PSCertificateEnrollment

1.0.12

Functions/Get-ESTCertificate.ps1

                                Function Get-ESTCertificate {

    [cmdletbinding()]

    param(

        [Parameter(Mandatory=$True, ValuefromPipeline=$True)]

        [ValidateNotNullOrEmpty()]

        [String]

        $CertificateRequest,

        [Parameter(Mandatory=$True)]

        [String]

        $ComputerName,

        [Parameter(Mandatory=$False)]

        [ValidateRange(1,65535)]

        [Int]

        $Port = 443,

        [Parameter(Mandatory=$False)]

        [ValidateNotNullOrEmpty()]

        [String]

        $Suffix = ".well-known/est",

        [Parameter(Mandatory=$False)]

        [System.Management.Automation.PSCredential]

        $Credential,

        [Parameter(Mandatory=$False)]

        [ValidateScript({($_.HasPrivateKey) -and ($null -ne $_.PSParentPath)})]

        [Security.Cryptography.X509Certificates.X509Certificate2]

        $RenewalCertificate

    )

    begin {

        # This hides the Status Indicators of the Invoke-WebRequest Calls later on

        $ProgressPreference = "SilentlyContinue"

    }

    process {

        <#

        RFC 7030 4.2.1

        When HTTPS POSTing to /simpleenroll, the client MUST include a Simple PKI Request as specified in CMC [RFC5272], Section 3.1 (i.e., a PKCS#10 Certification Request [RFC2986]).

        The HTTP content-type of "application/pkcs10" is used here. The format of the message is as specified in [RFC5967] with a Content-Transfer-Encoding of "base64" [RFC2045].

        #>

        $Headers = @{

            "Content-Type" = "application/pkcs10"

            "Content-Transfer-Encoding" = "base64"

        }

        if ($Credential -and (-not $RenewalCertificate)) {

            <#

            RFC 7030 3.2.3

            A client MAY set the username to the empty string ("") if it is presenting a password that is not associated with a username.

            #>

            $Username = $Credential.UserName

            # Zero the unmanaged copy of the password again as soon as it has been read

            $PasswordBstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($Credential.Password)

            try {

                $Password = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($PasswordBstr)

            }

            finally {

                [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($PasswordBstr)

            }

            $EncodedCredentials = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("$($Username):$($Password)"))

            $Headers.Add("Authorization", "Basic $EncodedCredentials")

        }

        $Arguments = @{

            UseBasicParsing = $True

            Method = "POST"

            Headers = $Headers

            Body = (ConvertFrom-PemToBase64 -String $CertificateRequest)

        }

        <#

        RFC 7030 4.2

        EST clients request a certificate from the EST server with an HTTPS

        POST using the operation path value of "/simpleenroll". EST clients

        request a renew/rekey of existing certificates with an HTTP POST

        using the operation path value of "/simplereenroll". EST servers

        MUST support the /simpleenroll and /simplereenroll functions.

        It is RECOMMENDED that a client obtain the current CA certificates,

        as described in Section 4.1, before performing certificate request

        functions. This ensures that the client will be able to validate the

        EST server certificate. The client MUST authenticate the EST server

        as specified in Section 3.3.1 if certificate-based authentication is

        used or Section 3.3.3 if the optional certificate-less authentication

        is used. The client MUST verify the authorization of the EST server

        as specified in Section 3.6.

        #>

        if ($RenewalCertificate) {

            $Arguments.Add("Uri", "https://${ComputerName}:${Port}/${Suffix}/simplereenroll")

            $Arguments.Add("Certificate", $RenewalCertificate)

        }

        else {

            $Arguments.Add("Uri", "https://${ComputerName}:${Port}/${Suffix}/simpleenroll")

        }

        $Response = Invoke-WebRequest @Arguments

        <#

        RFC 7030 4.2.3

        If the enrollment is successful, the server response MUST contain an HTTP 200 response code with a content-type of "application/pkcs7-mime".

        #>

        # Error 401: Unauthorized The server was unable to authorize the request. - e.g. when credentials are wrong

        # Error 400: Bad Request Invalid or corrupted pkcs10 request. - e.g when input is no valid CSR

        if ($Response.StatusCode -ne 200) {

            $Response

            return

        }

        <#

        A successful response MUST be a certs-only CMC Simple PKI Response, as defined in [RFC5272], containing only the certificate that was

        issued. The HTTP content-type of "application/pkcs7-mime" with an smime-type parameter "certs-only" is used, as specified in [RFC5273].

        #>

        # Only the media type counts - servers differ in the parameters they add and how they space them

        $MediaType = ("$($Response.Headers["Content-Type"])" -split ";")[0].Trim()

        if ($MediaType -ne "application/pkcs7-mime") {

            Write-Error "Got response as $($Response.Headers["Content-Type"]), which is not compliant to RFC 7030."

            return

        }

        $SimplePkiResponse = New-Object -TypeName Security.Cryptography.Pkcs.SignedCms

        $SimplePkiResponse.Decode([Convert]::Frombase64String([System.Text.Encoding]::ASCII.GetString($Response.Content).Replace("`n", [String]::Empty)))

        $SimplePkiResponse.Certificates

    }

}

# SIG # Begin signature block

# MIInYwYJKoZIhvcNAQcCoIInVDCCJ1ACAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA6aoqEkAANbLLk

# 7eOvwAowtxL15PrqoILzE/hBUUlfy6CCIBMwggZCMIIEKqADAgECAhBpEmNtaQD5

# xRtKmVz7/u/QMA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQK

# ExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2Rl

# IFNpZ25pbmcgMjAyMSBDQTAeFw0yNjAzMTgwNzQ5NDRaFw0yNzA2MjAwNzQ5NDNa

# MGgxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4xFDASBgNVBAcMC0TDvHJy

# d2FuZ2VuMRgwFgYDVQQKDA9Vd2UgR3JhZGVuZWdnZXIxGDAWBgNVBAMMD1V3ZSBH

# cmFkZW5lZ2dlcjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAM2hKwhe

# E1F2z3bW4sx0w3zQoHm6QC3uXPWzhQ9slqAzgu4PHaIRE22OqlABXYtXq+iu2kh6

# PZxkim0QEdq1vtuHOKBnD1XEOBUx/NIi+PxZ02AaRulDO685tLUOrnupohxaG4qq

# 6C/Seyab8/7tXzMEhv/PsOGl1N4m3YOLJjUslMVhkLoNc12T/PzF6qTZThBRiKeD

# N0tlQo5EraLhghZ3jFKkpCH6ckGEVolBNwqg0BBJiT6mQtVlcZmlJK2c1rNq9Apw

# IvN9bA+5A/w9T3yhbIlz0nuoIqdTaFq0DUH2SFQdXZP6xEPuAICJCDaDrc3hL4WF

# gLc4Tw5SzwVKLawFeYhzCbq22CvA6+c4dGgMyLY99UXtIiHB52UQEmL50tkMRxWw

# Hsonxy2/H380mrVQus2/lM1X9xYcQrxHcjoDjQSi4JCClZekVYPUxgd9lxYQBd8+

# PpdRucjAzKmOx0uc5+tddVRzMYYoc/xQSWj06aTr2zDQu+dpchWFJHEirQIDAQAB

# o4IBeDCCAXQwDAYDVR0TAQH/BAIwADA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8v

# Y2NzY2EyMDIxLmNybC5jZXJ0dW0ucGwvY2NzY2EyMDIxLmNybDBzBggrBgEFBQcB

# AQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9jY3NjYTIwMjEub2NzcC1jZXJ0dW0u

# Y29tMDUGCCsGAQUFBzAChilodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY2Nz

# Y2EyMDIxLmNlcjAfBgNVHSMEGDAWgBTddF1MANt7n6B0yrFu9zzAMsBwzTAdBgNV

# HQ4EFgQUwj1KxaiWz3BWxuN8zTWx+dWip28wSwYDVR0gBEQwQjAIBgZngQwBBAEw

# NgYLKoRoAYb2dwIFAQQwJzAlBggrBgEFBQcCARYZaHR0cHM6Ly93d3cuY2VydHVt

# LnBsL0NQUzATBgNVHSUEDDAKBggrBgEFBQcDAzAOBgNVHQ8BAf8EBAMCB4AwDQYJ

# KoZIhvcNAQELBQADggIBADrSbHhlYMa9ixnpIWBgVhL76qdlK5iPN35rlMHgK89n

# O9afz8EYTK7UExehOZxHtpLqO/hJu4eIQmjzC+tyUDii/3+IPoL1R9NlxAgoPxMc

# 3voLsX0xwTkl+R6dO6Q8RM3EDsknyUtVpjBggCPZ0pZsNumV1BXdIPPzdA1Rxm3F

# 6zcOGaXAJH37EWtbnc2e3X4EIxRFPm2EP5oiEYVEi90B3lcmo5p3iJG6zNSr+apG

# neN4AWuoGMbYBT7Ms5CdmbaM6uhuq73OqP6x47VjyeXpfuEVxvLSBfL24AI73//3

# 8sq2gH//j4qE8Ic4hV8NIBsHLvHuFH06z2EqWoEI0dKz2C92S86hqw+OGAcgLTVE

# StRppJXgtJwwxusm9OiJPIfDFY7kQxSGRq4B1YR1GGaUm1p4s2+819H8sYM+RGbM

# MCrY4C8EQNeCJedXZeCIXyWFDRizK7BB6B24DC0a7XR7cedQOMwMy/m9kZRsSt6X

# 7c84iOhCEL3Degnv8V4/KJSDtaOMVQUm6vRyFdQEfkVCHCaOuM6i4lQwKu38nOx+

# vNkCOSm3LWrYJGMxk1/KcPL5T+nR8WIR9SaS2vEGEvZmie71Q6qdug8cmPibxIs6

# N8wM2NJ+fDBHhoZl6as2VmDvLhqkbJaC0Piz82UWi6lGAfrhs4sLjOPIRvSauJTe

# MIIGuTCCBKGgAwIBAgIRAJmjgAomVTtlq9xuhKaz6jkwDQYJKoZIhvcNAQEMBQAw

# gYAxCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT

# LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJDAi

# BgNVBAMTG0NlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0EgMjAeFw0yMTA1MTkwNTMy

# MThaFw0zNjA1MTgwNTMyMThaMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3Nl

# Y28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNpZ25p

# bmcgMjAyMSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ0jzwQw

# IzvBRiznM3M+Y116dbq+XE26vest+L7k5n5TeJkgH4Cyk74IL9uP61olRsxsU/WB

# AElTMNQI/HsE0uCJ3VPLO1UufnY0qDHG7yCnJOvoSNbIbMpT+Cci75scCx7UsKK1

# fcJo4TXetu4du2vEXa09Tx/bndCBfp47zJNsamzUyD7J1rcNxOw5g6FJg0ImIv7n

# CeNn3B6gZG28WAwe0mDqLrvU49chyKIc7gvCjan3GH+2eP4mYJASflBTQ3HOs6JG

# driSMVoD1lzBJobtYDF4L/GhlLEXWgrVQ9m0pW37KuwYqpY42grp/kSYE4BUQrbL

# gBMNKRvfhQPskDfZ/5GbTCyvlqPN+0OEDmYGKlVkOMenDO/xtMrMINRJS5SY+jWC

# i8PRHAVxO0xdx8m2bWL4/ZQ1dp0/JhUpHEpABMc3eKax8GI1F03mSJVV6o/nmmKq

# DE6TK34eTAgDiBuZJzeEPyR7rq30yOVw2DvetlmWssewAhX+cnSaaBKMEj9O2GgY

# kPJ16Q5Da1APYO6n/6wpCm1qUOW6Ln1J6tVImDyAB5Xs3+JriasaiJ7P5KpXeiVV

# /HIsW3ej85A6cGaOEpQA2gotiUqZSkoQUjQ9+hPxDVb/Lqz0tMjp6RuLSKARsVQg

# ETwoNQZ8jCeKwSQHDkpwFndfCceZ/OfCUqjxAgMBAAGjggFVMIIBUTAPBgNVHRMB

# Af8EBTADAQH/MB0GA1UdDgQWBBTddF1MANt7n6B0yrFu9zzAMsBwzTAfBgNVHSME

# GDAWgBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0l

# BAwwCgYIKwYBBQUHAwMwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL2NybC5jZXJ0

# dW0ucGwvY3RuY2EyLmNybDBsBggrBgEFBQcBAQRgMF4wKAYIKwYBBQUHMAGGHGh0

# dHA6Ly9zdWJjYS5vY3NwLWNlcnR1bS5jb20wMgYIKwYBBQUHMAKGJmh0dHA6Ly9y

# ZXBvc2l0b3J5LmNlcnR1bS5wbC9jdG5jYTIuY2VyMDkGA1UdIAQyMDAwLgYEVR0g

# ADAmMCQGCCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZI

# hvcNAQEMBQADggIBAHWIWA/lj1AomlOfEOxD/PQ7bcmahmJ9l0Q4SZC+j/v09CD2

# csX8Yl7pmJQETIMEcy0VErSZePdC/eAvSxhd7488x/Cat4ke+AUZZDtfCd8yHZgi

# kGuS8mePCHyAiU2VSXgoQ1MrkMuqxg8S1FALDtHqnizYS1bIMOv8znyJjZQESp9R

# T+6NH024/IqTRsRwSLrYkbFq4VjNn/KV3Xd8dpmyQiirZdrONoPSlCRxCIi54vQc

# qKiFLpeBm5S0IoDtLoIe21kSw5tAnWPazS6sgN2oXvFpcVVpMcq0C4x/CLSNe0Xc

# kmmGsl9z4UUguAJtf+5gE8GVsEg/ge3jHGTYaZ/MyfujE8hOmKBAUkVa7NMxRSB1

# EdPFpNIpEn/pSHuSL+kWN/2xQBJaDFPr1AX0qLgkXmcEi6PFnaw5T17UdIInA58r

# Tu3mefNuzUtse4AgYmxEmJDodf8NbVcU6VdjWtz0e58WFZT7tST6EWQmx/OoHPel

# E77lojq7lpsjhDCzhhp4kfsfszxf9g2hoCtltXhCX6NqsqwTT7xe8LgMkH4hVy8L

# 1h2pqGLT2aNCx7h/F95/QvsTeGGjY7dssMzq/rSshFQKLZ8lPb8hFTmiGDJNyHga

# 5hZ59IGynk08mHhBFM/0MLeBzlAQq1utNjQprztZ5vv/NJy8ua9AGbwkMWkOMIIF

# yTCCBLGgAwIBAgIQG7WPJSrfIwBJKMmuPX7tJzANBgkqhkiG9w0BAQwFADB+MQsw

# CQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEn

# MCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYDVQQD

# ExlDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBMB4XDTIxMDUzMTA2NDMwNloXDTI5

# MDkxNzA2NDMwNlowgYAxCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRl

# Y2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBB

# dXRob3JpdHkxJDAiBgNVBAMTG0NlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0EgMjCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL35ePjm1YAMZJ2GG5ZkZz8i

# Oh51AX3v+1xnjMnMXGupkea5QuUgS5vam3u5mV3Zm4BL14RAKyfT6Lowuz4JGqdJ

# le8rQCTCl8en7psl76gKAJeFWqqd3CnJ4jUH63BNStbBs1a4oUE4m9H7MX+P4F/h

# sT8PjhZJYNcGjRj5qiYQqyrT0NFnjRtGvkcw1S5y0cVj2udjeUR+S2MkiYYuND8p

# TFKLKqfA4pEoibnAW/kd2ecnrf+aApfBxlCSmwIsvam5NFkKv4RK/9/+s5/r2Z7g

# mCPspmt3FirbzK07HKSH3EZzXhliaEVX5JCCQrtC1vBh4MGjPWajXfQY7ojJjRdF

# KZkydQIx7ikmyGsC5rViRX83FVojaInUPt5OJ7DwQAy8TRfLTaKzHtAGWt32k89X

# dZn1+oYaZ3izv5b+NNy951JW5bPldXvXQZEF3F1p45UNQ7n8g5Y5lXtsgFpPE3LG

# 130pekS6UqQq1UFGCSD+IqC2WzCNvIkM1ddw+IdS/drvrFEuB7NO/tAJ2nDvmPpW

# 5m3btVdL3OUsJRXIni54TvjanJ6GLMpX8xrlyJKLGoKWesO8UBJp2A5aRos66yb6

# I8m2sIG+QgCk+Nb+MC7H0kb25Y51/fLMudCHW8wGEGC7gzW3XmfeR+yZSPGkoRX+

# rYxijjlVTzkWubFjnf+3AgMBAAGjggE+MIIBOjAPBgNVHRMBAf8EBTADAQH/MB0G

# A1UdDgQWBBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAfBgNVHSMEGDAWgBQIds3LB/8k

# 9sXN7buQvOKEN0Z19zAOBgNVHQ8BAf8EBAMCAQYwLwYDVR0fBCgwJjAkoCKgIIYe

# aHR0cDovL2NybC5jZXJ0dW0ucGwvY3RuY2EuY3JsMGsGCCsGAQUFBwEBBF8wXTAo

# BggrBgEFBQcwAYYcaHR0cDovL3N1YmNhLm9jc3AtY2VydHVtLmNvbTAxBggrBgEF

# BQcwAoYlaHR0cDovL3JlcG9zaXRvcnkuY2VydHVtLnBsL2N0bmNhLmNlcjA5BgNV

# HSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDovL3d3dy5jZXJ0dW0u

# cGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4IBAQBRwqFYFiIQi/yGMdTCMtNc+EuiL2o+

# TfirCB7t1ej65wgN7LfGHg6ydQV6sQv613RqAAYfpM6q8mt92BHAEQjUDk1hxTqo

# +rHh45jq4mP9QfWTfQ28XZI7kZplutBfTL5MjWgDEBbV8dAEioUz+TfnWy4maUI8

# us281HrpTZ3a50P7Y1KAhQTEJZVV8H6nnwHFWyj44M6GcKYnOzn7OC6YU2UidS3X

# 9t0iIpGW691o7T+jGZfTOyWI7DYSPal+zgKNBZqSpyduRbKcYoY3DaQzjteoTtBK

# F0NMxfGnbNIeWGwUUX6KVKH27595el2BmhaQD+G78UoA+fndvu2q7M4KMIIGuTCC

# BKGgAwIBAgIRAOf/acc7Nc5LkSbYdHxopYcwDQYJKoZIhvcNAQEMBQAwgYAxCzAJ

# BgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScw

# JQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxJDAiBgNVBAMT

# G0NlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0EgMjAeFw0yMTA1MTkwNTMyMDdaFw0z

# NjA1MTgwNTMyMDdaMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0

# YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAy

# MSBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOkSHwQ17bldesWm

# lUG+imV/TnfRbSV102aO2/hhKH9/t4NAoVoipzu0ePujH67y8iwlmWuhqRR4xLeL

# dPxolEL55CzgUXQaq+Qzr5Zk7ySbNl/GZloFiYwuzwWS2AVgLPLCZd5DV8QTF+V5

# 7Y6lsdWTrrl5dEeMfsxhkjM2eOXabwfLy6UH2ZHzAv9bS/SmMo1PobSx+vHWST7c

# 4aiwVRvvJY2dWRYpTipLEu/XqQnqhUngFJtnjExqTokt4HyzOsr2/AYOm8YOcoJQ

# xgvc26+LAfXHiBkbQkBdTfHak4DP3UlYolICZHL+XSzSXlsRgqiWD4MypWGU4A13

# xiHmaRBZowS8FET+QAbMiqBaHDM3Y6wohW07yZ/mw9ZKu/KmVIAEBhrXesxifPB+

# DTyeWNkeCGq4IlgJr/Ecr1px6/1QPtj66yvXl3uauzPPGEXUk6vUym6nZyE1IGXI

# 45uGVI7XqvCt99WuD9LNop9Kd1LmzBGGvxucOo0lj1M3IRi8FimAX3krunSDguC5

# HgD75nWcUgdZVjm/R81VmaDPEP25Wj+C1reicY5CPckLGBjHQqsJe7jJz1CJXBMU

# tZs10cVKMEK3n/xD2ku5GFWhx0K6eFwe50xLUIZD9GfT7s/5/MyBZ1Ep8Q6H+GMu

# udDwF0mJitk3G8g6EzZprfMQMc3DAgMBAAGjggFVMIIBUTAPBgNVHRMBAf8EBTAD

# AQH/MB0GA1UdDgQWBBS+VAIvv0Bsc0POrAklTp5DRBru4DAfBgNVHSMEGDAWgBS2

# oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYI

# KwYBBQUHAwgwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL2NybC5jZXJ0dW0ucGwv

# Y3RuY2EyLmNybDBsBggrBgEFBQcBAQRgMF4wKAYIKwYBBQUHMAGGHGh0dHA6Ly9z

# dWJjYS5vY3NwLWNlcnR1bS5jb20wMgYIKwYBBQUHMAKGJmh0dHA6Ly9yZXBvc2l0

# b3J5LmNlcnR1bS5wbC9jdG5jYTIuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG

# CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM

# BQADggIBALiTWXfJTBX9lAcIoKd6oCzwQZOfARQkt0OmiQ390yEqMrStHmpfycgg

# fPGlBHdMDDYhHDVTGyvY+WIbdsIWpJ1BNRt9pOrpXe8HMR5sOu71AWOqUqfEIXaH

# WOEs0UWmVs8mJb4lKclOHV8oSoR0p3GCX2tVO+XF8Qnt7E6fbkwZt3/AY/C5KYzF

# ElU7TCeqBLuSagmM0X3Op56EVIMM/xlWRaDgRna0hLQze5mYHJGv7UuTCOO3wC1b

# zeZWdlPJOw5v4U1/AljsNLgWZaGRFuBwdF62t6hOKs86v+jPIMqFPwxNJN/ou22D

# qzpP+7TyYNbDocrThlEN9D2xvvtBXyYqA7jhYY/fW9edUqhZUmkUGM++Mvz9lyT/

# nBdfaKqM5otK0U5H8hCSL4SGfjOVyBWbbZlUIE8X6XycDBRRKEK0q5JTsaZksoKa

# bFAyRKJYgtObwS1UPoDGcmGirwSeGMQTJSh+WR5EXZaEWJVA6ZZPBlGvjgjFYaQ0

# kLq1OitbmuXZmX7Z70ks9h/elK0A8wOg8oiNVd3o1bb59ms1QF4OjZ45rkWfsGuz

# 8ctB9/leCuKzkx5Rt1WAOsXy7E7pws+9k+jrePrZKw2DnmlNaT19QgX2I+hFtvhC

# 6uOhj/CgjVEA4q1i1OJzpoAmre7zdEg+kZcFIkrDHgokA5mcIMK1MIIGgjCCBGqg

# AwIBAgIQKPB3wRw2vf5fdDJHcCcuAzANBgkqhkiG9w0BAQwFADBWMQswCQYDVQQG

# EwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQD

# ExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwHhcNMjYwMzExMDczNDU0WhcN

# MzYwMjI3MDczNDU0WjBQMQswCQYDVQQGEwJQTDEhMB8GA1UECgwYQXNzZWNvIERh

# dGEgU3lzdGVtcyBTLkEuMR4wHAYDVQQDDBVDZXJ0dW0gVGltZXN0YW1wIDIwMjYw

# ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC4vc3wcPsSNdoYthfbjUAT

# Tkk5EyItd37odw4lsmyOd/dmwXycOrTu8w7O1Kj/63o1X+MRU1N1zTj7LjhZD+Uj

# xbJ1sJ91SS/jYTYbLro72LELWkJ7zaNcJOOq3k4MLNS/DhRHSmsYMqk+MzkMfNZi

# 8DWUqlzVPUa2/aACViReDMnc/gtXm7tA9Pr4DN7agEPE1NtN36oCgj6iHR5aGhah

# /XskfvLZ6ZstoZ5zefWTrZrLh3kcH+YkzoZYX9Hf6qqrizkiBj4BlS9R4+VwVKMd

# jhO7UEa/pf8cTWy+jrsATuAGthG7sWIN+3KV7+Ytv5Uy+DQEgf3bn/VuH4wN0aPh

# j/mwueJ9jmIjNwqvM/dno8fBeR1jtnuP++XgveQfbTMP3qu9dPRg8ltvtrreQZ9K

# PDFyUxEZMsrLVm6nJ1JKJgPe6n4gwsL6VrjjHX0zpLF3vUvsQ8TiWgm4sk4r4D7p

# cXE/rX0E0Vwa+VMLT73PiDZ2nzhIpc1RwNdbb/qR3Mpa8sQXNPHFIoX/7bapGUtG

# 5sd1cUGsvLqIWk6dP/xAgPb2BludUinSTCYV7ysiHQS8vFmDXIU7fMkSE7/QHcYP

# Sahro4fk5z9W1t2kIxbZRJe0s4DXiPDlQPwiQFllLkU9wLvU6DqR8v35a65J4TeI

# XhMO/+iCzL+B0rI9GGeKLQIDAQABo4IBUDCCAUwwdQYIKwYBBQUHAQEEaTBnMDsG

# CCsGAQUFBzAChi9odHRwOi8vc3ViY2EucmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Rz

# Y2EyMDIxLmNlcjAoBggrBgEFBQcwAYYcaHR0cDovL3N1YmNhLm9jc3AtY2VydHVt

# LmNvbTAfBgNVHSMEGDAWgBS+VAIvv0Bsc0POrAklTp5DRBru4DAMBgNVHRMBAf8E

# AjAAMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9zdWJjYS5jcmwuY2VydHVtLnBs

# L2N0c2NhMjAyMS5jcmwwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/

# BAQDAgeAMCIGA1UdIAQbMBkwCAYGZ4EMAQQCMA0GCyqEaAGG9ncCBQELMB0GA1Ud

# DgQWBBQjOWooq5oSp6Sn8h/5RZq/jf6CAzANBgkqhkiG9w0BAQwFAAOCAgEAZv6T

# m6wL3k6mBTwkrYcTVcAR01uE37gUGNihgnTJR+gC41T2H9lwETRjE10nEdCUNv3N

# i8S6aBx4UcMRX93fd9w4RUteua2I+oj0kCpuNa3PQDKUwozHZmotWivaPO9KTs08

# y0YVhVSMZvuUH/reFec9eLT6FLAFnX0Sg9Wc7833uQB5RPa8TmXBkTolC8bNxHX+

# 2SfEWSNI8w/Y7o9qBF9l0uwVSrjQitVtIdZo2qb9NvMqqPFLWYef9SG+PGMqfPAQ

# 2EoYeT0hlFLkubWF1X3HbiDwXtz3TU2EWHU+VTcZMC4IzMyHK/+kh9n3oxSQ45ws

# Y71y7mqxKyYPyHSPoV3RiAQ1Thr9c65BeJLaELxWSKeQyAGIdBsMlIXPO6qp+VGm

# E49vosogQ0jYe2hgq5LgJ6oO0Ie364V/kITBnifUqS6Zxu+qjfOYS8o72EeoEWIi

# 04/BuH8Y6leNNP27j8NKwaPciWcqv/HBnQjizzmH/aqXn03K2SnjvaYPlCR8fFAA

# W2k6os0cZvLFEhMnHHAghYSIrdwCP98BrkjgA3ogOu+jXEO/nbD9OGL873Te6U2T

# coOu9lqQQyXYNHiLR5eMqJrzXiDlodarOEKjlukyPDnLIuLkg0y6K8S1A5wU8CkM

# 86cXdWFHLRIEYd9kdCfRZBZHhK7iVPeEZYxa9bgxggamMIIGogIBATBqMFYxCzAJ

# BgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAi

# BgNVBAMTG0NlcnR1bSBDb2RlIFNpZ25pbmcgMjAyMSBDQQIQaRJjbWkA+cUbSplc

# +/7v0DANBglghkgBZQMEAgEFAKCBiDAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIB

# BDAcBgkqhkiG9w0BCQUxDxcNMjYxMDA3MTQyMTQ2WjAcBgorBgEEAYI3AgELMQ4w

# DAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQgL6k154xyrD/NDUYcNpXXkd3Q

# wBt2D6QfAaf5GyunvOUwDQYJKoZIhvcNAQEBBQAEggGAbJ+vENCCrMsVCG4ZoWiy

# 4JHFkCN1bLl6WL1PtvrWEZyWRhT5/8ynbX5/UMozeewtO9qyK4u7D6SnJFrS9R0b

# z22n7iy65b/Z2fO3Co9Bc+QRQjkSu9/BEd0shK0LudTqTLOeKWl1b5UydnztG4Bd

# OGIYstDTogQWsOIrVRNeJpUv5QNsYksg3fUcQDC1bAW0opr4vnJ9w3ydisHLXtmi

# rP7IGcPlSkX6U/4IXB8mrYmYg94WeArxBXy9VP10co7a++UqCBIWK4jYNQ2qJXZr

# EiYzoxK2WlqnVK9laLU8q0W1U1ZSwvLQJEEfzyMOyFyzznPrkfRyKxnRe3daDx++

# 3V6Y/taBj0J82MTgCHW5dqGYSufCLc6DJXWvGEFPkpA/30k6g1fWTaqydZim97Ae

# MnPqCGRiy6O3RtXMBCFOhGhNGc2Rvpt3R3gmftSpV9cBIGKZqGiLgUh/dk/abJYX

# KHRiyqTu3iYi4Zr3jyqMG0bvycQXKXx84HHIzJtgDUPDoYIEAjCCA/4GCSqGSIb3

# DQEJBjGCA+8wggPrAgEBMGowVjELMAkGA1UEBhMCUEwxITAfBgNVBAoTGEFzc2Vj

# byBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMbQ2VydHVtIFRpbWVzdGFtcGlu

# ZyAyMDIxIENBAhAo8HfBHDa9/l90MkdwJy4DMA0GCWCGSAFlAwQCAgUAoIIBVjAa

# BgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTAw

# NzE0MjE0NlowNwYLKoZIhvcNAQkQAi8xKDAmMCQwIgQghb6Q4QrSQ418ySi2r0iw

# mrIIF3zs+LASbFjTkQUlxDwwPwYJKoZIhvcNAQkEMTIEMGG9Iu5xt6RAfGMBP3dE

# hISpP/SKUTrQdosixM9315CweHwpIzpfx0LvcHWeu2SQHDCBnwYLKoZIhvcNAQkQ

# AgwxgY8wgYwwgYkwgYYEFFcUaEEMqFrzQk75FkpRNhD0042YMG4wWqRYMFYxCzAJ

# BgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAi

# BgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQKPB3wRw2vf5fdDJH

# cCcuAzANBgkqhkiG9w0BAQEFAASCAgBNus84RTseLEqmZUsjdy7ZHTqN7d52tnlH

# MetzQVWNivPrEoBmbx8Bt2afyeyc3FcQjAUuzervN0a/wMQ0VPtclZgICU1pYf6b

# Z5PL87fqyLhixAnztOiCEt4VzpLlKHsQmiCXhECGY4zlPcrZ4sHv8TTjrbYaDAu2

# MInoR5E40uqXBhswXaeiW3vCMtg31NiThqU75b3nWOffKQZ21QzDwladUAMKp7CN

# zCNRd1cpglWWxCm1j46KLvdDOeMj8G/QeXrhezIEh4MTwr81YokyN0rUeF7iDTRn

# Sc4qxWz79l7+WovBU3+Cljr0njRRSXFnsX/fAscL4kCegSyM12vivDrGY2dcz68m

# ct1qkY8CrtQ7/Zbn82+L9uvn2CQ3XQcRRsCXFmiDLhW2Nu+7sO/BRQaBaS1fv59o

# UVDO4iwZ+HUf86clkNGiblbcqulykFi3J4rshRlIcM/H3dLse6OvKVRKLASD8ofT

# Ob+bTYpCe6nLdWtaopULh5cMvcCPJvXjTupl2r3URlLv5zFddufWU0J2kyKtyWdQ

# XM+5eZSxzVgOpZnZMQbX4XOPWVQqwzPEhcS4C826VgvojiVGgn1hXANekDQ3oURF

# 1QZcLgkBsXLi1NzI7yEsORk19UXHT9wiJrCB8H3uOLFTemq+PEfTOTwB9JonrfEY

# n1p0CvbSdg==

# SIG # End signature block