+++ /dev/null
-// Copyright (C) 2003 Adam Megacz <adam@xwt.org> all rights reserved.
-//
-// You may modify, copy, and redistribute this code under the terms of
-// the GNU Library Public License version 2.1, with the exception of
-// the portion of clause 6a after the semicolon (aka the "obnoxious
-// relink clause")
-
-package org.xwt.util;
-
-import org.bouncycastle.crypto.AsymmetricBlockCipher;
-import org.bouncycastle.crypto.Digest;
-import org.bouncycastle.crypto.CipherParameters;
-import org.bouncycastle.crypto.InvalidCipherTextException;
-import org.bouncycastle.crypto.params.RSAKeyParameters;
-import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
-import org.bouncycastle.crypto.params.KeyParameter;
-import org.bouncycastle.crypto.digests.SHA1Digest;
-import org.bouncycastle.crypto.digests.MD5Digest;
-import org.bouncycastle.crypto.digests.MD2Digest;
-import org.bouncycastle.crypto.engines.RSAEngine;
-import org.bouncycastle.crypto.engines.RC4Engine;
-import org.bouncycastle.util.encoders.Base64;
-import org.bouncycastle.asn1.DERInputStream;
-import org.bouncycastle.asn1.DEROutputStream;
-import org.bouncycastle.asn1.DERSequence;
-import org.bouncycastle.asn1.DERObject;
-import org.bouncycastle.asn1.DEROctetString;
-import org.bouncycastle.asn1.BERInputStream;
-import org.bouncycastle.asn1.x509.X509CertificateStructure;
-import org.bouncycastle.asn1.x509.RSAPublicKeyStructure;
-import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
-import org.bouncycastle.asn1.x509.TBSCertificateStructure;
-import org.bouncycastle.asn1.x509.X509Name;
-import org.bouncycastle.asn1.x509.X509Extensions;
-import org.bouncycastle.asn1.x509.X509Extension;
-import org.bouncycastle.asn1.x509.BasicConstraints;
-import org.xwt.util.Log;
-import java.net.*;
-import java.io.*;
-import java.util.*;
-import java.math.*;
-import java.text.*;
-
-/**
-
- TinySSL: a tiny SSL implementation in Java, built on the
- bouncycastle.org lightweight crypto library.
-
- This class implements an SSLv3 client-side socket, with the
- SSL_RSA_EXPORT_WITH_RC4_40_MD5 and SSL_RSA_WITH_RC4_128_MD5 cipher
- suites, as well as certificate chain verification against a
- collection of 93 built-in Trusted Root CA public keys (the same 93
- included with Microsoft Internet Explorer 5.5 SP2).
-
- As of 07-Dec-01, the zipped bytecode for this class is 43k, and the
- subset of bouncycastle it requires is 82k.
-
- This class should work correctly on any Java 1.1 compliant
- platform. The java.security.* classes are not used.
-
- The main design goal for this class was the smallest possible body
- of code capable of connecting to 99% of all active HTTPS
- servers. Although this class is useful in many other situations
- (IMAPS, Secure SMTP, etc), the author will refuse all feature
- requests and submitted patches which go beyond this scope.
-
- Because of the limited goals of this class, certain abstractions
- have been avoided, and certain parameters have been
- hard-coded. "Magic numbers" are often used instead of "static final
- int"'s, although they are usually accompanied by a descriptive
- comment. Numeric offsets into byte arrays are also favored over
- DataInputStream(ByteArrayInputStream(foo))'s.
-
- Much thanks and credit go to the BouncyCastle team for producing
- such a first-class library, and for helping me out on the
- dev-crypto mailing list while I was writing this.
-
- Revision History:
-
- 1.0 07-Dec-01 Initial Release
-
- 1.01 15-Mar-02 Added PKCS1 class to avoid dependancy on java.security.SecureRandom
-
- 1.02 27-Mar-02 Fixed a bug which would hang the connection when more than one
- Handshake message appeared in the same TLS Record
-
- 1.03 10-Aug-02 Fixed a vulnerability outlined at
- http://online.securityfocus.com/archive/1/286290
-
- 1.04 12-Dec-03 Renamed to org.xwt.SSL, fixed race condition
-
-*/
-
-public class SSL extends Socket {
-
- // Simple Test //////////////////////////////////////////////
-
- public static void main(String[] args) {
- Log.on = true;
- try {
- Socket s = new SSL("www.paypal.com", 443);
- PrintWriter pw = new PrintWriter(s.getOutputStream());
- BufferedReader br = new BufferedReader(new InputStreamReader(s.getInputStream()));
- pw.println("GET / HTTP/1.0");
- pw.println("");
- pw.flush();
-
- while(true) {
- String s2 = br.readLine();
- if (s2 == null) return;
- Log.info(SSL.class, s2);
- }
-
- } catch (Exception e) {
- e.printStackTrace();
- }
- }
-
- // Static Data //////////////////////////////////////////////
-
- public static class SSLException extends IOException { public SSLException(String s) { super(s); } }
- static SubjectPublicKeyInfo[] trusted_CA_public_keys;
- static String[] trusted_CA_public_key_identifiers;
- public static byte[] pad1 = new byte[48];
- public static byte[] pad2 = new byte[48];
- public static byte[] pad1_sha = new byte[40];
- public static byte[] pad2_sha = new byte[40];
- static byte[] randpool;
- static long randcnt = 0;
-
- // Cipher State //////////////////////////////////////////////
-
- public byte[] server_random = new byte[32];
- public byte[] client_random = new byte[32];
- public byte[] client_write_MAC_secret = new byte[16];
- public byte[] server_write_MAC_secret = new byte[16];
- public byte[] client_write_key = null;
- public byte[] server_write_key = null;
- public byte[] master_secret = null;
-
- /** the bytes of the ServerKeyExchangeMessage, null if none recieved */
- public byte[] serverKeyExchange = null;
-
- /** true iff the server asked for a certificate */
- public boolean cert_requested = false;
-
- public X509CertificateStructure server_cert = null;
-
- public SSLOutputStream os = null;
- public SSLInputStream is = null;
-
- String hostname;
-
- /** if true, we don't mind if the server's cert isn't signed by a CA. USE WITH CAUTION! */
- boolean ignoreUntrustedCert = false;
-
- /** the concatenation of all the bytes of all handshake messages sent or recieved */
- public byte[] handshakes = new byte[] { };
-
- /** true iff we're using SSL_RSA_EXPORT_WITH_RC4_40_MD5 */
- boolean export = false;
-
- public InputStream getInputStream() throws IOException { return is != null ? is : super.getInputStream(); }
- public OutputStream getOutputStream() throws IOException { return os != null ? os : super.getOutputStream(); }
-
- public SSL(String host, int port) throws IOException { this(host, port, true, false); }
- public SSL(String host, int port, boolean negotiateImmediately) throws IOException { this(host, port, negotiateImmediately, false); }
- public SSL(String host, int port, boolean negotiateImmediately, boolean ignoreUntrustedCert) throws IOException {
- super(host, port);
- if (!initializationFinished) {
- synchronized(SSL.class) {
- while (!initializationFinished)
- try { SSL.class.wait(); } catch (Exception e) { }
- }
- }
- hostname = host;
- this.ignoreUntrustedCert = ignoreUntrustedCert;
- if (negotiateImmediately) negotiate();
- }
-
- /** negotiates the SSL connection */
- public void negotiate() throws IOException {
- os = new SSLOutputStream(super.getOutputStream());
- is = new SSLInputStream(super.getInputStream());
- os.writeClientHello();
- is.readServerHandshakes();
- os.sendClientHandshakes();
- is.readServerFinished();
- }
-
- class SSLInputStream extends InputStream {
-
- /** the underlying inputstream */
- DataInputStream raw;
-
- /** the server's sequence number */
- public int seq_num = 0;
-
- /** the decryption engine */
- public RC4Engine rc4 = null;
-
- /** pending bytes -- decrypted, but not yet fed to consumer */
- byte[] pend = null;
- int pendstart = 0;
- int pendlen = 0;
-
- public void mark() { }
- public void reset() { }
- public boolean markSupported() { return false; }
- public long skip(long l) throws IOException { for(long i=0; i<l; i++) read(); return l; }
- public SSLInputStream(InputStream raw) { this.raw = new DataInputStream(raw); }
- public int available() throws IOException { return pendlen; }
-
- public int read() throws IOException {
- byte[] singlebyte = new byte[1];
- int numread = read(singlebyte);
- if (numread != 1) return -1;
- return (int)singlebyte[0];
- }
-
- public int read(byte[] b, int off, int len) throws IOException {
- if (pendlen == 0) {
- pend = readRecord();
- if (pend == null) return -1;
- pendstart = 0;
- pendlen = pend.length;
- }
- int ret = Math.min(len, pendlen);
- System.arraycopy(pend, pendstart, b, off, ret);
- pendlen -= ret;
- pendstart += ret;
- return ret;
- }
-
- /** reads and decrypts exactly one record; blocks if unavailable */
- public byte[] readRecord() throws IOException {
-
- // we only catch EOFException here, because anywhere else
- // would be "unusual", and we *want* and EOFException in
- // those cases
- byte type;
- try { type = raw.readByte();
- } catch (EOFException e) {
- if (Log.on) Log.info(this, "got EOFException reading packet type");
- return null;
- }
-
- byte ver_major = raw.readByte();
- byte ver_minor = raw.readByte();
- short len = raw.readShort();
- if (Log.on) Log.info(this, "got record of type " + type + ", SSLv" + ver_major + "." + ver_minor + ", length=" + len);
-
- byte[] ret = new byte[len];
- raw.readFully(ret);
-
- // simply ignore ChangeCipherSpec messages -- we change as soon as we send ours
- if (type == 20) {
- if (Log.on) Log.info(this, "got ChangeCipherSpec; ignoring");
- seq_num = 0;
- return readRecord();
- }
-
- byte[] decrypted_payload;
-
- // if crypto hasn't been enabled yet; skip crypt and hash
- if (rc4 == null) decrypted_payload = ret;
- else {
- // decrypt the payload
- decrypted_payload = new byte[len - 16];
- rc4.processBytes(ret, 0, len - 16, decrypted_payload, 0);
-
- // check the MAC
- byte[] MAC = new byte[16];
- rc4.processBytes(ret, len - 16, 16, MAC, 0);
- byte[] ourMAC = computeMAC(type, decrypted_payload, 0, decrypted_payload.length, server_write_MAC_secret, seq_num++);
- for(int i=0; i<MAC.length; i++)
- if (MAC[i] != ourMAC[i])
- throw new SSLException("MAC mismatch on byte " + i + ": got " + MAC[i] + ", expecting " + ourMAC[i]);
- }
-
- if (type == 21) {
- if (decrypted_payload[1] > 1) {
- throw new SSLException("got SSL ALERT message, level=" + decrypted_payload[0] + " code=" + decrypted_payload[1]);
- } else if (decrypted_payload[1] == 0) {
- if (Log.on) Log.info(this, "server requested connection closure; returning null");
- return null;
- } else {
- if (Log.on) Log.info(this, "got SSL ALERT message, level=" + decrypted_payload[0] + " code=" + decrypted_payload[1]);
- return readRecord();
- }
-
- } else if (type == 22) {
- if (Log.on) Log.info(this, "read a handshake");
-
- } else if (type != 23) {
- if (Log.on) Log.info(this, "unexpected record type: " + type + "; skipping");
- return readRecord();
-
- }
-
- if (Log.on) Log.info(this, " returning " + decrypted_payload.length + " byte record payload");
- return decrypted_payload;
- }
-
- private byte[] readHandshake() throws IOException {
- // acquire a handshake message
- byte type = (byte)read();
- int len = ((read() & 0xff) << 16) | ((read() & 0xff) << 8) | (read() & 0xff);
- byte[] rec = new byte[len + 4];
- rec[0] = type;
- rec[1] = (byte)(((len & 0x00ff0000) >> 16) & 0xff);
- rec[2] = (byte)(((len & 0x0000ff00) >> 8) & 0xff);
- rec[3] = (byte)((len & 0x000000ff) & 0xff);
- if (len > 0) read(rec, 4, len);
- return rec;
- }
-
- /** This reads the ServerHello, Certificate, and ServerHelloDone handshake messages */
- public void readServerHandshakes() throws IOException {
- for(;;) {
-
- byte[] rec = readHandshake();
- handshakes = concat(new byte[][] { handshakes, rec });
- DataInputStream stream = new DataInputStream(new ByteArrayInputStream(rec, 4, rec.length - 4));
-
- switch(rec[0]) {
- case 2: // ServerHello
- if (Log.on) Log.info(this, "got ServerHello");
- byte ver_major = rec[4];
- byte ver_minor = rec[5];
- System.arraycopy(rec, 6, server_random, 0, server_random.length);
- short cipher_high = rec[6 + server_random.length + rec[6 + server_random.length] + 1];
- short cipher_low = rec[6 + server_random.length + rec[6 + server_random.length] + 2];
-
- if (cipher_low == 0x04 || cipher_high != 0x00) {
- export = false;
- if (Log.on) Log.info(this, "using SSL_RSA_WITH_RC4_128_MD5");
-
- } else if (cipher_low == 0x03 || cipher_high != 0x00) {
- export = true;
- if (Log.on) Log.info(this, "using SSL_RSA_EXPORT_WITH_RC4_40_MD5");
-
- } else throw new SSLException("server asked for cipher " + ((cipher_high << 8) | cipher_low) +
- " but we only do SSL_RSA_WITH_RC4_128_MD5 (0x0004) and " +
- "SSL_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)");
-
- byte compressionMethod = rec[6 + server_random.length + rec[6 + server_random.length] + 3];
- if (compressionMethod != 0x0) throw new SSLException("server asked for compression method " + compressionMethod +
- " but we don't support compression");
- break;
-
- case 11: // Server's certificate(s)
- if (Log.on) Log.info(this, "got Server Certificate(s)");
- int numcertbytes = ((rec[4] & 0xff) << 16) | ((rec[5] & 0xff) << 8) | (rec[6] & 0xff);
- int numcerts = 0;
- X509CertificateStructure last_cert = null;
- X509CertificateStructure this_cert = null;
-
- for(int i=0; i<numcertbytes;) {
- int certlen = ((rec[7 + i] & 0xff) << 16) | ((rec[7 + i + 1] & 0xff) << 8) | (rec[7 + i + 2] & 0xff);
- try {
- DERInputStream dIn = new DERInputStream(new ByteArrayInputStream(rec, 7 + i + 3, certlen));
- this_cert = new X509CertificateStructure((DERSequence)dIn.readObject());
- } catch (Exception e) {
- SSLException t = new SSLException("error decoding server certificate: " + e);
- t.fillInStackTrace();
- throw t;
- }
-
- if (server_cert == null) {
- server_cert = this_cert;
- TBSCertificateStructure tbs = server_cert.getTBSCertificate();
- X509Name subject = tbs.getSubject();
-
- // gross hack to extract the Common Name so we can compare it to the server hostname
- String CN = tbs.getSubject().toString() + " ";
- boolean good = false;
- for(int j=0; j<CN.length() - 3; j++)
- if (CN.substring(j, j+3).equals("CN=")) {
- good = true;
- CN = CN.substring(j+3, CN.indexOf(' ', j+3));
- break;
- }
-
- if (!good) throw new SSLException("server certificate does not seem to have a CN: " + CN);
- if (!ignoreUntrustedCert && !CN.equalsIgnoreCase(hostname))
- throw new SSLException("connecting to host " + hostname + " but server certificate was issued for " + CN);
-
- SimpleDateFormat dateF = new SimpleDateFormat("MM-dd-yyyy-HH-mm-ss-z");
-
- // the following idiocy is a result of the brokenness of the GNU Classpath's SimpleDateFormat
- String s = tbs.getStartDate().getTime();
- s = s.substring(0, 4) + "-" + s.substring(4, 6) + "-" + s.substring(6, 8) + "-" +
- s.substring(8, 10) + "-" + s.substring(10, 12) + "-" +
- s.substring(12, 14) + "-" + s.substring(14);
-
- Date startDate = dateF.parse(s, new ParsePosition(0));
-
- s = tbs.getEndDate().getTime();
- s = s.substring(2, 4) + "-" + s.substring(4, 6) + "-" + s.substring(0, 2) + "-" + s.substring(6, 8) + "-" +
- s.substring(8, 10) + "-" + s.substring(10, 12) + "-" + s.substring(12);
- Date endDate = dateF.parse(s, new ParsePosition(0));
-
- Date now = new Date();
- if (!ignoreUntrustedCert && now.after(endDate))
- throw new SSLException("server certificate expired on " + endDate);
- if (!ignoreUntrustedCert && now.before(startDate))
- throw new SSLException("server certificate will not be valid until " + startDate);
-
- Log.info(this, "server cert (name, validity dates) checks out okay");
-
- } else {
-
- // don't check the top cert since some very old root certs lack a BasicConstraints field.
- if (certlen + 3 + i < numcertbytes) {
- // defend against Mike Benham's attack
- X509Extension basicConstraints = this_cert.getTBSCertificate().getExtensions().getExtension(X509Extensions.BasicConstraints);
- if (basicConstraints == null) throw new SSLException("certificate did not contain a basic constraints block");
- DERInputStream dis = new DERInputStream(new ByteArrayInputStream(basicConstraints.getValue().getOctets()));
- BasicConstraints bc = new BasicConstraints((DERSequence)dis.readObject());
- if (!bc.isCA()) throw new SSLException("non-CA certificate used for signing");
- }
-
- if (!isSignedBy(last_cert, this_cert.getSubjectPublicKeyInfo()))
- throw new SSLException("the server sent a broken chain of certificates");
- }
-
- last_cert = this_cert;
- i += certlen + 3;
- numcerts++;
- }
- if (Log.on) Log.info(this, " Certificate (" + numcerts + " certificates)");
-
- if (ignoreUntrustedCert) break;
-
- boolean good = false;
-
- // pass 1 -- only check CA's whose subject is a partial match
- String subject = this_cert.getSubject().toString();
- for(int i=0; i<trusted_CA_public_keys.length; i++) {
- if (subject.indexOf(trusted_CA_public_key_identifiers[i]) != -1 && isSignedBy(this_cert, trusted_CA_public_keys[i])) {
- if (Log.on) Log.info(this, "pass 1: server cert was signed by trusted CA " + i);
- good = true;
- break;
- }
- }
-
- // pass 2 -- try all certs
- if (!good)
- for(int i=0; i<trusted_CA_public_keys.length; i++) {
- if (isSignedBy(this_cert, trusted_CA_public_keys[i])) {
- if (Log.on) Log.info(this, "pass 2: server cert was signed by trusted CA " + i);
- good = true;
- break;
- }
- }
-
- if (!good) throw new SSLException("server cert was not signed by a trusted CA");
- break;
-
- case 12:
- if (Log.on) Log.info(this, "got ServerKeyExchange");
- serverKeyExchange = rec;
- break;
-
- case 13:
- if (Log.on) Log.info(this, "got Request for Client Certificates");
- cert_requested = true;
- break;
-
- case 14: if (Log.on) Log.info(this, " ServerHelloDone"); return;
- default: throw new SSLException("unknown handshake of type " + rec[0]);
- }
- }
- }
-
- public void readServerFinished() throws IOException {
-
- byte[] rec = readHandshake();
- if (rec[0] != 20) throw new SSLException("expecting server Finished message, but got message of type " + rec[0]);
-
- byte[] expectedFinished = concat(new byte[][] {
- md5(new byte[][] { master_secret, pad2,
- md5(new byte[][] { handshakes, new byte[] { (byte)0x53, (byte)0x52, (byte)0x56, (byte)0x52 },
- master_secret, pad1 }) }),
- sha(new byte[][] { master_secret, pad2_sha,
- sha(new byte[][] { handshakes, new byte[] { (byte)0x53, (byte)0x52, (byte)0x56, (byte)0x52 },
- master_secret, pad1_sha } ) } ) } );
-
- for(int i=0; i<expectedFinished.length; i++)
- if (expectedFinished[i] != rec[i + 4])
- throw new SSLException("server Finished message mismatch!");
-
- if (Log.on) Log.info(this, "server finished message checked out okay!");
- }
-
- }
-
- class SSLOutputStream extends OutputStream {
-
- /** the underlying outputstream */
- DataOutputStream raw;
-
- /** the sequence number for sending */
- public long seq_num = 0;
-
- /** the encryption engine for sending */
- RC4Engine rc4 = null;
-
- public SSLOutputStream(OutputStream raw) { this.raw = new DataOutputStream(raw); }
- public void flush() throws IOException { raw.flush(); }
- public void write(int b) throws IOException { write(new byte[] { (byte)b }, 0, 1); }
- public void write(byte[] b, int off, int len) throws IOException { write(b, off, len, (byte)23); }
- public void close() throws IOException {
- write(new byte[] { 0x1, 0x0 }, 0, 2, (byte)21);
- raw.close();
- }
-
- /** writes a single SSL Record */
- public void write(byte[] payload, int off, int len, byte type) throws IOException {
-
- // largest permissible frame is 2^14 octets
- if (len > 1 << 14) {
- write(payload, off, 1 << 14, type);
- write(payload, off + 1 << 14, len - 1 << 14, type);
- return;
- }
-
- raw.writeByte(type);
- raw.writeShort(0x0300);
-
- if (rc4 == null) {
- raw.writeShort(len);
- raw.write(payload, off, len);
-
- } else {
- byte[] MAC = computeMAC(type, payload, off, len, client_write_MAC_secret, seq_num);
- byte[] encryptedPayload = new byte[MAC.length + len];
- rc4.processBytes(payload, off, len, encryptedPayload, 0);
- rc4.processBytes(MAC, 0, MAC.length, encryptedPayload, len);
- raw.writeShort(encryptedPayload.length);
- raw.write(encryptedPayload);
-
- }
-
- seq_num++;
- }
-
- /** tacks a handshake header onto payload before sending it */
- public void writeHandshake(int type, byte[] payload) throws IOException {
- byte[] real_payload = new byte[payload.length + 4];
- System.arraycopy(payload, 0, real_payload, 4, payload.length);
- real_payload[0] = (byte)(type & 0xFF);
- intToBytes(payload.length, real_payload, 1, 3);
- handshakes = concat(new byte[][] { handshakes, real_payload });
- write(real_payload, 0, real_payload.length, (byte)22);
- }
-
- public void sendClientHandshakes() throws IOException {
-
- if (Log.on) Log.info(this, "shaking hands");
- if (cert_requested) {
- if (Log.on) Log.info(this, "telling the server we have no certificates");
- writeHandshake(11, new byte[] { 0x0, 0x0, 0x0 });
- }
-
- // generate the premaster secret
- byte[] pre_master_secret = new byte[48];
- pre_master_secret[0] = 0x03; // first two bytes of premaster secret are our version number
- pre_master_secret[1] = 0x00;
- getRandomBytes(pre_master_secret, 2, pre_master_secret.length - 2);
-
- // encrypt and send the pre_master_secret
- try {
- byte[] encrypted_pre_master_secret;
-
- SubjectPublicKeyInfo pki = server_cert.getSubjectPublicKeyInfo();
- RSAPublicKeyStructure rsa_pks = new RSAPublicKeyStructure((DERSequence)pki.getPublicKey());
- BigInteger modulus = rsa_pks.getModulus();
- BigInteger exponent = rsa_pks.getPublicExponent();
-
- if (serverKeyExchange != null) {
-
- AsymmetricBlockCipher rsa = new PKCS1(new RSAEngine());
- rsa.init(false, new RSAKeyParameters(false, modulus, exponent));
-
- int modulus_size = ((serverKeyExchange[4] & 0xff) << 8) | (serverKeyExchange[5] & 0xff);
- byte[] b_modulus = new byte[modulus_size];
- System.arraycopy(serverKeyExchange, 6, b_modulus, 0, modulus_size);
- modulus = new BigInteger(1, b_modulus);
-
- int exponent_size = ((serverKeyExchange[6 + modulus_size] & 0xff) << 8) | (serverKeyExchange[7 + modulus_size] & 0xff);
- byte[] b_exponent = new byte[exponent_size];
- System.arraycopy(serverKeyExchange, 8 + modulus_size, b_exponent, 0, exponent_size);
- exponent = new BigInteger(1, b_exponent);
-
- byte[] server_params = new byte[modulus_size + exponent_size + 4];
- System.arraycopy(serverKeyExchange, 4, server_params, 0, server_params.length);
-
- byte[] expectedSignature = concat(new byte[][] { md5(new byte[][] { client_random, server_random, server_params } ),
- sha(new byte[][] { client_random, server_random, server_params } ) } );
-
- byte[] recievedSignature = rsa.processBlock(serverKeyExchange, 6 + server_params.length,
- serverKeyExchange.length - 6 - server_params.length);
-
- for(int i=0; i<expectedSignature.length; i++)
- if (expectedSignature[i] != recievedSignature[i])
- throw new SSLException("ServerKeyExchange message had invalid signature " + i);
-
- if (Log.on) Log.info(this, "ServerKeyExchange successfully processed");
- }
-
- AsymmetricBlockCipher rsa = new PKCS1(new RSAEngine());
- rsa.init(true, new RSAKeyParameters(false, modulus, exponent));
-
- encrypted_pre_master_secret = rsa.processBlock(pre_master_secret, 0, pre_master_secret.length);
- writeHandshake(16, encrypted_pre_master_secret);
-
- } catch (Exception e) {
- SSLException t = new SSLException("exception encrypting premaster secret");
- t.fillInStackTrace();
- throw t;
- }
-
- // ChangeCipherSpec
- if (Log.on) Log.info(this, "Handshake complete; sending ChangeCipherSpec");
- write(new byte[] { 0x01 }, 0, 1, (byte)20);
- seq_num = 0;
-
- // compute master_secret
- master_secret = concat(new byte[][] {
- md5(new byte[][] { pre_master_secret,
- sha(new byte[][] { new byte[] { 0x41 }, pre_master_secret, client_random, server_random })}),
- md5(new byte[][] { pre_master_secret,
- sha(new byte[][] { new byte[] { 0x42, 0x42 }, pre_master_secret, client_random, server_random })}),
- md5(new byte[][] { pre_master_secret,
- sha(new byte[][] { new byte[] { 0x43, 0x43, 0x43 }, pre_master_secret, client_random, server_random })})
- } );
-
- // construct the key material
- byte[] key_material = new byte[] { };
- for(int i=0; key_material.length < 72; i++) {
- byte[] crap = new byte[i + 1];
- for(int j=0; j<crap.length; j++) crap[j] = (byte)(((byte)0x41) + ((byte)i));
- key_material = concat(new byte[][] { key_material,
- md5(new byte[][] { master_secret,
- sha(new byte[][] { crap, master_secret, server_random, client_random }) }) });
- }
-
- client_write_key = new byte[export ? 5 : 16];
- server_write_key = new byte[export ? 5 : 16];
-
- System.arraycopy(key_material, 0, client_write_MAC_secret, 0, 16);
- System.arraycopy(key_material, 16, server_write_MAC_secret, 0, 16);
- System.arraycopy(key_material, 32, client_write_key, 0, export ? 5 : 16);
- System.arraycopy(key_material, export ? 37 : 48, server_write_key, 0, export ? 5 : 16);
-
- if (export) {
- // see SSLv3 spec, 6.2.2 for explanation
- byte[] client_untrimmed = md5(new byte[][] { concat(new byte[][] { client_write_key, client_random, server_random } ) });
- byte[] server_untrimmed = md5(new byte[][] { concat(new byte[][] { server_write_key, server_random, client_random } ) });
- client_write_key = new byte[16];
- server_write_key = new byte[16];
- System.arraycopy(client_untrimmed, 0, client_write_key, 0, 16);
- System.arraycopy(server_untrimmed, 0, server_write_key, 0, 16);
- }
-
- rc4 = new RC4Engine();
- rc4.init(true, new KeyParameter(client_write_key));
- is.rc4 = new RC4Engine();
- is.rc4.init(false, new KeyParameter(server_write_key));
-
- // send Finished
- writeHandshake(20, concat(new byte[][] {
- md5(new byte[][] { master_secret, pad2,
- md5(new byte[][] { handshakes, new byte[] { (byte)0x43, (byte)0x4C, (byte)0x4E, (byte)0x54 },
- master_secret, pad1 }) }),
- sha(new byte[][] { master_secret, pad2_sha,
- sha(new byte[][] { handshakes, new byte[] { (byte)0x43, (byte)0x4C, (byte)0x4E, (byte)0x54 },
- master_secret, pad1_sha } ) })
- }));
- raw.flush();
- if (Log.on) Log.info(this, "wrote Finished message");
-
- }
-
- public void writeClientHello() throws IOException {
-
- if (Log.on) Log.info(this, "sending ClientHello");
- int unixtime = (int)(System.currentTimeMillis() / (long)1000);
-
- byte[] out = new byte[] {
- 0x03, 0x00, // client version (SSLv3.0)
-
- // space for random bytes
- 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
- 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
- 0x0, 0x0, 0x0, 0x0,
-
- 0x0, // empty vector for sessionid
- 0x0, 0x4, 0x0, 0x4, 0x0, 0x3, // we support two ciphersuites: SSL_RSA_WITH_RC4_128_MD5 and SSL_RSA_EXPORT_WITH_RC4_40_MD5
- 0x1, 0x0 // we only support one compression method: none
- };
-
- // don't need to use secure random here since it's sent in the clear
- Random rand = new Random(System.currentTimeMillis());
- rand.nextBytes(client_random);
- intToBytes(unixtime, client_random, 0, 4);
- System.arraycopy(client_random, 0, out, 2, client_random.length);
-
- writeHandshake(1, out);
- flush();
- }
- }
-
- // Static Helpers ////////////////////////////////////////////////////////////////////
-
- /** copy the least significant num bytes of val into byte array b, startint at offset */
- public static void intToBytes(long val, byte[] b, int offset, int num) {
- for(int i=0; i<num; i++)
- b[offset + num - i - 1] = (byte)((val & (0xFFL << (i * 8))) >> (i * 8));
- }
-
- /** fills b with random bytes */
- public static synchronized void getRandomBytes(byte[] b, int offset, int len) {
- MD5Digest md5 = new MD5Digest();
- byte[] b2 = new byte[16];
- while(len > 0) {
- md5.reset();
- md5.update(randpool, 0, randpool.length);
- intToBytes(randcnt++, b2, 0, 8);
- md5.update(b2, 0, 8);
- md5.doFinal(b2, 0);
- int n = len < 16 ? len : 16;
- System.arraycopy(b2, 0, b, offset, n);
- len -= n;
- offset += n;
- }
- }
-
- public static byte[] computeMAC(byte type, byte[] payload, int off, int len, byte[] MAC_secret, long seq_num) {
- byte[] MAC = new byte[16];
- MD5Digest md5 = new MD5Digest();
- md5.update(MAC_secret, 0, MAC_secret.length);
- md5.update(pad1, 0, pad1.length);
-
- byte[] b = new byte[11];
- intToBytes(seq_num, b, 0, 8);
- b[8] = type;
- intToBytes(len, b, 9, 2);
- md5.update(b, 0, b.length);
-
- md5.update(payload, off, len);
- md5.doFinal(MAC, 0);
- md5.reset();
- md5.update(MAC_secret, 0, MAC_secret.length);
- md5.update(pad2, 0, pad2.length);
- md5.update(MAC, 0, MAC.length);
- md5.doFinal(MAC, 0);
-
- return MAC;
- }
-
- public static byte[] concat(byte[][] inputs) {
- int total = 0;
- for(int i=0; i<inputs.length; i++) total += inputs[i].length;
- byte[] ret = new byte[total];
- int pos = 0;
- for(int i=0; i<inputs.length; i++) {
- System.arraycopy(inputs[i], 0, ret, pos, inputs[i].length);
- pos += inputs[i].length;
- }
- return ret;
- }
-
- SHA1Digest master_sha1 = new SHA1Digest();
- public byte[] sha(byte[][] inputs) {
- master_sha1.reset();
- for(int i=0; i<inputs.length; i++) master_sha1.update(inputs[i], 0, inputs[i].length);
- byte[] ret = new byte[master_sha1.getDigestSize()];
- master_sha1.doFinal(ret, 0);
- return ret;
- }
-
- MD5Digest master_md5 = new MD5Digest();
- public byte[] md5(byte[][] inputs) {
- master_md5.reset();
- for(int i=0; i<inputs.length; i++) master_md5.update(inputs[i], 0, inputs[i].length);
- byte[] ret = new byte[master_md5.getDigestSize()];
- master_md5.doFinal(ret, 0);
- return ret;
- }
-
- // FEATURE: improve error reporting in here
- /** returns true iff certificate "signee" is signed by public key "signer" */
- public static boolean isSignedBy(X509CertificateStructure signee, SubjectPublicKeyInfo signer) throws SSLException {
-
- Digest hash = null;
-
- String signature_algorithm_oid = signee.getSignatureAlgorithm().getObjectId().getId();
- if (signature_algorithm_oid.equals("1.2.840.113549.1.1.4")) hash = new MD5Digest();
- else if (signature_algorithm_oid.equals("1.2.840.113549.1.1.2")) hash = new MD2Digest();
- else if (signature_algorithm_oid.equals("1.2.840.113549.1.1.5")) hash = new SHA1Digest();
- else throw new SSLException("unsupported signing algorithm: " + signature_algorithm_oid);
-
- try {
- // decrypt the signature using the signer's public key
- byte[] ED = signee.getSignature().getBytes();
- SubjectPublicKeyInfo pki = signer;
- RSAPublicKeyStructure rsa_pks = new RSAPublicKeyStructure((DERSequence)pki.getPublicKey());
- BigInteger modulus = rsa_pks.getModulus();
- BigInteger exponent = rsa_pks.getPublicExponent();
- AsymmetricBlockCipher rsa = new PKCS1(new RSAEngine());
- rsa.init(false, new RSAKeyParameters(false, modulus, exponent));
-
- // Decode the embedded octet string
- byte[] D = rsa.processBlock(ED, 0, ED.length);
- BERInputStream beris = new BERInputStream(new ByteArrayInputStream(D));
- DERObject derob = beris.readObject();
- DERSequence dercs = (DERSequence)derob;
- DEROctetString deros = (DEROctetString)dercs.getObjectAt(1);
- byte[] MD = deros.getOctets();
-
- // generate our own hash
- ByteArrayOutputStream baos = new ByteArrayOutputStream();
- DEROutputStream dos = new DEROutputStream(baos);
- dos.writeObject(signee.getTBSCertificate());
- dos.flush();
- byte[] b = baos.toByteArray();
- hash.update(b, 0, b.length);
- byte[] md_out = new byte[MD.length];
- hash.doFinal(md_out, 0);
-
- // compare our hash to the signed hash
- for(int j=0; j<MD.length; j++) if (md_out[j] != MD[j]) return false;
- return true;
-
- } catch (Exception e) {
- return false;
-
- }
- }
-
- // Embedded Trusted Public Keys //////////////////////////////////////////////
-
- /** base64-encoded sequence of DER-encoded PKCS7 certs for all the "trusted root CA's" included with IE5.5 */
- static String[] base64_encoded_trusted_CA_public_keys = new String[] {
-
- "CN=ABA.ECOM Root CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsdMR4HlVQwcITMsFQgDiDYNGPe" +
- "STurYG0w1ZvT7BzkNnAYohqO+8zNCizLBVllOEZgUA2kRJgNhUCqUlhpTtY1b/cGyjoRnS" +
- "eL5oKkReL8/MGF5HvDqxRj0e8LksNF+MfEwIKZ1AVes8fYPetfD3ioMOoUy0OqWzX1oil+" +
- "wZm8EFaP3mt6mRlCzkeEgkGiUZOuuVnDkKis9CsvAc1V/7a+1oVns5LHI4sO6TqdN7dzzr" +
- "cQOpOEoWbIkqytozE3nCVYztnLvyy1sQ+C5hNcYpTCrQKmPRZVm0+M359ACEtldChZ0yqP" +
- "kqVPv/eEG8vXEo9LuQvP+WNATjRZ6hRihAgQIDAQAB",
-
- "O=ViaCode",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCws2enlrV2g+kWA9kaoHbVdOecBdJRP9" +
- "tPGaGoOU7LJH1hxB5qIK4Pgd7quDn9Gx9rNkDtTSEl8qPZoVHYbMAblvjUQpTUp84bj9NU" +
- "JqKE7zKFr0o/8TI2rz3mOifrA8IlfvRhK62KGkvmmzZo1C/l0oiU3Baq2sIVTGzD4RmRyQ" +
- "IBAw==",
-
- "CN=Xcert EZ by DST",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArVQY3rS/963odKrti3yPwtR1Gt" +
- "WEubZi/Inv5JdhkvsduOFaRzSengYi+9PqOMu4iwf3GqAXdwdaMBzUKTgg1ydA2FCTQ7/S" +
- "GKIpdgVyqmu2aZireR4cZfVqi/zFFqqictpg7U5uGSV6Ch0w41CbQjxE66GwIB7bAn7+PR" +
- "+/0ACK20B2philFadXtlLCAReYd4+KgcYatGoq5q+p1gCsz9gVSXzbG6H+gfqH+dOQwQLA" +
- "+dBC6ZFoJV/Gv4c56ZUAYCi/gyzA51621zYW52CHdujnJ7IlDYt65aod5VnNzgsOb8bInO" +
- "MQ2YU507eb+sa6fHTSXXVWq3SkolG/UnzucQIDAQAB",
-
- "CN=Certiposte Classe A Personne",
- "MIIBITANBgkqhkiG9w0BAQEFAAOCAQ4AMIIBCQKCAQAox3xaJSN48rMAR0Biy2+MQlCfnl" +
- "7UXA5lC1hWlSvjRtBhNuAtRpuCy5Hu0pV8mpKvBAp+pp/g17HDRfmYQRs5redW19m2f867" +
- "OS4sO8+2cwODzhNdMmpjottb+Esz6FBsy6gX7J6TuWwGSyYLdx6e+eWMiTfS0bv9qYwrLJ" +
- "wQMdhLjM23cX44LCnjF7JP6FK245I80v3hAtphEHTSGvPI0dFmB1/EhGNpva5s3GUjHLf7" +
- "98YTLoN+P6nlCyBtAQo34lzait4icOkN4HQ9xOtxm2Eq4g0Ui0xGN0wm0mjWVsNXqqJgN6" +
- "9fnaCzgILmQypMgAAJUNmoanNtA/5ec5LlAgMBAAE=",
-
- "CN=Certiposte Serveur",
- "MIIBITANBgkqhkiG9w0BAQEFAAOCAQ4AMIIBCQKCAQA+p3gzOJHiylaV0ZFGsiPcpVZ/D8" +
- "eXuOKekS4oFi6O80e2XIPE8Ob+ZxqTZH1ACdgdaADs1BHu2GOJAyPphF/HVQ5K4nK7KcFV" +
- "ZHao45LN9/ZuQlYYUjOJ+YAUqBlRfsd3v3qoMcB9F25DTtVmyQU+S+Ll4lUbdKpRHarMmB" +
- "F3pOvbKg4nx9XNSOzcfk5J50HNmQvRS14YGw06CpstmznHQAzQdgd8fI9+XHKOh9W+8qa5" +
- "3r/dnxJ5R3zFyZdARgCS0xNak0+dfthfTMFdSEnZLZg8/MynhyHwPo5yfVk4NhYaDEi+of" +
- "LVPqgWDCBZz84PM4M9rav1/93X/WkIiADvAgMBAAE=",
-
- "OU=Certisign - Autoridade Certificadora - AC2",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5MMyl65DWVpRnM4mDbUa+cJeTF04KJ3" +
- "DOycXyxdIt0RGcdzJsdNOSb/rp1bhhmqpMEz41OvDuCTbZ0Zcxx16sQUm/SG1OIFPJe2qj" +
- "ljFrsm6ozy9yTAatMs9aCPN9EJyqu7pz+fPwuCRvqGW2Iv4FWxBVRMIDHa3RIswIbfuMyw" +
- "IDAQAB",
-
- "OU=Certisign - Autoridade Certificadora - AC4",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDsg9TMg5A/X+y+wenQx1hGWR/xk0qyFx" +
- "MLzymZqwRFM+PRXr68jiV3Yt2bkpsxCkBFedXys91suUD9mH9Aoi3pspO9S9XB3unR+nH3" +
- "P0G89BSvzWvIOUqdYGW0hNBqQeljrptp6rlGHNsYCDtiTN5B156GfxNyEdTc6t5gpbvdGw" +
- "IDAQAB",
-
- "OU=Certisign Autoridade Certificadora AC1S",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwwJXro8VB+JtvcWOOkRFX+QPHaJoanG" +
- "Hwww8Ml2KIfiYBNX398W9PF5WqfvK7vO/idnNhlTZRgz6E6D+6VzY3lBNskmQflA3rVC9R" +
- "WuUoXvCShufkbSF6XzcL51u9LQKogfk/yxTIvKTF49HLN9yr5Yeq8guYLnrPzB7Cf+j9AQ" +
- "IDAQAB",
-
- "OU=Certisign Autoridade Certificadora AC3S",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOZE7Wz658mCeY7yjvujTDNRqd0mYecf" +
- "Hkli0nFzmQRY8t7+bVR6nhg4F8Pihx+oC7XfhDaxkQwZhvFZ4trklkROyEGmlZFleyPZLY" +
- "Zku/ma1DGMc4yYuOLAQus0trk/adH4SyzeYAwr42pbxZtZ+LGSD/5agopFW2irayxddE4w" +
- "IDAQAB",
-
- "O=Certplus, CN=Class 1 Primary CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw2spyC7HrnxSBemTiVYKWnnJzN" +
- "wl74eKLQXYgRcEGzpF+HkODUnUgUHIq0X7dcgV8uLQvNlhbISkExmn2fnySdxMD8Z9V7QT" +
- "3B4JcSk2nYBY9BvYiRTr09KTSyrxd+dqZb0Z5ar9DEpj4cKZtA8EtlobNjw3PL/F5V7xX1" +
- "cOH8f9LOfkb2qbYpY5EZtm8Cy2UtzhJ//bbf7rq2MUHWOIY+IWDPkgVA+b3RVqdoNPvSeL" +
- "U6Y30ofyR1BSO2bp0XgaG7I7afBZPDhb0SpMM14Oylal7S1bgoNN1jhOila2ai8kaxIwpi" +
- "rerwy7qkQSHBPFZQ/j/dgaMUvkPwx8RegWMwIDAQAB",
-
- "O=Certplus, CN=Class 2 Primary CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3FCW0BL4NdIIeHq2UnD9b+7PuR" +
- "HLXXfh7Ol+BI3WzG9zQ1dgrDMKROwDXxyAJJHlqJFWEoL34Cv0265hLokQjWtsurMCvdU2" +
- "xUg3I+LwWjdSMxcS4tFgTb4vQRHj9hclDIuRwBuZe5lWDa/u0rxHV+N5SXs0iSckhN6x7O" +
- "lYTv5O31q+Qa2sCMUYDu/SU+5s0J0SARON3IBi95WpRIhKcU5gVZ7bIxl5VgcMP2MLXLDi" +
- "vn4V/JQzWEE4dMThj4vfJqwftYs7t0NZa7Akpm2Qi8Ry6l0zmLfL3l5775TxGz7KySHBxZ" +
- "gCqqL2W3eb9X6WVTQcZ2nA8ULjR6z8KBxmVQIDAQAB",
-
- "O=Certplus, CN=Class 3 Primary CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt5QwbtBM2X5eYOVvuybKUm9rbI" +
- "WZpQvvABpvG01YtRgH+t17+MssUt38nLiNUum5sgt89Y9bmUgJWN7NSJWGJYkFNCcwC1e2" +
- "DHdjKctsqj65mVESDZhwdkdM+UmWIgj5a+qqADajFaccHp+Mylp5eyHaiR9jfnmSUAkEKK" +
- "3O420ESUqZsT9FCXhYIO+N/oDIBO0pLKBYjYQCJZc/oBPXe4sj45+4x7hCQDgbkkq9SpRV" +
- "x1YVDYF3zJ+iN4krW4UNi3f4xIv7EMuUx+kaVhKXZhTEu9d9bQIbv3FiJhjpSYr6o97hhK" +
- "2AykriIoxqCGGDsiLHCYg4Vl3RMavwCZ8TWQIDAQAB",
-
- "CN=Autoridad Certificadora de la Asociacion Nacional del Notariado Mexicano",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7tlrVYRxJvaOrUG71tLeY+ryP2" +
- "XyOxPBrlEm9L94j8ZMSay/Qd71KMco55/XgOXU7iMrk5U9yY9q9coA6RDHiIIabqNf8DRS" +
- "ISVoKPiV8ICVoiyxP2r2KNbihP0WZ5wluXXb5cZZA7SrQgeI1VxIRaIJA8muZ5KoolPHyq" +
- "t+mhKVWgVXjRBklicRsOYyMFvNPQygGxMtuxqr3TnOkmuiBNQTX213Z1Q5qHtpisZfeMoH" +
- "GGlu+cDT0IqOrx4waO742KhmDIR9I2qJPGJNFHSs25uc/LCD/gcw8factEjI5jpCJQko91" +
- "bCsdejmHcCh+qKwV3axIonB4VeSExVKEDtCQIDAQAB",
-
- "O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhA" +
- "wL0TPZ2RHP7gJYHyX3KqhEBarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lw" +
- "dd8KkMaOIG+YD/isI19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpw" +
- "IDAQAB",
-
- "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhA" +
- "wL0TPZ2RHP7gJYHyX3KqhEBarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lw" +
- "dd8KkMaOIG+YD/isI19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpw" +
- "IDAQAB",
-
- "C=FR, O=Certplus, CN=Class 3P Primary CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqzf/62CbQXhp9UlYsN4fcWmmK+" +
- "OuUMapvJPpIL7kxBOCVu/wQzIJypt1A498T+HgT3aeC61kehQ6mp2/LxYLZRyp7py84xpl" +
- "y0+F6pJWdWbWVUDv+8zWOD+rHO9CjRmJ9reVhsKnHen3KfEq2WV5/Cv1jsoad36e6Kz5Zr" +
- "9F++gTnV+2c+V9e477EnRdHwZehRumXhhEALq8027RUg4GrevutbTBu7zrOA9IIpHHb9K4" +
- "cju6f8CNbLe8R3MhKoX/rNYoohnVl2o6uaxtRezmTcPbqF3FXYKYrEpaquYrCAwQdLxi9j" +
- "pJBGbYURwmpth1n5y/rmBRPVy8ok97iWfNUwIDAQAB",
-
- "C=FR, O=Certplus, CN=Class 3TS Primary CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWWaI0MAPPklAUOYW0Y0N2c39F" +
- "tXjqPezYwvQbMVPeWYi/LMXKfHrzXHs6dPxxApV+kDiYNyBnZSwXACN0Dt8M6LsbGJrAKo" +
- "W93c1UNFBtwotulRG2ru83tIxZ0Rro2mcpPAJUKRqD5G4mhMgUCwQtN6vntH0kdQDKQSps" +
- "rkEtDAfDo8AanKApbeglrF+xm6PJzYD3QfmBiulFAyB1IQEUpL7FhVLNSeS5R7BdJy3wbw" +
- "jcsInuTutEStgvEbYWrxs/gWMTZCJLqQv7V+YW7CWQxUebRMiCgezBvfhIsjyL6vB/KRst" +
- "qNyoxffCg8fIlsBlm9Ps7FgtNqyaxoVe7FrwIDAQAB",
-
- "C=US, O=RSA Data Security, Inc., OU=Commercial Certification Authority",
- "MIGbMA0GCSqGSIb3DQEBAQUAA4GJADCBhQJ+AKT7gWJ7zhAn3ej3vmxuxnCZ27jVBQNpKI" +
- "Kccn+WP47srCmSP4oU+EJ2vr1dA7mQ1NC8BrJRM1/Ewr+2i4+ZtmIiYN3b3yCCtMqiLy1Q" +
- "7ZQy3uBVjdRo4uBM0s0FFi6VZlxhUjgeUaiCocTvJekK5osrjjFm2fjZ/b07adnrAgMBAA" +
- "E=",
-
- "C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 1",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQ3ZsMoBdERA+vIUBzZ1bwPmloEbrZN/" +
- "KBrsMkrGmhzfymGFVW/4ufMsHb53gsOdtggUGl79PNgI0YPOJSDAuf92Se5aDwuGFi9L/g" +
- "o9pYK/0VBGu9Op58nfI92OSVw+xOwvFlqwxL7EeCW+LhUHXY9mG0GFztM6BLHoP7T4S8eQ" +
- "IDAQAB",
-
- "C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust Center, CN=Deutsche Telekom Root CA 2",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqwujNeCLKRSxFIWvPBDkOW81XU" +
- "qu3ephjZVJ9G9koxpgZqSpQCKE2dSl5XiTDmgBrblNXDrO07ioQkDfz6O6gllqkhusHJra" +
- "CCslJ/lpI0fx4Ossepv1EwLQfjR8wp48AFmr9doM9TI8K6xQ2tbD3oOUyqgMmTIOCEhWW2" +
- "r72uFYWAFJX3JBPBUGAY5draq4k7TNnuun6GotUjTbOu9cdVHa2/Mx+e5xmDLEVBVEDPmb" +
- "Ve2t3xgIoKOGiknuUwWPGUzV3lh5m9JqHEKrxdWnz2gPluThYZh2YciRfNY+AOKRUIfhnQ" +
- "rmrZfSHcY6fcu82gM01Y5bAfVqB7cWtm5KfwIDAQAB",
-
- "C=US, O=Digital Signature Trust Co., OU=DST (ANX Network) CA",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC0SBGAWKDVpZkP9jcsRLZu0XzzKmueEb" +
- "aIIwRccSWeahJ3EW6/aDllqPay9qIYsokVoGe3eowiSGv2hDQftsr3G3LL8ltI04ceInYT" +
- "BLSsbJZ/5w4IyTJRMC3VgOghZ7rzXggkLAdZnZAa7kbJtaQelrRBkdR/0o04JrBvQ24JfQ" +
- "IBAw==",
-
- "OU=National Retail Federation, CN=DST (NRF) RootCA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2aybd/pQ08zcuUCsuXJqAIcj/A" +
- "+WIdAmr+TitV/606Z9ITAuzBeCj5h0/Gekpt+Il6JCKfWn2xGT+14jMMKqvCLnQRvl7SXe" +
- "yD/b3ldFeEBGg7LVGj3fD0Vt1WMCddgvxm6rlZF0Nw3LTQlc0dRbOtrdDshrmdjVOczfhV" +
- "XEklMCo+H3gMlwo9rcM8R/okcIHDWWH6EDHDCD9MTM/5jDsEZEosC/rdvSgfZMmCynXiTz" +
- "hspj1bp98JrAStAbWO7sqWfPaQJsIsBgLCzRyCDqyC373Zy7y1FM3OdXBDtUmxGlMnTsdA" +
- "HzkBVbL3wsk2W5Zme0gYg15Z6RGH+BqEHIywIDAQAB",
-
- "OU=United Parcel Service, CN=DST (UPS) RootCA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7xfsrynm2SsnwNt7JJ9m9ASjwq" +
- "0KyrDNhCuqN/OAoWDvQo/lXXdfV0JU3SvbYbJxXpN7b1/rJCvnpPLr8XOzC431Wdcy36yQ" +
- "jk4xuiVNtgym8eWvDOHlb1IDFcHfvn5KpqYYRnA/76dNqNz1dNlhekA8oZQo6sKUiMs3FQ" +
- "UZPJViuhwt+yiM0ciekjxbEVQ7eNlHO5stSuY+e2vf9PYFzyj2upg2AJ48N4UKnN63pIXF" +
- "Y/23YhRtFx7MioCFQjIRsCHinXfJgBZBnuvlFIl/t8O8T8Gfh5uW7GP2+ZBWDpWjIwqMZN" +
- "qbuxx3sExd5sjo9X15LVckP8zjPSyYzxKfFwIDAQAB",
-
- "CN=Autoridad Certificadora del Colegio Nacional de Correduria Publica Mexicana",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmO0dhYH7/jd0viOAJ18bQX6856" +
- "WK2HNdlkjqq1iqfaUdz/4gCtnydQnts9X9+JMqGaleqLEU8tZChkFBXk/FVqeaokJvLihI" +
- "6i6r2cHZmvClnotdEWeaNzdTYGbxIv93d0fp3dwYRu4u3+LBluDqWN6H65OIaZmwPm52KU" +
- "Bhwyhmc3+sMXb0OM3WMo9zMhAVNNJ8RND8eQwAnX0P4+P3RPWedEknrRvXMshTrm8qsNe1" +
- "LRgsbjs6TUzb9Wi1L7AMkPk93HU2msLgv7uWiMJr7hjXTlA/V4tnaKS+AzNdWRI0if52yN" +
- "kVdgFUZP2s41DvEMjQ7l/sHd9PBZg8tBReAQIDAQAB",
-
- "CN=DST RootCA X1",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0sYmtuelPcHEaNVQb1PFb0kTCb" +
- "ivLEiNFGqjF19a+dMudS/YKGLRky/8TdSrh+UIx5nnkj91vesltBXBmxk90kSN13QgbTcC" +
- "j2mTW4rEGZ30sg78Fmy5sQWSg9GFLGCUPkVVoNmrCCHmYOg7dPKZUFFo0AMtsYC+o9hSsE" +
- "TNQ0pwjliFleFOLNYtQW/WhOfImETKR9ssJKVpJs9ruCdiw/TJepIj7RNngq5FLkXlfnI/" +
- "hZ2UYhDmPJGhrXcA4BXs84SAcnqObmCXxyRZEDSDW+GlpGm2VzUceFnG0y86c2fulMoEEw" +
- "ViBnAjs/R87kXZZAtbSaqkQ84mxEQSbLjdeQIDAQAB",
-
- "OU=DSTCA X2, CN=DST RootCA X2",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3HXwjMB1lprAYh8m98ThmurgVn" +
- "Nbmc0BRKgIttWn2hoEGDmSSnijgcL1d3pQtHD/mqvGx8pug09CmPsmC9rcbdapmVVSZ+ko" +
- "A5Lc5bAFmg8V+WtZclby+jn8qmjuDx8Qgy/8nfoXlt2C4+ZFfcBLgEQf7SzghP2RXJJUaS" +
- "XlYmnc5e4AUr0zC611AoWnZFAtxRkZMMAm28nT/S6ZrVm1C03UQa6FSENZ3Leo4qLew4/X" +
- "uKFipmhQUuTPMaeUhdqfRjIXVuXy62Y9Ev9D25jvd8/LgY00scZQSibR5D5BUK9sriI0Lt" +
- "VrboO6ebh2ZUjaCSlkYyK5+0d2hYyGRMsJ2wIDAQAB",
-
- "C=US, O=Digital Signature Trust Co., OU=DST-Entrust GTI CA",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC2HfdLjQ8T4xL1Cf4GMg6vTEH1fdRHPS" +
- "oK34MF3t595gMW9lE6y0caSq1+xP0dtL50injdC4OOtIQTxPv4bSmuoeEPD0PjtV5gafqD" +
- "lPx55tx27dFEK479Erv+F3cXDIntp+9RfcTtOMM7o3r74k2gYLXy/RNl08bsP741nD0i7w" +
- "IBAw==",
-
- "C=US, O=Digital Signature Trust Co., OU=DSTCA E1",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCgbIGpzzQeJN3+hijM3oMv+V7UQtLodG" +
- "BmE5gGHKlREmlvMVW5SXIACH7TpWJENySZj9mDSI+ZbZUTu0M7LklOiDfBu1h//uG9+Lth" +
- "zfNHwJmm8fOR6Hh8AMthyUQncWlVSn5JTe2io74CTADKAqjuAQIxZA9SLRN0dja1erQtcQ" +
- "IBAw==",
-
- "C=US, O=Digital Signature Trust Co., OU=DSTCA E2",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC/k48Xku8zExjrEH9OFr//Bo8qhbxe+S" +
- "SmJIi2A7fBw18DW9Fvrn5C6mYjuGODVvsoLeE4i7TuqAHhzhy2iCoiRoX7n6dwqUcUP87e" +
- "ZfCocfdPJmyMvMa1795JJ/9IKn3oTQPMx7JSxhcxEzu1TdvIxPbDDyQq2gyd55FbgM2UnQ" +
- "IBAw==",
-
- "CN=Entrust.net Certification Authority (2048)",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQqK0vRvw" +
- "tKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQesYGpjX24zGtL" +
- "A/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuXMlBvPci6Zgzj/L24Sc" +
- "F2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVTXTzWnLLPKQP5L6RQstRIzgUy" +
- "VYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/HoZdenoVve8AjhUiVBcAkCaTvA5JaJ" +
- "G/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH4QIDAQAB",
-
- "CN=Entrust.net Client Certification Authority",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDIOpleMRffrCdvkHvkGf9FozTC28GoT/" +
- "Bo6oT9n3V5z8GKUZSvx1cDR2SerYIbWtp/N3hHuzeYEpbOxhN979IMMFGpOZ5V+Pux5zDe" +
- "g7K6PvHViTs7hbqqdCz+PzFur5GVbgbUB01LLFZHGARS2g4Qk79jkJvh34zmAqTmT173iw" +
- "IBAw==",
-
- "CN=Entrust.net Secure Server Certification Authority",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO" +
- "2f55M28Qpku0f1BBc/I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc" +
- "1lB5gXpa0zf3wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQw" +
- "IBAw==",
-
- "C=US, O=Equifax, OU=Equifax Secure Certificate Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBXbFYZwhi7qCaLR8IbZEUaJgKHv7aBG" +
- "8ThGIhw9F8zp8F4LgB8E407OKKlQRkrPFrU18Fs8tngL9CAo7+3QEJ7OEAFE/8+/AM3UO6" +
- "WyvhH4BwmRVXkxbxD5dqt8JoIxzMTVkwrFEeO68r1u5jRXvF2V9Q0uNQDzqI578U/eDHuQ" +
- "IDAQAB",
-
- "C=US, O=Equifax Secure Inc., CN=Equifax Secure eBusiness CA-1",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOLxm8F7d33pOpX1oNF080GgyY9CLZWd" +
- "TEaEbwtDXFhQMgxq9FpSFRRUHrFlg2Mm/iUGJk+f1RnKok2fSdgyqHCiHTEjg0bI0Ablqg" +
- "2ULuGiGV+VJMVVrFDzhPRvpt+C411h186+LwsHWAyKkTrL6I7zpuq18qOGICsBJ7/o+mAw" +
- "IDAQAB",
-
- "CN=Baltimore EZ by DST",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMyzPUN5uEf5FbduJrFMkph57c" +
- "Vw8zrp1d0D9Co/YIyW5UcWAvc2svGeJoj1nkJlng+uf+PMsW4h9fGIInTWH7J3BDkyuke1" +
- "NcATXQFyowVDzE7aJpqHqGFj9GanwxVG6tHR6jDDu3Fqm8FDhsE5H8ZWYAIb/Ig6oJm7jN" +
- "d4YdBeV4+RO4CLbv/JZYEKObuQEyA1SD+l4b8twXGDhSDtIIfLtv4ZjATd7Sld3woSzolW" +
- "8h9aGTFYtv1jNurJI96nkZcnZXKZbMd6RMRfvpsfHsqeWBymqiNq4wYbkiTYVyIJUBWQRv" +
- "CDXraATBKBPWZvBFU6iGvQ71aHUKC51lUbnQIDAQAB",
-
- "C=US, O=Equifax Secure, OU=Equifax Secure eBusiness CA-2",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkOTmTHlIGGyg2+LKjKcXtjrIRvf7r57" +
- "R0wo//BefZnQa/Esg/DvLW0SSyEd7RcwmK1LEsmAkNHlBGsoOmRY1iaLuFGyBwMqpAzaaW" +
- "X8RxNz8E87dBJDkHGh4uYVigEgvlpd/Fq+o3ccwcyDc6uZdSp6zFaiSUTpx7z8Bq1t8hvQ" +
- "IDAQAB",
-
- "C=US, O=Equifax Secure Inc., CN=Equifax Secure Global eBusiness CA-1",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC65xeQAmWxNFU8ScJR1d+n0TeP0eeBc0" +
- "FSYJudoRcmeK3HsegmlDK13jONOi/b8pp6WnOYo1zp+4pzG1znw7+AbM2p9NYrwPf5mapj" +
- "orFHAg/U5FE6EjxsilpUhHDbwcWQz3JFy6hZwM0znT+jluuFMyEcPh4+YG52nGeFxcjDYQ" +
- "IDAQAB",
-
- "O=EUnet International, CN=EUnet International Root CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeQTvZQUmLKJxZFPdQaCh7TQhcZ/+FHg" +
- "umzzoyArB8fEqftokCIQxKmYvLZFF+eFq2XqlTt+/vx9+lIVmXTuIH5S18GdUqysgz05YQ" +
- "Lt2gAJ/9yuhhqVPKth0YPpwR4GPnKmdbyESV8BNVSLu+VbhnN83LABMN/E9pFGpRlOy8Jw" +
- "IDAQAB",
-
- "CN=FESTE, Public Notary Certs, EmailAddress=feste@feste.org",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDhg/ObLsnn4cf0VAXNdkD+tLMTvucVXo" +
- "Ym6EB3GlU/0QMmjPqHX6TF+f61MonGf0GR2BVATnBS8PHa+GI1mV4clFNhzD5iwINdWNH4" +
- "SBFxbPewd+EYl7QHKDCRMcdPVPOEnsxZiUVtfrTJ245ClWbU3x4YTfylD9YahDnEyvK98w" +
- "IDAQAB",
-
- "CN=FESTE, Verified Certs",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqY58fOBqEBISzS5MZhKJ7YsOnqyzsYE" +
- "5VEeIEMicgNfkaeB8nZ6fggrAF6Capm4pEVr9LhFOjIqYOFlO5f68QyDMYVNnGTHzRW1ZS" +
- "U4amWz8T8sMB0jGhM1y8XeTcYjzKI5dPcPuBjrDZnq+T6raxJI0ELVFDPDjsJ0Nxh+g8xw" +
- "IDAQAB",
-
- "CN=First Data Digital Certificates Inc. Certification Authority",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQDfHBQeCbm/pEByIJl5toQi9NeFksUEJO" +
- "gHLgLkF5UFN5V2Pfyx5Q+HDmK5LDCXJuELFWcAphXe6I3LlewCWFLAR2UzTFafCh8EwDdQ" +
- "gVe63/rya2fry9CAD9lXlRBlewZFWOuutF7jkxUrmby2KS/7Qp9HKy5M6zQoMpkO7/9voQ" +
- "IBAw==",
-
- "C=ES, O=FNMT, OU=FNMT Clase 2 CA",
- "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCYP60ZNpM9Pv52QhT9NW/x+q0ieljjRt" +
- "Bdxlr5Yi2PMV7+tDD+UHSs1p0d4GLGSd0UEn1xC6wGwT/XBofgkInW5eMDsvInsZ8zyKpr" +
- "NkqjxD95QZ2JRi8rPmPUOFaRqh2xDUJ1TfOHTuMPTcy0bL9iE4fq0JuOtuL/GfSUCdWWYQ" +
- "IBAw==",
-
- "CN=Belgacom E-Trust Primary CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq2bmz1U9qTcVB0HsEYWqLcYEH2mTjWG" +
- "4nVcKtzhew/PqSjQjwHHL/ssMx/uBqh5dMzENXpyh5OrWDXaQdavFqxT4UIh1ZBm/wpjF3" +
- "3LBJOObLDA/+qnI0iNooOiFa7nQrG6TbWxMWtXNfw66M0sA+PbDL8OyLhgvCwUQYWmOo1Q" +
- "IDAQAB",
-
- "C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2g7mmY3Oo+NPin778YuDJWvqSB" +
- "/xKrC5lREEvfBj0eJnZs8c3c8bSCvujYmOmq8pgGWr6cctEsurHExwB6E9CjDNFY1P+N3U" +
- "jFAVHO9Q7sQu9/zpUvKRfeBt1TUwjl5Dc/JB6dVq47KJOlY5OG8GPIhpWypNxadUuGyJzJ" +
- "v5PMrl/Yn1EjySeJbW3HRuk0Rh0Y3HRrJ1DoboGYrVbWzVeBaVounICjjr8iQTT3NUkxOF" +
- "Ohu8HjS1iwWMuXeLsdsfIJGrCVNukM57N3S5cEeRIlFjFnmusa5BJgjIGSvRRqpI1mQq14" +
- "M0/ywqwWwZQ0oHhefTfPYhaO/q8lKff5OQzwIDAQAB",
-
- "CN=GTE CyberTrust Global Root",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrHiM3dFw4usJTQGz0O9p" +
- "TAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTSr41tiGeA5u2ylc9yMcqlHHK6" +
- "XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X404Wqk2kmhXBIgD8SFcd5tB8FLztimQ" +
- "IDAQAB",
-
- "CN=GTE CyberTrust Root",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6jr11kBL65Xl0stn3JtQOQR3pNgdWct" +
- "W4adpU1LHWeG2q4zs9o4Q3JcevrwTcsyKx6W2+gm3rjS+9tK5wHqLWbiAxUeZWXHNSsiNQ" +
- "Trz7mmdAxIYRRsdDIrrqAE9scs1hnN7L+u4w0ub6W53Fmdwg+Dm/ZIwHVju93Gxe9r/h2Q" +
- "IDAQAB",
-
- "C=US, O=GTE Corporation, CN=GTE CyberTrust Root",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC45k+625h8cXyvRLfTD0bZZOWTwUKOx7" +
- "pJjTUteueLveUFMVnGsS8KDPufpz+iCWaEVh43KRuH6X4MypqfpX/1FZSj1aJGgthoTNE3" +
- "FQZor734sLPwKfWVWgkWYXcKIiXUT0Wqx73llt/51KiOQswkwB6RJ0q1bQaAYznEol44Aw" +
- "IDAQAB",
-
- "OU=ValiCert Class 3 Policy Validation Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjmFGWHOjVsQaBalfDcnWTq8+epvzzFl" +
- "LWLU2fNUSoLgRNB0mKOCn1dzfnt6td3zZxFJmP3MKS8edgkpfs2Ejcv8ECIMYkpChMMFp2" +
- "bbFc893enhBxoYjHW5tBbcqwuI4V7q0zK89HBFx1cQqYJJgpp0lZpd34t0NiYfPT4tBVPw" +
- "IDAQAB",
-
- "OU=ValiCert Class 1 Policy Validation Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYWYJ6ibiWuqYvaG9YLqdUHAZu9OqNSL" +
- "wxlBfw8068srg1knaw0KWlAdcAAxIiGQj4/xEjm84H9b9pGib+TunRf50sQB1ZaG6m+Fiw" +
- "nRqP0z/x3BkGgagO4DrdyFNFCQbmD3DD+kCmDuJWBQ8YTfwggtFzVXSNdnKgHZ0dwN0/cQ" +
- "IDAQAB",
-
- "OU=ValiCert Class 2 Policy Validation Authority",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vYdA757tn2VUdZZU" +
- "cOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9WlmpZdRJEy0kTRxQb7XB" +
- "hVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QSv4dk+NoS/zcnwbNDu+97bi5p9w" +
- "IDAQAB",
-
- "C=hk, O=C&W HKT SecureNet CA Class A",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtBuiCqVMc2NGUUh0Y6i0jBbb9M" +
- "hn3qFIAv/Lo8+n39mxMeDjLihxBKZkWsZc/tCnuOo+Ctr7EX9/JCheyIqsbniqyKIYOZ5M" +
- "UNHwmLXvpLIbYGu/+XO0C3X5Irvp5YGgldJ2THzTp/5dlRXtB9TH3mAwAO7yLpTxhjLlWV" +
- "Ho34CiKgDvPIhdEeMAX1TkDEcQbLD1+DN2HDRmW9S7NGM502aUOuzNIinz9hK71CEpN6VE" +
- "Td+JDAQMfUF7h/MWwUMpZLTWRWerhkxljwG36mOMTnhUREcaU4aMaxgnIQvFVmYOJfbgea" +
- "xoAHTpmmQ8SU6e4B3IiBtQBvddCfiNixP9XQIDAQAB",
-
- "CN=IPS SERVIDORES",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsT1J0nznqjtwlxLyYXZhkJAk8IbPMGb" +
- "WOlI6H0fg3PqHILVikgDVboXVsHUUMH2Fjal5vmwpMwci4YSM1gf/+rHhwLWjhOgeYlQJU" +
- "3c0jt4BT18g3RXIGJBK6E2Ehim51KODFDzT9NthFf+G4Nu+z4cYgjui0OLzhPvYR3oydAQ" +
- "IDAQAB",
-
- "CN=Microsoft Root Authority",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQK9wXDmO/JOGyifl3heMOqiqY" +
- "0lX/j+lUyjt/6doiA+fFGim6KPYDJr0UJkee6sdslU2vLrnIYcj5+EZrPFa3piI9YdPN4P" +
- "AZLolsS/LWaammgmmdA6LL8MtVgmwUbnCj44liypKDmo7EmDQuOED7uabFVhrIJ8oWAtd0" +
- "zpmbRkO5pQHDEIJBSfqeeRKxjmPZhjFGBYBWWfHTdSh/en75QCxhvTv1VFs4mAvzrsVJRO" +
- "rv2nem10Tq8YzJYJKCEAV5BgaTe7SxIHPFb/W/ukZgoIptKBVlfvtjteFoF3BNr2vq6Alf" +
- "6wzX/WpxpyXDzKvPAIoyIwswaFybMgdxOF3wIDAQAB",
-
- "CN=Microsoft Root Certificate Authority",
- "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA8136gGfUWqepDCyQINA1CDx1hM" +
- "23B4mcidrezsNg+pFoWp6UcSkYdnzC4MgldpQOWPoENDbm36/3gLrpWAsrk+WdBeN3IpH3" +
- "NGQ8IpEdXuEJkLwU/vx1WBnhebcHkqOuiFkI2J8HygNY/GgpbTLX0qjLS/zhC0gyT+bruK" +
- "1P5FxvE5SZ25XVdduoGreUkbR3W/VIDI9qeX0UcAR9ba+Q9dpw2Ee3v5svbOcFt+ERYKx5" +
- "kRR8xdam5OF+1cN+5ZLSPAC1NoLeeeFt87Vu+J8zyctSfXOYNtuLoWuilZebo97CTSb/Bp" +
- "ZnJQbI56zk7hIzlTGZyDUITjTKeVPVtb5jMllANsClTgRNPdtbBzPkWL/vP1Nk2EJZNVf9" +
- "D0V8JARNntY4dBGXIpDOaER0km/VS2+whuPHNkKg0PzBwFr5o2G5MEdxlgoWsJHAQpXvEH" +
- "8oauMqH7HkzQM/d3EExyD8SQ8dRYik18t+iK2OLexF28RRBMkq/OyGnpoRl1vezlOI5uK3" +
- "/ayVwihA2+8EkN+BMznZskWlI4cGpVWJMbsGLWAOQRh9Hy61l8sR6xXVJKWU7xUUif1Lc/" +
- "oyW/zRMwD5WWJwBzLqLqtALXvK3SFnGzCZjxaqI6hB0bBuEZs2xN5AdJzhWGXBYB56WzjI" +
- "j7sEJnzUFkDltmtsqob9AL/OwTUCAwEAAQ==",
-
- "CN=NetLock Expressz (Class C) Tanusitvanykiado",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDr7LBsYYojJa9gIOPZn/yTC9tdjbChs0" +
- "A6gs79deB4MgOGWoaVke1T+p1A/Obo3dlbegO9XfM7DMNReZutVaDp0AMQrwq6FELZUiYR" +
- "IsfSIMyCpJqp/riBdp1qt9I2dT6xhgn2bm1+Trd67K5xhPYEMwglMut0rBZExuRAkx1/rQ" +
- "IDAQAB",
-
- "CN=NetLock Kozjegyzoi (Class A) Tanusitvanykiado",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvHSMD7tM9DceqQWC2ObhbHDqeL" +
- "Vu0ThEDaiDzl3S1tWBxdRL51uUcCbbO51qTGL3cfNk1mE7PetzozfZz+qMkjvN9wfcZnSX" +
- "9EUi3fRc4L9t875lM+QVOr/bmJBVOMTtplVjC7B4BPTjbsE/jvxReB+SnoPC/tmwqcm8Wg" +
- "D/qaiYdPv2LD4VOQ22BFWoDpggQrOxJa1+mm9dU7GrDPzr4PN6s6iz/0b2Y6LYOph7tqyF" +
- "/7AlT3Rj5xMHpQqPBffAZG9+pyeAlt7ULoZgx2srXnN7F+eRP2QM2EsiNCubMvJIH5+hCo" +
- "R64sKtlz2O1cH5VqNQ6ca0+pii7pXmKgOM3wIDAQAB",
-
- "OU=Tanusitvanykiadok, CN=NetLock Uzleti (Class B) Tanusitvanykiado",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCx6gTsIKAjwo84YM/HRrPVG/77uZmeBN" +
- "wcf4xKgZjupNTKihe5In+DCnVMm8Bp2GQ5o+2So/1bXHQawEfKOml2mrriRBf8TKPV/riX" +
- "iK+IA4kfpPIEPsgHC+b5sy96YhQJRhTKZPWLgLViqNhr1nGTLbO/CVRY7QbrqHvcQ7GhaQ" +
- "IDAQAB",
-
- "CN=Post.Trust Root CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1n8T5A0k2Nj76bbDsVKjTty3O+" +
- "L3Dl+B5gHwpuY2cNgTc6H/UgiQ8hW88jIcqNfhBhB7QaiUxz89RBXcgFHnMP5TSPWQX21t" +
- "JeBgu6D71sYp+E1wUBo3oA7NeCq2aPOZ1AyOXhJi/8JfWporiEequ6HZdfAsXP5twrFbMc" +
- "yDhxqnvpAO6BBUU1ILnEnzgAL+byemo1cwuNu40AAEA+Tl1EMG66toTWgm0pk0ueASln9L" +
- "u2tuIXHmCEVKHWYNN8kD4dHK3LEvcPa3gWKWG2Sn/rvhhutBn6ic2Mqg4dYv+A/hukA492" +
- "3RpcpMGciW3MxJHAq206iROvna7B3Nc0okPwIDAQAB",
-
- "CN=PTT Post Root CA, 0.9.2342.19200300.100.1.3=ca@ptt-post.nl",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsH7iOgHxSK1T1HHO276A4FCtma" +
- "KEeto6JyQ6EYE2Eg3mo5mOpMwmtQ5hxu4oq22G3y6XYfpAacmNjMQxe/pSXlZMIJ5gGl9s" +
- "SnjJiTyflYasd2cOpg5C6CxiSTJLBD4yQ5AOCiLKyHQOhe+DgcVb8ttshQhvTialBqt245" +
- "iiTl7EgODo+8zpMGzycmGuJ35T1BWUD9KPeYLZ9o+rxhPmHJh0SwBhDnlpVPKQsqMJAWX3" +
- "BEdsTvopK/AOBheT3ILAEd6PsDBGWUhKZs42r8fPMdGSdBQj1aq64InbEtHs1GkjuAsWST" +
- "POGvninF98aB13uwGqZ+Ixxv/WOmn9DBt8IwIDAQAB",
-
- "CN=Saunalahden Serveri CA, EmailAddress=gold-certs@saunalahti.fi",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5wQp3NbgUtPWTwCvHIGIvzxUcv" +
- "OeeWP9y2DaDHxyL8obqeIQaWd6OZ/CoCXMg4ONgxEcuP3n26mIowySIVfBquLqM35KZgO8" +
- "c43SHCn9x39D7Y/rV3uhQb9NczFKNyi0GFdYPGhwUJO6EB14zZPDwoLvuN8PDFjVMFdDOh" +
- "QlKjhZBrREzdvJXkbyS7gcQ0GB0j5Dsq4hnhtKgHymyrP0JqkuLPi39zwYD5sybxEJc8TN" +
- "L+jT7Ek284GN2ML/0Bpt3dgUvzLQ6cMNPgiv7dpLnWrPE4uQgmn612cjYUtb/aWAZB1696" +
- "XT2ncceLtR++dGgJBxcbYW+EO0Gb0Yq952ewIDAQAB",
-
- "CN=Saunalahden Serveri CA, EmailAddress=silver-certs@saunalahti.fi",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0neMvIdsNk5TqmhgRbgjd2fj7k" +
- "mC5mx/XpJdtRxhUteoYEsW+ut5fp1MkulXe16GMKkoPH030SHidhoZw++q2u74AZ4aOSov" +
- "k3UDZj9uKU2NhGOMpx8VlLQ0SbTk00GruvvEXLWecvUoyjKCY0zHRPi0HcSKCldVkK8wiV" +
- "QOp2gm00AHIrPOPKP7mNckPN58gkm0NIx9JNtkbmSy6f+GyKx+q1Pk0kH0EYTuR0wIHUTm" +
- "Vk0AfNqJQjnveAjRhea+XJ4zuTX/HM70g7XyZMUxSKm0rMXYPIwabab/Qq3z+EvOrNrFir" +
- "APAyPB9fPHWX8w8d9mHVoxBaJGHTnkVbOtDwIDAQAB",
-
- "C=hk, O=C&W HKT SecureNet CA Class B",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn+AlkQ8EV8LHXLFlAmYPqP3YMQ" +
- "5vgmz5wx6w46C9OERSx4x2EnhMfsIrjIrk+dwK4JVF3+seftJE+AMVAOzEsTx6tk22lgp3" +
- "vAdg7/C3N/6J/bLYB6tS/oI/vDVnM9n7LNy1WGGiDLF9lNGohGkkPZfNmwhMUImBmh/Swi" +
- "BvzD8OZcThSEncO/nlKjEHbqZrR6gZWq7ToXS1vMLbOT36q7DwySIJ1DxGaGwuLh/4qIwR" +
- "oXY1UpLXq4gh3L3pnNn4Pt4wMUwCIi9XZrtWcjk3UJmvV9D0S9Qp7alvxtOyhpGLHRBtaB" +
- "Zk8Q5tv15n/bKOcGXnb3K8RHWrAXb/N2RFIQIDAQAB",
-
- "C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority",
- "MIGbMA0GCSqGSIb3DQEBAQUAA4GJADCBhQJ+AJLOesGugz5aqomDV6wlAXYMra6OLDfO6z" +
- "V4ZFQD5YRAUcm/jwjiioII0haGN1XpsSECrXZogZoFokvJSyVmIlZsiAeP94FZbYQHZXAT" +
- "cXY+m3dM41CJVphIuR2nKRoTLkoRWZweFdVJVCxzOmmCsZc5nG1wZ0jl3S3WyB57AgMBAA" +
- "E=",
-
- "C=au, O=SecureNet CA Class A",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqaN8+JCzjoRM4Aq+qxIqjQw+L7" +
- "XdmxCIuWq3h3Ugt0vvIiMG6/BWMvfLLXDFA2+3wdDDZhMCvVVJh4fpLZ6l5XY2q+JkJViI" +
- "wxsbAvBdsY+fE03CUim0EDVPNoivCy2BCCRhw2iNWm0x6FQZUxf9pxP2QJmmqCnAn0J7Jy" +
- "nB7tvvjQNkJYGx/pUaHtoQQWIbVn8YGEiY0k1LwRhot2lna2RMbo8CvxRpe/ZEIxDpLrxe" +
- "Ys1bnMyjjoxRgbSiorG8qMnoKpiqu0sVoeHpkHqef+hlBegRcXpv43XeVT/L2OrIAM0llH" +
- "JkHu99ED5NL5F5vQLq15DBSWhuWRQl4t3dCQIDAQAB",
-
- "C=au, O=SecureNet CA Class B",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApmPZxhVadudGZcc0kfl73Va7+J" +
- "Y1LinKp30KHvcxUuhayNPPOQFOW/AfsbhK0rNHQ2Y/AUBOMEnhD/3rEmN4zPYWYhj1b2n9" +
- "fm4zdiGjwIgP6uYl/KmXzBhyxzG2C5vNwsV4YWNFrDSmJ3hoxL1SaM6ETdIkpShsgObK5s" +
- "/mmp5QeM7zNtKjQ1ocBq/LIO7QLMREGJBssZFkZbm3hYNLqJGZxeCc97hQ19OwT5rtY/tN" +
- "9NQoJDqAW3uTjMUFhK87hv6BMce2nV8a6pB7sEZesghSAFcNVVKDeJVK/WiPntlQtktT+v" +
- "KFApVOOPWDp5bUMT8/p8o3U9zFL20adKbMvwIDAQAB",
-
- "C=au, O=SecureNet CA Root",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApyi02Dz1v3oGkb2lQkyzfJ6IZp" +
- "nF2xfURVTDe8DwJFZmmL9E4HkTdmiu3Zp0z6Lpl+bBwKnD9yzVNjtzna+C2twOX1Ov625Q" +
- "16jwqo6rY9Kbdf5VCnzRs8BZk1Eqh2mKGe3k19eOFKu1GVizzmzgTYLTA4TBqwAYekmoFX" +
- "0IyQFgJ5To+wlgntE/Ts0To3j9ZfcRX/abADCMIu0oiWUb0x9he8Mjo+PGgPmD8/e63oZ4" +
- "X/aVw4xqSCJlhdMiefb9RBboD2EENip1xtviZRQnYtyCXJYSMw5MGNX2PJ2xzWEcsYX5A9" +
- "G69kzW7p990ZIh8PYKFqQ0h/dWj5O+l69SpwIDAQAB",
-
- "C=au, O=SecureNet CA SGC Root",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp1uxDYpTIbpSiDiQQmVE/Vbrc8" +
- "WF8wYx5Qj8jLHVescLIwq8WgkiAfinwN5XdDGLrTbMXnP39kTwMcr1LKIF8wocMHqGM+JG" +
- "U/Zk1kersVOUY3fEYtMvC+pfsHUCXvgrzybz3tKt62V/vC5BhPyZmumBG6ecZsf49bKEGy" +
- "B1ciHHhP8CRswPpmmFfVkh1Q6nXVYVT8wfQSx/Zhuv691Bo+yp5lZK/h6nxFwiny/gC3QB" +
- "cMhzgwoHpGie5FEOjXQxL6LG2ggQK+8lPmyGtUbnl4PAq96wrgYa58j7736tjrCaRfGb9b" +
- "HoMbtkAL9/kWbNqK+V6hM6Akxb68CT5EH8rQIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA1",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlJAMS3EpHNr2aHl6pLrn0syNr+" +
- "hHkJkfxirql2PoH84XV8Yas6jHfIftNTWAurpubb4X/swtG2zvigBJFuHuBl5KB12rPdFQ" +
- "uJFG1NTaFdiUXA7K19q/oPdJPMi7zuomgQoULZwNN0VrQcpXizjwJh8x/M80jo93wT/jq1" +
- "Q8J7TOMkxVE2L8/joWJc8ba6Ijt+DqAmm79yJxbXwLGZOhl5zjkWkfaOQvfRBtj2euwRCi" +
- "sF5jSpf35niprSa7VMnftO7FntMl3RNoU/mP6Ozl3oHWeD7uUEC0ATysFcGCOy5/8VIni3" +
- "Lg59v5iynDw0orM4mrXCoH/HwjHitPCCL+wQIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA1",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlJAMS3EpHNr2aHl6pLrn0syNr+" +
- "hHkJkfxirql2PoH84XV8Yas6jHfIftNTWAurpubb4X/swtG2zvigBJFuHuBl5KB12rPdFQ" +
- "uJFG1NTaFdiUXA7K19q/oPdJPMi7zuomgQoULZwNN0VrQcpXizjwJh8x/M80jo93wT/jq1" +
- "Q8J7TOMkxVE2L8/joWJc8ba6Ijt+DqAmm79yJxbXwLGZOhl5zjkWkfaOQvfRBtj2euwRCi" +
- "sF5jSpf35niprSa7VMnftO7FntMl3RNoU/mP6Ozl3oHWeD7uUEC0ATysFcGCOy5/8VIni3" +
- "Lg59v5iynDw0orM4mrXCoH/HwjHitPCCL+wQIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA2",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlnuSIz9g3wk8WIAI42MJl+jkC3" +
- "Vh1M0Oo/LjHkO6g/+6gVwvyN6Qi0wOLyn5B9aOs6Yor4Iqe8K0Zkxx9Ax0GrjbGuhoN6n5" +
- "oaJuHCjNbCY8jyoznp3LtHnE2WQ9lcYzqEf75QcJ3PZtuCVCTMP7Su1bLtQHqOWTECSTWG" +
- "59wdAez+kp19C8X0zwFRbD2MLO41sXW5SLKGsUZyQ79FLsDW58TrSZAtvJ8w+CqwH0jN4W" +
- "cMa8Fwdh/xFAhOosG3o6sANhB6qWjdDauYOO5J1RaXVxZIG0iFXcEIPOLaX1MJZhLjsK/I" +
- "dfnFyCdRMe05jR7cntchYcDAbcWSB+8F3v9wIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA2",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlnuSIz9g3wk8WIAI42MJl+jkC3" +
- "Vh1M0Oo/LjHkO6g/+6gVwvyN6Qi0wOLyn5B9aOs6Yor4Iqe8K0Zkxx9Ax0GrjbGuhoN6n5" +
- "oaJuHCjNbCY8jyoznp3LtHnE2WQ9lcYzqEf75QcJ3PZtuCVCTMP7Su1bLtQHqOWTECSTWG" +
- "59wdAez+kp19C8X0zwFRbD2MLO41sXW5SLKGsUZyQ79FLsDW58TrSZAtvJ8w+CqwH0jN4W" +
- "cMa8Fwdh/xFAhOosG3o6sANhB6qWjdDauYOO5J1RaXVxZIG0iFXcEIPOLaX1MJZhLjsK/I" +
- "dfnFyCdRMe05jR7cntchYcDAbcWSB+8F3v9wIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA3",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmV4egJZmI2TOnIwAPgqvCOm4BO" +
- "CEuG1TdU02qLXg14xOYFW2A5ebWhqn87o92ZqUMXZ0I8n37BJd2CDUHekbojd2BA8+rBZp" +
- "O+H/EC9WJeQzUBMJzE4Oq/Dkddtx1fxKze3bDzUFFdWwZntCeyblWeK1x8Cyx6FD/Q8vC4" +
- "MlJVeBu7vRNTB0kZCyj59o1dJDt7JFqSPAVtiHEtNz/stZ6q/85x9eVEUcqm2Vk2JHQkFe" +
- "T+s2Bw4oeFQKfMDDJBOGAwK5rHaSSlrdxdzs+LPbK7UbNud4gkyVfiBWsnUcfZfvf5Q4Ka" +
- "IA4tHqseM0NjFAWLiqt86BGgwXgQ3967jTvQIDAQAB",
-
- "C=hk, O=C&W HKT SecureNet CA Root",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtBiikFaM1l2/RliRJ+qddeCk66" +
- "JQcIdFSUmSa7c5AEt7qNpA4eYNouA3AUhNznLhXJPTw/mSDSTvSM5HKsutkjqq1pWy8hme" +
- "PpV8j2ACdJMWKGn+O+5deJMcejwj6WE5bMUwLR+EkgVx53TBQkfpMLGjFww2Y89Q0DKoh6" +
- "VAYhQROPvOL40zsIvpjnD7sJ7HXQPu9uWNcjzIvFSSz8qQ38jbrwXx61DK0QWsBbQBFZb1" +
- "6zihafeDQ+g8pl2lLLokFi/7DjJwphLWmTb3axuj5/zHG8jYL3XRNbPpwtaPBB3BtX4EOz" +
- "iJ5KMj8P3KvczrnRcGFXLt0Ob71m+z8Z0+uwIDAQAB",
-
- "C=JP, O=Japan Certification Services, Inc., CN=SecureSign RootCA3",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmV4egJZmI2TOnIwAPgqvCOm4BO" +
- "CEuG1TdU02qLXg14xOYFW2A5ebWhqn87o92ZqUMXZ0I8n37BJd2CDUHekbojd2BA8+rBZp" +
- "O+H/EC9WJeQzUBMJzE4Oq/Dkddtx1fxKze3bDzUFFdWwZntCeyblWeK1x8Cyx6FD/Q8vC4" +
- "MlJVeBu7vRNTB0kZCyj59o1dJDt7JFqSPAVtiHEtNz/stZ6q/85x9eVEUcqm2Vk2JHQkFe" +
- "T+s2Bw4oeFQKfMDDJBOGAwK5rHaSSlrdxdzs+LPbK7UbNud4gkyVfiBWsnUcfZfvf5Q4Ka" +
- "IA4tHqseM0NjFAWLiqt86BGgwXgQ3967jTvQIDAQAB",
-
- "CN=SERVICIOS DE CERTIFICACION - A.N.C.",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsiov7CtZakOTiUYqiuXs+gX64s" +
- "jeQWuvA9sAWu9IN89XifvdyZIQ3ncDlRyQPse2ZyU7VZjv2Tz+JuSKO0SpdDeDCncndLip" +
- "ca3dlxPSyqIuuLqdyb5Z6Nly8oqFZhxHXrSHgtYP32cmpr02sfNdkFBRdjIsOy+qX2Fe41" +
- "TVEl3/DY0Rx4J6Nt/hTBbEdN0tau/QsfAzp/6/N2dDEi55SpSvhPsHEQhOMJN16QFUzsXe" +
- "FIbwrq6bciUPRHfi82yveZwuSceemHYyFpq8AN7gtCAFkRfdgBUU7jZBxCGP7tkAShnGcW" +
- "GlEV0AO+SndGw6Sm6D4HoxXCFl+AiHQodn5QIDAQAB",
-
- "CN=SIA Secure Client CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS/LBAYGpmY1Jm5mkJcY2BmB4dHfPgSQ" +
- "3IK2/Qd1FFxZ1uo1xw3hV4Fh5f4MJi9H0yQ3cI19/S9X83glLGfpOd8U1naMIvwiWIHXHm" +
- "2ArQeORRQjlVBvOAYv6WpW3FRsdB5QASm2bB4o2VPtXHDFj3yGCknHhxlYzeegm/HNX8ow" +
- "IDAQAB",
-
- "C=IT, O=SIA S.p.A., L=Milano, CN=SIA Secure Server CA",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA28ELzCfTEiIuuWQWdKxZJ+IqkA" +
- "CSntWYXCtRbhsTb1RvShCihethC+ztnH7Of2WTbsxsQZzILarGs5v7THCcEXXzcom6iQCt" +
- "xy5J53PagLIs/vKXmfQCGzQvOaqL5u8F/Ln1ulR/ob+OHkg2Mwl0Yac9x5skx8OJzcpOKD" +
- "EjBhxiFY7fTxtrLUri9LDczvOQ/XmBE8E+Lma8+SJNCy9iM42oK+rpb3OnN5QEL+leTQ3p" +
- "7XwyP3lK5jp2KSBQ84+CRHJsMDRIWKpdGz8B6yHs6n6oK4Rd9sExlU8pe7U1t/60BlewFN" +
- "fyVVmMupu5MT/lqqrvJXCVkjZB8VWfwQhEnQIDAQAB",
-
- "OU=Public CA Services",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwOeC2xUTrnnCtF+SjyO8uvfG0Q" +
- "Cv1lRp8V2mYvhh0Zzeyjss6VwWJzTmuNHKdO8leGRt/hzoiXMxU2dnhsStamjnClZEgzpY" +
- "R4l3Gtpv8vkHQMk9Ae9q0dlrhJ7FaytOtyz4pGpXq2gxuhlmuuwbV/vOStZLeMPBgT1Llj" +
- "CZqcMt4uQSJgqkYxIc1HfIgdSnVUMt/ARWndwLrrdsCtozkIgFyX5UgujSMtDXAUkqNZB5" +
- "OXPWi7xhzYdtUBUFTKnoSkcxiwXM5flC1xJg+Do/o6k2GqWGNiymBIMJ9lLFsH0fiEGQmM" +
- "VlaJYQshPJFkm9Kr6wSKfC/S1eVtA3TVhR+wIDAQAB",
-
- "OU=TC TrustCenter Class 1 CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwKeu0drOu17ZbtF7nveOxnEkEV1uhq9" +
- "l/Exv9umGr2Odx3y0AlF1RSH0j73VihJA8Ch9ZEXQvjoCl/TACPSlSzXIaSSGcvMtSjkih" +
- "Y5bIEIUwaVd0RcBahsbVPeBoV30xaiSNRZc+MX5oZjJuJG3sMjbJQcrwMUTIo2HKG6A2Hw" +
- "IDAQAB",
-
- "OU=TC TrustCenter Class 2 CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaOOjtMgApcYMBDb+MAdzaxq05pKmKL9" +
- "WLXGhfUMZi9Wa9ypEi7KodUdc9s1Gyg05dy0mw8ExV5Wstx4ULMBySToLUygLt92++3ODj" +
- "FLgFU/Ka9FaLWp6Fk9G0glauTbuoS1cWvP74WJ74KY2we814yU+si2cM8Zz7/FebV1xPDQ" +
- "IDAQAB",
-
- "OU=TC TrustCenter Class 3 CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2tME1BS4NjeygQGocDiemUJJrUBsH3i" +
- "7ndszg2vyEqF6MY2orTdlOAnYRwQvyjXnKALbxsA7X+6QXPa+raXqWJ7+vM6GaKlmqxLU3" +
- "CPISpTG2Q/UylnEoKKuNKIbfu+7jDH0w1sNSq49dJ5xrwKPnBWtXSUSzbupkz9KOelB3dw" +
- "IDAQAB",
-
- "OU=TC TrustCenter Class 4 CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/L2PWNnuyDdNV9WRs5iVdxrTIFLolOI" +
- "PrVmKlVallo/QjmcJLudDNVGemo6CjqTMrduS9rXey7VwSdMPFtg9SmnKTQ5BiZhUPRaXd" +
- "4N24b0BuV8F5cqNgqrp2HRKJU1r8Ar7hCRPFSi/cPYsZrdeLJEX7TPTNXDUdKUxR8/JsVQ" +
- "IDAQAB",
-
- "CN=Thawte Premium Server CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDSNjZqi9fCW57agUFijzjuSQRV1tDvHB" +
- "uVFkfvGEg1OlL0K2oGjzsv6lbjr4aNnhf3nrRldQJN78sJoiFR2JvQZ9C6DZIGFHPUk8uX" +
- "KgCcXE4MvPoVUvzyRG7aEUpuCJ8vLeP5qjqGc7ZGU1jIiQW9gxG4cz+qB430Qk3nQJ0cNw" +
- "IDAQAB",
-
- "C=hk, O=C&W HKT SecureNet CA SGC Root",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqFNPj0Pdr+zBtA0bX7cIoprIQu" +
- "Nt1yUa3+DKvC8iJPlpIr0arVHncfe1dtTzPsg+EdBNe5keGLeezT5hG0URS1sm3Ck8AE0R" +
- "2h2Pnh903hVAvDDJD9/4LXzYjZ2g4J+wzydgzzgRCO82L3xONh0mAqf01FBDgUnr3beWFD" +
- "BjMtEDzSG8N5EePmWuFoL2FWBLUTuW5RnowvemBYE6qH8YWD53w1kAg/T1eUlgpy4DPgH9" +
- "heLfoZqJ2fhkCiuEzUPNJTUAXjBmdKHHCHWsSSeC17CVNW4dmYDrkqAtWtY4u7VHJ6sazL" +
- "9TU8FGsm/o101XEd2wNUgfqybqVg24CjC22wIDAQAB",
-
- "CN=Thawte Server CA",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTpFBuyP9Wa+bPXbbqDGh1R6KqwtqEJf" +
- "yo9EdR2oW1IHSUhh4PdcnpCGH1Bm0wbhUZAulSwGLbTZme4moMRDjN/r7jZAlwxf6xaym2" +
- "L0nIO9QnBCUQly/nkG3AKEKZ10xD3sP1IW1Un13DWOHA5NlbsLjctHvfNjrCtWYiEtaHDQ" +
- "IDAQAB",
-
- "CN=UTN - DATACorp SGC",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3+5YEKIrblXEjr8uRgnn4AgPLi" +
- "t6E5Qbvfa2gI5lBZMAHryv4g+OGQ0SR+ysraP6LnD43m77VkIVni5c7yPeIbkFdicZD0/W" +
- "w5y0vpQZY/KmEQrrU0icvvIpOxboGqBMpsn0GFlowHDyUwDAXlCCpVZvNvlK4ESGoE1O1k" +
- "duSUrLZ9emxAW5jh70/P/N5zbgnAVssjMiFdC04MwXwLLA9P4yPykqlXvY8qdOD1R8oQ2A" +
- "swkDwf9c3V6aPryuvEeKaq5xyh+xKrhfQgUL7EYw0XILyulWbfXv33i+Ybqypa4ETLyorG" +
- "kVl73v67SMvzX41MPRKA5cOp9wGDMgd8SirwIDAQAB",
-
- "CN=UTN-USERFirst-Hardware",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsffDOD+0qH/POYJRZ9Btn9L/WP" +
- "PnnyvsDYlUmbk4mRb34CF5SMK7YXQSlh08anLVPBBnOjntKxPNZuuVCTOkbJex6MbswXV5" +
- "nEZejavQav25KlUXEFSzGfCa9vGxXbanbfvgcRdrooj7AN/+GjF3DJoBerEy4ysBBzhuw6" +
- "VeI7xFm3tQwckwj9vlK3rTW/szQB6g1ZgXvIuHw4nTXaCOsqqq9o5piAbF+okh8widaS4J" +
- "M5spDUYPjMxJNLBpUb35Bs1orWZMvD6sYb0KiA7I3z3ufARMnQpea5HW7sftKI2rTYeJc9" +
- "BupNAeFosU4XZEA39jrOTNSZzFkvSrMqFIWwIDAQAB",
-
- "CN=UTN-USERFirst-Network Applications",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs/uRoeQ2VYWsBjRboJpYsvi1Dw" +
- "V3g64ysXaSaOwjSsl2P+Octjd5A7mraY0HJbYZZ+SwGxhzYUrofs3TL2TjpnwM+heAow1H" +
- "iU9RcS/u/D/5uBaAh4mTJSCaQ4JpJHYoWTWhHcB/gwZkFiAs00mkhbTAYX9RCPhoFZGAy6" +
- "XV7js69IQEXmBZp4w0cu64eMXROxJKb35lJ7mkVcW5b0OkxR0smcBSpHhMFbNAmAhrQ8YB" +
- "sHp79WscIj/L7/+o0DpLdhWe0tHGLuPbVxsyorhv6IamP3Cr5XCSq0QeQFD7nKNi5GxuoM" +
- "je4oBC+ukv6M4yBI98jbccozU8Fd2ew66XpQIDAQAB",
-
- "CN=VeriSign Class 3 Public Primary Certification Authority - G3",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy7qcUvx4Hxoebxs3c734yWuUEj" +
- "BP8DZH9dCRCvUXyKVhwRZATfuKYZDldiDBEQZ9qyxupvURQY76La0qYVmkZyZM0Oi8Ultw" +
- "IARY0XrJpGm8gxdkrQWLvNBYzo2M9evwQkkLnZcnZzJu4a6TFRxwvCBNLxjekojobIVXER" +
- "rpfuMmEVSiRZZVg8owiejc2KPtKoA/f3llVz4VIGYIL5WTv6pHL6hGl/AS4v7CCitR5nbm" +
- "t0a34g2mzKjDTFlVieboU1wc6p3wYhYLp8lfDPDewnbOr/dq8vpBpqIzFMnlemPTnmI31Y" +
- "Vlng7mUyR0G14dElNbxyzng0k7Fa6KaLlXlwIDAQAB",
-
- "CN=VeriSign Class 4 Public Primary Certification Authority - G3",
- "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArculEWnGWavxj7UZD1bOzLUfIO" +
- "SeJiVL4HNliVne0IPk9Q+1u63xfOgh/OToDO58RSIZdpK0E7cgWwn6Ya6o8qWNhcIq1t5m" +
- "NtKbAvSokmB8nGm0jyQe0IZS9jKcQVgeIr3NRWKVCG7QZt1ToszwENxUc4sEoUYzM1wXQL" +
- "meTdPzvlWD6LGJjlp8mpYikDuIJfLSU4gCDAt48uY3F0swRgfkgG2m2JYu6Cz4EbM4DWam" +
- "m+rJI1vbjuLzE44aWS2qAvDspIdm3ME/9di59OyCxtI9lR3lwE+EydmjRCgGatdFrPBrau" +
- "9OX/gRgh44YzRmUNQ+k3P6MMNmrf+TLZfvAwIDAQAB",
-
- "OU=VeriSign Trust Network",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRN" +
- "zjMHPVKmIquNDMHO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDH" +
- "qGKB3FtKqsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHw" +
- "IDAQAB",
-
- "OU=VeriSign Trust Network",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRN" +
- "zjMHPVKmIquNDMHO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDH" +
- "qGKB3FtKqsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHw" +
- "IDAQAB",
-
- "OU=VeriSign Trust Network",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm" +
- "1HP9SFIIThbbP4pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71" +
- "lSk8UOg013gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZw" +
- "IDAQAB",
-
- "OU=VeriSign Trust Network",
- "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm" +
- "1HP9SFIIThbbP4pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71" +
- "lSk8UOg013gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZw" +
- "IDAQAB"
- };
-
- public static boolean alwaysFalse = false;
-
- static class entropySpinner extends Thread {
- volatile boolean stop = false;
- byte counter = 0;
- entropySpinner() { start(); }
- public void run() {
- while (true) {
- counter++;
-
- // without this line, GCJ will over-optimize this loop into an infinite loop. Argh.
- if (alwaysFalse) stop = true;
-
- if (stop) return;
- }
- }
- }
-
- private static volatile boolean initializationFinished = false;
- static {
- entropySpinner[] spinners = new entropySpinner[10];
- for(int i=0; i<spinners.length; i++) spinners[i] = new entropySpinner();
-
- for(int i=0; i<pad1.length; i++) pad1[i] = (byte)0x36;
- for(int i=0; i<pad2.length; i++) pad2[i] = (byte)0x5C;
- for(int i=0; i<pad1_sha.length; i++) pad1_sha[i] = (byte)0x36;
- for(int i=0; i<pad2_sha.length; i++) pad2_sha[i] = (byte)0x5C;
-
- try {
- if (Log.on) Log.info(SSL.class, "reading in trusted root public keys...");
- trusted_CA_public_keys = new SubjectPublicKeyInfo[base64_encoded_trusted_CA_public_keys.length / 2];
- trusted_CA_public_key_identifiers = new String[base64_encoded_trusted_CA_public_keys.length / 2];
- for(int i=0; i<base64_encoded_trusted_CA_public_keys.length; i+=2) {
- trusted_CA_public_key_identifiers[i/2] = base64_encoded_trusted_CA_public_keys[i];
- byte[] b = Base64.decode(base64_encoded_trusted_CA_public_keys[i+1]);
- DERInputStream dIn = new DERInputStream(new ByteArrayInputStream(b));
- trusted_CA_public_keys[i/2] = new SubjectPublicKeyInfo((DERSequence)dIn.readObject());
- }
-
- } catch (Exception e) {
- if (Log.on) Log.info(SSL.class, e);
- }
-
- if (Log.on) Log.info(SSL.class, "generating entropy...");
- randpool = new byte[10];
- try { Thread.sleep(100); } catch (Exception e) { }
- for(int i=0; i<spinners.length; i++) {
- spinners[i].stop = true;
- randpool[i] = spinners[i].counter;
- }
-
- MD5Digest md5 = new MD5Digest();
- md5.update(randpool, 0, randpool.length);
- intToBytes(System.currentTimeMillis(), randpool, 0, 4); md5.update(randpool, 0, 4);
- intToBytes(Runtime.getRuntime().freeMemory(), randpool, 0, 4); md5.update(randpool, 0, 4);
- intToBytes(Runtime.getRuntime().totalMemory(), randpool, 0, 4); md5.update(randpool, 0, 4);
- intToBytes(System.identityHashCode(SSL.class), randpool, 0, 4); md5.update(randpool, 0, 4);
- Properties p = System.getProperties();
- for(Enumeration e = p.propertyNames(); e.hasMoreElements();) {
- String s = (String)e.nextElement();
- byte[] b = s.getBytes();
- md5.update(b, 0, b.length);
- b = p.getProperty(s).getBytes();
- md5.update(b, 0, b.length);
- }
- randpool = new byte[md5.getDigestSize()];
- md5.doFinal(randpool, 0);
-
- if (Log.on) Log.info(SSL.class, "SSL is initialized.");
- initializationFinished = true;
- SSL.class.notifyAll();
- }
-
-
- /**
- * A PKCS1 encoder which uses SSL's built-in PRNG instead of java.security.SecureRandom.
- * This code was derived from BouncyCastle's org.bouncycastle.crypto.encoding.PKCS1Encoding.
- */
- private static class PKCS1 implements AsymmetricBlockCipher {
- private static int HEADER_LENGTH = 10;
- private AsymmetricBlockCipher engine;
- private boolean forEncryption;
- private boolean forPrivateKey;
-
- public PKCS1(AsymmetricBlockCipher cipher) { this.engine = cipher; }
- public AsymmetricBlockCipher getUnderlyingCipher() { return engine; }
-
- public void init(boolean forEncryption, CipherParameters param) {
- engine.init(forEncryption, (AsymmetricKeyParameter)param);
- this.forPrivateKey = ((AsymmetricKeyParameter)param).isPrivate();
- this.forEncryption = forEncryption;
- }
-
- public int getInputBlockSize() { return engine.getInputBlockSize() - (forEncryption ? HEADER_LENGTH : 0); }
- public int getOutputBlockSize() { return engine.getOutputBlockSize() - (forEncryption ? 0 : HEADER_LENGTH); }
-
- public byte[] processBlock(byte[] in, int inOff, int inLen) throws InvalidCipherTextException {
- return forEncryption ? encodeBlock(in, inOff, inLen) : decodeBlock(in, inOff, inLen);
- }
-
- private byte[] encodeBlock(byte[] in, int inOff, int inLen) throws InvalidCipherTextException {
- byte[] block = new byte[engine.getInputBlockSize()];
- if (forPrivateKey) {
- block[0] = 0x01; // type code 1
- for (int i = 1; i != block.length - inLen - 1; i++)
- block[i] = (byte)0xFF;
- } else {
- getRandomBytes(block, 0, block.length);
- block[0] = 0x02; // type code 2
-
- // a zero byte marks the end of the padding, so all
- // the pad bytes must be non-zero.
- for (int i = 1; i != block.length - inLen - 1; i++)
- while (block[i] == 0)
- getRandomBytes(block, i, 1);
- }
-
- block[block.length - inLen - 1] = 0x00; // mark the end of the padding
- System.arraycopy(in, inOff, block, block.length - inLen, inLen);
- return engine.processBlock(block, 0, block.length);
- }
-
- private byte[] decodeBlock(byte[] in, int inOff, int inLen) throws InvalidCipherTextException {
- byte[] block = engine.processBlock(in, inOff, inLen);
- if (block.length < getOutputBlockSize())
- throw new InvalidCipherTextException("block truncated");
- if (block[0] != 1 && block[0] != 2)
- throw new InvalidCipherTextException("unknown block type");
-
- // find and extract the message block.
- int start;
- for (start = 1; start != block.length; start++)
- if (block[start] == 0)
- break;
- start++; // data should start at the next byte
-
- if (start >= block.length || start < HEADER_LENGTH)
- throw new InvalidCipherTextException("no data in block");
-
- byte[] result = new byte[block.length - start];
- System.arraycopy(block, start, result, 0, result.length);
- return result;
- }
- }
-
-}
-
projects / org.ibex.core.git / blobdiff