Certbot challenge fails

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: voigtstr.com

I ran this command: sudo certbot renew --dry-run
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/minecraft.voigtstr.com.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for minecraft.voigtstr.com
Waiting for verification...
Challenge failed for domain minecraft.voigtstr.com
http-01 challenge for minecraft.voigtstr.com
Cleaning up challenges
Attempting to renew cert (minecraft.voigtstr.com) from /etc/letsencrypt/renewal/minecraft.voigtstr.com.conf produced an unexpected error: Some challenges have failed.. Skipping.

Processing /etc/letsencrypt/renewal/music.voigtstr.com.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for music.voigtstr.com
Waiting for verification...
Challenge failed for domain music.voigtstr.com
http-01 challenge for music.voigtstr.com
Cleaning up challenges
Attempting to renew cert (music.voigtstr.com) from /etc/letsencrypt/renewal/music.voigtstr.com.conf produced an unexpected error: Some challenges have failed.. Skipping.

Processing /etc/letsencrypt/renewal/voigtstr.com.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator apache, Installer apache
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for voigtstr.com
http-01 challenge for www.voigtstr.com
Waiting for verification...
Challenge failed for domain voigtstr.com
Challenge failed for domain www.voigtstr.com
http-01 challenge for voigtstr.com
http-01 challenge for www.voigtstr.com
Cleaning up challenges
Attempting to renew cert (voigtstr.com) from /etc/letsencrypt/renewal/voigtstr.com.conf produced an unexpected error: Some challenges have failed.. Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem (failure)
/etc/letsencrypt/live/music.voigtstr.com/fullchain.pem (failure)
/etc/letsencrypt/live/voigtstr.com/fullchain.pem (failure)

** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem (failure)
/etc/letsencrypt/live/music.voigtstr.com/fullchain.pem (failure)
/etc/letsencrypt/live/voigtstr.com/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)

3 renew failure(s), 0 parse failure(s)

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: minecraft.voigtstr.com
    Type: connection
    Detail: Fetching
    http://minecraft.voigtstr.com/.well-known/acme-challenge/6DyXMRsfiGLE71-CGfMec7LXCugBLcYAD_EzY5JBfl0:
    Timeout during connect (likely firewall problem)

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you're using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

  • The following errors were reported by the server:

    Domain: music.voigtstr.com
    Type: connection
    Detail: Fetching
    http://music.voigtstr.com/.well-known/acme-challenge/oyhrnFULPJul7zcxL6jTHLyWiKv8BSBh20QDNoe71TE:
    Timeout during connect (likely firewall problem)

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you're using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

  • The following errors were reported by the server:

    Domain: voigtstr.com
    Type: connection
    Detail: Fetching
    http://voigtstr.com/.well-known/acme-challenge/3EIVpOR-2C_elNq4g1CMaWKHujRCHoODqdvcjCqgjMA:
    Timeout during connect (likely firewall problem)

    Domain: www.voigtstr.com
    Type: connection
    Detail: Fetching
    http://www.voigtstr.com/.well-known/acme-challenge/vl-mmrcb4He7-DwvHvu-_DzT6N-MO-BT9hHFPVXmud8:
    Timeout during connect (likely firewall problem)

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you're using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

My web server is (include version):
Server version: Apache/2.4.41 (Ubuntu)
Server built: 2022-01-05T14:49:56

The operating system my web server runs on is (include version):
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Codename: focal

My hosting provider, if applicable, is: self hosted

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot)
certbot 0.40.0

A bit of background. I had the system working fine when I was on a static IP. We have since moved house and I'm now now on dynamic IP but have a dedicated IP through PUREVPN which is connected through PPTP. I've opened ports 80,465,587,443,143,993 so far on PUREVPN's portal and in my Asus router (although if data is coming through the PPTP tunnel then I probably just need the vpn ports open?)

What do I need to run next in terms of troubleshooting?

Cheers,
Simon

2

Welcome @voigtstr

First, make sure the public DNS has the right IP. It is currently set to 172.94.99.1

Second, use this site to help test changes you make. It uses some of the same techniques Let's Encrypt server is using. Failures are fairly well explained.

2 Likes
3

Hi Mike,
I'm using a company called melbourneit for DNS and on their portal I have 172.94.99.1 against the A records for voigtstr.com. and subdomains www,mail,minecraft,music,server1

Pinging voigtstr.com returns the same IP address. Pings are in the vicinity of 600ms due to geostationary satellite.

Let's debug is showing the correct IP.

172.94.99.1 is the dedicated IP provided by PureVPN over PPTP which currently says its connected.

ubuntu firewall wall has:

voigtstr@voigtstr-VirtualBox:~$ sudo ufw status
[sudo] password for voigtstr:
Status: active

To Action From

OpenSSH ALLOW Anywhere
Apache Full ALLOW Anywhere
20/tcp ALLOW Anywhere
21/tcp ALLOW Anywhere
40000:50000/tcp ALLOW Anywhere
990/tcp ALLOW Anywhere
25565 ALLOW Anywhere
Anywhere ALLOW 172.94.99.1/gre
OpenSSH (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
20/tcp (v6) ALLOW Anywhere (v6)
21/tcp (v6) ALLOW Anywhere (v6)
40000:50000/tcp (v6) ALLOW Anywhere (v6)
990/tcp (v6) ALLOW Anywhere (v6)
25565 (v6) ALLOW Anywhere (v6)

The Apache Full line would be opening 80 and 443 wouldn't it?

Cheers,
Simon

4

The only ports I see open at that IP are:

443/tcp  open  https
1723/tcp open  pptp

Consequently, requests to http times out but https connects. The cert sent does not have the domain names you show here but the connection succeeds. See the result here and note the names in the SAN list:

Best to use curl rather than ping such as: curl -I http://voigtstr.com

2 Likes
5

Actually just noticed that my ip address for the unix box at the end of the PPTP tunnel is 172.94.99.246

I'll disconnect and reconnect the pptp tunnel and see if I get the same address, and if I do I'll add that to the DNS portal and after propagation test letsdebug again

Cheers,
Simon

6

172.94.99.1 was the gateway for PPTP

7

Sounds good. These are useful commands too:

curl -4 ifconfig.co
curl -6 ifconfig.co

Will show the machines public IP for both IPv4 and IPv6, if present.
Cheers

2 Likes
10

Then this is s fail:

and might better be set to:

That IP responds with:

curl -Ii 172.94.99.246
HTTP/1.1 200 OK
Date: Mon, 24 Jan 2022 05:24:19 GMT
Server: Apache/2.4.41 (Ubuntu)            <<<<<<<<<<<<<<<<<<<<<<<<<<
Last-Modified: Wed, 14 Jul 2021 22:44:06 GMT
ETag: "876-5c71d178881aa"
Accept-Ranges: bytes
Content-Length: 2166
Vary: Accept-Encoding
Content-Type: text/html

Which matches:

1 Like
11

from a separate machine:
simonvoigt###acBook-Pro ~ % host voigtstr.com
voigtstr.com has address 172.94.99.246
voigtstr.com mail is handled by 1 mail.voigtstr.com.

back on ubuntu:
voigtstr#####gtstr-VirtualBox:~$ curl -4 ifconfig.co
172.94.99.246

let's Debug says
ANotWorking
ERROR
voigtstr.com has an A (IPv4) record (172.94.99.246) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
A timeout was experienced while communicating with voigtstr.com/172.94.99.246: Get "https://voigtstr.com/.well-known/acme-challenge/letsdebug-test": context deadline exceeded

Trace:
0ms: Making a request to http://voigtstr.com/.well-known/acme-challenge/letsdebug-test (using initial IP 172.94.99.246)
0ms: Dialing 172.94.99.246
1741ms: Server response: HTTP 301 Moved Permanently
1741ms: Received redirect to https://voigtstr.com/.well-known/acme-challenge/letsdebug-test
1741ms: Dialing 172.94.99.246
10000ms: Experienced error: context deadline exceeded

12

The HTTP requests are being redirected to HTTPS [and there it fails].
Let's try dealing with the challenge requests in HTTP.
Show:
apachectl -t -D DUMP_VHOSTS

[while you ensure port 443 gets opened]

1 Like
13

is this ok to do whilst using apache?

15

voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ apachectl -t
AH00526: Syntax error on line 9 of /etc/apache2/sites-enabled/minecraft.voigtstr.com-le-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem' does not exist or is empty
Action '-t' failed.
The Apache error log may have more information.

16

Try:
apachectl -t -D DUMP_VHOSTS

1 Like
17

voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ apachectl -t -D DUMP_VHOSTS
AH00526: Syntax error on line 9 of /etc/apache2/sites-enabled/minecraft.voigtstr.com-le-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem' does not exist or is empty
Action '-t -D DUMP_VHOSTS' failed.
The Apache error log may have more information.

18

That's a buzz kill.

Show:
ls -lR /etc/letsencrypt/live/
and
certbot certificates

1 Like
19

voigtstr###oigtstr-VirtualBox:/etc/apache2/sites-enabled$ ls -lR /etc/letsencrypt/live/
ls: cannot open directory '/etc/letsencrypt/live/': Permission denied
voigtstr###oigtstr-VirtualBox:/etc/apache2/sites-enabled$ sudo ls -lR /etc/letsencrypt/live/
/etc/letsencrypt/live/:
total 16
drwxr-xr-x 2 root root 4096 Nov 17 22:05 minecraft.voigtstr.com
drwxr-xr-x 2 root root 4096 Nov 17 22:05 music.voigtstr.com
-rw-r--r-- 1 root root 740 Sep 21 2020 README
drwxr-xr-x 2 root root 4096 Nov 17 22:05 voigtstr.com

/etc/letsencrypt/live/minecraft.voigtstr.com:
total 4
lrwxrwxrwx 1 root root 46 Nov 17 22:05 cert.pem -> ../../archive/minecraft.voigtstr.com/cert8.pem
lrwxrwxrwx 1 root root 47 Nov 17 22:05 chain.pem -> ../../archive/minecraft.voigtstr.com/chain8.pem
lrwxrwxrwx 1 root root 51 Nov 17 22:05 fullchain.pem -> ../../archive/minecraft.voigtstr.com/fullchain8.pem
lrwxrwxrwx 1 root root 49 Nov 17 22:05 privkey.pem -> ../../archive/minecraft.voigtstr.com/privkey8.pem
-rw-r--r-- 1 root root 692 Sep 21 2020 README

/etc/letsencrypt/live/music.voigtstr.com:
total 4
lrwxrwxrwx 1 root root 42 Nov 17 22:05 cert.pem -> ../../archive/music.voigtstr.com/cert8.pem
lrwxrwxrwx 1 root root 43 Nov 17 22:05 chain.pem -> ../../archive/music.voigtstr.com/chain8.pem
lrwxrwxrwx 1 root root 47 Nov 17 22:05 fullchain.pem -> ../../archive/music.voigtstr.com/fullchain8.pem
lrwxrwxrwx 1 root root 45 Nov 17 22:05 privkey.pem -> ../../archive/music.voigtstr.com/privkey8.pem
-rw-r--r-- 1 root root 692 Sep 21 2020 README

/etc/letsencrypt/live/voigtstr.com:
total 4
lrwxrwxrwx 1 root root 36 Nov 17 22:05 cert.pem -> ../../archive/voigtstr.com/cert8.pem
lrwxrwxrwx 1 root root 37 Nov 17 22:05 chain.pem -> ../../archive/voigtstr.com/chain8.pem
lrwxrwxrwx 1 root root 41 Nov 17 22:05 fullchain.pem -> ../../archive/voigtstr.com/fullchain8.pem
lrwxrwxrwx 1 root root 39 Nov 17 22:05 privkey.pem -> ../../archive/voigtstr.com/privkey8.pem
-rw-r--r-- 1 root root 692 Sep 21 2020 README

voigtstr###oigtstr-VirtualBox:/etc/apache2/sites-enabled$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: minecraft.voigtstr.com
Domains: minecraft.voigtstr.com
Expiry Date: 2022-02-15 10:05:36+00:00 (VALID: 22 days)
Certificate Path: /etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/minecraft.voigtstr.com/privkey.pem
Certificate Name: music.voigtstr.com
Domains: music.voigtstr.com
Expiry Date: 2022-02-15 10:05:46+00:00 (VALID: 22 days)
Certificate Path: /etc/letsencrypt/live/music.voigtstr.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/music.voigtstr.com/privkey.pem
Certificate Name: voigtstr.com
Domains: voigtstr.com www.voigtstr.com
Expiry Date: 2022-02-15 10:05:56+00:00 (VALID: 22 days)
Certificate Path: /etc/letsencrypt/live/voigtstr.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/voigtstr.com/privkey.pem

20

That's weird...

[contradiction]

Show:
ls -ltr /etc/letsencrypt/archive/minecraft.voigtstr.com/

1 Like
21

voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ ls -ltr /etc/letsencrypt/archive/minecraft.voigtstr.com/
ls: cannot access '/etc/letsencrypt/archive/minecraft.voigtstr.com/': Permission denied

voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ sudo ls -ltr /etc/letsencrypt/archive/minecraft.voigtstr.com/
total 144
-rw------- 1 root root 1704 Sep 21 2020 privkey1.pem
-rw-r--r-- 1 root root 3574 Sep 21 2020 fullchain1.pem
-rw-r--r-- 1 root root 1647 Sep 21 2020 chain1.pem
-rw-r--r-- 1 root root 1927 Sep 21 2020 cert1.pem
-rw------- 1 root root 1708 Nov 21 2020 privkey2.pem
-rw-r--r-- 1 root root 3578 Nov 21 2020 fullchain2.pem
-rw-r--r-- 1 root root 1647 Nov 21 2020 chain2.pem
-rw-r--r-- 1 root root 1931 Nov 21 2020 cert2.pem
-rw------- 1 root root 1704 Jan 20 2021 privkey3.pem
-rw-r--r-- 1 root root 3448 Jan 20 2021 fullchain3.pem
-rw-r--r-- 1 root root 1586 Jan 20 2021 chain3.pem
-rw-r--r-- 1 root root 1862 Jan 20 2021 cert3.pem
-rw------- 1 root root 1704 Mar 22 2021 privkey4.pem
-rw-r--r-- 1 root root 3448 Mar 22 2021 fullchain4.pem
-rw-r--r-- 1 root root 1586 Mar 22 2021 chain4.pem
-rw-r--r-- 1 root root 1862 Mar 22 2021 cert4.pem
-rw------- 1 root root 1704 May 21 2021 privkey5.pem
-rw-r--r-- 1 root root 5612 May 21 2021 fullchain5.pem
-rw-r--r-- 1 root root 3750 May 21 2021 chain5.pem
-rw-r--r-- 1 root root 1862 May 21 2021 cert5.pem
-rw------- 1 root root 1704 Jul 20 2021 privkey6.pem
-rw-r--r-- 1 root root 5612 Jul 20 2021 fullchain6.pem
-rw-r--r-- 1 root root 3750 Jul 20 2021 chain6.pem
-rw-r--r-- 1 root root 1862 Jul 20 2021 cert6.pem
-rw------- 1 root root 1704 Sep 18 18:17 privkey7.pem
-rw-r--r-- 1 root root 5612 Sep 18 18:17 fullchain7.pem
-rw-r--r-- 1 root root 3750 Sep 18 18:17 chain7.pem
-rw-r--r-- 1 root root 1862 Sep 18 18:17 cert7.pem
-rw------- 1 root root 1704 Nov 17 22:05 privkey8.pem
-rw-r--r-- 1 root root 5612 Nov 17 22:05 fullchain8.pem
-rw-r--r-- 1 root root 3750 Nov 17 22:05 chain8.pem
-rw-r--r-- 1 root root 1862 Nov 17 22:05 cert8.pem

22

Look like it's there to me!

Show:
cat /etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem

[never show *key* files - fullchain is public info]

1 Like
23

voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ cat /etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem
cat: /etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem: Permission denied

so sudo again...
voigtstr@voigtstr-VirtualBox:/etc/apache2/sites-enabled$ sudo cat /etc/letsencrypt/live/minecraft.voigtstr.com/fullchain.pem

-----BEGIN CERTIFICATE-----
MIIFMzCCBBugAwIBAgISA1/cEdzugBRy79FmxMDQm+Q4MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTExMTcxMDA1MzdaFw0yMjAyMTUxMDA1MzZaMCExHzAdBgNVBAMT
Fm1pbmVjcmFmdC52b2lndHN0ci5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQC2x5axifpHJ/SKpDsD3KbJ2t0ofCxy153nx6vr3sIrn+y7D4lncqCw
sYHt8nm5vN/HX9kddxfnwwIw1E7VwepFCaJ1dwnDr8sMoVZrg/3hNx7OGA2k7RwQ
FKLr3LBqFeVPdC7lDQB386aaOVVT0/KMaFYWKwrGSuxkMPIFtYs8IXI1VnRr1NkS
6F785eJpJ3R1hyTanaaon7qo36iS4KjgiXaZYv27FaCMNBdPC0jYyLbtVnv+CP+r
zYK00t5paaISoNE4W5+BNgx4mtmgr9ozociixOwZoL6O0vrvxy3Ur5kioHvIP4dt
I4QxJb6UjxEiTWchW55ixe92xmo9+SNRAgMBAAGjggJSMIICTjAOBgNVHQ8BAf8E
BAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQC
MAAwHQYDVR0OBBYEFEPsuOUT8IcjtqH35kLRO9FVAEwCMB8GA1UdIwQYMBaAFBQu
sxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYV
aHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5s
ZW5jci5vcmcvMCEGA1UdEQQaMBiCFm1pbmVjcmFmdC52b2lndHN0ci5jb20wTAYD
VR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYa
aHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEFBgorBgEEAdZ5AgQCBIH2BIHz
APEAdwApeb7wnjk5IfBWc59jpXflvld9nGAK+PlNXSZcJV3HhAAAAX0tktZ5AAAE
AwBIMEYCIQDg3rTodUjX0yygyfb4TEPcPCPNQnALuIfBijGY94o0bwIhANAbtgxx
u1AGxDyfG6vZjUA3QxARU6nJ88zcX9NnEtX6AHYAb1N2rDHwMRnYmQCkURX/dxUc
EdkCwQApBo2yCJo32RMAAAF9LZLZ1QAABAMARzBFAiEAzpxBnZrD63sUESHIYifE
Lor8E77je52jnv6RqhQU+ocCIFjjnfo2pT+zvD2oylFIvnK6Cj0ryK0pU7KX1WeP
GxbdMA0GCSqGSIb3DQEBCwUAA4IBAQCenfwY7kvq1D8KWK1DFwBhfkPUSpMoy4iM
Iij6E+2HfWSx44gYuHnK9KMn2n1DEz195P/QaxbWNy+a3h5fkKS0rg5g7d51zap1
Y8X2+xJDSYvtDAPOdM6j97pKx4Q+U5MIYzAZsbr58uIe7NctL0BqfJCw1fhVYhyf
TLvv3kRZ1K6DJC04Js2IKeerID0QwSSwSUAAO56/iBqGq+ljaEBLgZDT8KSXVy19
GPG5qE0zhzKAT9iRQTwwnnfsH9S0ikERsnq2+9uXGXlhEtbkPFon+2OcEecFgbkF
x5e/DiWS05ZyRMYBSddmIBPaJwisz4P6GKjzqPl5V5nnOOy99Ogk
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----