AzStackHci.DiagnosticSettings

0.7.1

Public/AzStackHci.SSLInspection.ps1

                                # ///////////////////////////////////////////////////////////////////

# Strict Mode v1 (PS 5.1 safe) - surfaces reads of uninitialised variables at runtime.

Set-StrictMode -Version 1.0

# Test-AzStackHciSSLInspection function

# Used to check for the presence of SSL Inspection on traffic sent to a specified URL

# ///////////////////////////////////////////////////////////////////

function Test-AzStackHciSSLInspection {

    <#

    .SYNOPSIS

    Function to check for the presence of SSL Inspection on traffic sent to a specified URL.

    .PARAMETER url

    The URL to test for SSL Inspection

    .DESCRIPTION

    Expects Microsoft or DigiCert certificates to be used for SSL/TLS connections to the specified URL.

    If a different certificate is detected, the script will report that SSL Inspection is present.

    Script checks for redirects and follows them to test further URLs if required.

    Returns $true if SSL Inspection is detected, otherwise $false.

    #>

    [CmdletBinding()]

    [OutputType([bool])]

    param (

        [parameter(Mandatory=$true,HelpMessage="The URL to test for SSL Inspection",Position=0)]

        [System.Uri]$url,

        [Parameter(Mandatory=$false, HelpMessage="Optional switch to prevent console output from the function.")]

        [switch]$NoOutput

    )

    begin {

        # Reset SilentMode at entry — ensures clean state even if a prior call threw while -NoOutput was active

        $script:SilentMode = $false

        # Handle -NoOutput: suppress all console output

        if ($NoOutput.IsPresent) {

            $script:SilentMode = $true

            $VerbosePreference = 'SilentlyContinue'

            $DebugPreference = 'SilentlyContinue'

        }

        # Save the caller's $ErrorActionPreference so we can restore it in end {}.

        # Without this, the 'Stop' preference leaks to the caller's session (C-001).

        $OldErrorActionPreference = $ErrorActionPreference

        $ErrorActionPreference = "Stop"

        Write-HostAzS "`n`t///////////////////////////////////////////////"

        Write-HostAzS "`t Basic SSL Inspection Test for Azure Stack HCI"

        Write-HostAzS "`t///////////////////////////////////////////////`n"

        [bool]$RedirectsComplete = $false

        [bool]$SSLInspectionDetected = $false

        [int]$redirectCount = 0

        Write-HostAzS "Starting SSL Inspection Tests`n"

        Write-HostAzS "Date/Time = $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"

        Write-HostAzS "Performing test from hostname: $($env:COMPUTERNAME)`n"

    }

    process {

        try {

        do {

            $redirectCount++

            if ($redirectCount -gt $script:HTTP_MAX_REDIRECTS) {

                Write-HostAzS "Error: Maximum redirect limit ($($script:HTTP_MAX_REDIRECTS)) exceeded. Aborting SSL inspection test." -ForegroundColor Red

                $RedirectsComplete = $true

                break

            }

            $Request = $null

            $Response = $null

            $Request = [System.Net.HttpWebRequest]::Create($url)

            $Request.Method = "GET"

            $Request.AllowAutoRedirect = $False

            $Request.Proxy = [System.Net.WebRequest]::DefaultWebProxy

            Write-HostAzS "Testing SSL/TLS Certificate for endpoint: '$($Request.Address.AbsoluteUri)'"

            try {

                [System.Net.HttpWebResponse]$Response = $Request.GetResponse()    

            }

            catch {

                Write-HostAzS "Error: $($_.Exception.Message)"

                # Make the null-result explicit: the typed assignment above throws before

                # binding, so $Response stays $null and the later `if ($Response)` guard skips it.

                $Response = $null

            }

            try {

            # Check if the certificate subject contains "O=Microsoft" as most SSL inspection appliances will replace the certificate with their own

            if(($Request.ServicePoint.Certificate.Subject).Contains("O=Microsoft")){

                Write-HostAzS -ForegroundColor Green "Expected Certificate Subject Found: `nSubject = $($Request.ServicePoint.Certificate.Subject)"

            } else {

                $SSLInspectionDetected = $true

                Write-HostAzS -ForegroundColor Red "UNKNOWN Certificate Subject Found: `nSubject = '$($Request.ServicePoint.Certificate.Subject)'"

                Write-HostAzS -ForegroundColor Yellow "`tNote: Expected Certificate Contains Subject = 'O=Microsoft'"

            }

            # Check if the certificate issuer contains "O=Microsoft Corporation" or "O=DigiCert Inc" as most SSL inspection appliances will replace the certificate with their own

            if(($Request.ServicePoint.Certificate.Issuer).Contains("O=Microsoft Corporation") -or (($Request.ServicePoint.Certificate.Issuer).Contains("O=DigiCert Inc"))){

                Write-HostAzS -ForegroundColor Green "Expected Certificate Issuer Found: `nCertificate Issuer = $($Request.ServicePoint.Certificate.Issuer)"

            } else {

                $SSLInspectionDetected = $true

                Write-HostAzS -ForegroundColor Red "UNKNOWN Certificate Issuer Found: `nCertificate Issuer = '$($Request.ServicePoint.Certificate.Issuer)'"

                Write-HostAzS -ForegroundColor Yellow "`tNote: Expected Certificate Contains Issuer = 'O=Microsoft Corporation' or 'O=DigiCert Inc'"

            }

            # Root CA thumbprint validation: build the certificate chain and verify the root

            # against a known list of trusted Microsoft/DigiCert root CA thumbprints.

            # This provides a stronger check than string matching alone — a sophisticated

            # MITM could spoof Issuer/Subject strings but not root CA thumbprints.

            try {

                $cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($Request.ServicePoint.Certificate)

                $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

                $null = $chain.Build($cert2)

                if ($chain.ChainElements.Count -eq 0) {

                    Write-HostAzS -ForegroundColor Yellow "Warning: Certificate chain is empty — unable to validate root CA thumbprint."

                    throw "Certificate chain contains no elements"

                }

                $rootCert = $chain.ChainElements[$chain.ChainElements.Count - 1].Certificate

                if ($script:TRUSTED_ROOT_CA_THUMBPRINTS -contains $rootCert.Thumbprint) {

                    Write-HostAzS -ForegroundColor Green "Root CA Thumbprint Verified: $($rootCert.Thumbprint) ($($rootCert.Subject))"

                } else {

                    $SSLInspectionDetected = $true

                    Write-HostAzS -ForegroundColor Red "UNKNOWN Root CA Thumbprint: $($rootCert.Thumbprint)"

                    Write-HostAzS -ForegroundColor Red "Root CA Subject: $($rootCert.Subject)"

                    Write-HostAzS -ForegroundColor Yellow "`tNote: Root CA thumbprint does not match any known Microsoft/DigiCert root CAs"

                }

            } catch {

                Write-HostAzS -ForegroundColor Yellow "Warning: Unable to build certificate chain for root CA thumbprint validation: $($_.Exception.Message)"

            }

            # If $Response exists, check if for any redirects to further test required URLs

            if($Response){

                if(-not([string]::IsNullOrWhiteSpace($Response.Headers["Location"]))){

                    Write-HostAzS "Checking Redirected URL, as 'HTTP StatusCode = $($Response.StatusCode)'"

                    $url = $Response.Headers["Location"]

                } else {

                    # No redirects found

                    $RedirectsComplete = $true

                }

            } else {

                # No response found, unable to determine if redirects are required

                $RedirectsComplete = $true

            }

            } finally {

                # Ensure the response is always closed/disposed to prevent socket leaks

                if ($Response) { $Response.Close(); $Response = $null }

            }

            Write-HostAzS ""

        } while (

            $RedirectsComplete -ne $true

        ) # End of do..while loop for redirects

        # Note: this test uses both string matching AND root CA thumbprint verification.

        # String matching checks Subject/Issuer for known Microsoft/DigiCert organizations.

        # Thumbprint matching validates the root certificate against known trusted root CA thumbprints

        # from $script:TRUSTED_ROOT_CA_THUMBPRINTS (defined in AzStackHci.Constants.ps1).

        Write-HostAzS -ForegroundColor Yellow "Note: This test verifies certificates by matching Subject/Issuer strings and root CA thumbprints."

        Write-HostAzS -ForegroundColor Yellow "It is not intended to be an exhaustive certificate validity test.`n"

        if($SSLInspectionDetected -eq $true){

            Write-HostAzS -ForegroundColor Red "SSL Inspection Detected!`nCheck your network / proxy server configuration for SSL Inspection - https://learn.microsoft.com/en-us/azure-stack/hci/concepts/firewall-requirements`n"

        } else {

            Write-HostAzS -ForegroundColor Green "No SSL Inspection Detected :-)`n"

        }

        } finally {

            # Restore caller's $ErrorActionPreference even if an exception terminates process {} (C-001)

            $ErrorActionPreference = $OldErrorActionPreference

        }

    } # End of process block

    end {

        if ($NoOutput.IsPresent) { $script:SilentMode = $false }

        Write-HostAzS "SSL Inspection Tests Complete`n"

        # Write-Debug "Completed Test-AzStackHciSSLInspection function"

        return $SSLInspectionDetected

    }

} # End of Test-AzStackHciSSLInspection function

# SIG # Begin signature block

# MIInOAYJKoZIhvcNAQcCoIInKTCCJyUCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBr2hBZCTvPjwiL

# Y9jm7618JTqt7ZrtTzhLqiftudHiuKCCDMkwggYEMIID7KADAgECAhMzAAACHPrN

# xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD

# b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1

# OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD

# VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB

# DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP

# oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC

# /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf

# rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j

# qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT

# xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B

# Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O

# BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL

# EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT

# DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw

# YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w

# cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy

# bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z

# b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl

# MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC

# AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN

# rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK

# 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK

# Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY

# BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu

# uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE

# msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz

# 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6

# U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO

# 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD

# 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC

# EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS

# b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX

# DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m

# dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ

# Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq

# lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo

# 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv

# QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a

# 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1

# FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO

# GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7

# ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ

# uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS

# CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm

# VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3

# SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E

# BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX

# LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB

# Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP

# oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv

# TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw

# TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv

# TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC

# AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D

# 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY

# nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI

# vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6

# aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w

# PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7

# RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK

# /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK

# YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw

# YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT

# Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghnFMIIZwQIBATBu

# MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x

# KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc

# +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCggZAwGQYJKoZIhvcNAQkDMQwG

# CisGAQQBgjcCAQQwLwYJKoZIhvcNAQkEMSIEIF16awt+mfCEgTZS6suceyO8VQOe

# yrhHpBhkM4FAOcjBMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBv

# AGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAE

# ggEABFjVcrxsa1061bfF9Vh3Jlq8lni7hjyujRfCCdMTalck7Pic7SVTm3x34SRR

# RcevGtkFgbF94V+ELf2FQ+7CkC9rLNj8Hf24FONtRDPF+gu/KG2o4ykGeWr2s4fz

# Oc82S9I3bsm8OWs+4aGq6795U1tyKewismZhnCFVCywQHD0UejdcJNAKblmuRC3Y

# fHNmyBfANLUghLwmcZVoPqlxgo80WIeCzwQawLMmZpZnwqNGFBKI6o8ydvjdwHCK

# 3D7BiA2Ve7P9evaMuOyQW0qPZYLlIvkSxPPsU4DSXH47FM6Qs6CVvWXA2sMyz3tR

# 5QkzfuZUZsCYyw6J/wOwCHB2XqGCF5UwgheRBgorBgEEAYI3AwMBMYIXgTCCF30G

# CSqGSIb3DQEHAqCCF24wghdqAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFQBgsqhkiG

# 9w0BCRABBKCCAT8EggE7MIIBNwIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC

# AQUABCDUKyt7SVfp7XB4/IQK3LvOKn3rThJ2GJNVTE3wBKk65QIGarUkHKK5GBEy

# MDI2MDkyOTIwNDQ0OS41WjAEgAIB9KCB0aSBzjCByzELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2Eg

# T3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOkE5MzUtMDNFMC1E

# OTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloIIR7TCC

# ByAwggUIoAMCAQICEzMAAAIn1cCDw7EuVy0AAQAAAicwDQYJKoZIhvcNAQELBQAw

# fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd

# TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcNMjYwMjE5MTk0MDA0WhcN

# MjcwNTE3MTk0MDA0WjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUG

# A1UECxMeblNoaWVsZCBUU1MgRVNOOkE5MzUtMDNFMC1EOTQ3MSUwIwYDVQQDExxN

# aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEA4sVstXwzki+Ko9wNaWncvnpSAy8Jxd1Li8ySDlsBh3BIK8cc

# LZ8r4lCA5pscpU1JdbvtqwT6ds0+AcMEIbxmiaRMarzy5QxZW35kn5SiPOnhaqH4

# me4/DU0TuJe8BoPTY5vprjWrk3BVtqnXyIyhPedDpK5vTJzDhmMvn4mzWHcUz0T6

# tU+DC2St7N73TMjBDpXXDkJEiqcQ+v9RpOoDpgrtioCPH9Hser2MZyg5fVtDi0hG

# v+svNqCG7JvtUAYnzkOO8VikxtQpr7Rq/OS8wO+fzAHFJkcOf6H/6hE9FBVdVrpT

# HCayOgwEgLDQjQfuli66LbgWQI/lTJam5+UTGekOCGOycGgIiF4e1Y8a58FDmGRv

# FhBoX6wPfHYvuyxJ/QKr7xDshvlEHI1YQgmzBl4oCV0gKXsnlrqQrA9I4EDDQsXw

# eQSwQ1sYHWN3SQRD4MX5IEw0CwYILVb9neQmMRyoCCLQeGyOXkm+Y5CBtlqLZxXr

# U9JXoKcPxKM8H9/WqOrRDWNtXlViM0cPxrJr8I2EBer1a8Tg9KRlbH6hhfLN1T3m

# O4SNk8RxTKjQNCAf2tjS2OyU8WACgD/9dRCWbe8W6gyzIA9WA3RhMxqUIo5t5wDw

# i9gnmz/45rvdGmydluNucoJRh0yP5wga8EqX0QoMM63xXpSWgijOvt+WhX8CAwEA

# AaOCAUkwggFFMB0GA1UdDgQWBBTS1ufDeDBkhurne41qoE/dqK30XjAfBgNVHSME

# GDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRw

# Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1l

# LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsG

# AQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p

# Y3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB

# Af8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDAN

# BgkqhkiG9w0BAQsFAAOCAgEAKp3LneD0gtbXm9h+p0bsu7A4iitdxVyYq1QeE38I

# 3aNjG/kC+I+8Gf5OBvT9AgDR2Raw0HCtFRQ08rK2LvGdAIWteGnA2T7MiKD7wBkU

# YWhxLn+zXJEY5H2v8paNSsiCPI2y/TfbCQKgTy/FeBTQY5Y7/tRhwzsNdu62c+WU

# kz6AD29kgNL+cg4HKVDH8YJT8qenJzz6EKU7Q/ThsfA8Jtj/qNUz8QSMuiNE/UWr

# rpaIFQrysH5X3i03CgL50htawo3q0l5lNQzVzrAA/27K0o4G1+ZgGw+100TBf72s

# AFhEhXJ/wY44s8XlmW9NGmEpZCQNq1bRZTDOPNWlVl3QG1zz+Uc1Ilk5YMh3/xu5

# QsR2FhiGbgdd092iOmPJhIJ/6LuNGohSaPK9PotD+RnTZ3lrcYkdAjClH5KPubP+

# 93MHtVn6fASl2tu9HInFUGrBX+bEVe6RZvle3zUV8Aru2p0zpoGu+szu/9rfszpY

# m76YU/kOmXfgdqmLEp+MQWmPmMx6Z8nC1uXLycoT8QQnG9aEWH4UcwgA29rrSNhL

# Rgo3Nj9oouC8keEDG/5/HDsHi/SKlUyis81ZPs2ScVd766eC8rkF8NDt9JWugXB3

# TQAAAfVAvN87NxvXfgJSH2SzPe7TFDSlo2waSIqxcei0wxV1bWUHe4asy2Aco24x

# 9LowggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEB

# CwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD

# VQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAe

# Fw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVTMRMw

# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN

# aWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0

# YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5OGm

# TOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/XE/H

# ZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1hlDc

# wUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7M62A

# W36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3KNi1w

# jjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy1cCG

# MFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF803RKJ

# 1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQcNIIP

# 8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahhaYQFz

# ymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkLiWHz

# NgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV2xo3

# xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIGCSsG

# AQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUpzxD/

# LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBTMFEG

# DCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29m

# dC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYIKwYB

# BQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8G

# A1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186aGMQw

# VgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9j

# cmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsGAQUF

# BwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br

# aS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcNAQEL

# BQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1OdfC

# cTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYAA7AF

# vonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbzaN9l

# 9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6LGYnn

# 8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3mSj5m

# O0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0SCyx

# TkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxkoJLo4

# S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFmPWn9

# y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC4822rpM

# +Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7vzhw

# RNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDUDCCAjgC

# AQEwgfmhgdGkgc4wgcsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u

# MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp

# b24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNV

# BAsTHm5TaGllbGQgVFNTIEVTTjpBOTM1LTAzRTAtRDk0NzElMCMGA1UEAxMcTWlj

# cm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIaAxUAIx86rYT8

# DtBg3JAzAOseeJSIjCqggYMwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0Eg

# MjAxMDANBgkqhkiG9w0BAQsFAAIFAO5mOVowIhgPMjAyNjA5MjkxMzE5MjJaGA8y

# MDI2MDkzMDEzMTkyMlowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA7mY5WgIBADAK

# AgEAAgIQNwIB/zAHAgEAAgITcjAKAgUA7meK2gIBADA2BgorBgEEAYRZCgQCMSgw

# JjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3

# DQEBCwUAA4IBAQCQns0zI7vSzxRdVvcwjTRmngk9c7547GmD/7tAFMwBiYQ6kqmY

# tHa7tYlUkBdpeYDZHv3bXZcJSSC8dIS79k9sl39gelUvYtozhKCM2Cg3r6GGuHg6

# 9JC+6CPztoYcBz1tE+zF6JmtpCexaaXNWgvMvvhfEaGbds/X8xg2+5egy8jc59f7

# dGt9zN4khKwiQPGdhG+e2H/9W/OFGHnXiR5+jrZ3Uj6pNwId5teZ2gqymr7ZmgIn

# rmabMzjqz1jT27Ipcj41z6OFwwnBow66i7KfGKSfISc/HjjQXiIfCNrJBAElpReH

# MICCvLETE8gP2Yo0eEtSbngB1gHanJZrc4XfMYIEDTCCBAkCAQEwgZMwfDELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9z

# b2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIn1cCDw7EuVy0AAQAAAicwDQYJ

# YIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkq

# hkiG9w0BCQQxIgQg2htEzbM9f8fJsdsGsCQOXOldBDqyerpwiBxNe655BXEwgfoG

# CyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCDl5wEaNaFSHDiySg6pRNGnav42fU13

# ZZ11kXFxk4QRcjCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNo

# aW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29y

# cG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEw

# AhMzAAACJ9XAg8OxLlctAAEAAAInMCIEIHz9/l1M8iNg99d8Ab7uOcZlXnvjs0eI

# J5riFGqoghncMA0GCSqGSIb3DQEBCwUABIICALjsMmijUCDFWB+29UWZzWoPVv/x

# sFmYQyWAii462uqynJy2meRHVAzGOZHWUNONBNEyFCiIk9CI5H4p2fpOLas146LT

# 20wXi8BtceOO6d1hI9mqgZo8xIWkJ4ZFkyrN/5X4bVo0QUlUK6qx9EKWMdgMGhDB

# 7s7A1UW6f+st41AazEVyeMPsfSQwpEcdmE65rbEwLBLOckna/sI1QlaUsFsiwg3p

# 0aYPwSxA8UMZCMMn9LiapBwa0ebQEodkstRuLDOrAhF+fYvTlT/e3eOXHUbDPnBL

# Z3S7wruCtsK3f+Siatw3nCnE7gO4yyUq79hnty5kLLt64KQe6fZUynL8tj06USI0

# cz2xZTSFvtSnEwNHj9/S+1ElDUWHwQ/YM0DxIFPkQc3kFotXUE1saVd9hpz4h3dK

# 4ymYO5hqBlDTo12bLCwzt7I7wZgnT8SuVHu8NdpvmQNdEp1NHePuNtUAWeme2zMP

# 3kYdj9TVqdLtUSEDb6Xf8stK0JCN+ssfmQSoUticPfsxj1dY+HlTStQkqvQ59981

# +P+9evdReZlMgkpQvFTEZ5WDsXkDTzPauhoGbk0l0Lmncc90WWPsJHtolQbuOevG

# PcLjd4IqSVeNKaOLQ4aRJaJaAOUue1+1w3GveG0E4zbSWbxU2ha5K+mYnvY4toQw

# AYVlAofDzw5AcOdB

# SIG # End signature block