Microsoft.AzureStack.ReadinessChecker

1.2002.1111.69

CertificateValidation/Microsoft.AzureStack.PublicCertificateRequest.Internal.psm1

                                function Set-CertificateSubject {

    <#

    .SYNOPSIS

        Set Distinguished name for certificate request

    .DESCRIPTION

        Checks if Common Name is present and honours CN in distinguished name.

        If common name is not present, it preprends the target RP hostname to the distinguished name as a common name value.

    #>

    param (

            [System.Security.Cryptography.X509Certificates.X500DistinguishedName]$distinguishedName,

            [System.Security.Cryptography.X509Certificates.X500DistinguishedNameFlags]$distinguishedNameFlag = 'UseUTF8Encoding',

            [string]$commonName

            )

    try {

        $thisFunction = $MyInvocation.MyCommand.Name

        if ($distinguishedName) {

            $distinguishedNameExpanded = $distinguishedName.Format($true)

            $distinguishedNameString = $distinguishedName.Format($false)

            Write-AzsReadinessLog -Message ("User DN String is: {0}, flag: {1}" -f $distinguishedNameString,$distinguishedNameFlag) -Type Info -Function $thisFunction

            $commonNamePair = $distinguishedNameExpanded.trim() -split "`n" | Where-Object { $PSITEM -imatch 'cn='}

        }

        if ($commonNamePair) {

            #$distinguishedNameString = $distinguishedName.Name.replace($commonNamePair,"CN=$commonName")

            Write-AzsReadinessLog -Message ("User DN String contains common name, no change: {0}" -f $distinguishedNameString) -Type Info -Function $thisFunction

        }

        else {

            $distinguishedNameString = "CN={0}" -f (($commonName,$distinguishedName.Name) -join ',')

            Write-AzsReadinessLog -Message ("Calculated DN String is: {0}, flag: {1}." -f $distinguishedNameString,$distinguishedNameFlag) -Type Info -Function $thisFunction

        }

        return [System.Security.Cryptography.X509Certificates.X500DistinguishedName]::new($distinguishedNameString,[System.Security.Cryptography.X509Certificates.X500DistinguishedNameFlags]::UseUTF8Encoding)

    }

    catch {

        Write-AzsReadinessLog -Message ("Setting Certificate Subject failed with exception: {0}" -f $_.exception.message) -Type Error -Function $thisFunction -toScreen

        break

    }

}

function Get-CSRFileName {

    param (

        [array]$commonName

    )

    $filename = "{0}_certrequest.req" -f $commonName[0].Replace('.', '_').Replace('*', 'wildcard')

    return $filename

}

function Write-AzsCertificateRequestFileInternal {

    <#

    .SYNOPSIS

        Internal function to call CSR using the standard Azure Stack request template.

    .DESCRIPTION

        Imports the standard Azure Stack certificate request template

        replaces deployment specific data such as subject and SAN.

        Detects if commas are used in the subject name and thus requiring a different X500NameFlag

    .EXAMPLE

        Write-AzsCertificateRequestFileInternal -subjectAltNames $completeSANs -subject $subject  -KeyLength $KeyLength -HashAlgorithm $HashAlgorithm -OutputRequestPath $OutputRequestPath

    .INPUTS

        subjectAltNames - string - SubjectAlternativeNames

        subject - ordereddictionary - hashtable of deployment subject

        OutputRequestPath - string - path (parent must be valid) to where the CSRs should land.

        KeyLength - int - Defines the length of the public and private key

        HashAlgorithm - string - Hash Algorithm to be used for this request.

    .OUTPUTS

        Encoded CSR file - This is the file or content that should be presented to a CA to request certificates

        Clear Text INF file - this is a reference file to help debugging.

        Certreq log file - the output of the certreq.exe command, later streamed into overall AzsCertificateRequest.log

    .NOTES

    #>

    [cmdletbinding()]

    param (

        [Parameter(Mandatory = $true)]

        [ValidateNotNullOrEmpty()]

        [string]$subject,

        [Parameter(Mandatory = $true)]

        [ValidateNotNullOrEmpty()]

        [string[]]$subjectAltNames,

        [Parameter(Mandatory = $true)]

        [ValidateNotNullOrEmpty()]

        [ValidateScript( {Test-Path (Split-Path $_ -parent) -PathType Container})]

        $OutputRequestPath,

        [Parameter(Mandatory = $false)]

        [ValidateSet(2048, 4096, 8192)]

        [int]$KeyLength = 2048,

        [Parameter(Mandatory = $false)]

        [ValidateSet('SHA256', 'SHA384', 'SHA512')]

        [string]$HashAlgorithm = 'SHA256',

        [Parameter(Mandatory = $false)]

        [string[]]$KeyUsage = @('DigitalSignature','KeyEncipherment'),

        [Parameter(Mandatory = $false)]

        [string[]]$KeyUsageEKUExtension = @('Server Authentication','Client Authentication'),

        [Parameter(Mandatory = $false)]

        [System.Security.Cryptography.X509Certificates.X500DistinguishedNameFlags]$DistinguishedNameFlag = $null

    )

    $thisFunction = $MyInvocation.MyCommand.Name

    try {

        # translate DistinguishNameFlag

        $x500flagValue = switch ($DistinguishedNameFlag) {

            'DoNotUsePlusSign' {'0x20000000'}

            'DoNotUseQuotes'   {'0x10000000'}

            'ForceUTF8Encoding'{'0x80000'}

            'None'             {'0'}

            'Reversed'         {'0x2000000'}

            'UseCommas'        {'0x4000000'}

            'UseNewLines'      {'0x8000000'}

            'UseSemicolons'    {'0x40000000'}

            'UseT61Encoding'   {'0x20000'}

            'UseUTF8Encoding'  {'0x40000'}

            'Default'          {'0'}

        }

        # if name flag isn't 'none' write the flag in the inf file, otherwise write nothing.

        if ($x500flagValue -ne '0') {

            $X500NameFlags = "X500NameFlags = $x500flagValue`n`r"

        }

        # Get Key Usages Strings

        $keyUsageStrings = Format-KeyUsage -KeyUsage $KeyUsage

        # Get Enhanced Key Usage strings

        $EKUInfStrings = Format-EnhancedKeyUsage -EKUExtension $KeyUsageEKUExtension

        # Get SAN DNS names formatted

        $sanString = Format-SubjectAlternativeNames -subjectAltNames $subjectAltNames

        # Get INF Template and replace placeholders with user data

        $data = Import-PowerShellDataFile $PSScriptRoot\Microsoft.AzureStack.PublicCertificateRequestData.psd1

        $infTemplate = $data.requestINF

        $requestINF = $infTemplate.Replace('[[SubjectString]]', $subject.replace('"',''))

        $requestINF = $requestINF.Replace('[[KeyUsage]]',$keyUsageStrings)

        $requestINF = $requestINF.Replace('[[X500]]', $X500NameFlags)

        $requestINF = $requestINF.Replace('[[SANStrings]]', $sanString)

        $requestINF = $requestINF.Replace('[[KeyLength]]', $KeyLength)

        $requestINF = $requestINF.Replace('[[HashAlgorithm]]', $HashAlgorithm)

        $requestINF = $requestINF.Replace('[[EnhancedKeyStrings]]', $EKUInfStrings.Strings)

        $requestINF = $requestINF.Replace('[[EnhancedKeyExtension]]', $EKUInfStrings.Extensions)

        <# 

        Create filepaths for inf, req and log as [host|wildcard].region.external.fqdn-CertRequest-

        $infFilePath = "{0}\{1}_CertRequest_{2}_ClearTextDoNotUse.inf" -f $OutputRequestPath, $subjectAltNames[0].Replace('.', '_').Replace('*', 'wildcard'), (Get-Date -f yyyyMMddHHmmss)

        Write-AzsReadinessLog -Message ("Setting infFilePath to {0}" -f $infFilePath) -Type Info -Function $thisFunction

        $csrFilePath = $infFilePath.Replace('_ClearTextDoNotUse', '').Replace('inf', 'req')

        $certReqLogPath = $csrFilePath.Replace('.req', '.log')

        #>

        $CertReqFilePaths = Get-CertReqFilePaths -filePath $OutputRequestPath

        $infFilePath = $CertReqFilePaths.infFilePath

        $csrFilePath = $CertReqFilePaths.csrFilePath

        $certReqLogPath = $CertReqFilePaths.certReqLogPath

        # Create and print Inf template

        $requestINF | Out-File $infFilePath -Force

        # Create encoded cert request

        Write-AzsReadinessLog -Message ("Setting csrFilePath to {0}" -f $csrFilePath) -Type Info -Function $thisFunction

        $cmd = "-new $infFilePath $csrFilePath"

        $process = Start-Process -FilePath certreq.exe `

            -ArgumentList $cmd `

            -WindowStyle Hidden `

            -PassThru `

            -Wait `

            -RedirectStandardOutput $certReqLogPath

        if ($process.ExitCode -ne 0) {

            $certReqLogContent = Get-Content $certReqLogPath

            throw $certReqLogContent

        }

        Write-AzsReadinessLog -Message ("CSR generating for following SAN(s): {0}" -f ($subjectAltNames -join ',')) -Type Info -Function $thisFunction -toScreen

        Write-AzsReadinessLog -Message ("Present this CSR to your Certificate Authority for Certificate Generation: {0}" -f $csrFilePath) -Type Info -Function $thisFunction -toScreen

    }

    catch {

        Write-AzsReadinessLog -Message ("CSR generation failed with: {0}" -f $_.exception) -Type Error -Function $thisFunction

        throw ("CSR generation failed with: {0}" -f $_.exception)

    }

    finally {

        # Move inf file to child directory called inf

        $infDest = ("{0}\{1}" -f (Split-Path $infFilePath -parent), 'Inf')

        if (-not (Test-Path $infDest)) {$null = New-Item -path $infDest  -ItemType Directory -Force}

        Move-Item -Path $infFilePath -Destination $infDest -Force -ErrorAction SilentlyContinue

        # Move log content to parent log and clean up log file.

        $certReqLogContent = Get-Content $certReqLogPath -ErrorAction SilentlyContinue | ForEach-Object {if ($_) {$_}}

        if (-not $certReqLogContent) {$certReqLogContent = '[missing]'}

        Write-AzsReadinessLog -Message ("Certreq.exe output: {0}" -f ($certReqLogContent -join '. ')) -Type Info -Function $thisFunction -toScreen

        Remove-item $certReqLogPath -Force

    }

}

function Format-KeyUsage {

    param([string[]]$KeyUsage)

    $thisFunction = $MyInvocation.MyCommand.Name

    try {

        Write-AzsReadinessLog -Message ("Formating key {0} usage(s)." -f $KeyUsage.Length) -Type Info -Function $thisFunction

        $KeyUsageOutput = for ($i = 0; $i -lt $KeyUsage.Length; $i++) {

            # convert the value

            Write-AzsReadinessLog -Message ("Formating Key usage: {0}" -f $KeyUsage[$i]) -Type Info -Function $thisFunction

            $keyUsageValue = switch ($KeyUsage[$i]) {

                digitalSignature {'CERT_DIGITAL_SIGNATURE_KEY_USAGE'}

                nonRepudiation {'CERT_NON_REPUDIATION_KEY_USAGE'}

                keyEncipherment {'CERT_KEY_ENCIPHERMENT_KEY_USAGE'}

                dataEncipherment {'CERT_DATA_ENCIPHERMENT_KEY_USAGE'}

                keyAgreement {'CERT_KEY_AGREEMENT_KEY_USAGE'}

                keyCertSign {'CERT_KEY_CERT_SIGN_KEY_USAGE'}

                cRLSign {'CERT_CRL_SIGN_KEY_USAGE'}

                encipherOnly {'CERT_ENCIPHER_ONLY_KEY_USAGE'}

                decipherOnly {'CERT_DECIPHER_ONLY_KEY_USAGE'}

            }

            "`"$keyUsageValue`""

        }

        $keyUsageString = $KeyUsageOutput -join '|'

        $keyUsageString

    }

    catch {

        Write-AzsReadinessLog -Message ("Formatting key usage failed with exception: {0}" -f $_.exception) -Type Error -Function $thisFunction

        break

    }

}

function Format-EnhancedKeyUsage {

    <#

    .SYNOPSIS

        Crafts neccessary data for certificate request file

    .DESCRIPTION

        Creates strings section and extensions section data e.g.

        [Strings]

        szOID_SUBJECT_ALT_NAME2 = "2.5.29.17"

        szOID_ENHANCED_KEY_USAGE = "2.5.29.37"

        szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"

        szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2"

        [Extensions]

        %szOID_SUBJECT_ALT_NAME2% = "{text}[[SANStrings]]"

        %szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_PKIX_KP_SERVER_AUTH%,%szOID_PKIX_KP_CLIENT_AUTH%"

    #>

    param ([string[]]$EKUExtension)

    $thisFunction = $MyInvocation.MyCommand.Name

    try {

        $dataFile = Import-PowerShellDataFile $PSScriptRoot\Microsoft.AzureStack.CertificateConfig.psd1

        $EKUHashtable = $dataFile.CertificateAttributes.EnhancedKeyUsage

        Write-AzsReadinessLog -Message ("Formating Enhanced Key usages: {0}" -f ($EKUExtension -join ',')) -Type Info -Function $thisFunction

        if ($null -ne $EKUExtension) {

            $enhancedStrings = @()

            $enhancedExtensions = @()

            $enhancedStrings += "szOID_ENHANCED_KEY_USAGE = `"2.5.29.37`""

            foreach ($eku in $EKUExtension) {

                Write-AzsReadinessLog -Message ("Formating Key usage: {0}" -f $eku) -Type Info -Function $thisFunction

                $ekuData = $EKUHashtable[$eku]

                # Construct string format

                $ekuString = "{0} = `"{1}`"" -f $ekuData.GetEnumerator().Name,$ekuData[$ekuData.GetEnumerator().Name]

                Write-AzsReadinessLog -Message ("EKU String: {0}" -f $ekuString) -Type Info -Function $thisFunction

                # Append string section with EKU and OID

                $enhancedStrings += $ekuString.replace('XCN_','sz')

                Write-AzsReadinessLog -Message ("Enhanced String: {0}" -f $enhancedStrings) -Type Info -Function $thisFunction

                # Append Extension section with EKU and OID

                $enhancedExtensions += $ekuData.GetEnumerator().Name.replace('XCN_','sz')

                Write-AzsReadinessLog -Message ("EKU Extension: {0}" -f $enhancedExtensions) -Type Info -Function $thisFunction

            }

            $enhancedExtensionString += "%szOID_ENHANCED_KEY_USAGE% = `"{{text}}%{0}%`"" -f ($enhancedExtensions -join '%,%')

        }

        @{Strings = ($enhancedStrings -join "`n"); Extensions = $enhancedExtensionString}

    }

    Catch {

        Write-AzsReadinessLog -Message ("Formatting key usage failed with exception: {0}" -f $_.exception) -Type Error -Function $thisFunction

        break

    }

}

function Format-SubjectAlternativeNames {

    <#

    .SYNOPSIS

        Formats array of DNS names for SAN

    .DESCRIPTION

        Creates neccessary string for SAN in certificate request inf config.

        %szOID_SUBJECT_ALT_NAME2% = "{text}dns=*.queue.east.azurestack.contoso.com"

    #>

    param ([string[]]$subjectAltNames)

    $thisFunction = $MyInvocation.MyCommand.Name

    try {

        $sanStrings = @()

        foreach ($san in $subjectAltNames) {

            Write-AzsReadinessLog -Message ("Formatting Subject Alternative DNS Names : {0}" -f $san) -Type Info -Function $thisFunction

            $sanStrings += "dns={0}" -f $san

        }

        $sanStrings -join "&"

    }

    catch {

        Write-AzsReadinessLog -Message ("Formatting Subject Alternative DNS Names failed with exception: {0}" -f $_.exception) -Type Error -Function $thisFunction

        break

    }

}

function Test-DistinguishedName {

    <#

    .SYNOPSIS

        Ensure user specified distinguished name is valid.

    .DESCRIPTION

        Ensure the distringuished name has the rght number of rdn when it is formatted

    .NOTES

        General notes

    #>

    param (

        [System.Security.Cryptography.X509Certificates.X500DistinguishedName]$DistinguishedName,

        [System.Security.Cryptography.X509Certificates.X500DistinguishedNameFlags]$DistinguishedNameFlag

    )

    $thisFunction = $MyInvocation.MyCommand.Name

    try {

        $dn = [Security.Cryptography.X509Certificates.X500DistinguishedName]::new($distinguishedName.Name,$DistinguishedNameFlag)

        $rdnCount = $distinguishedName.Name.ToCharArray() | Group-Object -NoElement | Where-Object Name -eq '=' | Select-Object -ExpandProperty Count

        $dnFormat = $dn.Format($true)

        $formatLineCount = $dnFormat | Measure-Object -Line | Select-Object -ExpandProperty Lines

        # Checking for common issues

        if ($dnFormat -match ',' -and $DistinguishedNameFlag -ne 'UseSemicolons') {

            throw ("One or more RDNs appear to contain commas, the correct format for the distinguished name is to seperate RDNs with semi-colons and pass the UseSemiColons DistinguishedNameFlag")

        }

        # if the number of rdns doesn't match the number of '=' characters, the format probably isn't what the user intended.

        if ($rdnCount -ne $formatLineCount) {

            throw ("Error validating the distinguish name provided: {0}" -f $dnFormat)

        }

        Write-AzsReadinessLog ("Validated the distinguished name: {0}" -f $dnFormat) -Type Info -Function $thisFunction

        return $true

    }

    catch {

        Write-AzsReadinessLog ("Check the input of the distinguished name. Error {0}" -f $_.exception.message) -type Error -Function $thisFunction -toScreen

        throw $_.exception.message

    }

}

function Get-CertReqFilePaths {

    <#

    .SYNOPSIS

        Short description

    .DESCRIPTION

        Long description

    .EXAMPLE

        PS C:\> $FilePath = Join-Path -Path $OutputRequestPath -ChildPath $subjectAltNames[0].Replace('.', '_').Replace('*', 'wildcard')

        Get-CertReqFilePaths -filePath $FilePath

        outputs inf path, req path and log path.

    #>

    param ($filePath)

    $thisFunction = $MyInvocation.MyCommand.Name

    $directory = Split-Path $filePath -Parent

    $fileSeed = Split-Path $filePath -Leaf

    #Create filepaths for inf, req and log as [host|wildcard].region.external.fqdn-CertRequest-

    $infFilePath = "{0}\{1}_CertRequest_{2}_ClearTextDoNotUse.inf" -f $directory, $fileSeed, (Get-Date -f yyyyMMddHHmmss)

    Write-AzsReadinessLog -Message ("Setting infFilePath to {0}" -f $infFilePath) -Type Info -Function $thisFunction

    $csrFilePath = $infFilePath.Replace('_ClearTextDoNotUse', '').Replace('inf', 'req')

    $certReqLogPath = $csrFilePath.Replace('.req', '.log')

    @{infFilePath = $infFilePath; csrFilePath = $csrFilePath; certReqLogPath = $certReqLogPath}

}

# SIG # Begin signature block

# MIIjhgYJKoZIhvcNAQcCoIIjdzCCI3MCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDpFT79vxIxal43

# NFOCMQtrqtZdDiTqtenURUBiQCfgbKCCDYEwggX/MIID56ADAgECAhMzAAABUZ6N

# j0Bxow5BAAAAAAFRMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMTkwNTAyMjEzNzQ2WhcNMjAwNTAyMjEzNzQ2WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQCVWsaGaUcdNB7xVcNmdfZiVBhYFGcn8KMqxgNIvOZWNH9JYQLuhHhmJ5RWISy1

# oey3zTuxqLbkHAdmbeU8NFMo49Pv71MgIS9IG/EtqwOH7upan+lIq6NOcw5fO6Os

# +12R0Q28MzGn+3y7F2mKDnopVu0sEufy453gxz16M8bAw4+QXuv7+fR9WzRJ2CpU

# 62wQKYiFQMfew6Vh5fuPoXloN3k6+Qlz7zgcT4YRmxzx7jMVpP/uvK6sZcBxQ3Wg

# B/WkyXHgxaY19IAzLq2QiPiX2YryiR5EsYBq35BP7U15DlZtpSs2wIYTkkDBxhPJ

# IDJgowZu5GyhHdqrst3OjkSRAgMBAAGjggF+MIIBejAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUV4Iarkq57esagu6FUBb270Zijc8w

# UAYDVR0RBEkwR6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1

# ZXJ0byBSaWNvMRYwFAYDVQQFEw0yMzAwMTIrNDU0MTM1MB8GA1UdIwQYMBaAFEhu

# ZOVQBdOCqhc3NyK1bajKdQKVMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cu

# bWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY0NvZFNpZ1BDQTIwMTFfMjAxMS0w

# Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3

# Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx

# MS0wNy0wOC5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAWg+A

# rS4Anq7KrogslIQnoMHSXUPr/RqOIhJX+32ObuY3MFvdlRElbSsSJxrRy/OCCZdS

# se+f2AqQ+F/2aYwBDmUQbeMB8n0pYLZnOPifqe78RBH2fVZsvXxyfizbHubWWoUf

# NW/FJlZlLXwJmF3BoL8E2p09K3hagwz/otcKtQ1+Q4+DaOYXWleqJrJUsnHs9UiL

# crVF0leL/Q1V5bshob2OTlZq0qzSdrMDLWdhyrUOxnZ+ojZ7UdTY4VnCuogbZ9Zs

# 9syJbg7ZUS9SVgYkowRsWv5jV4lbqTD+tG4FzhOwcRQwdb6A8zp2Nnd+s7VdCuYF

# sGgI41ucD8oxVfcAMjF9YX5N2s4mltkqnUe3/htVrnxKKDAwSYliaux2L7gKw+bD

# 1kEZ/5ozLRnJ3jjDkomTrPctokY/KaZ1qub0NUnmOKH+3xUK/plWJK8BOQYuU7gK

# YH7Yy9WSKNlP7pKj6i417+3Na/frInjnBkKRCJ/eYTvBH+s5guezpfQWtU4bNo/j

# 8Qw2vpTQ9w7flhH78Rmwd319+YTmhv7TcxDbWlyteaj4RK2wk3pY1oSz2JPE5PNu

# Nmd9Gmf6oePZgy7Ii9JLLq8SnULV7b+IP0UXRY9q+GdRjM2AEX6msZvvPCIoG0aY

# HQu9wZsKEK2jqvWi8/xdeeeSI9FN6K1w4oVQM4Mwggd6MIIFYqADAgECAgphDpDS

# AAAAAAADMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0

# ZSBBdXRob3JpdHkgMjAxMTAeFw0xMTA3MDgyMDU5MDlaFw0yNjA3MDgyMTA5MDla

# MH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS

# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMT

# H01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTEwggIiMA0GCSqGSIb3DQEB

# AQUAA4ICDwAwggIKAoICAQCr8PpyEBwurdhuqoIQTTS68rZYIZ9CGypr6VpQqrgG

# OBoESbp/wwwe3TdrxhLYC/A4wpkGsMg51QEUMULTiQ15ZId+lGAkbK+eSZzpaF7S

# 35tTsgosw6/ZqSuuegmv15ZZymAaBelmdugyUiYSL+erCFDPs0S3XdjELgN1q2jz

# y23zOlyhFvRGuuA4ZKxuZDV4pqBjDy3TQJP4494HDdVceaVJKecNvqATd76UPe/7

# 4ytaEB9NViiienLgEjq3SV7Y7e1DkYPZe7J7hhvZPrGMXeiJT4Qa8qEvWeSQOy2u

# M1jFtz7+MtOzAz2xsq+SOH7SnYAs9U5WkSE1JcM5bmR/U7qcD60ZI4TL9LoDho33

# X/DQUr+MlIe8wCF0JV8YKLbMJyg4JZg5SjbPfLGSrhwjp6lm7GEfauEoSZ1fiOIl

# XdMhSz5SxLVXPyQD8NF6Wy/VI+NwXQ9RRnez+ADhvKwCgl/bwBWzvRvUVUvnOaEP

# 6SNJvBi4RHxF5MHDcnrgcuck379GmcXvwhxX24ON7E1JMKerjt/sW5+v/N2wZuLB

# l4F77dbtS+dJKacTKKanfWeA5opieF+yL4TXV5xcv3coKPHtbcMojyyPQDdPweGF

# RInECUzF1KVDL3SV9274eCBYLBNdYJWaPk8zhNqwiBfenk70lrC8RqBsmNLg1oiM

# CwIDAQABo4IB7TCCAekwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFEhuZOVQ

# BdOCqhc3NyK1bajKdQKVMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud

# DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFHItOgIxkEO5FAVO

# 4eqnxzHRI4k0MFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwubWljcm9zb2Z0

# LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y

# Mi5jcmwwXgYIKwYBBQUHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p

# Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y

# Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQUFBwIB

# FjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2RvY3MvcHJpbWFyeWNw

# cy5odG0wQAYIKwYBBQUHAgIwNB4yIB0ATABlAGcAYQBsAF8AcABvAGwAaQBjAHkA

# XwBzAHQAYQB0AGUAbQBlAG4AdAAuIB0wDQYJKoZIhvcNAQELBQADggIBAGfyhqWY

# 4FR5Gi7T2HRnIpsLlhHhY5KZQpZ90nkMkMFlXy4sPvjDctFtg/6+P+gKyju/R6mj

# 82nbY78iNaWXXWWEkH2LRlBV2AySfNIaSxzzPEKLUtCw/WvjPgcuKZvmPRul1LUd

# d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ

# Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf

# wzIY4vDFLc5bnrRJOQrGCsLGra7lstnbFYhRRVg4MnEnGn+x9Cf43iw6IGmYslmJ

# aG5vp7d0w0AFBqYBKig+gj8TTWYLwLNN9eGPfxxvFX1Fp3blQCplo8NdUmKGwx1j

# NpeG39rz+PIWoZon4c2ll9DuXWNB41sHnIc+BncG0QaxdR8UvmFhtfDcxhsEvt9B

# xw4o7t5lL+yX9qFcltgA1qFGvVnzl6UJS0gQmYAf0AApxbGbpT9Fdx41xtKiop96

# eiL6SJUfq/tHI4D1nvi/a7dLl+LrdXga7Oo3mXkYS//WsyNodeav+vyL6wuA6mk7

# r/ww7QRMjt/fdW1jkT3RnVZOT7+AVyKheBEyIXrvQQqxP/uozKRdwaGIm1dxVk5I

# RcBCyZt2WwqASGv9eZ/BvW1taslScxMNelDNMYIVWzCCFVcCAQEwgZUwfjELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z

# b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMQITMwAAAVGejY9AcaMOQQAAAAABUTAN

# BglghkgBZQMEAgEFAKCBrjAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgor

# BgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQgwqdz960F

# u9b2nCrBUI2JWD0LQVeddWReE13FgM6iyvAwQgYKKwYBBAGCNwIBDDE0MDKgFIAS

# AE0AaQBjAHIAbwBzAG8AZgB0oRqAGGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbTAN

# BgkqhkiG9w0BAQEFAASCAQBZJYtE7c2x+wK5ucHeYPX2DTieu/1TfNSMVfT8Ew/U

# MbdFp7V75PslIiFpUazazOH22GPJZW46lKrLAhX0HWzZRN7SqiwUoGhxf3xMxiKK

# 90ntAkH2UlClvTo/r/lnteYwtHv2CA6QackbMfVwu//SK9qpxFza+A7VZEVFtnA3

# ec/OJ2R8KtB7UND1e4SAT38KBLaVB6C6NvtKUj7x/TPBkC9eME8NMfOzyLpAjTbu

# 4aT5zO9GCeRWcqqNQhZAe7PpjkspCIWQBSUIhkUlHfqksz5ruuQJcDBLLDP2XPQS

# ZZ1VBFGg2dso/SzaXNRL6pIq99lFPCl6EfAXE2OXWilJoYIS5TCCEuEGCisGAQQB

# gjcDAwExghLRMIISzQYJKoZIhvcNAQcCoIISvjCCEroCAQMxDzANBglghkgBZQME

# AgEFADCCAVEGCyqGSIb3DQEJEAEEoIIBQASCATwwggE4AgEBBgorBgEEAYRZCgMB

# MDEwDQYJYIZIAWUDBAIBBQAEIBzHRFy6fBIAoowl51/1an3cIXDJCVlQVQ/KPwi/

# q9kBAgZd++V2CewYEzIwMjAwMTE3MDkxMjExLjA3MlowBIACAfSggdCkgc0wgcox

# CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJXQTEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG

# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQg

# SXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1Mg

# RVNOOjhENDEtNEJGNy1CM0I3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFt

# cCBTZXJ2aWNloIIOPDCCBPEwggPZoAMCAQICEzMAAAEKUsg5AVLRcEsAAAAAAQow

# DQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcN

# MTkxMDIzMjMxOTE1WhcNMjEwMTIxMjMxOTE1WjCByjELMAkGA1UEBhMCVVMxCzAJ

# BgNVBAgTAldBMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQg

# Q29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlv

# bnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046OEQ0MS00QkY3LUIz

# QjcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggEiMA0G

# CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7PhutlKFwxZ+GePU/V0pMke215HSX

# 8PcLX1hjYUbyCERBFs7/wEwrbwMIZdOo7NDqcIUhXXt3kxg1OqBJxuozVcCJ8JwR

# y/VI79p1ZeLbSv3aMMxouOzoqaNL/Dmb8CT9UEcqq3PF18vMv1cZfk8ZphuVSGPM

# 0eWsJvE1kfPXCJsYzsZturq0jEI6XBh9hpuKQq8KSXvoqCE37EZWrYWy3uhRJnsr

# d4Tq2YgYsyWQ/aQF20db73ZWwItXG4TUly4IQ0pcQi9/UH3fsVu06q8/yNvc7MfI

# cmnYOUPOyFMBh0EW519K/mg/xYgMhtmZlnzmvHnr5npzJTiwbBuhnwUnAgMBAAGj

# ggEbMIIBFzAdBgNVHQ4EFgQU+ESUpf06TE1Q3pH4Oq0BopFxhSgwHwYDVR0jBBgw

# FoAU1WM6XIoxkPNDe3xGG8UzaFqFbVUwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDov

# L2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljVGltU3RhUENB

# XzIwMTAtMDctMDEuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0

# cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNUaW1TdGFQQ0FfMjAx

# MC0wNy0wMS5jcnQwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDCDAN

# BgkqhkiG9w0BAQsFAAOCAQEAVJeufNQV8t3TcyWq0Su3nVYZfdRcV6isTp0Zj5gj

# BKZ8VEpE3AR7xyYu3QQ7F7PJNXr7991hPKs9w8O+BHeToXmwd4oTGiGOupyPEBrf

# JVD1IllqRdlUrNodbNu8y4DyRybOPQn9jr+mTntoWyn+Sv6W7lo13DlXdaCK0lin

# ATp+hlCwGtNM81GEhdUwec8STqzb7ucLpPL1ksgmFh4zKou6K0kYq8SJGEPw9jOQ

# YmcuSOnrUgIOT/TRlVm++Vcuie2HfZmih5n3/7vrSj2DaVSEXyhoscIHWLzZ1QKF

# d3Nm6VQTBDkJlaHxYiNBlJS6847W9XQV86p03BwPJe4V0jCCBnEwggRZoAMCAQIC

# CmEJgSoAAAAAAAIwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRp

# ZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTEwMDcwMTIxMzY1NVoXDTI1MDcwMTIx

# NDY1NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV

# BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQG

# A1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggEiMA0GCSqGSIb3

# DQEBAQUAA4IBDwAwggEKAoIBAQCpHQ28dxGKOiDs/BOX9fp/aZRrdFQQ1aUKAIKF

# ++18aEssX8XD5WHCdrc+Zitb8BVTJwQxH0EbGpUdzgkTjnxhMFmxMEQP8WCIhFRD

# DNdNuDgIs0Ldk6zWczBXJoKjRQ3Q6vVHgc2/JGAyWGBG8lhHhjKEHnRhZ5FfgVSx

# z5NMksHEpl3RYRNuKMYa+YaAu99h/EbBJx0kZxJyGiGKr0tkiVBisV39dx898Fd1

# rL2KQk1AUdEPnAY+Z3/1ZsADlkR+79BL/W7lmsqxqPJ6Kgox8NpOBpG2iAg16Hgc

# sOmZzTznL0S6p/TcZL2kAcEgCZN4zfy8wMlEXV4WnAEFTyJNAgMBAAGjggHmMIIB

# 4jAQBgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQU1WM6XIoxkPNDe3xGG8UzaFqF

# bVUwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8GA1Ud

# EwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186aGMQwVgYD

# VR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwv

# cHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsGAQUFBwEB

# BE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9j

# ZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwgaAGA1UdIAEB/wSBlTCB

# kjCBjwYJKwYBBAGCNy4DMIGBMD0GCCsGAQUFBwIBFjFodHRwOi8vd3d3Lm1pY3Jv

# c29mdC5jb20vUEtJL2RvY3MvQ1BTL2RlZmF1bHQuaHRtMEAGCCsGAQUFBwICMDQe

# MiAdAEwAZQBnAGEAbABfAFAAbwBsAGkAYwB5AF8AUwB0AGEAdABlAG0AZQBuAHQA

# LiAdMA0GCSqGSIb3DQEBCwUAA4ICAQAH5ohRDeLG4Jg/gXEDPZ2joSFvs+umzPUx

# vs8F4qn++ldtGTCzwsVmyWrf9efweL3HqJ4l4/m87WtUVwgrUYJEEvu5U4zM9GAS

# inbMQEBBm9xcF/9c+V4XNZgkVkt070IQyK+/f8Z/8jd9Wj8c8pl5SpFSAK84Dxf1

# L3mBZdmptWvkx872ynoAb0swRCQiPM/tA6WWj1kpvLb9BOFwnzJKJ/1Vry/+tuWO

# M7tiX5rbV0Dp8c6ZZpCM/2pif93FSguRJuI57BlKcWOdeyFtw5yjojz6f32WapB4

# pm3S4Zz5Hfw42JT0xqUKloakvZ4argRCg7i1gJsiOCC1JeVk7Pf0v35jWSUPei45

# V3aicaoGig+JFrphpxHLmtgOR5qAxdDNp9DvfYPw4TtxCd9ddJgiCGHasFAeb73x

# 4QDf5zEHpJM692VHeOj4qEir995yfmFrb3epgcunCaw5u+zGy9iCtHLNHfS4hQEe

# gPsbiSpUObJb2sgNVZl6h3M7COaYLeqN4DMuEin1wC9UJyH3yKxO2ii4sanblrKn

# QqLJzxlBTeCG+SqaoxFmMNO7dDJL32N79ZmKLxvHIa9Zta7cRDyXUHHXodLFVeNp

# 3lfB0d4wwP3M5k37Db9dT+mdHhk4L7zPWAUu7w2gUDXa7wknHNWzfjUeCLraNtvT

# X4/edIhJEqGCAs4wggI3AgEBMIH4oYHQpIHNMIHKMQswCQYDVQQGEwJVUzELMAkG

# A1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD

# b3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0aW9u

# cyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4RDQxLTRCRjctQjNC

# NzElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcG

# BSsOAwIaAxUAOb12pXHRf+5RrRVyRXbiGmhj3vmggYMwgYCkfjB8MQswCQYDVQQG

# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG

# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQg

# VGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIFAOHL9lMwIhgPMjAy

# MDAxMTcxNzAxMDdaGA8yMDIwMDExODE3MDEwN1owdzA9BgorBgEEAYRZCgQBMS8w

# LTAKAgUA4cv2UwIBADAKAgEAAgIJwAIB/zAHAgEAAgIRlzAKAgUA4c1H0wIBADA2

# BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIB

# AAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAHtPhUUos+aURm3sPliT9610bCHR+Tvt

# 2AXBt7OthK910dnfUBXM23ORoLc210qiauf0IpoQW6hXjlcQ3oGVLuc+T8yZLvrD

# 4Y+Oa86xui7uT+CpJPkHX8fjKPPtqSBIx3toVi6ihvu/ndd+rgCc5nduDHtw5yO7

# 4JVc6YP2yGxgMYIDDTCCAwkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgT

# Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m

# dCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENB

# IDIwMTACEzMAAAEKUsg5AVLRcEsAAAAAAQowDQYJYIZIAWUDBAIBBQCgggFKMBoG

# CSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgG/gDkJz0

# TKZdEaRZIaSkYlHlWZFuQ6Jm5Y7PWFub7SwwgfoGCyqGSIb3DQEJEAIvMYHqMIHn

# MIHkMIG9BCBXAzYkM7qhDCgN6EbxXbZtR3HNkNZaGSMYHzfL5NKsqjCBmDCBgKR+

# MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS

# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT

# HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABClLIOQFS0XBLAAAA

# AAEKMCIEIJe/GVMrhuCJkALf4uT17YF38Xhh6sCAkWskqfrd7sp4MA0GCSqGSIb3

# DQEBCwUABIIBAA+CgEgI7XgDXgiXWEqsFOWF+vLhytQpjbUP3oxRkUhyYeOuAsja

# rWYswzGWLGV4H4yP4AQgok/h6H3amJbPwBZN0tlqMVyqnjJdOnQ01UDZKYACAY4u

# UuiE+jqquY+S4/VzIjatEJPLEl59+kLyR+/e3ogrmkf6K+VbX9QYlnQr5qmV2kjL

# /8H8j0nJKoti1Ze36AwZ8LdLeqX6wxfZRGVZws3QZTMDSO6knUSm+ADNz6B3H0yc

# iZ07tzTaKUDH6vYtKxd4kQCT8ybZO0uUq3hTcwXughal2evjiqznDXptFysGtPBp

# sid4K0zzecOoNsRbBwQgkzbhyLSPq87XCWI=

# SIG # End signature block