c2VuY3J5cHQub3JnL2NlcnRpZmljYXRlcy88
L2E+Cjxicj4mZ3Q7Jmd0OyAmZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsgJmd0OyZndDsgTG9vayBhdCB0
aGUgY2EuY3J0IHlvdSB1c2VkIGFuZCBzZWUgaG93IG1hbnkgY2VydGlmaWNhdGVzIGFyZSBpbiB0
aGVyZS4KPGJyPiZndDsmZ3Q7ICZndDsmZ3Q7IEkmIzM5O20gYXNzdW1pbmcgdGhlcmUgaXMgb25s
eSBvbmUuIFlvdSBjYW4gdHJ5IGNvbmNhdGVuYXRpbmcgdGhlIFgxIGFuZCBYMwo8YnI+Jmd0OyZn
dDsgJmd0OyZndDsgY2VydHMgaW50byB0aGF0IGFuZCB0aGluZ3Mgc2hvdWxkIHdvcmsuCjxicj4m
Z3Q7Jmd0OyAmZ3Q7Jmd0Owo8YnI+Jmd0OyZndDsgJmd0OyZndDsgcm9iCjxicj4mZ3Q7Jmd0OyAm
Z3Q7ICAgCjxicj4mZ3Q7Jmd0OyAmZ3Q7ICAgCjxicj4mZ3Q7Jmd0OyAmZ3Q7IF9fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCjxicj4mZ3Q7Jmd0OyAmZ3Q7IEZy
ZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJz
QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVk
Lm9yZzwvYT4KPGJyPiZndDsmZ3Q7ICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOmZyZWVpcGEt
dXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFo
b3N0ZWQub3JnPC9hPiZndDsKPGJyPiZndDsmZ3Q7ICZndDsgVG8gdW5zdWJzY3JpYmUgc2VuZCBh
biBlbWFpbCB0byA8YSBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRv
cmFob3N0ZWQub3JnIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8
L2E+Cjxicj4mZ3Q7Jmd0OyAmbHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJz
LWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMu
ZmVkb3JhaG9zdGVkLm9yZzwvYT4mZ3Q7Cjxicj4mZ3Q7Jmd0OyAmZ3Q7IEZlZG9yYSBDb2RlIG9m
IENvbmR1Y3Q6IDxhIGhyZWY9Imh0dHBzOi8vZ2V0ZmVkb3JhLm9yZy9jb2RlLW9mLWNvbmR1Y3Qu
aHRtbCI+aHR0cHM6Ly9nZXRmZWRvcmEub3JnL2NvZGUtb2YtY29uZHVjdC5odG1sPC9hPgo8YnI+
Jmd0OyZndDsgJmd0OyBMaXN0IEd1aWRlbGluZXM6IDxhIGhyZWY9Imh0dHBzOi8vZmVkb3JhcHJv
amVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcyI+aHR0cHM6Ly9mZWRvcmFwcm9q
ZWN0Lm9yZy93aWtpL01haWxpbmdfbGlzdF9ndWlkZWxpbmVzPC9hPgo8YnI+Jmd0OyZndDsgJmd0
OyBMaXN0IEFyY2hpdmVzOiA8YSBocmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcv
YXJjaGl2ZXMvbGlzdC9mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmh0dHBz
Oi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hcmNoaXZlcy9saXN0L2ZyZWVpcGEtdXNlcnNAbGlz
dHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPGJyPiZndDsmZ3Q7Cjxicj4mZ3Q7Jmd0OyAmZ3Q7ICAg
Cjxicj4mZ3Q7Jmd0Owo8YnI+Cjxicj48L2Rpdj48L2Rpdj48L3NwYW4+PC9ibG9ja3F1b3RlPjwv
Ym9keT48L2h0bWw+Cg==

--===============5069900976163822988==--

