S/MIME support. From Oliver Ehli <elmy@acm.org> and Mike Schiraldi

<raldi@research.netsol.com>.

diff --git a/Makefile.am b/Makefile.am
index bc2cb4b5b6a2661909e1dfc806f2fe6629540375..538e8fe30044eed549c055834e6fb62439624b1b 100644 (file)
--- a/Makefile.am
+++ b/Makefile.am
@@ -15,7 +15,7 @@ bin_SCRIPTS = muttbug flea
 
 BUILT_SOURCES = keymap_defs.h patchlist.c
 
-bin_PROGRAMS = mutt @DOTLOCK_TARGET@ @PGPAUX_TARGET@
+bin_PROGRAMS = mutt @DOTLOCK_TARGET@ @PGPAUX_TARGET@ @SMIMEAUX_TARGET@
 mutt_SOURCES = $(BUILT_SOURCES) \
        addrbook.c alias.c attach.c base64.c browser.c buffy.c color.c \
        commands.c complete.c compose.c copy.c curs_lib.c curs_main.c date.c \
@@ -56,20 +56,14 @@ INCLUDES=-I. -I$(top_srcdir) $(IMAP_INCLUDES) -Iintl
 
 CPPFLAGS=@CPPFLAGS@ -I$(includedir)
 
-non_us_sources = pgp.c pgpinvoke.c pgpkey.c pgplib.c sha1.c \
-       pgpmicalg.c gnupgparse.c sha1.h \
-       doc/language.txt doc/language50.txt OPS.PGP doc/PGP-Notes.txt \
-       OPS.MIX remailer.c remailer.h pgpewrap.c        \
-       contrib/pgp2.rc contrib/pgp5.rc contrib/gpg.rc \
-       mutt_ssl.c mutt_ssl.h README.SSL mutt_ssl_nss.c \
-       pgppacket.c pgppacket.h
 
 EXTRA_mutt_SOURCES = account.c md5c.c mutt_sasl.c mutt_socket.c mutt_ssl.c \
-       mutt_tunnel.c pop.c pop_auth.c pop_lib.c pgp.c pgpinvoke.c pgpkey.c \
+       mutt_tunnel.c pop.c pop_auth.c pop_lib.c crypt.c smime.c pgp.c pgpinvoke.c pgpkey.c \
        pgplib.c sha1.c pgpmicalg.c gnupgparse.c resize.c dotlock.c remailer.c \
        browser.h mbyte.h remailer.h url.h mutt_ssl_nss.c pgppacket.c 
 
-EXTRA_DIST = COPYRIGHT GPL OPS OPS.PGP TODO configure acconfig.h account.h \
+EXTRA_DIST = COPYRIGHT GPL OPS OPS.PGP OPS.CRYPT OPS.SMIME TODO \
+       configure acconfig.h account.h \
        attach.h buffy.h charset.h copy.h dotlock.h functions.h gen_defs \
        globals.h hash.h history.h init.h keymap.h \
        mailbox.h mapping.h md5.h mime.h mutt.h mutt_curses.h mutt_menu.h \
@@ -77,8 +71,8 @@ EXTRA_DIST = COPYRIGHT GPL OPS OPS.PGP TODO configure acconfig.h account.h \
        mx.h pager.h pgp.h pop.h protos.h reldate.h rfc1524.h rfc2047.h \
        rfc2231.h rfc822.h sha1.h sort.h mime.types VERSION prepare \
        _regex.h OPS.MIX README.SECURITY remailer.c remailer.h browser.h \
-       mbyte.h lib.h extlib.c pgpewrap.c pgplib.h Muttrc.head Muttrc \
-       makedoc.c stamp-doc-rc README.SSL \
+       mbyte.h lib.h extlib.c pgpewrap.c smime_keys.pl pgplib.h Muttrc.head Muttrc \
+       makedoc.c stamp-doc-rc README.SSL crypt.h \
        muttbug pgppacket.h depcomp ascii.h BEWARE PATCHES patchlist.sh
 
 mutt_dotlock_SOURCES = mutt_dotlock.c
@@ -105,6 +99,10 @@ flea:       muttbug.sh
        cp muttbug.sh flea
        chmod +x flea
 
+smime_keys: smime_keys.pl
+       cp smime_keys.pl smime_keys
+       chmod +x smime_keys
+
 Makefile: $(BUILT_SOURCES)
 
 keymap_defs.h: $(OPS) $(srcdir)/gen_defs
@@ -156,27 +154,6 @@ changelog:
 dist-hook:
        -for file in $(BUILT_SOURCES) ; do rm -f $(distdir)/$$file ; done
 
-us-distdir: distdir dist-hook
-       mv $(distdir) $(distdir)-us
-       find $(distdir)-us -type f -print | while read f ; do           \
-               cp $$f `dirname $$f`/_`basename $$f`.$$$$ &&            \
-               rm $$f && mv `dirname $$f`/_`basename $$f`.$$$$ $$f ;   \
-       done
-
-
-us-dist: us-distdir
-       for file in $(distdir)-us/*.c $(distdir)-us/*.h ; do \
-               $(srcdir)/reap.pl HAVE_PGP < $$file | $(srcdir)/reap.pl MIXMASTER | $(srcdir)/reap.pl USE_SSL > $$file.n && rm $$file && mv $$file.n $$file ; \
-       done
-       for file in $(non_us_sources) ; do \
-               echo "/* This file is only available in the international mutt version */" \
-                       > $(distdir)-us/$$file ; \
-       done
-       echo "This version of mutt may be exported from the US.">  $(distdir)-us/EXPORTABLE
-       -chmod -R a+r $(distdir)-us
-       GZIP=$(GZIP) $(TAR) chozf $(distdir)-us.tar.gz $(distdir)-us
-       -rm -rf $(distdir)-us
-
 mutt-dist:
        (cd $(srcdir) && ./build-release )
 

diff --git a/OPS.CRYPT b/OPS.CRYPT
new file mode 100644 (file)
index 0000000..0f5664c
--- /dev/null
+++ b/OPS.CRYPT
@@ -0,0 +1,4 @@
+OP_DECRYPT_SAVE "make decrypted copy and delete"
+OP_DECRYPT_COPY "make decrypted copy"
+OP_FORGET_PASSPHRASE "wipe passphrase(s) from memory"
+OP_EXTRACT_KEYS "extract supported public keys"

diff --git a/OPS.PGP b/OPS.PGP
index 0eb8ac20ba723eb5f18e037e36dcf07a646e8bb2..8ab7eb1deaa7eb35f2a362d31296b1ecd9af11c3 100644 (file)
--- a/OPS.PGP
+++ b/OPS.PGP
@@ -1,10 +1,6 @@
 OP_COMPOSE_ATTACH_KEY "attach a PGP public key"
 OP_COMPOSE_PGP_MENU "show PGP options"
-OP_EXTRACT_KEYS "extract PGP public keys"
-OP_FORGET_PASSPHRASE "wipe PGP passphrase from memory"
 OP_MAIL_KEY "mail a PGP public key"
 OP_VERIFY_KEY "verify a PGP public key"
 OP_VIEW_ID "view the key's user id"
-OP_DECRYPT_SAVE "make decrypted copy and delete"
-OP_DECRYPT_COPY "make decrypted copy"
 OP_CHECK_TRADITIONAL "check for classic pgp"

diff --git a/OPS.SMIME b/OPS.SMIME
new file mode 100644 (file)
index 0000000..1161ff9
--- /dev/null
+++ b/OPS.SMIME
@@ -0,0 +1 @@
+OP_COMPOSE_SMIME_MENU "show S/MIME options"

diff --git a/attach.c b/attach.c
index 3a7bcbcd46e168193262f6d86912bc1d746f6343..5921ddf209d264e0c8a2581c49ce2501baed3af6 100644 (file)
--- a/attach.c
+++ b/attach.c
@@ -32,6 +32,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #include <ctype.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -413,10 +417,11 @@ int mutt_view_attachment (FILE *fp, BODY *a, int flag, HEADER *hdr,
   int unlink_tempfile = 0;
   
   is_message = mutt_is_message_type(a->type, a->subtype);
-#ifdef HAVE_PGP
-  if (is_message && a->hdr && (a->hdr->pgp & PGPENCRYPT) && !pgp_valid_passphrase())
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  if (is_message && a->hdr && (a->hdr->security & ENCRYPT) &&
+      !crypt_valid_passphrase(a->hdr->security))
     return (rc);
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
   use_mailcap = (flag == M_MAILCAP ||
                (flag == M_REGULAR && mutt_needs_mailcap (a)));
   snprintf (type, sizeof (type), "%s/%s", TYPE (a), a->subtype);

diff --git a/commands.c b/commands.c
index 632970acc6efc88b7fdccd5792ba21036d9a90c9..32320317e26405bce5cfdf6cf85d656a6a4d8510 100644 (file)
--- a/commands.c
+++ b/commands.c
@@ -45,6 +45,11 @@
 #endif
 
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
+
 
 #include <errno.h>
 #include <unistd.h>
@@ -76,18 +81,22 @@ int mutt_display_message (HEADER *cur)
   mutt_parse_mime_message (Context, cur);
   mutt_message_hook (Context, cur, M_MESSAGEHOOK);
 
-#ifdef HAVE_PGP
+#if defined (HAVE_PGP) || defined (HAVE_SMIME)
   /* see if PGP is needed for this message.  if so, we should exit curses */
-  if (cur->pgp)
+  if (cur->security)
   {
-    if (cur->pgp & PGPENCRYPT)
+    if (cur->security & ENCRYPT)
     {
-      if (!pgp_valid_passphrase ())
+#ifdef HAVE_SMIME
+      if (cur->env->to && cur->security & APPLICATION_SMIME)
+         smime_getkeys (cur->env->to->mailbox);
+#endif
+      if(!crypt_valid_passphrase(cur->security))
        return 0;
 
       cmflags |= M_CM_VERIFY;
     }
-    else if (cur->pgp & PGPSIGN)
+    else if (cur->security & SIGN)
     {
       /* find out whether or not the verify signature */
       if (query_quadoption (OPT_VERIFYSIG, _("Verify PGP signature?")) == M_YES)
@@ -97,15 +106,25 @@ int mutt_display_message (HEADER *cur)
     }
   }
   
-  if ((cmflags & M_CM_VERIFY) || (cur->pgp & PGPENCRYPT))
+  if (cmflags & M_CM_VERIFY || cur->security & ENCRYPT)
   {
-    if (cur->env->from)
-      pgp_invoke_getkeys (cur->env->from);
+#ifdef HAVE_PGP
+    if (cur->security & APPLICATION_PGP)
+    {
+      if (cur->env->from)
+        pgp_invoke_getkeys (cur->env->from);
 
-    mutt_message _("Invoking PGP...");
-  }
+      mutt_message _("Invoking PGP...");
+    }
+#endif
 
+#ifdef HAVE_SMIME
+    if (cur->security & APPLICATION_SMIME)
+      mutt_message _("Invoking OpenSSL...");
 #endif
+  }
+#endif /*  defined (HAVE_PGP) || defined (HAVE_SMIME) */
+
 
   mutt_mktemp (tempfile);
   if ((fpout = safe_fopen (tempfile, "w")) == NULL)
@@ -153,18 +172,35 @@ int mutt_display_message (HEADER *cur)
   if (fpfilterout != NULL && mutt_wait_filter (filterpid) != 0)
     mutt_any_key_to_continue (NULL);
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   /* update PGP information for this message */
-  cur->pgp |= pgp_query (cur->content);
+  cur->security |= crypt_query (cur->content);
+
 #endif
 
   if (builtin)
   {
     pager_t info;
+#ifdef HAVE_SMIME
+    char *smime_signer;
+
+    if (cur->security & APPLICATION_SMIME && (cmflags & M_CM_VERIFY))
+    {
+      if (cur->security & GOODSIGN)
+      {
+       if (!(smime_signer = smime_verify_sender(cur)))
+         mutt_message ( _("S/MIME signature successfully verified."));
+       else
+         mutt_error ( _("S/MIME certificate owner does not match sender."));
+      }
+      else if (cur->security & SIGN || cur->security & BADSIGN)
+       mutt_error ( _("S/MIME signature could NOT be verified."));
+    }
+#endif
 
 #ifdef HAVE_PGP
-    if (cmflags & M_CM_VERIFY)
-      mutt_message ((cur->pgp & PGPGOODSIGN) ?
+    if (cur->security & APPLICATION_PGP && (cmflags & M_CM_VERIFY))
+      mutt_message ((cur->security & GOODSIGN) ?
                    _("PGP signature successfully verified.") :
                    _("PGP signature could NOT be verified."));
 #endif
@@ -282,17 +318,16 @@ void pipe_msg (HEADER *h, FILE *fp, int decode, int print)
   
   pipe_set_flags (decode, print, &cmflags, &chflags);
 
-#ifdef HAVE_PGP
-  
-  if (decode && (h->pgp & PGPENCRYPT))
-  {
-    if (!pgp_valid_passphrase())
-      return;
-    endwin();
-  }
-  
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+    if (decode && h->security & ENCRYPT)
+    {
+      if(!crypt_valid_passphrase(h->security))
+       return;
+      endwin ();
+    }
 #endif
 
+
   if (decode)
     mutt_parse_mime_message (Context, h);
 
@@ -313,17 +348,22 @@ static int _mutt_pipe_message (HEADER *h, char *cmd,
   pid_t thepid;
   FILE *fpout;
   
-  mutt_endwin (NULL);
+/*   mutt_endwin (NULL); 
+
+     is this really needed here ? 
+     it makes the screen flicker on pgp and s/mime messages,
+     before asking for a passphrase...
+                                     Oliver Ehli */
   if (h)
   {
 
     mutt_message_hook (Context, h, M_MESSAGEHOOK);
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     if (decode)
     {
       mutt_parse_mime_message (Context, h);
-      if(h->pgp & PGPENCRYPT && !pgp_valid_passphrase())
+      if(h->security & ENCRYPT && !crypt_valid_passphrase(h->security))
        return 1;
     }
     mutt_endwin (NULL);
@@ -336,7 +376,7 @@ static int _mutt_pipe_message (HEADER *h, char *cmd,
     }
       
     pipe_msg (h, fpout, decode, print);
-    safe_fclose (&fpout);
+    fclose (fpout);
     rc = mutt_wait_filter (thepid);
   }
   else
@@ -344,7 +384,7 @@ static int _mutt_pipe_message (HEADER *h, char *cmd,
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
 
     if (decode)
     {
@@ -353,8 +393,8 @@ static int _mutt_pipe_message (HEADER *h, char *cmd,
        {
          mutt_message_hook (Context, Context->hdrs[Context->v2r[i]], M_MESSAGEHOOK);
          mutt_parse_mime_message(Context, Context->hdrs[Context->v2r[i]]);
-         if (Context->hdrs[Context->v2r[i]]->pgp & PGPENCRYPT &&
-             !pgp_valid_passphrase())
+         if (Context->hdrs[Context->v2r[i]]->security & ENCRYPT &&
+             !crypt_valid_passphrase(Context->hdrs[Context->v2r[i]]->security))
            return 1;
        }
     }
@@ -576,18 +616,30 @@ static void set_copy_flags (HEADER *hdr, int decode, int decrypt, int *cmflags,
   *cmflags = 0;
   *chflags = CH_UPDATE_LEN;
   
-#ifdef HAVE_PGP
-  if (!decode && decrypt && (hdr->pgp & PGPENCRYPT))
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  if (!decode && decrypt && (hdr->security & ENCRYPT))
   {
+#ifdef HAVE_PGP
     if (mutt_is_multipart_encrypted(hdr->content))
     {
       *chflags = CH_NONEWLINE | CH_XMIT | CH_MIME;
       *cmflags = M_CM_DECODE_PGP;
     }
-    else if (mutt_is_application_pgp(hdr->content) & PGPENCRYPT)
+    else if (mutt_is_application_pgp(hdr->content) & ENCRYPT)
       decode = 1;
-  }
 #endif
+#if defined(HAVE_PGP) && defined(HAVE_SMIME)
+    else
+#endif
+#ifdef HAVE_SMIME
+         if (mutt_is_application_smime(hdr->content) & ENCRYPT)
+    {
+      *chflags = CH_NONEWLINE | CH_XMIT | CH_MIME;
+      *cmflags = M_CM_DECODE_SMIME;
+    }
+#endif
+  }
+#endif /* defined(HAVE_PGP) || defined(HAVE_SMIME) */
 
   if (decode)
   {
@@ -628,8 +680,8 @@ int mutt_save_message (HEADER *h, int delete,
                       int decode, int decrypt, int *redraw)
 {
   int i, need_buffy_cleanup;
-#ifdef HAVE_PGP
-  int need_passphrase = 0;
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  int need_passphrase = 0, app=0;
 #endif
   char prompt[SHORT_STRING], buf[_POSIX_PATH_MAX];
   CONTEXT ctx;
@@ -651,10 +703,12 @@ int mutt_save_message (HEADER *h, int delete,
             (delete ? _("Save%s to mailbox") : _("Copy%s to mailbox"))),
            h ? "" : _(" tagged"));
   
+
   if (h)
   {
-#ifdef HAVE_PGP
-    need_passphrase = h->pgp & PGPENCRYPT;
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      need_passphrase = h->security & ENCRYPT;
+      app = h->security;
 #endif
     mutt_message_hook (Context, h, M_MESSAGEHOOK);
     mutt_default_save (buf, sizeof (buf), h);
@@ -672,12 +726,14 @@ int mutt_save_message (HEADER *h, int delete,
       }
     }
 
+
     if (h)
     {
       mutt_message_hook (Context, h, M_MESSAGEHOOK);
       mutt_default_save (buf, sizeof (buf), h);
-#ifdef HAVE_PGP
-      need_passphrase |= h->pgp & PGPENCRYPT;
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      need_passphrase = h->security & ENCRYPT;
+      app = h->security;
 #endif
       h = NULL;
     }
@@ -712,10 +768,8 @@ int mutt_save_message (HEADER *h, int delete,
   if (!mutt_save_confirm (buf, &st))
     return -1;
 
-#ifdef HAVE_PGP
-  if(need_passphrase && (decode || decrypt) && !pgp_valid_passphrase())
+  if (need_passphrase && (decode || decrypt) && !crypt_valid_passphrase(app))
     return -1;
-#endif
   
   mutt_message (_("Copying to %s..."), buf);
   
@@ -865,20 +919,19 @@ void mutt_edit_content_type (HEADER *h, BODY *b, FILE *fp)
   if (fp && (is_multipart (b) || mutt_is_message_type (b->type, b->subtype)))
     mutt_parse_part (fp, b);
   
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   if (h)
   {
     if (h->content == b)
-      h->pgp = 0;
-    h->pgp |= pgp_query (b);
-  }
-#endif /* HAVE_PGP */
+      h->security  = 0;
 
+    h->security |= crypt_query (b);
+#endif
+  }
 }
 
 
 #ifdef HAVE_PGP
-
 static int _mutt_check_traditional_pgp (HEADER *h, int *redraw)
 {
   MESSAGE *msg;
@@ -889,7 +942,7 @@ static int _mutt_check_traditional_pgp (HEADER *h, int *redraw)
     return 0;
   if (pgp_check_traditional (msg->fp, h->content, 0))
   {
-    h->pgp = pgp_query (h->content);
+    h->security = crypt_query (h->content);
     *redraw |= REDRAW_FULL;
     rv = 1;
   }

diff --git a/compose.c b/compose.c
index f222b3923068462573ac1260ba777c1cb0b6467b..9ec18e2ca73252c30df946d42c258adffe29352c 100644 (file)
--- a/compose.c
+++ b/compose.c
@@ -58,11 +58,10 @@ enum
   HDR_MIX,
 #endif
 
-#ifdef HAVE_PGP
-  HDR_PGP,
-  HDR_PGPSIGINFO,
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  HDR_CRYPT,
+  HDR_CRYPTINFO,
 #endif
-  
 
   HDR_ATTACH  = (HDR_FCC + 5) /* where to start printing the attachments */
 };
@@ -103,80 +102,204 @@ static void snd_entry (char *b, size_t blen, MUTTMENU *menu, int num)
 
 
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #ifdef HAVE_PGP
 #include "pgp.h"
+#endif
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
 
-static void redraw_pgp_lines (int pgp)
+static void redraw_crypt_lines (HEADER *msg)
 {
-  mvaddstr (HDR_PGP, 0,     "     PGP: ");
-  if ((pgp & (PGPENCRYPT | PGPSIGN)) == (PGPENCRYPT | PGPSIGN))
+#ifdef HAVE_SMIME
+  int off = 0;
+#endif
+
+#if defined(HAVE_PGP) && defined(HAVE_SMIME)
+  if (!msg->security)
+    mvaddstr (HDR_CRYPT, 0,     "Security: ");
+  else if (msg->security & APPLICATION_SMIME)
+    mvaddstr (HDR_CRYPT, 0,     "  S/MIME: ");
+  else if (msg->security & APPLICATION_PGP)
+    mvaddstr (HDR_CRYPT, 0,     "     PGP: ");
+#else
+#ifdef HAVE_SMIME
+  mvaddstr (HDR_CRYPT, 0,     "  S/MIME: ");
+#endif
+#ifdef HAVE_PGP
+  mvaddstr (HDR_CRYPT, 0,     "     PGP: ");
+#endif
+#endif
+
+
+  if ((msg->security & (ENCRYPT | SIGN)) == (ENCRYPT | SIGN))
     addstr (_("Sign, Encrypt"));
-  else if (pgp & PGPENCRYPT)
+  else if (msg->security & ENCRYPT)
     addstr (_("Encrypt"));
-  else if (pgp & PGPSIGN)
+  else if (msg->security & SIGN)
     addstr (_("Sign"));
   else
     addstr (_("Clear"));
   clrtoeol ();
 
-  move (HDR_PGPSIGINFO, 0);
+  move (HDR_CRYPTINFO, 0);
   clrtoeol ();
-  if (pgp & PGPSIGN)
+#ifdef HAVE_PGP
+  if (msg->security & APPLICATION_PGP  && msg->security & SIGN)
     printw ("%s%s", _(" sign as: "), PgpSignAs ? PgpSignAs : _("<default>"));
+#endif
+#ifdef HAVE_SMIME
+  if (msg->security & APPLICATION_SMIME  && msg->security & SIGN) {
+      printw ("%s%s", _(" sign as: "), SmimeSignAs ? SmimeSignAs : _("<default>"));
+  }
+  if (msg->security & APPLICATION_SMIME  && (msg->security & ENCRYPT)) {
+      mvprintw (HDR_CRYPTINFO, 40, "%s%s", _("Encrypt with: "),
+               NONULL(SmimeCryptAlg));
+      off = 20;
+  }
+#endif
 }
+#endif  /* defined(HAVE_PGP) || defined(HAVE_SMIME) */
+
+
 
-static int pgp_send_menu (int bits, int *redraw)
+#ifdef HAVE_PGP
+static int pgp_send_menu (HEADER *msg, int *redraw)
 {
   pgp_key_t *p;
   char input_signas[SHORT_STRING];
 
-  switch (mutt_multi_choice (_("(e)ncrypt, (s)ign, sign (a)s, (b)oth, or (f)orget it? "),
+  switch (mutt_multi_choice (_("PGP (e)ncrypt, (s)ign, sign (a)s, (b)oth, or (f)orget it? "),
                             _("esabf")))
   {
   case 1: /* (e)ncrypt */
-    bits |= PGPENCRYPT;
+    msg->security |= PGPENCRYPT;
     break;
 
   case 2: /* (s)ign */
-    bits |= PGPSIGN;
+    msg->security |= PGPSIGN;
     break;
 
   case 3: /* sign (a)s */
 
     unset_option(OPTPGPCHECKTRUST);
 
-    if ((p = pgp_ask_for_key (_("Sign as: "), NULL, KEYFLAG_CANSIGN, PGP_SECRING)))
+    if ((p = pgp_ask_for_key (_("Sign as: "), NULL, KEYFLAG_CANSIGN, PGP_PUBRING)))
     {
       snprintf (input_signas, sizeof (input_signas), "0x%s", pgp_keyid (p));
       mutt_str_replace (&PgpSignAs, input_signas);
       pgp_free_key (&p);
       
-      bits |= PGPSIGN;
+      msg->security |= PGPSIGN;
        
       pgp_void_passphrase ();  /* probably need a different passphrase */
     }
     else
     {
-      bits &= ~PGPSIGN;
+      msg->security &= ~PGPSIGN;
     }
 
     *redraw = REDRAW_FULL;
     break;
 
   case 4: /* (b)oth */
-    bits = PGPENCRYPT | PGPSIGN;
+    msg->security = PGPENCRYPT | PGPSIGN;
     break;
 
   case 5: /* (f)orget it */
-    bits = 0;
+    msg->security = 0;
     break;
   }
-  if (!*redraw)
-    redraw_pgp_lines (bits);
-  return (bits);
+
+  if(*redraw)
+      redraw_crypt_lines (msg);
+  return (msg->security);
 }
 #endif /* HAVE_PGP */
 
+
+
+#ifdef HAVE_SMIME
+
+static int smime_send_menu (HEADER *msg, int *redraw)
+{
+    char *p;
+
+  switch (mutt_multi_choice (_("S/MIME (e)ncrypt, (s)ign, encrypt (w)ith, sign (a)s, (b)oth, or (f)orget it? "),
+                            _("ewsabf")))
+  {
+  case 1: /* (e)ncrypt */
+    msg->security |= SMIMEENCRYPT;
+    break;
+
+  case 2: /* encrypt (w)ith */
+    msg->security |= SMIMEENCRYPT;
+    switch (mutt_multi_choice (_("1: DES, 2: Tripple-DES, 3: RC2-40,"
+                                " 4: RC2-64, 5: RC2-128, or (f)orget it? "),
+                              _("12345f"))) {
+    case 1:
+       mutt_str_replace (&SmimeCryptAlg, "des");
+       break;
+    case 2:
+       mutt_str_replace (&SmimeCryptAlg, "des3");
+       break;
+    case 3:
+       mutt_str_replace (&SmimeCryptAlg, "rc2-40");
+       break;
+    case 4:
+       mutt_str_replace (&SmimeCryptAlg, "rc2-64");
+       break;
+    case 5:
+       mutt_str_replace (&SmimeCryptAlg, "rc2-128");
+       break;
+    case 6: /* forget it */
+       break;
+    }
+    break;
+
+  case 3: /* (s)ign */
+      
+    if(!SmimeSignAs)
+       mutt_message("Can\'t sign: No key specified. use sign(as).");
+    else
+       msg->security |= SMIMESIGN;
+    break;
+
+  case 4: /* sign (a)s */
+
+    if ((p = smime_ask_for_key (_("Sign as: "), NULL, 0))) {
+      p[mutt_strlen (p)-1] = '\0';
+      mutt_str_replace (&SmimeSignAs, p);
+       
+      msg->security |= SMIMESIGN;
+
+      /* probably need a different passphrase */
+      smime_void_passphrase ();
+    }
+    else
+      msg->security &= ~SMIMESIGN;
+
+    *redraw = REDRAW_FULL;
+    break;
+
+  case 5: /* (b)oth */
+    msg->security = SMIMEENCRYPT | SMIMESIGN;
+    break;
+
+  case 6: /* (f)orget it */
+    msg->security = 0;
+    break;
+  }
+
+  if(*redraw)
+      redraw_crypt_lines (msg);
+  return (msg->security);
+}
+#endif /* HAVE_SMIME */
+
 #ifdef MIXMASTER
 
 static void redraw_mix_line (LIST *chain)
@@ -269,9 +392,10 @@ static void draw_envelope (HEADER *msg, char *fcc)
 
 
 
-#ifdef HAVE_PGP
-  redraw_pgp_lines (msg->pgp);
-#endif /* HAVE_PGP */
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  redraw_crypt_lines (msg);
+#endif /* HAVE_PGP || HAVE_SMIE */
+
 
 #ifdef MIXMASTER
   redraw_mix_line (msg->chain);
@@ -1190,15 +1314,53 @@ int mutt_compose_menu (HEADER *msg,   /* structure for new message */
 #ifdef HAVE_PGP
       case OP_COMPOSE_PGP_MENU:
 
-       msg->pgp = pgp_send_menu (msg->pgp, &menu->redraw);
+#ifdef HAVE_SMIME
+       if (msg->security & APPLICATION_SMIME)
+       {
+         if (mutt_yesorno (_("S/MIME already selected. Clear & continue ? "),
+                            M_YES) == M_NO)
+         {
+           mutt_clear_error ();
+           break;
+         }
+         msg->security = 0;
+       }
+#endif /* HAVE_SMIME */
+       msg->security = pgp_send_menu (msg, &menu->redraw);
+       redraw_crypt_lines (msg);
        break;
+#endif /* HAVE_PGP */
 
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_FORGET_PASSPHRASE:
 
-       mutt_forget_passphrase ();
+       crypt_forget_passphrase ();
        break;
 
-#endif /* HAVE_PGP */
+#endif /* HAVE_(PGP||SMIME) */
+
+
+#ifdef HAVE_SMIME
+      case OP_COMPOSE_SMIME_MENU:
+
+#ifdef HAVE_PGP
+       if (msg->security & APPLICATION_PGP)
+       {
+         if (mutt_yesorno (_("PGP already selected. Clear & continue ? "),
+                             M_YES) == M_NO)
+         {
+            mutt_clear_error ();
+            break;
+         }
+         msg->security = 0;
+       }
+#endif /* HAVE_pgp */
+       msg->security = smime_send_menu(msg, &menu->redraw);
+       redraw_crypt_lines (msg);
+       break;
+
+#endif /* HAVE_SMIME */
 
 
 #ifdef MIXMASTER

diff --git a/configure.in b/configure.in
index 2dabe529bfe58b5f08ac911582d5da33c2f3df91..0603ca17617cb40c3b921b847a63e35147a09cc8 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -79,6 +79,24 @@ else
                 OPS="$OPS \$(srcdir)/OPS.PGP"
         fi
 
+       AC_ARG_ENABLE(smime, [  --disable-smime              Disable SMIME support],
+       [       if test x$enableval = xno ; then
+                       have_smime=no
+               fi
+       ])
+ 
+       if test x$have_smime != xno ; then
+               AC_DEFINE(HAVE_SMIME,1,[ Define if you want S/MIME support. ])
+               MUTT_LIB_OBJECTS="$MUTT_LIB_OBJECTS smime.o "
+               OPS="$OPS \$(srcdir)/OPS.SMIME"
+               SMIMEAUX_TARGET="smime_keys"
+       fi
+  
+       if test x$HAVE_SMIME != xno -o x$HAVE_PGP != xno ; then
+               MUTT_LIB_OBJECTS="$MUTT_LIB_OBJECTS crypt.o "
+               OPS="$OPS \$(srcdir)/OPS.CRYPT"
+       fi
+ 
         AC_ARG_WITH(mixmaster, [  --with-mixmaster[=PATH]    Include Mixmaster support],
                 [if test -x "$withval" ; then
                         MIXMASTER="$withval"
@@ -95,6 +113,7 @@ fi
 AC_SUBST(OPS)
 
 AC_SUBST(PGPAUX_TARGET)
+AC_SUBST(SMIMEAUX_TARGET)
 
 AC_DEFINE_UNQUOTED(SUBVERSION,"$SUBVERSION",[ Is this the international version? ])
 AC_SUBST(SUBVERSION)

diff --git a/contrib/Makefile.in b/contrib/Makefile.in
index aaa3b32d8bc52ac90563795853196ca9570a2bc5..7f180bcebf29f910f710a140a122833351b22aab 100644 (file)
--- a/contrib/Makefile.in
+++ b/contrib/Makefile.in
@@ -21,7 +21,8 @@ VPATH = @srcdir@
 subdir = contrib
 
 SAMPLES = Mush.rc Pine.rc gpg.rc pgp2.rc pgp5.rc pgp6.rc Tin.rc \
-       sample.muttrc  sample.mailcap sample.muttrc-tlr
+       sample.muttrc  sample.mailcap sample.muttrc-tlr smime.rc \
+       ca-bundle.crt
 
 DISTFILES = Makefile.in language.txt language50.txt  \
        patch.slang-1.2.2.keypad.1      \

diff --git a/contrib/ca-bundle.crt b/contrib/ca-bundle.crt
new file mode 100644 (file)
index 0000000..12b997d
--- /dev/null
+++ b/contrib/ca-bundle.crt
@@ -0,0 +1,4599 @@
+##
+##  ca-bundle.crt -- Bundle of CA Root Certificates
+##  Last Modified: Thu Mar  2 09:32:46 CET 2000
+##
+##  This is a bundle of X.509 certificates of public
+##  Certificate Authorities (CA). These were automatically
+##  extracted from Netscape Communicator 4.72's certificate database
+##  (the file `cert7.db'). It contains the certificates in both
+##  plain text and PEM format and therefore can be directly used
+##  with an Apache+mod_ssl webserver for SSL client authentication.
+##  Just configure this file as the SSLCACertificateFile.
+##
+##  (SKIPME)
+##
+
+ABAecom (sub., Am. Bankers Assn.) Root CA
+=========================================
+MD5 Fingerprint: 82:12:F7:89:E1:0B:91:60:A4:B6:22:9F:94:68:11:92
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIID+DCCAuCgAwIBAgIRANAeQJAAACdLAAAAAQAAAAQwDQYJKoZIhvcNAQEFBQAw
+gYwxCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRVdGFoMRcwFQYDVQQHEw5TYWx0IExh
+a2UgQ2l0eTEYMBYGA1UEChMPWGNlcnQgRVogYnkgRFNUMRgwFgYDVQQDEw9YY2Vy
+dCBFWiBieSBEU1QxITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAe
+Fw05OTA3MTQxNjE0MThaFw0wOTA3MTExNjE0MThaMIGMMQswCQYDVQQGEwJVUzEN
+MAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxGDAWBgNVBAoT
+D1hjZXJ0IEVaIGJ5IERTVDEYMBYGA1UEAxMPWGNlcnQgRVogYnkgRFNUMSEwHwYJ
+KoZIhvcNAQkBFhJjYUBkaWdzaWd0cnVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCtVBjetL/3reh0qu2LfI/C1HUa1YS5tmL8ie/kl2GS+x24
+4VpHNJ6eBiL70+o4y7iLB/caoBd3B1owHNQpOCDXJ0DYUJNDv9IYoil2BXKqa7Zp
+mKt5Hhxl9WqL/MUWqqJy2mDtTm4ZJXoKHTDjUJtCPETrobAgHtsCfv49H7/QAIrb
+QHamGKUVp1e2UsIBF5h3j4qBxhq0airmr6nWAKzP2BVJfNsbof6B+of505DBAsD5
+0ELpkWglX8a/hznplQBgKL+DLMDnXrbXNhbnYId26OcnsiUNi3rlqh3lWc3OCw5v
+xsic4xDZhTnTt5v6xrp8dNJddVardKSiUb9SfO5xAgMBAAGjUzBRMA8GA1UdEwEB
+/wQFMAMBAf8wHwYDVR0jBBgwFoAUCCBsZuuBCmxc1bWmPEHdHJaRJ3cwHQYDVR0O
+BBYEFAggbGbrgQpsXNW1pjxB3RyWkSd3MA0GCSqGSIb3DQEBBQUAA4IBAQBah1iP
+Lat2IWtUDNnxQfZOzSue4x+boy1/2St9WMhnpCn16ezVvZY/o3P4xFs2fNBjLDQ5
+m0i4PW/2FMWeY+anNG7T6DOzxzwYbiOuQ5KZP5jFaTDxNjutuTCC1rZZFpYCCykS
+YbQRifcML5SQhZgonFNsfmPdc/QZ/0qB0bJSI/08SjTOWhvgUIrtT4GV2GDn5MQN
+u1g+WPdOaG8+Z8nLepcWJ+xCYRR2uwDF6wg9FX9LtiJdhzuQ9PPA/jez6dliDMDD
+Wa9gvR8N26E0HzDEPYutsB0Ek+1f1eS/IDAE9EjpMwHRLpAnUrOb3jocq6mXf5vr
+wo3CbezcE9NGxXl8
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            d0:1e:40:90:00:00:27:4b:00:00:00:01:00:00:00:04
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Utah, L=Salt Lake City, O=Xcert EZ by DST, CN=Xcert EZ by DST/Email=ca@digsigtrust.com
+        Validity
+            Not Before: Jul 14 16:14:18 1999 GMT
+            Not After : Jul 11 16:14:18 2009 GMT
+        Subject: C=US, ST=Utah, L=Salt Lake City, O=Xcert EZ by DST, CN=Xcert EZ by DST/Email=ca@digsigtrust.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ad:54:18:de:b4:bf:f7:ad:e8:74:aa:ed:8b:7c:
+                    8f:c2:d4:75:1a:d5:84:b9:b6:62:fc:89:ef:e4:97:
+                    61:92:fb:1d:b8:e1:5a:47:34:9e:9e:06:22:fb:d3:
+                    ea:38:cb:b8:8b:07:f7:1a:a0:17:77:07:5a:30:1c:
+                    d4:29:38:20:d7:27:40:d8:50:93:43:bf:d2:18:a2:
+                    29:76:05:72:aa:6b:b6:69:98:ab:79:1e:1c:65:f5:
+                    6a:8b:fc:c5:16:aa:a2:72:da:60:ed:4e:6e:19:25:
+                    7a:0a:1d:30:e3:50:9b:42:3c:44:eb:a1:b0:20:1e:
+                    db:02:7e:fe:3d:1f:bf:d0:00:8a:db:40:76:a6:18:
+                    a5:15:a7:57:b6:52:c2:01:17:98:77:8f:8a:81:c6:
+                    1a:b4:6a:2a:e6:af:a9:d6:00:ac:cf:d8:15:49:7c:
+                    db:1b:a1:fe:81:fa:87:f9:d3:90:c1:02:c0:f9:d0:
+                    42:e9:91:68:25:5f:c6:bf:87:39:e9:95:00:60:28:
+                    bf:83:2c:c0:e7:5e:b6:d7:36:16:e7:60:87:76:e8:
+                    e7:27:b2:25:0d:8b:7a:e5:aa:1d:e5:59:cd:ce:0b:
+                    0e:6f:c6:c8:9c:e3:10:d9:85:39:d3:b7:9b:fa:c6:
+                    ba:7c:74:d2:5d:75:56:ab:74:a4:a2:51:bf:52:7c:
+                    ee:71
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Authority Key Identifier: 
+                keyid:08:20:6C:66:EB:81:0A:6C:5C:D5:B5:A6:3C:41:DD:1C:96:91:27:77
+
+            X509v3 Subject Key Identifier: 
+                08:20:6C:66:EB:81:0A:6C:5C:D5:B5:A6:3C:41:DD:1C:96:91:27:77
+    Signature Algorithm: sha1WithRSAEncryption
+        5a:87:58:8f:2d:ab:76:21:6b:54:0c:d9:f1:41:f6:4e:cd:2b:
+        9e:e3:1f:9b:a3:2d:7f:d9:2b:7d:58:c8:67:a4:29:f5:e9:ec:
+        d5:bd:96:3f:a3:73:f8:c4:5b:36:7c:d0:63:2c:34:39:9b:48:
+        b8:3d:6f:f6:14:c5:9e:63:e6:a7:34:6e:d3:e8:33:b3:c7:3c:
+        18:6e:23:ae:43:92:99:3f:98:c5:69:30:f1:36:3b:ad:b9:30:
+        82:d6:b6:59:16:96:02:0b:29:12:61:b4:11:89:f7:0c:2f:94:
+        90:85:98:28:9c:53:6c:7e:63:dd:73:f4:19:ff:4a:81:d1:b2:
+        52:23:fd:3c:4a:34:ce:5a:1b:e0:50:8a:ed:4f:81:95:d8:60:
+        e7:e4:c4:0d:bb:58:3e:58:f7:4e:68:6f:3e:67:c9:cb:7a:97:
+        16:27:ec:42:61:14:76:bb:00:c5:eb:08:3d:15:7f:4b:b6:22:
+        5d:87:3b:90:f4:f3:c0:fe:37:b3:e9:d9:62:0c:c0:c3:59:af:
+        60:bd:1f:0d:db:a1:34:1f:30:c4:3d:8b:ad:b0:1d:04:93:ed:
+        5f:d5:e4:bf:20:30:04:f4:48:e9:33:01:d1:2e:90:27:52:b3:
+        9b:de:3a:1c:ab:a9:97:7f:9b:eb:c2:8d:c2:6d:ec:dc:13:d3:
+        46:c5:79:7c
+
+ANX Network CA by DST
+=====================
+MD5 Fingerprint: A8:ED:DE:EB:93:88:66:D8:2F:C3:BD:1D:BE:45:BE:4D
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDTTCCAragAwIBAgIENm6ibzANBgkqhkiG9w0BAQUFADBSMQswCQYDVQQGEwJV
+UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMR0wGwYDVQQL
+ExREU1QgKEFOWCBOZXR3b3JrKSBDQTAeFw05ODEyMDkxNTQ2NDhaFw0xODEyMDkx
+NjE2NDhaMFIxCzAJBgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVy
+ZSBUcnVzdCBDby4xHTAbBgNVBAsTFERTVCAoQU5YIE5ldHdvcmspIENBMIGdMA0G
+CSqGSIb3DQEBAQUAA4GLADCBhwKBgQC0SBGAWKDVpZkP9jcsRLZu0XzzKmueEbaI
+IwRccSWeahJ3EW6/aDllqPay9qIYsokVoGe3eowiSGv2hDQftsr3G3LL8ltI04ce
+InYTBLSsbJZ/5w4IyTJRMC3VgOghZ7rzXggkLAdZnZAa7kbJtaQelrRBkdR/0o04
+JrBvQ24JfQIBA6OCATAwggEsMBEGCWCGSAGG+EIBAQQEAwIABzB0BgNVHR8EbTBr
+MGmgZ6BlpGMwYTELMAkGA1UEBhMCVVMxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0
+dXJlIFRydXN0IENvLjEdMBsGA1UECxMURFNUIChBTlggTmV0d29yaykgQ0ExDTAL
+BgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkxNTQ2NDhagQ8yMDE4MTIw
+OTE1NDY0OFowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFIwWVXDMFgpTZMKlhKqz
+ZBdDP4I2MB0GA1UdDgQWBBSMFlVwzBYKU2TCpYSqs2QXQz+CNjAMBgNVHRMEBTAD
+AQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqGSIb3DQEBBQUAA4GB
+AEklyWCxDF+pORDTxTRVfc95wynr3vnCQPnoVsXwL+z02exIUbhjOF6TbhiWhbnK
+UJykuOpmJmiThW9vTHHQvnoLPDG5975pnhDX0UDorBZxq66rOOFwscqSFuBdhaYY
+gAYAnOGmGEJRp2hoWe8mlF+tMQz+KR4XAYQ3W+gSMqNd
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 913220207 (0x366ea26f)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Digital Signature Trust Co., OU=DST (ANX Network) CA
+        Validity
+            Not Before: Dec  9 15:46:48 1998 GMT
+            Not After : Dec  9 16:16:48 2018 GMT
+        Subject: C=US, O=Digital Signature Trust Co., OU=DST (ANX Network) CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b4:48:11:80:58:a0:d5:a5:99:0f:f6:37:2c:44:
+                    b6:6e:d1:7c:f3:2a:6b:9e:11:b6:88:23:04:5c:71:
+                    25:9e:6a:12:77:11:6e:bf:68:39:65:a8:f6:b2:f6:
+                    a2:18:b2:89:15:a0:67:b7:7a:8c:22:48:6b:f6:84:
+                    34:1f:b6:ca:f7:1b:72:cb:f2:5b:48:d3:87:1e:22:
+                    76:13:04:b4:ac:6c:96:7f:e7:0e:08:c9:32:51:30:
+                    2d:d5:80:e8:21:67:ba:f3:5e:08:24:2c:07:59:9d:
+                    90:1a:ee:46:c9:b5:a4:1e:96:b4:41:91:d4:7f:d2:
+                    8d:38:26:b0:6f:43:6e:09:7d
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Digital Signature Trust Co./OU=DST (ANX Network) CA/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not Before: Dec  9 15:46:48 1998 GMT, Not After: Dec  9 15:46:48 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:8C:16:55:70:CC:16:0A:53:64:C2:A5:84:AA:B3:64:17:43:3F:82:36
+
+            X509v3 Subject Key Identifier: 
+                8C:16:55:70:CC:16:0A:53:64:C2:A5:84:AA:B3:64:17:43:3F:82:36
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        49:25:c9:60:b1:0c:5f:a9:39:10:d3:c5:34:55:7d:cf:79:c3:
+        29:eb:de:f9:c2:40:f9:e8:56:c5:f0:2f:ec:f4:d9:ec:48:51:
+        b8:63:38:5e:93:6e:18:96:85:b9:ca:50:9c:a4:b8:ea:66:26:
+        68:93:85:6f:6f:4c:71:d0:be:7a:0b:3c:31:b9:f7:be:69:9e:
+        10:d7:d1:40:e8:ac:16:71:ab:ae:ab:38:e1:70:b1:ca:92:16:
+        e0:5d:85:a6:18:80:06:00:9c:e1:a6:18:42:51:a7:68:68:59:
+        ef:26:94:5f:ad:31:0c:fe:29:1e:17:01:84:37:5b:e8:12:32:
+        a3:5d
+
+American Express CA
+===================
+MD5 Fingerprint: 1C:D5:8E:82:BE:70:55:8E:39:61:DF:AD:51:DB:6B:A0
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICkDCCAfkCAgCNMA0GCSqGSIb3DQEBBAUAMIGPMQswCQYDVQQGEwJVUzEnMCUG
+A1UEChMeQW1lcmljYW4gRXhwcmVzcyBDb21wYW55LCBJbmMuMSYwJAYDVQQLEx1B
+bWVyaWNhbiBFeHByZXNzIFRlY2hub2xvZ2llczEvMC0GA1UEAxMmQW1lcmljYW4g
+RXhwcmVzcyBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNOTgwODE0MjIwMTAwWhcN
+MDYwODE0MjM1OTAwWjCBjzELMAkGA1UEBhMCVVMxJzAlBgNVBAoTHkFtZXJpY2Fu
+IEV4cHJlc3MgQ29tcGFueSwgSW5jLjEmMCQGA1UECxMdQW1lcmljYW4gRXhwcmVz
+cyBUZWNobm9sb2dpZXMxLzAtBgNVBAMTJkFtZXJpY2FuIEV4cHJlc3MgQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJ8kmS
+hcr9FSm1BrZE7PyIo/KGzv8UTyQckvnCI8HOQ99dNMi4FOzVKnCRSZXXVs2U8amT
+0Ggi3E19oApyKkfqJfCFAF82VGHPC/k3Wmed6R/pZD9wlWGn0DAC3iYopGYDBOkw
++48zB/lvYYeictvzaHhjZlmpybdm4RWySDYs+QIDAQABMA0GCSqGSIb3DQEBBAUA
+A4GBAGgXYrhzi0xs60qlPqvlnS7SzYoHV/PGWZd2Fxf4Uo4nk9hY2Chs9KIEeorC
+diSxArTfKPL386infiNIYYj0EWiuJl32oUtTJWrYKhQCDuCHIG6eGVxzkAsj4jGX
+Iz/VIqLTBnvaN/XXtUFEF3pFAtmFRWbWjsfwegyZYiJpW+3S
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 141 (0x8d)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, O=American Express Company, Inc., OU=American Express Technologies, CN=American Express Certificate Authority
+        Validity
+            Not Before: Aug 14 22:01:00 1998 GMT
+            Not After : Aug 14 23:59:00 2006 GMT
+        Subject: C=US, O=American Express Company, Inc., OU=American Express Technologies, CN=American Express Certificate Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c9:f2:49:92:85:ca:fd:15:29:b5:06:b6:44:ec:
+                    fc:88:a3:f2:86:ce:ff:14:4f:24:1c:92:f9:c2:23:
+                    c1:ce:43:df:5d:34:c8:b8:14:ec:d5:2a:70:91:49:
+                    95:d7:56:cd:94:f1:a9:93:d0:68:22:dc:4d:7d:a0:
+                    0a:72:2a:47:ea:25:f0:85:00:5f:36:54:61:cf:0b:
+                    f9:37:5a:67:9d:e9:1f:e9:64:3f:70:95:61:a7:d0:
+                    30:02:de:26:28:a4:66:03:04:e9:30:fb:8f:33:07:
+                    f9:6f:61:87:a2:72:db:f3:68:78:63:66:59:a9:c9:
+                    b7:66:e1:15:b2:48:36:2c:f9
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        68:17:62:b8:73:8b:4c:6c:eb:4a:a5:3e:ab:e5:9d:2e:d2:cd:
+        8a:07:57:f3:c6:59:97:76:17:17:f8:52:8e:27:93:d8:58:d8:
+        28:6c:f4:a2:04:7a:8a:c2:76:24:b1:02:b4:df:28:f2:f7:f3:
+        a8:a7:7e:23:48:61:88:f4:11:68:ae:26:5d:f6:a1:4b:53:25:
+        6a:d8:2a:14:02:0e:e0:87:20:6e:9e:19:5c:73:90:0b:23:e2:
+        31:97:23:3f:d5:22:a2:d3:06:7b:da:37:f5:d7:b5:41:44:17:
+        7a:45:02:d9:85:45:66:d6:8e:c7:f0:7a:0c:99:62:22:69:5b:
+        ed:d2
+
+American Express Global CA
+==========================
+MD5 Fingerprint: 63:1B:66:93:8C:F3:66:CB:3C:79:57:DC:05:49:EA:DB
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEBDCCAuygAwIBAgICAIUwDQYJKoZIhvcNAQEFBQAwgZYxCzAJBgNVBAYTAlVT
+MScwJQYDVQQKEx5BbWVyaWNhbiBFeHByZXNzIENvbXBhbnksIEluYy4xJjAkBgNV
+BAsTHUFtZXJpY2FuIEV4cHJlc3MgVGVjaG5vbG9naWVzMTYwNAYDVQQDEy1BbWVy
+aWNhbiBFeHByZXNzIEdsb2JhbCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNOTgw
+ODE0MTkwNjAwWhcNMTMwODE0MjM1OTAwWjCBljELMAkGA1UEBhMCVVMxJzAlBgNV
+BAoTHkFtZXJpY2FuIEV4cHJlc3MgQ29tcGFueSwgSW5jLjEmMCQGA1UECxMdQW1l
+cmljYW4gRXhwcmVzcyBUZWNobm9sb2dpZXMxNjA0BgNVBAMTLUFtZXJpY2FuIEV4
+cHJlc3MgR2xvYmFsIENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAPAkJmYu++tKc3FTiUfLJjxTkpRMysKFtQ34w1e9
+Lyofahi3V68MABb6oLaQpvcaoS5mJsdoo4qTaWa1RlYtHYLqkAwKIsKJUI0F89Sr
+c0HwzxKsKLRvFJSWWUuekHWG3+JH6+HpT0N+h8onGGaetcFAZX38YW+tm3LPqV7Y
+8/nabpEQ+ky16n4g3qk5L/WI5IpvNcYgnCuGRjMK/DFVpWusFkDpzTVZbzIEw3u1
+D3t3cPNIuypSgs6vKW3xEW9t5gcAAe+a8yYNpnkTZ6/4qxx1rJG1a75AsN6cDLFp
+hRlxkRNFyt/R/eayypaDedvFuKpbepALeFY+xteflEgR9a0CAwEAAaNaMFgwEgYD
+VR0TAQH/BAgwBgEB/wIBBTAOBgNVHQ8BAf8EBAMCAQYwFwYDVR0gBBAwDjAMBgoq
+hkiG+Q8KAQUBMBkGA1UdDgQSBBBXRzV7NicRqAj8L0Yl6yRpMA0GCSqGSIb3DQEB
+BQUAA4IBAQDHYUWoinG5vjTpIXshzVYTmNUwY+kYqkuSFb8LHbvskmnFLsNhi+gw
+RcsQRsFzOFyLGdIr80DrfHKzLh4n43WVihybLsSVBYZy0FX0oZJSeVzb9Pjc5dcS
+sUDHPIbkMWVKyjfG3nZXGWlMRmn8Kq0WN3qTrPchSy3766lQy8HRQAjaA2mHpzde
+VcHF7cTjjgwml5tcV0ty4/IDBdACOyYDQJCevgtbSQx48dVMVSng9v1MA6lUAjLR
+V1qFrEPtWzsWX6C/NdtLnnvo/+cNPDuom0lBRvVzTv+SZSGDE1Vx60k8f4gawhIo
+JaFGS0E3l3/sjvHUoZbCILZerakcHhGg
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 133 (0x85)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=American Express Company, Inc., OU=American Express Technologies, CN=American Express Global Certificate Authority
+        Validity
+            Not Before: Aug 14 19:06:00 1998 GMT
+            Not After : Aug 14 23:59:00 2013 GMT
+        Subject: C=US, O=American Express Company, Inc., OU=American Express Technologies, CN=American Express Global Certificate Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:f0:24:26:66:2e:fb:eb:4a:73:71:53:89:47:cb:
+                    26:3c:53:92:94:4c:ca:c2:85:b5:0d:f8:c3:57:bd:
+                    2f:2a:1f:6a:18:b7:57:af:0c:00:16:fa:a0:b6:90:
+                    a6:f7:1a:a1:2e:66:26:c7:68:a3:8a:93:69:66:b5:
+                    46:56:2d:1d:82:ea:90:0c:0a:22:c2:89:50:8d:05:
+                    f3:d4:ab:73:41:f0:cf:12:ac:28:b4:6f:14:94:96:
+                    59:4b:9e:90:75:86:df:e2:47:eb:e1:e9:4f:43:7e:
+                    87:ca:27:18:66:9e:b5:c1:40:65:7d:fc:61:6f:ad:
+                    9b:72:cf:a9:5e:d8:f3:f9:da:6e:91:10:fa:4c:b5:
+                    ea:7e:20:de:a9:39:2f:f5:88:e4:8a:6f:35:c6:20:
+                    9c:2b:86:46:33:0a:fc:31:55:a5:6b:ac:16:40:e9:
+                    cd:35:59:6f:32:04:c3:7b:b5:0f:7b:77:70:f3:48:
+                    bb:2a:52:82:ce:af:29:6d:f1:11:6f:6d:e6:07:00:
+                    01:ef:9a:f3:26:0d:a6:79:13:67:af:f8:ab:1c:75:
+                    ac:91:b5:6b:be:40:b0:de:9c:0c:b1:69:85:19:71:
+                    91:13:45:ca:df:d1:fd:e6:b2:ca:96:83:79:db:c5:
+                    b8:aa:5b:7a:90:0b:78:56:3e:c6:d7:9f:94:48:11:
+                    f5:ad
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:5
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Certificate Policies: 
+                Policy: 1.2.840.113807.10.1.5.1
+
+            X509v3 Subject Key Identifier: 
+                57:47:35:7B:36:27:11:A8:08:FC:2F:46:25:EB:24:69
+    Signature Algorithm: sha1WithRSAEncryption
+        c7:61:45:a8:8a:71:b9:be:34:e9:21:7b:21:cd:56:13:98:d5:
+        30:63:e9:18:aa:4b:92:15:bf:0b:1d:bb:ec:92:69:c5:2e:c3:
+        61:8b:e8:30:45:cb:10:46:c1:73:38:5c:8b:19:d2:2b:f3:40:
+        eb:7c:72:b3:2e:1e:27:e3:75:95:8a:1c:9b:2e:c4:95:05:86:
+        72:d0:55:f4:a1:92:52:79:5c:db:f4:f8:dc:e5:d7:12:b1:40:
+        c7:3c:86:e4:31:65:4a:ca:37:c6:de:76:57:19:69:4c:46:69:
+        fc:2a:ad:16:37:7a:93:ac:f7:21:4b:2d:fb:eb:a9:50:cb:c1:
+        d1:40:08:da:03:69:87:a7:37:5e:55:c1:c5:ed:c4:e3:8e:0c:
+        26:97:9b:5c:57:4b:72:e3:f2:03:05:d0:02:3b:26:03:40:90:
+        9e:be:0b:5b:49:0c:78:f1:d5:4c:55:29:e0:f6:fd:4c:03:a9:
+        54:02:32:d1:57:5a:85:ac:43:ed:5b:3b:16:5f:a0:bf:35:db:
+        4b:9e:7b:e8:ff:e7:0d:3c:3b:a8:9b:49:41:46:f5:73:4e:ff:
+        92:65:21:83:13:55:71:eb:49:3c:7f:88:1a:c2:12:28:25:a1:
+        46:4b:41:37:97:7f:ec:8e:f1:d4:a1:96:c2:20:b6:5e:ad:a9:
+        1c:1e:11:a0
+
+BelSign Object Publishing CA
+============================
+MD5 Fingerprint: 8A:02:F8:DF:B8:E1:84:9F:5A:C2:60:24:65:D1:73:FB
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDAzCCAmygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBuzELMAkGA1UEBhMCQkUx
+ETAPBgNVBAcTCEJydXNzZWxzMRMwEQYDVQQKEwpCZWxTaWduIE5WMTgwNgYDVQQL
+Ey9CZWxTaWduIE9iamVjdCBQdWJsaXNoaW5nIENlcnRpZmljYXRlIEF1dGhvcml0
+eTElMCMGA1UEAxMcQmVsU2lnbiBPYmplY3QgUHVibGlzaGluZyBDQTEjMCEGCSqG
+SIb3DQEJARYUd2VibWFzdGVyQGJlbHNpZ24uYmUwHhcNOTcwOTE5MjIwMzAwWhcN
+MDcwOTE5MjIwMzAwWjCBuzELMAkGA1UEBhMCQkUxETAPBgNVBAcTCEJydXNzZWxz
+MRMwEQYDVQQKEwpCZWxTaWduIE5WMTgwNgYDVQQLEy9CZWxTaWduIE9iamVjdCBQ
+dWJsaXNoaW5nIENlcnRpZmljYXRlIEF1dGhvcml0eTElMCMGA1UEAxMcQmVsU2ln
+biBPYmplY3QgUHVibGlzaGluZyBDQTEjMCEGCSqGSIb3DQEJARYUd2VibWFzdGVy
+QGJlbHNpZ24uYmUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMQuH7a/7oJA
+3fm3LkHVngWxWtAmfGJVA5v8y2HeS+/+6Jn+h7mIz5DaDwk8dt8Xl7bLPyVF/bS8
+WAC+sFq2FIeP7mdkrR2Ig7tnn2VhAFgIgFCfgMkx9iqQHC33SmwQ9iNDXTgJYIhX
+As0WbBj8zfuSKnfQnpOjXYhk0Mj4XVRRAgMBAAGjFTATMBEGCWCGSAGG+EIBAQQE
+AwIABzANBgkqhkiG9w0BAQQFAAOBgQBjdhd8lvBTpV0BHFPOKcJ+daxMDaIIc7Rq
+Mf0CBhSZ3FQEpL/IloafMUMyJVf2hfYluze+oXkjyVcGJXFrRU/49AJAFoIir1Tq
+Mij2De6ZuksIUQ9uhiMhTC0liIHELg7xEyw4ipUCJMM6lWPkk45IuwhHcl+u5jpa
+R9Zxxp6aUg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, L=Brussels, O=BelSign NV, OU=BelSign Object Publishing Certificate Authority, CN=BelSign Object Publishing CA/Email=webmaster@belsign.be
+        Validity
+            Not Before: Sep 19 22:03:00 1997 GMT
+            Not After : Sep 19 22:03:00 2007 GMT
+        Subject: C=BE, L=Brussels, O=BelSign NV, OU=BelSign Object Publishing Certificate Authority, CN=BelSign Object Publishing CA/Email=webmaster@belsign.be
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c4:2e:1f:b6:bf:ee:82:40:dd:f9:b7:2e:41:d5:
+                    9e:05:b1:5a:d0:26:7c:62:55:03:9b:fc:cb:61:de:
+                    4b:ef:fe:e8:99:fe:87:b9:88:cf:90:da:0f:09:3c:
+                    76:df:17:97:b6:cb:3f:25:45:fd:b4:bc:58:00:be:
+                    b0:5a:b6:14:87:8f:ee:67:64:ad:1d:88:83:bb:67:
+                    9f:65:61:00:58:08:80:50:9f:80:c9:31:f6:2a:90:
+                    1c:2d:f7:4a:6c:10:f6:23:43:5d:38:09:60:88:57:
+                    02:cd:16:6c:18:fc:cd:fb:92:2a:77:d0:9e:93:a3:
+                    5d:88:64:d0:c8:f8:5d:54:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        63:76:17:7c:96:f0:53:a5:5d:01:1c:53:ce:29:c2:7e:75:ac:
+        4c:0d:a2:08:73:b4:6a:31:fd:02:06:14:99:dc:54:04:a4:bf:
+        c8:96:86:9f:31:43:32:25:57:f6:85:f6:25:bb:37:be:a1:79:
+        23:c9:57:06:25:71:6b:45:4f:f8:f4:02:40:16:82:22:af:54:
+        ea:32:28:f6:0d:ee:99:ba:4b:08:51:0f:6e:86:23:21:4c:2d:
+        25:88:81:c4:2e:0e:f1:13:2c:38:8a:95:02:24:c3:3a:95:63:
+        e4:93:8e:48:bb:08:47:72:5f:ae:e6:3a:5a:47:d6:71:c6:9e:
+        9a:52
+
+BelSign Secure Server CA
+========================
+MD5 Fingerprint: 3D:5E:82:C6:D9:AD:D9:8B:93:6B:0C:10:B9:49:0A:B1
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIC8zCCAlygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBszELMAkGA1UEBhMCQkUx
+ETAPBgNVBAcTCEJydXNzZWxzMRMwEQYDVQQKEwpCZWxTaWduIE5WMTQwMgYDVQQL
+EytCZWxTaWduIFNlY3VyZSBTZXJ2ZXIgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSEw
+HwYDVQQDExhCZWxTaWduIFNlY3VyZSBTZXJ2ZXIgQ0ExIzAhBgkqhkiG9w0BCQEW
+FHdlYm1hc3RlckBiZWxzaWduLmJlMB4XDTk3MDcxNjIyMDA1NFoXDTA3MDcxNjIy
+MDA1NFowgbMxCzAJBgNVBAYTAkJFMREwDwYDVQQHEwhCcnVzc2VsczETMBEGA1UE
+ChMKQmVsU2lnbiBOVjE0MDIGA1UECxMrQmVsU2lnbiBTZWN1cmUgU2VydmVyIENl
+cnRpZmljYXRlIEF1dGhvcml0eTEhMB8GA1UEAxMYQmVsU2lnbiBTZWN1cmUgU2Vy
+dmVyIENBMSMwIQYJKoZIhvcNAQkBFhR3ZWJtYXN0ZXJAYmVsc2lnbi5iZTCBnzAN
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1gESeJL4BEJ/yccig/x8R3AwK0kLPjZA
+kCjaIXODU/LE0RZAwFP/rqbGJLMnbaWzPTl3XagG9ubpvGMRTgZlcAqdk/miQIt/
+SoQOjRax1swIZBIM4ChLyKWEkBf7EUYu1qeFGMsYrmOasFgG9ADP+MQJGjUMofnu
+Sv1t3v4mpTsCAwEAAaMVMBMwEQYJYIZIAYb4QgEBBAQDAgCgMA0GCSqGSIb3DQEB
+BAUAA4GBAGw9mcMF4h3K5S2qaIWLQDEgZhNo5lg6idCNdbLFYth9go/32TKBd/Y1
+W4UpzmeyubwrGXjP84f9RvGVdbIJVwMwwXrNckdxgMp9ncllPEcRIn36BwsoeKGT
+6AVFSOIyMko96FMcELfHc4wHUOH5yStTQfWDjeUJOUqOA2KqQGOL
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, L=Brussels, O=BelSign NV, OU=BelSign Secure Server Certificate Authority, CN=BelSign Secure Server CA/Email=webmaster@belsign.be
+        Validity
+            Not Before: Jul 16 22:00:54 1997 GMT
+            Not After : Jul 16 22:00:54 2007 GMT
+        Subject: C=BE, L=Brussels, O=BelSign NV, OU=BelSign Secure Server Certificate Authority, CN=BelSign Secure Server CA/Email=webmaster@belsign.be
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d6:01:12:78:92:f8:04:42:7f:c9:c7:22:83:fc:
+                    7c:47:70:30:2b:49:0b:3e:36:40:90:28:da:21:73:
+                    83:53:f2:c4:d1:16:40:c0:53:ff:ae:a6:c6:24:b3:
+                    27:6d:a5:b3:3d:39:77:5d:a8:06:f6:e6:e9:bc:63:
+                    11:4e:06:65:70:0a:9d:93:f9:a2:40:8b:7f:4a:84:
+                    0e:8d:16:b1:d6:cc:08:64:12:0c:e0:28:4b:c8:a5:
+                    84:90:17:fb:11:46:2e:d6:a7:85:18:cb:18:ae:63:
+                    9a:b0:58:06:f4:00:cf:f8:c4:09:1a:35:0c:a1:f9:
+                    ee:4a:fd:6d:de:fe:26:a5:3b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL Client, S/MIME
+    Signature Algorithm: md5WithRSAEncryption
+        6c:3d:99:c3:05:e2:1d:ca:e5:2d:aa:68:85:8b:40:31:20:66:
+        13:68:e6:58:3a:89:d0:8d:75:b2:c5:62:d8:7d:82:8f:f7:d9:
+        32:81:77:f6:35:5b:85:29:ce:67:b2:b9:bc:2b:19:78:cf:f3:
+        87:fd:46:f1:95:75:b2:09:57:03:30:c1:7a:cd:72:47:71:80:
+        ca:7d:9d:c9:65:3c:47:11:22:7d:fa:07:0b:28:78:a1:93:e8:
+        05:45:48:e2:32:32:4a:3d:e8:53:1c:10:b7:c7:73:8c:07:50:
+        e1:f9:c9:2b:53:41:f5:83:8d:e5:09:39:4a:8e:03:62:aa:40:
+        63:8b
+
+Deutsche Telekom AG Root CA
+===========================
+MD5 Fingerprint: 77:DE:04:94:77:D0:0C:5F:A7:B1:F4:30:18:87:FB:55
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICjjCCAfegAwIBAgIBBjANBgkqhkiG9w0BAQQFADBtMQswCQYDVQQGEwJERTEc
+MBoGA1UEChMTRGV1dHNjaGUgVGVsZWtvbSBBRzEdMBsGA1UECxMUVGVsZVNlYyBU
+cnVzdCBDZW50ZXIxITAfBgNVBAMTGERldXRzY2hlIFRlbGVrb20gUm9vdCBDQTAe
+Fw05ODEyMDkwOTExMDBaFw0wNDEyMDkyMzU5MDBaMG0xCzAJBgNVBAYTAkRFMRww
+GgYDVQQKExNEZXV0c2NoZSBUZWxla29tIEFHMR0wGwYDVQQLExRUZWxlU2VjIFRy
+dXN0IENlbnRlcjEhMB8GA1UEAxMYRGV1dHNjaGUgVGVsZWtvbSBSb290IENBMIGf
+MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdBSz5BbO5EtdpcffqVjAIVxRDe7sa
+nG0vV2HX4vVEa+42QZb2ZM7hwbK5pBQEmFDocPiONZp9ScFhHVmu2gYYlX2tzuyp
+vtEYD0CRdiqj5f3+iRX0V/fgVdp1rQD0LME1zLRDJlViRC4BJZyKW/DB0AA1eP41
+3pRAZHiDocw5iQIDAQABoz4wPDAPBgNVHRMECDAGAQH/AgEFMA4GA1UdDwEB/wQE
+AwIBBjAZBgNVHQ4EEgQQLIdZH4sTgLL5hp0+En5YljANBgkqhkiG9w0BAQQFAAOB
+gQAP/nO1B4hvoAuJ6spQH5TelCsLJ15P9RyVJtqMllStGZE3Q12ryYuzzW+YOT3t
+3TXjcbftE5OD6IblKTMTE7w1e/0oL3BZ1dO0jSgTWTvI1XT5RcIHYKq4GFT5pWj/
+1wXVj7YFMS5BSvQQH2BHGguLGU2SVyDS71AZ6M3QcLy8Ng==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, O=Deutsche Telekom AG, OU=TeleSec Trust Center, CN=Deutsche Telekom Root CA
+        Validity
+            Not Before: Dec  9 09:11:00 1998 GMT
+            Not After : Dec  9 23:59:00 2004 GMT
+        Subject: C=DE, O=Deutsche Telekom AG, OU=TeleSec Trust Center, CN=Deutsche Telekom Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:dd:05:2c:f9:05:b3:b9:12:d7:69:71:f7:ea:56:
+                    30:08:57:14:43:7b:bb:1a:9c:6d:2f:57:61:d7:e2:
+                    f5:44:6b:ee:36:41:96:f6:64:ce:e1:c1:b2:b9:a4:
+                    14:04:98:50:e8:70:f8:8e:35:9a:7d:49:c1:61:1d:
+                    59:ae:da:06:18:95:7d:ad:ce:ec:a9:be:d1:18:0f:
+                    40:91:76:2a:a3:e5:fd:fe:89:15:f4:57:f7:e0:55:
+                    da:75:ad:00:f4:2c:c1:35:cc:b4:43:26:55:62:44:
+                    2e:01:25:9c:8a:5b:f0:c1:d0:00:35:78:fe:35:de:
+                    94:40:64:78:83:a1:cc:39:89
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:TRUE, pathlen:5
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                2C:87:59:1F:8B:13:80:B2:F9:86:9D:3E:12:7E:58:96
+    Signature Algorithm: md5WithRSAEncryption
+        0f:fe:73:b5:07:88:6f:a0:0b:89:ea:ca:50:1f:94:de:94:2b:
+        0b:27:5e:4f:f5:1c:95:26:da:8c:96:54:ad:19:91:37:43:5d:
+        ab:c9:8b:b3:cd:6f:98:39:3d:ed:dd:35:e3:71:b7:ed:13:93:
+        83:e8:86:e5:29:33:13:13:bc:35:7b:fd:28:2f:70:59:d5:d3:
+        b4:8d:28:13:59:3b:c8:d5:74:f9:45:c2:07:60:aa:b8:18:54:
+        f9:a5:68:ff:d7:05:d5:8f:b6:05:31:2e:41:4a:f4:10:1f:60:
+        47:1a:0b:8b:19:4d:92:57:20:d2:ef:50:19:e8:cd:d0:70:bc:
+        bc:36
+
+Digital Signature Trust Co. Global CA 1
+=======================================
+MD5 Fingerprint: 25:7A:BA:83:2E:B6:A2:0B:DA:FE:F5:02:0F:08:D7:AD
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgIENnAVljANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV
+UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL
+EwhEU1RDQSBFMTAeFw05ODEyMTAxODEwMjNaFw0xODEyMTAxODQwMjNaMEYxCzAJ
+BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x
+ETAPBgNVBAsTCERTVENBIEUxMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCg
+bIGpzzQeJN3+hijM3oMv+V7UQtLodGBmE5gGHKlREmlvMVW5SXIACH7TpWJENySZ
+j9mDSI+ZbZUTu0M7LklOiDfBu1h//uG9+LthzfNHwJmm8fOR6Hh8AMthyUQncWlV
+Sn5JTe2io74CTADKAqjuAQIxZA9SLRN0dja1erQtcQIBA6OCASQwggEgMBEGCWCG
+SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx
+JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI
+RFNUQ0EgRTExDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMTAxODEw
+MjNagQ8yMDE4MTIxMDE4MTAyM1owCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFGp5
+fpFpRhgTCgJ3pVlbYJglDqL4MB0GA1UdDgQWBBRqeX6RaUYYEwoCd6VZW2CYJQ6i
++DAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG
+SIb3DQEBBQUAA4GBACIS2Hod3IEGtgllsofIH160L+nEHvI8wbsEkBFKg05+k7lN
+QseSJqBcNJo4cvj9axY+IO6CizEqkzaFI4iKPANo08kJD038bKTaKHKTDomAsH3+
+gG9lbRgzl4vCa4nuYD3Im+9/KzJic5PLPON74nZ4RbyhkwS7hp86W0N6w4pl
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 913315222 (0x36701596)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E1
+        Validity
+            Not Before: Dec 10 18:10:23 1998 GMT
+            Not After : Dec 10 18:40:23 2018 GMT
+        Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:a0:6c:81:a9:cf:34:1e:24:dd:fe:86:28:cc:de:
+                    83:2f:f9:5e:d4:42:d2:e8:74:60:66:13:98:06:1c:
+                    a9:51:12:69:6f:31:55:b9:49:72:00:08:7e:d3:a5:
+                    62:44:37:24:99:8f:d9:83:48:8f:99:6d:95:13:bb:
+                    43:3b:2e:49:4e:88:37:c1:bb:58:7f:fe:e1:bd:f8:
+                    bb:61:cd:f3:47:c0:99:a6:f1:f3:91:e8:78:7c:00:
+                    cb:61:c9:44:27:71:69:55:4a:7e:49:4d:ed:a2:a3:
+                    be:02:4c:00:ca:02:a8:ee:01:02:31:64:0f:52:2d:
+                    13:74:76:36:b5:7a:b4:2d:71
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E1/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not Before: Dec 10 18:10:23 1998 GMT, Not After: Dec 10 18:10:23 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8
+
+            X509v3 Subject Key Identifier: 
+                6A:79:7E:91:69:46:18:13:0A:02:77:A5:59:5B:60:98:25:0E:A2:F8
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        22:12:d8:7a:1d:dc:81:06:b6:09:65:b2:87:c8:1f:5e:b4:2f:
+        e9:c4:1e:f2:3c:c1:bb:04:90:11:4a:83:4e:7e:93:b9:4d:42:
+        c7:92:26:a0:5c:34:9a:38:72:f8:fd:6b:16:3e:20:ee:82:8b:
+        31:2a:93:36:85:23:88:8a:3c:03:68:d3:c9:09:0f:4d:fc:6c:
+        a4:da:28:72:93:0e:89:80:b0:7d:fe:80:6f:65:6d:18:33:97:
+        8b:c2:6b:89:ee:60:3d:c8:9b:ef:7f:2b:32:62:73:93:cb:3c:
+        e3:7b:e2:76:78:45:bc:a1:93:04:bb:86:9f:3a:5b:43:7a:c3:
+        8a:65
+
+Digital Signature Trust Co. Global CA 2
+=======================================
+MD5 Fingerprint: 6C:C9:A7:6E:47:F1:0C:E3:53:3B:78:4C:4D:C2:6A:C5
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIID2DCCAsACEQDQHkCLAAACfAAAAAIAAAABMA0GCSqGSIb3DQEBBQUAMIGpMQsw
+CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp
+dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE
+CxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDExITAfBgkqhkiG9w0B
+CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODEyMDExODE4NTVaFw0wODExMjgx
+ODE4NTVaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO
+U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0
+IENvLjERMA8GA1UECxMIRFNUQ0EgWDExFjAUBgNVBAMTDURTVCBSb290Q0EgWDEx
+ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBANLGJrbnpT3BxGjVUG9TxW9JEwm4ryxIjRRqoxdf
+WvnTLnUv2Chi0ZMv/E3Uq4flCMeZ55I/db3rJbQVwZsZPdJEjdd0IG03Ao9pk1uK
+xBmd9LIO/BZsubEFkoPRhSxglD5FVaDZqwgh5mDoO3TymVBRaNADLbGAvqPYUrBE
+zUNKcI5YhZXhTizWLUFv1oTnyJhEykfbLCSlaSbPa7gnYsP0yXqSI+0TZ4KuRS5F
+5X5yP4WdlGIQ5jyRoa13AOAV7POEgHJ6jm5gl8ckWRA0g1vhpaRptlc1HHhZxtMv
+OnNn7pTKBBMFYgZwI7P0fO5F2WQLW0mqpEPOJsREEmy43XkCAwEAATANBgkqhkiG
+9w0BAQUFAAOCAQEAojeyP2n714Z5VEkxlTMr89EJFEliYIalsBHiUMIdBlc+Legz
+ZL6bqq1fG03UmZWii5rJYnK1aerZWKs17RWiQ9a2vAd5ZWRzfdd5ynvVWlHG4VME
+lo04z6MXrDlxawHDi1M8Y+nuecDkvpIyZHqzH5eUYr3qsiAVlfuX8ngvYzZAOONG
+Dx3drJXK50uQe7FLqdTF65raqtWjlBRGjS0f8zrWkzr2Pnn86Oawde3uPclwx12q
+gUtGJRzHbBXjlU4PqjI3lAoXJJIThFjSY28r9+ZbYgsTF7ANUkz+/m9c4pFuHf2k
+Ytdo+o56T9II2pPc8JIRetDccpMMc5NihWjQ9A==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            d0:1e:40:8b:00:00:02:7c:00:00:00:02:00:00:00:01
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/Email=ca@digsigtrust.com
+        Validity
+            Not Before: Dec  1 18:18:55 1998 GMT
+            Not After : Nov 28 18:18:55 2008 GMT
+        Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X1, CN=DST RootCA X1/Email=ca@digsigtrust.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d2:c6:26:b6:e7:a5:3d:c1:c4:68:d5:50:6f:53:
+                    c5:6f:49:13:09:b8:af:2c:48:8d:14:6a:a3:17:5f:
+                    5a:f9:d3:2e:75:2f:d8:28:62:d1:93:2f:fc:4d:d4:
+                    ab:87:e5:08:c7:99:e7:92:3f:75:bd:eb:25:b4:15:
+                    c1:9b:19:3d:d2:44:8d:d7:74:20:6d:37:02:8f:69:
+                    93:5b:8a:c4:19:9d:f4:b2:0e:fc:16:6c:b9:b1:05:
+                    92:83:d1:85:2c:60:94:3e:45:55:a0:d9:ab:08:21:
+                    e6:60:e8:3b:74:f2:99:50:51:68:d0:03:2d:b1:80:
+                    be:a3:d8:52:b0:44:cd:43:4a:70:8e:58:85:95:e1:
+                    4e:2c:d6:2d:41:6f:d6:84:e7:c8:98:44:ca:47:db:
+                    2c:24:a5:69:26:cf:6b:b8:27:62:c3:f4:c9:7a:92:
+                    23:ed:13:67:82:ae:45:2e:45:e5:7e:72:3f:85:9d:
+                    94:62:10:e6:3c:91:a1:ad:77:00:e0:15:ec:f3:84:
+                    80:72:7a:8e:6e:60:97:c7:24:59:10:34:83:5b:e1:
+                    a5:a4:69:b6:57:35:1c:78:59:c6:d3:2f:3a:73:67:
+                    ee:94:ca:04:13:05:62:06:70:23:b3:f4:7c:ee:45:
+                    d9:64:0b:5b:49:aa:a4:43:ce:26:c4:44:12:6c:b8:
+                    dd:79
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        a2:37:b2:3f:69:fb:d7:86:79:54:49:31:95:33:2b:f3:d1:09:
+        14:49:62:60:86:a5:b0:11:e2:50:c2:1d:06:57:3e:2d:e8:33:
+        64:be:9b:aa:ad:5f:1b:4d:d4:99:95:a2:8b:9a:c9:62:72:b5:
+        69:ea:d9:58:ab:35:ed:15:a2:43:d6:b6:bc:07:79:65:64:73:
+        7d:d7:79:ca:7b:d5:5a:51:c6:e1:53:04:96:8d:38:cf:a3:17:
+        ac:39:71:6b:01:c3:8b:53:3c:63:e9:ee:79:c0:e4:be:92:32:
+        64:7a:b3:1f:97:94:62:bd:ea:b2:20:15:95:fb:97:f2:78:2f:
+        63:36:40:38:e3:46:0f:1d:dd:ac:95:ca:e7:4b:90:7b:b1:4b:
+        a9:d4:c5:eb:9a:da:aa:d5:a3:94:14:46:8d:2d:1f:f3:3a:d6:
+        93:3a:f6:3e:79:fc:e8:e6:b0:75:ed:ee:3d:c9:70:c7:5d:aa:
+        81:4b:46:25:1c:c7:6c:15:e3:95:4e:0f:aa:32:37:94:0a:17:
+        24:92:13:84:58:d2:63:6f:2b:f7:e6:5b:62:0b:13:17:b0:0d:
+        52:4c:fe:fe:6f:5c:e2:91:6e:1d:fd:a4:62:d7:68:fa:8e:7a:
+        4f:d2:08:da:93:dc:f0:92:11:7a:d0:dc:72:93:0c:73:93:62:
+        85:68:d0:f4
+
+Digital Signature Trust Co. Global CA 3
+=======================================
+MD5 Fingerprint: 93:C2:8E:11:7B:D4:F3:03:19:BD:28:75:13:4A:45:4A
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgIENm7TzjANBgkqhkiG9w0BAQUFADBGMQswCQYDVQQGEwJV
+UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMREwDwYDVQQL
+EwhEU1RDQSBFMjAeFw05ODEyMDkxOTE3MjZaFw0xODEyMDkxOTQ3MjZaMEYxCzAJ
+BgNVBAYTAlVTMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4x
+ETAPBgNVBAsTCERTVENBIEUyMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC/
+k48Xku8zExjrEH9OFr//Bo8qhbxe+SSmJIi2A7fBw18DW9Fvrn5C6mYjuGODVvso
+LeE4i7TuqAHhzhy2iCoiRoX7n6dwqUcUP87eZfCocfdPJmyMvMa1795JJ/9IKn3o
+TQPMx7JSxhcxEzu1TdvIxPbDDyQq2gyd55FbgM2UnQIBA6OCASQwggEgMBEGCWCG
+SAGG+EIBAQQEAwIABzBoBgNVHR8EYTBfMF2gW6BZpFcwVTELMAkGA1UEBhMCVVMx
+JDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UECxMI
+RFNUQ0EgRTIxDTALBgNVBAMTBENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkxOTE3
+MjZagQ8yMDE4MTIwOTE5MTcyNlowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFB6C
+TShlgDzJQW6sNS5ay97u+DlbMB0GA1UdDgQWBBQegk0oZYA8yUFurDUuWsve7vg5
+WzAMBgNVHRMEBTADAQH/MBkGCSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqG
+SIb3DQEBBQUAA4GBAEeNg61i8tuwnkUiBbmi1gMOOHLnnvx75pO2mqWilMg0HZHR
+xdf0CiUPPXiBng+xZ8SQTGPdXqfiup/1902lMXucKS1M/mQ+7LZT/uqb7YLbdHVL
+B3luHtgZg3Pe9T7Qtd7nS2h9Qy4qIOF+oHhEngj1mPnHfxsb1gYgAlihw6ID
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 913232846 (0x366ed3ce)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Digital Signature Trust Co., OU=DSTCA E2
+        Validity
+            Not Before: Dec  9 19:17:26 1998 GMT
+            Not After : Dec  9 19:47:26 2018 GMT
+        Subject: C=US, O=Digital Signature Trust Co., OU=DSTCA E2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:bf:93:8f:17:92:ef:33:13:18:eb:10:7f:4e:16:
+                    bf:ff:06:8f:2a:85:bc:5e:f9:24:a6:24:88:b6:03:
+                    b7:c1:c3:5f:03:5b:d1:6f:ae:7e:42:ea:66:23:b8:
+                    63:83:56:fb:28:2d:e1:38:8b:b4:ee:a8:01:e1:ce:
+                    1c:b6:88:2a:22:46:85:fb:9f:a7:70:a9:47:14:3f:
+                    ce:de:65:f0:a8:71:f7:4f:26:6c:8c:bc:c6:b5:ef:
+                    de:49:27:ff:48:2a:7d:e8:4d:03:cc:c7:b2:52:c6:
+                    17:31:13:3b:b5:4d:db:c8:c4:f6:c3:0f:24:2a:da:
+                    0c:9d:e7:91:5b:80:cd:94:9d
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Digital Signature Trust Co./OU=DSTCA E2/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not Before: Dec  9 19:17:26 1998 GMT, Not After: Dec  9 19:17:26 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B
+
+            X509v3 Subject Key Identifier: 
+                1E:82:4D:28:65:80:3C:C9:41:6E:AC:35:2E:5A:CB:DE:EE:F8:39:5B
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        47:8d:83:ad:62:f2:db:b0:9e:45:22:05:b9:a2:d6:03:0e:38:
+        72:e7:9e:fc:7b:e6:93:b6:9a:a5:a2:94:c8:34:1d:91:d1:c5:
+        d7:f4:0a:25:0f:3d:78:81:9e:0f:b1:67:c4:90:4c:63:dd:5e:
+        a7:e2:ba:9f:f5:f7:4d:a5:31:7b:9c:29:2d:4c:fe:64:3e:ec:
+        b6:53:fe:ea:9b:ed:82:db:74:75:4b:07:79:6e:1e:d8:19:83:
+        73:de:f5:3e:d0:b5:de:e7:4b:68:7d:43:2e:2a:20:e1:7e:a0:
+        78:44:9e:08:f5:98:f9:c7:7f:1b:1b:d6:06:20:02:58:a1:c3:
+        a2:03
+
+Digital Signature Trust Co. Global CA 4
+=======================================
+MD5 Fingerprint: CD:3B:3D:62:5B:09:B8:09:36:87:9E:12:2F:71:64:BA
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIID2DCCAsACEQDQHkCLAAB3bQAAAAEAAAAEMA0GCSqGSIb3DQEBBQUAMIGpMQsw
+CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp
+dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjERMA8GA1UE
+CxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIxITAfBgkqhkiG9w0B
+CQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05ODExMzAyMjQ2MTZaFw0wODExMjcy
+MjQ2MTZaMIGpMQswCQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMO
+U2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0
+IENvLjERMA8GA1UECxMIRFNUQ0EgWDIxFjAUBgNVBAMTDURTVCBSb290Q0EgWDIx
+ITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBANx18IzAdZaawGIfJvfE4Zrq4FZzW5nNAUSoCLbV
+p9oaBBg5kkp4o4HC9Xd6ULRw/5qrxsfKboNPQpj7Jgva3G3WqZlVUmfpKAOS3OWw
+BZoPFflrWXJW8vo5/Kpo7g8fEIMv/J36F5bdguPmRX3AS4BEH+0s4IT9kVySVGkl
+5WJp3OXuAFK9MwutdQKFp2RQLcUZGTDAJtvJ0/0uma1ZtQtN1EGuhUhDWdy3qOKi
+3sOP17ihYqZoUFLkzzGnlIXan0YyF1bl8utmPRL/Q9uY73fPy4GNNLHGUEom0eQ+
+QVCvbK4iNC7Va26Dunm4dmVI2gkpZGMiuftHdoWMhkTLCdsCAwEAATANBgkqhkiG
+9w0BAQUFAAOCAQEAtTYOXeFhKFoRZcA/gwN5Tb4opgsHAlKFzfiR0BBstWogWxyQ
+2TA8xkieil5k+aFxd+8EJx8H6+Qm93N0yUQYGmbT4EOvkTvRyyzYdFQ6HE3K1GjN
+I3wdEJ5F6fYAbqbNGf9PLCmPV03Ed5K+4EwJ+11EhmYhqLkyolbV6YyDfFk/xPEL
+553snr2cGA4+wjl5KLcDDQjLxufZATdQEOzMYRZA1K8xdHv8PzGn0EdzMzkbzE5q
+10mDEQb+64JYMzJM8FasHpwvVpp7wUocpf1VNs78lk30sPDst2yC7S8xmUJMqbIN
+uBVd8d+6ybVK1GSYsyapMMj9puyrliGtf8J4tg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            d0:1e:40:8b:00:00:77:6d:00:00:00:01:00:00:00:04
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/Email=ca@digsigtrust.com
+        Validity
+            Not Before: Nov 30 22:46:16 1998 GMT
+            Not After : Nov 27 22:46:16 2008 GMT
+        Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=DSTCA X2, CN=DST RootCA X2/Email=ca@digsigtrust.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:dc:75:f0:8c:c0:75:96:9a:c0:62:1f:26:f7:c4:
+                    e1:9a:ea:e0:56:73:5b:99:cd:01:44:a8:08:b6:d5:
+                    a7:da:1a:04:18:39:92:4a:78:a3:81:c2:f5:77:7a:
+                    50:b4:70:ff:9a:ab:c6:c7:ca:6e:83:4f:42:98:fb:
+                    26:0b:da:dc:6d:d6:a9:99:55:52:67:e9:28:03:92:
+                    dc:e5:b0:05:9a:0f:15:f9:6b:59:72:56:f2:fa:39:
+                    fc:aa:68:ee:0f:1f:10:83:2f:fc:9d:fa:17:96:dd:
+                    82:e3:e6:45:7d:c0:4b:80:44:1f:ed:2c:e0:84:fd:
+                    91:5c:92:54:69:25:e5:62:69:dc:e5:ee:00:52:bd:
+                    33:0b:ad:75:02:85:a7:64:50:2d:c5:19:19:30:c0:
+                    26:db:c9:d3:fd:2e:99:ad:59:b5:0b:4d:d4:41:ae:
+                    85:48:43:59:dc:b7:a8:e2:a2:de:c3:8f:d7:b8:a1:
+                    62:a6:68:50:52:e4:cf:31:a7:94:85:da:9f:46:32:
+                    17:56:e5:f2:eb:66:3d:12:ff:43:db:98:ef:77:cf:
+                    cb:81:8d:34:b1:c6:50:4a:26:d1:e4:3e:41:50:af:
+                    6c:ae:22:34:2e:d5:6b:6e:83:ba:79:b8:76:65:48:
+                    da:09:29:64:63:22:b9:fb:47:76:85:8c:86:44:cb:
+                    09:db
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        b5:36:0e:5d:e1:61:28:5a:11:65:c0:3f:83:03:79:4d:be:28:
+        a6:0b:07:02:52:85:cd:f8:91:d0:10:6c:b5:6a:20:5b:1c:90:
+        d9:30:3c:c6:48:9e:8a:5e:64:f9:a1:71:77:ef:04:27:1f:07:
+        eb:e4:26:f7:73:74:c9:44:18:1a:66:d3:e0:43:af:91:3b:d1:
+        cb:2c:d8:74:54:3a:1c:4d:ca:d4:68:cd:23:7c:1d:10:9e:45:
+        e9:f6:00:6e:a6:cd:19:ff:4f:2c:29:8f:57:4d:c4:77:92:be:
+        e0:4c:09:fb:5d:44:86:66:21:a8:b9:32:a2:56:d5:e9:8c:83:
+        7c:59:3f:c4:f1:0b:e7:9d:ec:9e:bd:9c:18:0e:3e:c2:39:79:
+        28:b7:03:0d:08:cb:c6:e7:d9:01:37:50:10:ec:cc:61:16:40:
+        d4:af:31:74:7b:fc:3f:31:a7:d0:47:73:33:39:1b:cc:4e:6a:
+        d7:49:83:11:06:fe:eb:82:58:33:32:4c:f0:56:ac:1e:9c:2f:
+        56:9a:7b:c1:4a:1c:a5:fd:55:36:ce:fc:96:4d:f4:b0:f0:ec:
+        b7:6c:82:ed:2f:31:99:42:4c:a9:b2:0d:b8:15:5d:f1:df:ba:
+        c9:b5:4a:d4:64:98:b3:26:a9:30:c8:fd:a6:ec:ab:96:21:ad:
+        7f:c2:78:b6
+
+Entrust Worldwide by DST
+========================
+MD5 Fingerprint: B4:65:22:0A:7C:AD:DF:41:B7:D5:44:D5:AD:FA:9A:75
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDRzCCArCgAwIBAgIENm3FGDANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJV
+UzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRswGQYDVQQL
+ExJEU1QtRW50cnVzdCBHVEkgQ0EwHhcNOTgxMjA5MDAwMjI0WhcNMTgxMjA5MDAz
+MjI0WjBQMQswCQYDVQQGEwJVUzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUg
+VHJ1c3QgQ28uMRswGQYDVQQLExJEU1QtRW50cnVzdCBHVEkgQ0EwgZ0wDQYJKoZI
+hvcNAQEBBQADgYsAMIGHAoGBALYd90uNDxPjEvUJ/gYyDq9MQfV91Ec9KgrfgwXe
+3n3mAxb2UTrLRxpKrX7E/R20vnSKeN0Lg460hBPE+/htKa6h4Q8PQ+O1XmBp+oOU
+/Hnm3Hbt0UQrjv0Su/4XdxcMie2n71F9xO04wzujevviTaBgtfL9E2XTxuw/vjWc
+PSLvAgEDo4IBLjCCASowEQYJYIZIAYb4QgEBBAQDAgAHMHIGA1UdHwRrMGkwZ6Bl
+oGOkYTBfMQswCQYDVQQGEwJVUzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUg
+VHJ1c3QgQ28uMRswGQYDVQQLExJEU1QtRW50cnVzdCBHVEkgQ0ExDTALBgNVBAMT
+BENSTDEwKwYDVR0QBCQwIoAPMTk5ODEyMDkwMDAyMjRagQ8yMDE4MTIwOTAwMDIy
+NFowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFJOaRMrQeFOAKUkE38evMz+ZdV+u
+MB0GA1UdDgQWBBSTmkTK0HhTgClJBN/HrzM/mXVfrjAMBgNVHRMEBTADAQH/MBkG
+CSqGSIb2fQdBAAQMMAobBFY0LjADAgSQMA0GCSqGSIb3DQEBBQUAA4GBAGSJzAOn
+3AryWCDn/RegKHLNh7DNmLUkR2MzMRAQsu+KV3KuTAPgZ5+sYEOEIsGpo+Wxp94J
+1M8NeEYjW49Je/4TIpeU6nJI4SwgeJbpZkUZywllY2E/0UmYsXYQVdVjSmZLpAdr
+3nt/ueaTWxoCW4AO3Y0Y1Iqjwmjxo+AY0U5M
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 913163544 (0x366dc518)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Digital Signature Trust Co., OU=DST-Entrust GTI CA
+        Validity
+            Not Before: Dec  9 00:02:24 1998 GMT
+            Not After : Dec  9 00:32:24 2018 GMT
+        Subject: C=US, O=Digital Signature Trust Co., OU=DST-Entrust GTI CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b6:1d:f7:4b:8d:0f:13:e3:12:f5:09:fe:06:32:
+                    0e:af:4c:41:f5:7d:d4:47:3d:2a:0a:df:83:05:de:
+                    de:7d:e6:03:16:f6:51:3a:cb:47:1a:4a:ad:7e:c4:
+                    fd:1d:b4:be:74:8a:78:dd:0b:83:8e:b4:84:13:c4:
+                    fb:f8:6d:29:ae:a1:e1:0f:0f:43:e3:b5:5e:60:69:
+                    fa:83:94:fc:79:e6:dc:76:ed:d1:44:2b:8e:fd:12:
+                    bb:fe:17:77:17:0c:89:ed:a7:ef:51:7d:c4:ed:38:
+                    c3:3b:a3:7a:fb:e2:4d:a0:60:b5:f2:fd:13:65:d3:
+                    c6:ec:3f:be:35:9c:3d:22:ef
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Digital Signature Trust Co./OU=DST-Entrust GTI CA/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not Before: Dec  9 00:02:24 1998 GMT, Not After: Dec  9 00:02:24 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:93:9A:44:CA:D0:78:53:80:29:49:04:DF:C7:AF:33:3F:99:75:5F:AE
+
+            X509v3 Subject Key Identifier: 
+                93:9A:44:CA:D0:78:53:80:29:49:04:DF:C7:AF:33:3F:99:75:5F:AE
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        64:89:cc:03:a7:dc:0a:f2:58:20:e7:fd:17:a0:28:72:cd:87:
+        b0:cd:98:b5:24:47:63:33:31:10:10:b2:ef:8a:57:72:ae:4c:
+        03:e0:67:9f:ac:60:43:84:22:c1:a9:a3:e5:b1:a7:de:09:d4:
+        cf:0d:78:46:23:5b:8f:49:7b:fe:13:22:97:94:ea:72:48:e1:
+        2c:20:78:96:e9:66:45:19:cb:09:65:63:61:3f:d1:49:98:b1:
+        76:10:55:d5:63:4a:66:4b:a4:07:6b:de:7b:7f:b9:e6:93:5b:
+        1a:02:5b:80:0e:dd:8d:18:d4:8a:a3:c2:68:f1:a3:e0:18:d1:
+        4e:4c
+
+Entrust.net Premium 2048 Secure Server CA
+=========================================
+MD5 Fingerprint: BA:21:EA:20:D6:DD:DB:8F:C1:57:8B:40:AD:A1:FC:FC
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEXDCCA0SgAwIBAgIEOGO5ZjANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
+RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp
+bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5
+IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0xOTEy
+MjQxODIwNTFaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3
+LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp
+YWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG
+A1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQq
+K0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQe
+sYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuX
+MlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVT
+XTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/
+HoZdenoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH
+4QIDAQABo3QwcjARBglghkgBhvhCAQEEBAMCAAcwHwYDVR0jBBgwFoAUVeSB0RGA
+vtiJuQijMfmhJAkWuXAwHQYDVR0OBBYEFFXkgdERgL7YibkIozH5oSQJFrlwMB0G
+CSqGSIb2fQdBAAQQMA4bCFY1LjA6NC4wAwIEkDANBgkqhkiG9w0BAQUFAAOCAQEA
+WUesIYSKF8mciVMeuoCFGsY8Tj6xnLZ8xpJdGGQC49MGCBFhfGPjK50xA3B20qMo
+oPS7mmNz7W3lKtvtFKkrxjYR0CvrB4ul2p5cGZ1WEvVUKcgF7bISKo30Axv/55IQ
+h7A6tcOdBTcSo8f0FbnVpDkWm1M6I5HxqIKiaohowXkCIryqptau37AUX7iH0N18
+f3v/rxzP5tsHrV7bhZ3QKw0z2wTR5klAEyt2+z7pnIkPFc4YsIV4IU9rTw76NmfN
+B/L/CNDi3tm/Kq+4h4YhPATKt5Rof8886ZjXOP/swNlQ8C5LWK5Gb9Auw2DaclVy
+vUxFnmG6v4SBkgPR0ml8xQ==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 946059622 (0x3863b966)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
+        Validity
+            Not Before: Dec 24 17:50:51 1999 GMT
+            Not After : Dec 24 18:20:51 2019 GMT
+        Subject: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048)
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ad:4d:4b:a9:12:86:b2:ea:a3:20:07:15:16:64:
+                    2a:2b:4b:d1:bf:0b:4a:4d:8e:ed:80:76:a5:67:b7:
+                    78:40:c0:73:42:c8:68:c0:db:53:2b:dd:5e:b8:76:
+                    98:35:93:8b:1a:9d:7c:13:3a:0e:1f:5b:b7:1e:cf:
+                    e5:24:14:1e:b1:81:a9:8d:7d:b8:cc:6b:4b:03:f1:
+                    02:0c:dc:ab:a5:40:24:00:7f:74:94:a1:9d:08:29:
+                    b3:88:0b:f5:87:77:9d:55:cd:e4:c3:7e:d7:6a:64:
+                    ab:85:14:86:95:5b:97:32:50:6f:3d:c8:ba:66:0c:
+                    e3:fc:bd:b8:49:c1:76:89:49:19:fd:c0:a8:bd:89:
+                    a3:67:2f:c6:9f:bc:71:19:60:b8:2d:e9:2c:c9:90:
+                    76:66:7b:94:e2:af:78:d6:65:53:5d:3c:d6:9c:b2:
+                    cf:29:03:f9:2f:a4:50:b2:d4:48:ce:05:32:55:8a:
+                    fd:b2:64:4c:0e:e4:98:07:75:db:7f:df:b9:08:55:
+                    60:85:30:29:f9:7b:48:a4:69:86:e3:35:3f:1e:86:
+                    5d:7a:7a:15:bd:ef:00:8e:15:22:54:17:00:90:26:
+                    93:bc:0e:49:68:91:bf:f8:47:d3:9d:95:42:c1:0e:
+                    4d:df:6f:26:cf:c3:18:21:62:66:43:70:d6:d5:c0:
+                    07:e1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 Authority Key Identifier: 
+                keyid:55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70
+
+            X509v3 Subject Key Identifier: 
+                55:E4:81:D1:11:80:BE:D8:89:B9:08:A3:31:F9:A1:24:09:16:B9:70
+            1.2.840.113533.7.65.0: 
+                0...V5.0:4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        59:47:ac:21:84:8a:17:c9:9c:89:53:1e:ba:80:85:1a:c6:3c:
+        4e:3e:b1:9c:b6:7c:c6:92:5d:18:64:02:e3:d3:06:08:11:61:
+        7c:63:e3:2b:9d:31:03:70:76:d2:a3:28:a0:f4:bb:9a:63:73:
+        ed:6d:e5:2a:db:ed:14:a9:2b:c6:36:11:d0:2b:eb:07:8b:a5:
+        da:9e:5c:19:9d:56:12:f5:54:29:c8:05:ed:b2:12:2a:8d:f4:
+        03:1b:ff:e7:92:10:87:b0:3a:b5:c3:9d:05:37:12:a3:c7:f4:
+        15:b9:d5:a4:39:16:9b:53:3a:23:91:f1:a8:82:a2:6a:88:68:
+        c1:79:02:22:bc:aa:a6:d6:ae:df:b0:14:5f:b8:87:d0:dd:7c:
+        7f:7b:ff:af:1c:cf:e6:db:07:ad:5e:db:85:9d:d0:2b:0d:33:
+        db:04:d1:e6:49:40:13:2b:76:fb:3e:e9:9c:89:0f:15:ce:18:
+        b0:85:78:21:4f:6b:4f:0e:fa:36:67:cd:07:f2:ff:08:d0:e2:
+        de:d9:bf:2a:af:b8:87:86:21:3c:04:ca:b7:94:68:7f:cf:3c:
+        e9:98:d7:38:ff:ec:c0:d9:50:f0:2e:4b:58:ae:46:6f:d0:2e:
+        c3:60:da:72:55:72:bd:4c:45:9e:61:ba:bf:84:81:92:03:d1:
+        d2:69:7c:c5
+
+Entrust.net Secure Personal CA
+==============================
+MD5 Fingerprint: 0C:41:2F:13:5B:A0:54:F5:96:66:2D:7E:CD:0E:03:F4
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIE7TCCBFagAwIBAgIEOAOR7jANBgkqhkiG9w0BAQQFADCByTELMAkGA1UEBhMC
+VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MUgwRgYDVQQLFD93d3cuZW50cnVzdC5u
+ZXQvQ2xpZW50X0NBX0luZm8vQ1BTIGluY29ycC4gYnkgcmVmLiBsaW1pdHMgbGlh
+Yi4xJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNV
+BAMTKkVudHJ1c3QubmV0IENsaWVudCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
+Fw05OTEwMTIxOTI0MzBaFw0xOTEwMTIxOTU0MzBaMIHJMQswCQYDVQQGEwJVUzEU
+MBIGA1UEChMLRW50cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9D
+bGllbnRfQ0FfSW5mby9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjEl
+MCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMq
+RW50cnVzdC5uZXQgQ2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0G
+CSqGSIb3DQEBAQUAA4GLADCBhwKBgQDIOpleMRffrCdvkHvkGf9FozTC28GoT/Bo
+6oT9n3V5z8GKUZSvx1cDR2SerYIbWtp/N3hHuzeYEpbOxhN979IMMFGpOZ5V+Pux
+5zDeg7K6PvHViTs7hbqqdCz+PzFur5GVbgbUB01LLFZHGARS2g4Qk79jkJvh34zm
+AqTmT173iwIBA6OCAeAwggHcMBEGCWCGSAGG+EIBAQQEAwIABzCCASIGA1UdHwSC
+ARkwggEVMIHkoIHhoIHepIHbMIHYMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50
+cnVzdC5uZXQxSDBGBgNVBAsUP3d3dy5lbnRydXN0Lm5ldC9DbGllbnRfQ0FfSW5m
+by9DUFMgaW5jb3JwLiBieSByZWYuIGxpbWl0cyBsaWFiLjElMCMGA1UECxMcKGMp
+IDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5uZXQg
+Q2xpZW50IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCyg
+KqAohiZodHRwOi8vd3d3LmVudHJ1c3QubmV0L0NSTC9DbGllbnQxLmNybDArBgNV
+HRAEJDAigA8xOTk5MTAxMjE5MjQzMFqBDzIwMTkxMDEyMTkyNDMwWjALBgNVHQ8E
+BAMCAQYwHwYDVR0jBBgwFoAUxPucKXuXzUyW/O5bs8qZdIuV6kwwHQYDVR0OBBYE
+FMT7nCl7l81MlvzuW7PKmXSLlepMMAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EA
+BAwwChsEVjQuMAMCBJAwDQYJKoZIhvcNAQEEBQADgYEAP66K8ddmAwWePvrqHEa7
+pFuPeJoSSJn59DXeDDYHAmsQOokUgZwxpnyyQbJq5wcBoUv5nyU7lsqZwz6hURzz
+wy5E97BnRqqS5TvaHBkUODDV4qIxJS7x7EU47fgGWANzYrAQMY9Av2TgXD7FTx/a
+EkP/TOYGJqibGapEPHayXOw=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 939758062 (0x380391ee)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority
+        Validity
+            Not Before: Oct 12 19:24:30 1999 GMT
+            Not After : Oct 12 19:54:30 2019 GMT
+        Subject: C=US, O=Entrust.net, OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab., OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Client Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c8:3a:99:5e:31:17:df:ac:27:6f:90:7b:e4:19:
+                    ff:45:a3:34:c2:db:c1:a8:4f:f0:68:ea:84:fd:9f:
+                    75:79:cf:c1:8a:51:94:af:c7:57:03:47:64:9e:ad:
+                    82:1b:5a:da:7f:37:78:47:bb:37:98:12:96:ce:c6:
+                    13:7d:ef:d2:0c:30:51:a9:39:9e:55:f8:fb:b1:e7:
+                    30:de:83:b2:ba:3e:f1:d5:89:3b:3b:85:ba:aa:74:
+                    2c:fe:3f:31:6e:af:91:95:6e:06:d4:07:4d:4b:2c:
+                    56:47:18:04:52:da:0e:10:93:bf:63:90:9b:e1:df:
+                    8c:e6:02:a4:e6:4f:5e:f7:8b
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Entrust.net/OU=www.entrust.net/Client_CA_Info/CPS incorp. by ref. limits liab./OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Client Certification Authority/CN=CRL1
+                URI:http://www.entrust.net/CRL/Client1.crl
+
+            X509v3 Private Key Usage Period: 
+                Not Before: Oct 12 19:24:30 1999 GMT, Not After: Oct 12 19:24:30 2019 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C
+
+            X509v3 Subject Key Identifier: 
+                C4:FB:9C:29:7B:97:CD:4C:96:FC:EE:5B:B3:CA:99:74:8B:95:EA:4C
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: md5WithRSAEncryption
+        3f:ae:8a:f1:d7:66:03:05:9e:3e:fa:ea:1c:46:bb:a4:5b:8f:
+        78:9a:12:48:99:f9:f4:35:de:0c:36:07:02:6b:10:3a:89:14:
+        81:9c:31:a6:7c:b2:41:b2:6a:e7:07:01:a1:4b:f9:9f:25:3b:
+        96:ca:99:c3:3e:a1:51:1c:f3:c3:2e:44:f7:b0:67:46:aa:92:
+        e5:3b:da:1c:19:14:38:30:d5:e2:a2:31:25:2e:f1:ec:45:38:
+        ed:f8:06:58:03:73:62:b0:10:31:8f:40:bf:64:e0:5c:3e:c5:
+        4f:1f:da:12:43:ff:4c:e6:06:26:a8:9b:19:aa:44:3c:76:b2:
+        5c:ec
+
+Entrust.net Secure Server CA
+============================
+MD5 Fingerprint: DF:F2:80:73:CC:F1:E6:61:73:FC:F5:42:E9:C5:7C:EE
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIE2DCCBEGgAwIBAgIEN0rSQzANBgkqhkiG9w0BAQUFADCBwzELMAkGA1UEBhMC
+VVMxFDASBgNVBAoTC0VudHJ1c3QubmV0MTswOQYDVQQLEzJ3d3cuZW50cnVzdC5u
+ZXQvQ1BTIGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMGA1UECxMc
+KGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDE6MDgGA1UEAxMxRW50cnVzdC5u
+ZXQgU2VjdXJlIFNlcnZlciBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05OTA1
+MjUxNjA5NDBaFw0xOTA1MjUxNjM5NDBaMIHDMQswCQYDVQQGEwJVUzEUMBIGA1UE
+ChMLRW50cnVzdC5uZXQxOzA5BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5j
+b3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBF
+bnRydXN0Lm5ldCBMaW1pdGVkMTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUg
+U2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGdMA0GCSqGSIb3DQEBAQUA
+A4GLADCBhwKBgQDNKIM0VBuJ8w+vN5Ex/68xYMmo6LIQaO2f55M28Qpku0f1BBc/
+I0dNxScZgSYMVHINiC3ZH5oSn7yzcdOAGT9HZnuMNSjSuQrfJNqc1lB5gXpa0zf3
+wkrYKZImZNHkmGw6AIr1NJtl+O3jEP/9uElY3KDegjlrgbEWGWG5VLbmQwIBA6OC
+AdcwggHTMBEGCWCGSAGG+EIBAQQEAwIABzCCARkGA1UdHwSCARAwggEMMIHeoIHb
+oIHYpIHVMIHSMQswCQYDVQQGEwJVUzEUMBIGA1UEChMLRW50cnVzdC5uZXQxOzA5
+BgNVBAsTMnd3dy5lbnRydXN0Lm5ldC9DUFMgaW5jb3JwLiBieSByZWYuIChsaW1p
+dHMgbGlhYi4pMSUwIwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVk
+MTowOAYDVQQDEzFFbnRydXN0Lm5ldCBTZWN1cmUgU2VydmVyIENlcnRpZmljYXRp
+b24gQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMCmgJ6AlhiNodHRwOi8vd3d3LmVu
+dHJ1c3QubmV0L0NSTC9uZXQxLmNybDArBgNVHRAEJDAigA8xOTk5MDUyNTE2MDk0
+MFqBDzIwMTkwNTI1MTYwOTQwWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAU8Bdi
+E1U9s/8KAGv7UISX8+1i0BowHQYDVR0OBBYEFPAXYhNVPbP/CgBr+1CEl/PtYtAa
+MAwGA1UdEwQFMAMBAf8wGQYJKoZIhvZ9B0EABAwwChsEVjQuMAMCBJAwDQYJKoZI
+hvcNAQEFBQADgYEAkNwwAvpkdMKnCqV8IY00F6j7Rw7/JXyNEwr75Ji174z4xRAN
+95K+8cPV1ZVqBLssziY2ZcgxxufuP+NXdYR6Ee9GTxj005i7qIcyunL2POI9n9cd
+2cNgQ4xYDiKWL2KjLB+6rQXvqzJ4h6BUcxm1XAX5Uj5tLUUL9wqT6u0G+bI=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 927650371 (0x374ad243)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
+        Validity
+            Not Before: May 25 16:09:40 1999 GMT
+            Not After : May 25 16:39:40 2019 GMT
+        Subject: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Secure Server Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:cd:28:83:34:54:1b:89:f3:0f:af:37:91:31:ff:
+                    af:31:60:c9:a8:e8:b2:10:68:ed:9f:e7:93:36:f1:
+                    0a:64:bb:47:f5:04:17:3f:23:47:4d:c5:27:19:81:
+                    26:0c:54:72:0d:88:2d:d9:1f:9a:12:9f:bc:b3:71:
+                    d3:80:19:3f:47:66:7b:8c:35:28:d2:b9:0a:df:24:
+                    da:9c:d6:50:79:81:7a:5a:d3:37:f7:c2:4a:d8:29:
+                    92:26:64:d1:e4:98:6c:3a:00:8a:f5:34:9b:65:f8:
+                    ed:e3:10:ff:fd:b8:49:58:dc:a0:de:82:39:6b:81:
+                    b1:16:19:61:b9:54:b6:e6:43
+                Exponent: 3 (0x3)
+        X509v3 extensions:
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority/CN=CRL1
+                URI:http://www.entrust.net/CRL/net1.crl
+
+            X509v3 Private Key Usage Period: 
+                Not Before: May 25 16:09:40 1999 GMT, Not After: May 25 16:09:40 2019 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
+
+            X509v3 Subject Key Identifier: 
+                F0:17:62:13:55:3D:B3:FF:0A:00:6B:FB:50:84:97:F3:ED:62:D0:1A
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0
+..V4.0....
+    Signature Algorithm: sha1WithRSAEncryption
+        90:dc:30:02:fa:64:74:c2:a7:0a:a5:7c:21:8d:34:17:a8:fb:
+        47:0e:ff:25:7c:8d:13:0a:fb:e4:98:b5:ef:8c:f8:c5:10:0d:
+        f7:92:be:f1:c3:d5:d5:95:6a:04:bb:2c:ce:26:36:65:c8:31:
+        c6:e7:ee:3f:e3:57:75:84:7a:11:ef:46:4f:18:f4:d3:98:bb:
+        a8:87:32:ba:72:f6:3c:e2:3d:9f:d7:1d:d9:c3:60:43:8c:58:
+        0e:22:96:2f:62:a3:2c:1f:ba:ad:05:ef:ab:32:78:87:a0:54:
+        73:19:b5:5c:05:f9:52:3e:6d:2d:45:0b:f7:0a:93:ea:ed:06:
+        f9:b2
+
+Equifax Premium CA
+==================
+MD5 Fingerprint: A9:E9:A8:9D:0E:73:E3:B1:2F:37:0D:E8:48:3F:86:ED
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAoygAwIBAgIENeHvHjANBgkqhkiG9w0BAQUFADBPMQswCQYDVQQGEwJV
+UzEQMA4GA1UEChMHRXF1aWZheDEuMCwGA1UECxMlRXF1aWZheCBQcmVtaXVtIENl
+cnRpZmljYXRlIEF1dGhvcml0eTAeFw05ODA4MjQyMjU0MjNaFw0xODA4MjQyMjU0
+MjNaME8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFcXVpZmF4MS4wLAYDVQQLEyVF
+cXVpZmF4IFByZW1pdW0gQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIGfMA0GCSqGSIb3
+DQEBAQUAA4GNADCBiQKBgQDOoQaOBswIC8GGqN4g1Q0O0Q3En+pq2bPCMkdAb4qI
+pAm9OCwd5svmpPM269rrvPxkswf2Lbyqzp8ZSGhK/PWiRX4JEPWPs0lcIwY56hOL
+uAvNkR12X9k3oUT7X5DyZ7PNGJlDH3YSawLylYM4Q8L2YjTKyXhdX9LYupr/vhBg
+WwIDAQABo4IBCjCCAQYwcQYDVR0fBGowaDBmoGSgYqRgMF4xCzAJBgNVBAYTAlVT
+MRAwDgYDVQQKEwdFcXVpZmF4MS4wLAYDVQQLEyVFcXVpZmF4IFByZW1pdW0gQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIw
+MTgwODI0MjI1NDIzWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUFe6yKFmrbuX4
+z4uB9CThrj91G5gwHQYDVR0OBBYEFBXusihZq27l+M+LgfQk4a4/dRuYMAwGA1Ud
+EwQFMAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEB
+BQUAA4GBAL0LnCepA9so3JipS9DRjqeoGlqR4Jzx9xh8LiKeNh/JqLXNRkpu+jUH
+G4YI65/iqPmdQS06rlxctl80BOv8KmCw+3TkhellOJbuFcfGd2MSvYpoH6tsfdrK
+XBPO6snrCVzFc+cSAdXZUwee4A+W8Iu0u0VIn4bFGVWgy5bFA/xI
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 903999262 (0x35e1ef1e)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Equifax, OU=Equifax Premium Certificate Authority
+        Validity
+            Not Before: Aug 24 22:54:23 1998 GMT
+            Not After : Aug 24 22:54:23 2018 GMT
+        Subject: C=US, O=Equifax, OU=Equifax Premium Certificate Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ce:a1:06:8e:06:cc:08:0b:c1:86:a8:de:20:d5:
+                    0d:0e:d1:0d:c4:9f:ea:6a:d9:b3:c2:32:47:40:6f:
+                    8a:88:a4:09:bd:38:2c:1d:e6:cb:e6:a4:f3:36:eb:
+                    da:eb:bc:fc:64:b3:07:f6:2d:bc:aa:ce:9f:19:48:
+                    68:4a:fc:f5:a2:45:7e:09:10:f5:8f:b3:49:5c:23:
+                    06:39:ea:13:8b:b8:0b:cd:91:1d:76:5f:d9:37:a1:
+                    44:fb:5f:90:f2:67:b3:cd:18:99:43:1f:76:12:6b:
+                    02:f2:95:83:38:43:c2:f6:62:34:ca:c9:78:5d:5f:
+                    d2:d8:ba:9a:ff:be:10:60:5b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Equifax/OU=Equifax Premium Certificate Authority/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not After: Aug 24 22:54:23 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:15:EE:B2:28:59:AB:6E:E5:F8:CF:8B:81:F4:24:E1:AE:3F:75:1B:98
+
+            X509v3 Subject Key Identifier: 
+                15:EE:B2:28:59:AB:6E:E5:F8:CF:8B:81:F4:24:E1:AE:3F:75:1B:98
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0...V3.0c....
+    Signature Algorithm: sha1WithRSAEncryption
+        bd:0b:9c:27:a9:03:db:28:dc:98:a9:4b:d0:d1:8e:a7:a8:1a:
+        5a:91:e0:9c:f1:f7:18:7c:2e:22:9e:36:1f:c9:a8:b5:cd:46:
+        4a:6e:fa:35:07:1b:86:08:eb:9f:e2:a8:f9:9d:41:2d:3a:ae:
+        5c:5c:b6:5f:34:04:eb:fc:2a:60:b0:fb:74:e4:85:e9:65:38:
+        96:ee:15:c7:c6:77:63:12:bd:8a:68:1f:ab:6c:7d:da:ca:5c:
+        13:ce:ea:c9:eb:09:5c:c5:73:e7:12:01:d5:d9:53:07:9e:e0:
+        0f:96:f0:8b:b4:bb:45:48:9f:86:c5:19:55:a0:cb:96:c5:03:
+        fc:48
+
+Equifax Secure CA
+=================
+MD5 Fingerprint: 67:CB:9D:C0:13:24:8A:82:9B:B2:17:1E:D1:1B:EC:D4
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV
+UzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1
+MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVx
+dWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCBnzANBgkqhkiG9w0B
+AQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPRfM6f
+BeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+A
+cJkVV5MW8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kC
+AwEAAaOCAQkwggEFMHAGA1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQ
+MA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoGA1UdEAQTMBGBDzIwMTgw
+ODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj
+IBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQF
+MAMBAf8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUA
+A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y
+7qj/WsjTVbJmcVfewCHrPSqnI0kBBIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh
+1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee9570+sB3c4
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 903804111 (0x35def4cf)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
+        Validity
+            Not Before: Aug 22 16:41:51 1998 GMT
+            Not After : Aug 22 16:41:51 2018 GMT
+        Subject: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c1:5d:b1:58:67:08:62:ee:a0:9a:2d:1f:08:6d:
+                    91:14:68:98:0a:1e:fe:da:04:6f:13:84:62:21:c3:
+                    d1:7c:ce:9f:05:e0:b8:01:f0:4e:34:ec:e2:8a:95:
+                    04:64:ac:f1:6b:53:5f:05:b3:cb:67:80:bf:42:02:
+                    8e:fe:dd:01:09:ec:e1:00:14:4f:fc:fb:f0:0c:dd:
+                    43:ba:5b:2b:e1:1f:80:70:99:15:57:93:16:f1:0f:
+                    97:6a:b7:c2:68:23:1c:cc:4d:59:30:ac:51:1e:3b:
+                    af:2b:d6:ee:63:45:7b:c5:d9:5f:50:d2:e3:50:0f:
+                    3a:88:e7:bf:14:fd:e0:c7:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 CRL Distribution Points: 
+                DirName:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority/CN=CRL1
+
+            X509v3 Private Key Usage Period: 
+                Not After: Aug 22 16:41:51 2018 GMT
+            X509v3 Key Usage: 
+                Certificate Sign, CRL Sign
+            X509v3 Authority Key Identifier: 
+                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
+
+            X509v3 Subject Key Identifier: 
+                48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            1.2.840.113533.7.65.0: 
+                0...V3.0c....
+    Signature Algorithm: sha1WithRSAEncryption
+        58:ce:29:ea:fc:f7:de:b5:ce:02:b9:17:b5:85:d1:b9:e3:e0:
+        95:cc:25:31:0d:00:a6:92:6e:7f:b6:92:63:9e:50:95:d1:9a:
+        6f:e4:11:de:63:85:6e:98:ee:a8:ff:5a:c8:d3:55:b2:66:71:
+        57:de:c0:21:eb:3d:2a:a7:23:49:01:04:86:42:7b:fc:ee:7f:
+        a2:16:52:b5:67:67:d3:40:db:3b:26:58:b2:28:77:3d:ae:14:
+        77:61:d6:fa:2a:66:27:a0:0d:fa:a7:73:5c:ea:70:f1:94:21:
+        65:44:5f:fa:fc:ef:29:68:a9:a2:87:79:ef:79:ef:4f:ac:07:
+        77:38
+
+GTE CyberTrust Global Root
+==========================
+MD5 Fingerprint: CA:3D:D3:68:F1:03:5C:D0:32:FA:B8:2B:59:E8:5A:DB
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD
+VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
+bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv
+b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV
+UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU
+cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds
+b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH
+iM3dFw4usJTQGz0O9pTAipTHBsiQl8i4ZBp6fmw8U+E3KHNgf7KXUwefU/ltWJTS
+r41tiGeA5u2ylc9yMcqlHHK6XALnZELn+aks1joNrI1CqiQBOeacPwGFVw1Yh0X4
+04Wqk2kmhXBIgD8SFcd5tB8FLztimQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAG3r
+GwnpXtlR22ciYaQqPEh346B8pt5zohQDhT37qw4wxYMWM4ETCJ57NE7fQMh017l9
+3PR2VX2bY1QY6fDq81yx2YtCHrnAlU66+tXifPVoYb+O7AWXX1uw16OFNMQkpw0P
+lZPvy5TYnh+dXIVtx6quTx8itc2VrbqnzPmrC3p/
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 421 (0x1a5)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
+        Validity
+            Not Before: Aug 13 00:29:00 1998 GMT
+            Not After : Aug 13 23:59:00 2018 GMT
+        Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Global Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:95:0f:a0:b6:f0:50:9c:e8:7a:c7:88:cd:dd:17:
+                    0e:2e:b0:94:d0:1b:3d:0e:f6:94:c0:8a:94:c7:06:
+                    c8:90:97:c8:b8:64:1a:7a:7e:6c:3c:53:e1:37:28:
+                    73:60:7f:b2:97:53:07:9f:53:f9:6d:58:94:d2:af:
+                    8d:6d:88:67:80:e6:ed:b2:95:cf:72:31:ca:a5:1c:
+                    72:ba:5c:02:e7:64:42:e7:f9:a9:2c:d6:3a:0d:ac:
+                    8d:42:aa:24:01:39:e6:9c:3f:01:85:57:0d:58:87:
+                    45:f8:d3:85:aa:93:69:26:85:70:48:80:3f:12:15:
+                    c7:79:b4:1f:05:2f:3b:62:99
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        6d:eb:1b:09:e9:5e:d9:51:db:67:22:61:a4:2a:3c:48:77:e3:
+        a0:7c:a6:de:73:a2:14:03:85:3d:fb:ab:0e:30:c5:83:16:33:
+        81:13:08:9e:7b:34:4e:df:40:c8:74:d7:b9:7d:dc:f4:76:55:
+        7d:9b:63:54:18:e9:f0:ea:f3:5c:b1:d9:8b:42:1e:b9:c0:95:
+        4e:ba:fa:d5:e2:7c:f5:68:61:bf:8e:ec:05:97:5f:5b:b0:d7:
+        a3:85:34:c4:24:a7:0d:0f:95:93:ef:cb:94:d8:9e:1f:9d:5c:
+        85:6d:c7:aa:ae:4f:1f:22:b5:cd:95:ad:ba:a7:cc:f9:ab:0b:
+        7a:7f
+
+GTE CyberTrust Japan Root CA
+============================
+MD5 Fingerprint: DE:AB:FF:43:2A:65:37:06:9B:28:B5:7A:E8:84:D3:8E
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICETCCAXoCAU4wDQYJKoZIhvcNAQEEBQAwUTELMAkGA1UEBhMCSlAxHzAdBgNV
+BAoTFkN5YmVyVHJ1c3QgSmFwYW4sIEluYy4xITAfBgNVBAMTGEN5YmVyVHJ1c3Qg
+SkFQQU4gUm9vdCBDQTAeFw05ODA4MDQwNzU3MDBaFw0wMzA4MDQyMzU5MDBaMFEx
+CzAJBgNVBAYTAkpQMR8wHQYDVQQKExZDeWJlclRydXN0IEphcGFuLCBJbmMuMSEw
+HwYDVQQDExhDeWJlclRydXN0IEpBUEFOIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEB
+BQADgY0AMIGJAoGBALet/MpHEHaJ/Wes5HMGfIFLHda1fA5Hr+ymVHWoxP1lr+fI
+sbFsNDWN97lkVygLIVredP7ceC6GRhJMfxEf3JO9X75mmIa4t+xtSdOQ2eF5AFZo
+uq1sHyw7H8ksjEOwBELqgXOmzjN1RQ2KRXIvqldV5AfDQ+J1Og+8PNCEzrrvAgMB
+AAEwDQYJKoZIhvcNAQEEBQADgYEAt6ZkowyAPBzE2O5BO+WGpJ5gXdYBMqhqZC0g
+cEC6ck5m+gdlTgOOC/1W4K07IKcy+rISHoDfHuN6GMxX2+bJNGDvdesQFtCkLnDY
+JCO4pXdzQvkHOt0BbAiTBzUmECVgKf8J5WSfabkWSfNc3SRjRpMNsFM2dbxIILsZ
+to/QIv0=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 78 (0x4e)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=JP, O=CyberTrust Japan, Inc., CN=CyberTrust JAPAN Root CA
+        Validity
+            Not Before: Aug  4 07:57:00 1998 GMT
+            Not After : Aug  4 23:59:00 2003 GMT
+        Subject: C=JP, O=CyberTrust Japan, Inc., CN=CyberTrust JAPAN Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b7:ad:fc:ca:47:10:76:89:fd:67:ac:e4:73:06:
+                    7c:81:4b:1d:d6:b5:7c:0e:47:af:ec:a6:54:75:a8:
+                    c4:fd:65:af:e7:c8:b1:b1:6c:34:35:8d:f7:b9:64:
+                    57:28:0b:21:5a:de:74:fe:dc:78:2e:86:46:12:4c:
+                    7f:11:1f:dc:93:bd:5f:be:66:98:86:b8:b7:ec:6d:
+                    49:d3:90:d9:e1:79:00:56:68:ba:ad:6c:1f:2c:3b:
+                    1f:c9:2c:8c:43:b0:04:42:ea:81:73:a6:ce:33:75:
+                    45:0d:8a:45:72:2f:aa:57:55:e4:07:c3:43:e2:75:
+                    3a:0f:bc:3c:d0:84:ce:ba:ef
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        b7:a6:64:a3:0c:80:3c:1c:c4:d8:ee:41:3b:e5:86:a4:9e:60:
+        5d:d6:01:32:a8:6a:64:2d:20:70:40:ba:72:4e:66:fa:07:65:
+        4e:03:8e:0b:fd:56:e0:ad:3b:20:a7:32:fa:b2:12:1e:80:df:
+        1e:e3:7a:18:cc:57:db:e6:c9:34:60:ef:75:eb:10:16:d0:a4:
+        2e:70:d8:24:23:b8:a5:77:73:42:f9:07:3a:dd:01:6c:08:93:
+        07:35:26:10:25:60:29:ff:09:e5:64:9f:69:b9:16:49:f3:5c:
+        dd:24:63:46:93:0d:b0:53:36:75:bc:48:20:bb:19:b6:8f:d0:
+        22:fd
+
+GTE CyberTrust Japan Secure Server CA
+=====================================
+MD5 Fingerprint: DD:0D:0D:B4:78:4B:7D:CE:30:0A:A6:35:C6:AB:4C:88
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICIzCCAYwCAU8wDQYJKoZIhvcNAQEEBQAwWjELMAkGA1UEBhMCSlAxHzAdBgNV
+BAoTFkN5YmVyVHJ1c3QgSmFwYW4sIEluYy4xKjAoBgNVBAMTIUN5YmVyVHJ1c3Qg
+SkFQQU4gU2VjdXJlIFNlcnZlciBDQTAeFw05ODA4MDQwODA2MzJaFw0wMzA4MDQy
+MzU5MDBaMFoxCzAJBgNVBAYTAkpQMR8wHQYDVQQKExZDeWJlclRydXN0IEphcGFu
+LCBJbmMuMSowKAYDVQQDEyFDeWJlclRydXN0IEpBUEFOIFNlY3VyZSBTZXJ2ZXIg
+Q0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKwmo6G4b2rALBL52zEFkuf9
++tSBtLjVKtWQ+vBDZfwSFcrs27lh3jNjN0+vADx/kjcbGHPlnzyI8RoTRP558sMm
+lQ8L8J4UByFsV8Jdw+JRsM2LX81fhjj4eZc57Oi/Ui6xXqqprozt7tfIty4xi7Q5
+kjt8gScHGgFEL0lzILbJAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAaB17Eu5aeSkx
+ygGsi1CpJ5ksAPw4Ghz/wtXwE/4bpzn1gBTrUfrAjXuEG1musTVRbqE+1xvsoJ7f
+4KWCluOxP9io8ct5gI738ESZfhT1I6MR42hLBTZuiOOrhqo4UwNCO9O5+eC/BenT
+X8NKp7b9t12QSfiasq1mpoIAk65g/yA=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 79 (0x4f)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=JP, O=CyberTrust Japan, Inc., CN=CyberTrust JAPAN Secure Server CA
+        Validity
+            Not Before: Aug  4 08:06:32 1998 GMT
+            Not After : Aug  4 23:59:00 2003 GMT
+        Subject: C=JP, O=CyberTrust Japan, Inc., CN=CyberTrust JAPAN Secure Server CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ac:26:a3:a1:b8:6f:6a:c0:2c:12:f9:db:31:05:
+                    92:e7:fd:fa:d4:81:b4:b8:d5:2a:d5:90:fa:f0:43:
+                    65:fc:12:15:ca:ec:db:b9:61:de:33:63:37:4f:af:
+                    00:3c:7f:92:37:1b:18:73:e5:9f:3c:88:f1:1a:13:
+                    44:fe:79:f2:c3:26:95:0f:0b:f0:9e:14:07:21:6c:
+                    57:c2:5d:c3:e2:51:b0:cd:8b:5f:cd:5f:86:38:f8:
+                    79:97:39:ec:e8:bf:52:2e:b1:5e:aa:a9:ae:8c:ed:
+                    ee:d7:c8:b7:2e:31:8b:b4:39:92:3b:7c:81:27:07:
+                    1a:01:44:2f:49:73:20:b6:c9
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        68:1d:7b:12:ee:5a:79:29:31:ca:01:ac:8b:50:a9:27:99:2c:
+        00:fc:38:1a:1c:ff:c2:d5:f0:13:fe:1b:a7:39:f5:80:14:eb:
+        51:fa:c0:8d:7b:84:1b:59:ae:b1:35:51:6e:a1:3e:d7:1b:ec:
+        a0:9e:df:e0:a5:82:96:e3:b1:3f:d8:a8:f1:cb:79:80:8e:f7:
+        f0:44:99:7e:14:f5:23:a3:11:e3:68:4b:05:36:6e:88:e3:ab:
+        86:aa:38:53:03:42:3b:d3:b9:f9:e0:bf:05:e9:d3:5f:c3:4a:
+        a7:b6:fd:b7:5d:90:49:f8:9a:b2:ad:66:a6:82:00:93:ae:60:
+        ff:20
+
+GTE CyberTrust Root 2
+=====================
+MD5 Fingerprint: BA:ED:17:57:9A:4B:FF:7C:F9:C9:1F:A2:CD:1A:D6:87
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICUDCCAbkCAgGbMA0GCSqGSIb3DQEBBAUAMHAxCzAJBgNVBAYTAlVTMRgwFgYD
+VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
+bHV0aW9ucywgSW5jLjEeMBwGA1UEAxMVR1RFIEN5YmVyVHJ1c3QgUm9vdCAyMB4X
+DTk4MDgxMTExMzUwN1oXDTA4MDgxMTExMjIxNlowcDELMAkGA1UEBhMCVVMxGDAW
+BgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1c3Qg
+U29sdXRpb25zLCBJbmMuMR4wHAYDVQQDExVHVEUgQ3liZXJUcnVzdCBSb290IDIw
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANksTE4vaRoj41a6886EwAnAefFE
+XzMfFZF/iogouCRFzI8YzR900bWPcUzWMfZzloSUQMWpg2Akfa9vNLdLTMIJgDtF
+BJ7EPMQndXsADKFkR7UUXYJLUTpYu0RMPdPlBjjoYVyYeLuAs5zacoJioN+cX+v5
+T3fCzGAYAGs0giWzAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAo2SRbxDt526iQkCU
+eM74FAjR+kOF60bNkhTQ7y4tNjkY2brJJ4gp6UgXb/jBqshhbS39QC11QzCXOfgU
+ZL1v72OoK0LfsloNJex7N9jOkSmCFvnoYqLhdsQCfd0li5jh9g1gjPZZkEBRRNHC
++xkkHhc5a3QhFTPWVdeCHnAsJ6g=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 411 (0x19b)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 2
+        Validity
+            Not Before: Aug 11 11:35:07 1998 GMT
+            Not After : Aug 11 11:22:16 2008 GMT
+        Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 2
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d9:2c:4c:4e:2f:69:1a:23:e3:56:ba:f3:ce:84:
+                    c0:09:c0:79:f1:44:5f:33:1f:15:91:7f:8a:88:28:
+                    b8:24:45:cc:8f:18:cd:1f:74:d1:b5:8f:71:4c:d6:
+                    31:f6:73:96:84:94:40:c5:a9:83:60:24:7d:af:6f:
+                    34:b7:4b:4c:c2:09:80:3b:45:04:9e:c4:3c:c4:27:
+                    75:7b:00:0c:a1:64:47:b5:14:5d:82:4b:51:3a:58:
+                    bb:44:4c:3d:d3:e5:06:38:e8:61:5c:98:78:bb:80:
+                    b3:9c:da:72:82:62:a0:df:9c:5f:eb:f9:4f:77:c2:
+                    cc:60:18:00:6b:34:82:25:b3
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        a3:64:91:6f:10:ed:e7:6e:a2:42:40:94:78:ce:f8:14:08:d1:
+        fa:43:85:eb:46:cd:92:14:d0:ef:2e:2d:36:39:18:d9:ba:c9:
+        27:88:29:e9:48:17:6f:f8:c1:aa:c8:61:6d:2d:fd:40:2d:75:
+        43:30:97:39:f8:14:64:bd:6f:ef:63:a8:2b:42:df:b2:5a:0d:
+        25:ec:7b:37:d8:ce:91:29:82:16:f9:e8:62:a2:e1:76:c4:02:
+        7d:dd:25:8b:98:e1:f6:0d:60:8c:f6:59:90:40:51:44:d1:c2:
+        fb:19:24:1e:17:39:6b:74:21:15:33:d6:55:d7:82:1e:70:2c:
+        27:a8
+
+GTE CyberTrust Root 3
+=====================
+MD5 Fingerprint: DB:81:96:57:AE:64:61:EF:77:A7:83:C4:51:24:3C:87
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICUDCCAbkCAgGXMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVTMRgwFgYD
+VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
+bHV0aW9ucywgSW5jLjEeMBwGA1UEAxMVR1RFIEN5YmVyVHJ1c3QgUm9vdCAzMB4X
+DTk4MDgxMDE5NTkwOFoXDTA4MDgxMDE5MzYzOVowcDELMAkGA1UEBhMCVVMxGDAW
+BgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1c3Qg
+U29sdXRpb25zLCBJbmMuMR4wHAYDVQQDExVHVEUgQ3liZXJUcnVzdCBSb290IDMw
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOHzsSsLztwU2TSXYlASVmOETFP6
+wIXP+sHdD955E39T+6oOYN3iYr/G7k6ZNKpoQzWZ+KP982O9AVRqnrI6lix7eCjG
+WrWNGhUY/eOMLqJQCVtx1g21GB8ZjgQpk5N4q18U53NC8gMMV6IbUDsLu1ngoDoD
+7icbWky5sAjKuRqJAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAheutlCAG6bKiazvy
+ZuvjS7gSJgXl9JGo3IfcmPSUwfRhvdWcbFFzlV7QvdfmRdw8z0aE1ee57ORnY24A
+KHdxXUoF6bl8hszCRLveKUja6t29F58dUQGo6BResVf3/9qPzpX+Le0yEnf/fGph
+la4xcgYI8PnzDY7i76hTXZEDg94=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 407 (0x197)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 3
+        Validity
+            Not Before: Aug 10 19:59:08 1998 GMT
+            Not After : Aug 10 19:36:39 2008 GMT
+        Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:e1:f3:b1:2b:0b:ce:dc:14:d9:34:97:62:50:12:
+                    56:63:84:4c:53:fa:c0:85:cf:fa:c1:dd:0f:de:79:
+                    13:7f:53:fb:aa:0e:60:dd:e2:62:bf:c6:ee:4e:99:
+                    34:aa:68:43:35:99:f8:a3:fd:f3:63:bd:01:54:6a:
+                    9e:b2:3a:96:2c:7b:78:28:c6:5a:b5:8d:1a:15:18:
+                    fd:e3:8c:2e:a2:50:09:5b:71:d6:0d:b5:18:1f:19:
+                    8e:04:29:93:93:78:ab:5f:14:e7:73:42:f2:03:0c:
+                    57:a2:1b:50:3b:0b:bb:59:e0:a0:3a:03:ee:27:1b:
+                    5a:4c:b9:b0:08:ca:b9:1a:89
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        85:eb:ad:94:20:06:e9:b2:a2:6b:3b:f2:66:eb:e3:4b:b8:12:
+        26:05:e5:f4:91:a8:dc:87:dc:98:f4:94:c1:f4:61:bd:d5:9c:
+        6c:51:73:95:5e:d0:bd:d7:e6:45:dc:3c:cf:46:84:d5:e7:b9:
+        ec:e4:67:63:6e:00:28:77:71:5d:4a:05:e9:b9:7c:86:cc:c2:
+        44:bb:de:29:48:da:ea:dd:bd:17:9f:1d:51:01:a8:e8:14:5e:
+        b1:57:f7:ff:da:8f:ce:95:fe:2d:ed:32:12:77:ff:7c:6a:61:
+        95:ae:31:72:06:08:f0:f9:f3:0d:8e:e2:ef:a8:53:5d:91:03:
+        83:de
+
+GTE CyberTrust Root 4
+=====================
+MD5 Fingerprint: 33:43:02:B1:B9:E0:73:B1:B1:20:CA:CB:C7:84:03:50
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDVTCCAj0CAgGoMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNVBAYTAlVTMRgwFgYD
+VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv
+bHV0aW9ucywgSW5jLjEeMBwGA1UEAxMVR1RFIEN5YmVyVHJ1c3QgUm9vdCA0MB4X
+DTk4MDgxMzEzNTEwMFoXDTEzMDgxMzIzNTkwMFowcDELMAkGA1UEBhMCVVMxGDAW
+BgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1c3Qg
+U29sdXRpb25zLCBJbmMuMR4wHAYDVQQDExVHVEUgQ3liZXJUcnVzdCBSb290IDQw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6nSJuf9pmPDlCsaMqb9P3
+vK6sMVrXEZBHuZ0ZLvnzGyKgw+GnusT8XgqUS5haSybkH/Tc8/6OiNxsLXx3hyZQ
+wF5OqCih6hdpT03GAQ7amg0GViYVtqRdejWvje14Uob5OKuzAdPaBZaxtlCrwKGu
+F1P6QzkgcWUj223Etu2YRYPX0vbiqWv7+XXM78WrcZY16N+OkZuoEHUft84Tjmuz
+lneXGpEvxyxpmfAPKmgAmHZEG4wo0uuO9IO0f6QlXmw72cZo1WG41F4xB7VbkDVS
+V3sXIO0tuB6OiDk+Usvf8FyxZbulErSQY79xnTLB2r9QSpW+BjrEK+vNmHZETQvl
+AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAEOvHIfJSbpliTRJPOoHO0eiedSgO5Bs
+3n+oVMPoTEAyvMjsHOXZrEC6/Iw/wnOc9GTq36ntTlvIAWDuOW1DJ/N/qgjS/k5v
+FDJNfeQ0gKU1xNZGULQ7oC1lH09lfjQoLcCndn0xyQ0zFvYgGSARULsDzHBtlrfv
+TKfaNhXPu03UltyITWyY7blz/ihXoO1k+AqBKXP29pcyhzm0ge/ZTRoHNPe6QjXe
+V9xc1vfF6wonDIGmwtBoTv2SW0iD9haKjzZb7TFsP0F6cfeSPzGkCkBM84biYcE8
+SYEtpbjvupcPvCsdm4ny0o4eTYbywqv2LZnAGyoNobZP+SxYTT19Nwo=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 424 (0x1a8)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 4
+        Validity
+            Not Before: Aug 13 13:51:00 1998 GMT
+            Not After : Aug 13 23:59:00 2013 GMT
+        Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ba:9d:22:6e:7f:da:66:3c:39:42:b1:a3:2a:6f:
+                    d3:f7:bc:ae:ac:31:5a:d7:11:90:47:b9:9d:19:2e:
+                    f9:f3:1b:22:a0:c3:e1:a7:ba:c4:fc:5e:0a:94:4b:
+                    98:5a:4b:26:e4:1f:f4:dc:f3:fe:8e:88:dc:6c:2d:
+                    7c:77:87:26:50:c0:5e:4e:a8:28:a1:ea:17:69:4f:
+                    4d:c6:01:0e:da:9a:0d:06:56:26:15:b6:a4:5d:7a:
+                    35:af:8d:ed:78:52:86:f9:38:ab:b3:01:d3:da:05:
+                    96:b1:b6:50:ab:c0:a1:ae:17:53:fa:43:39:20:71:
+                    65:23:db:6d:c4:b6:ed:98:45:83:d7:d2:f6:e2:a9:
+                    6b:fb:f9:75:cc:ef:c5:ab:71:96:35:e8:df:8e:91:
+                    9b:a8:10:75:1f:b7:ce:13:8e:6b:b3:96:77:97:1a:
+                    91:2f:c7:2c:69:99:f0:0f:2a:68:00:98:76:44:1b:
+                    8c:28:d2:eb:8e:f4:83:b4:7f:a4:25:5e:6c:3b:d9:
+                    c6:68:d5:61:b8:d4:5e:31:07:b5:5b:90:35:52:57:
+                    7b:17:20:ed:2d:b8:1e:8e:88:39:3e:52:cb:df:f0:
+                    5c:b1:65:bb:a5:12:b4:90:63:bf:71:9d:32:c1:da:
+                    bf:50:4a:95:be:06:3a:c4:2b:eb:cd:98:76:44:4d:
+                    0b:e5
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        43:af:1c:87:c9:49:ba:65:89:34:49:3c:ea:07:3b:47:a2:79:
+        d4:a0:3b:90:6c:de:7f:a8:54:c3:e8:4c:40:32:bc:c8:ec:1c:
+        e5:d9:ac:40:ba:fc:8c:3f:c2:73:9c:f4:64:ea:df:a9:ed:4e:
+        5b:c8:01:60:ee:39:6d:43:27:f3:7f:aa:08:d2:fe:4e:6f:14:
+        32:4d:7d:e4:34:80:a5:35:c4:d6:46:50:b4:3b:a0:2d:65:1f:
+        4f:65:7e:34:28:2d:c0:a7:76:7d:31:c9:0d:33:16:f6:20:19:
+        20:11:50:bb:03:cc:70:6d:96:b7:ef:4c:a7:da:36:15:cf:bb:
+        4d:d4:96:dc:88:4d:6c:98:ed:b9:73:fe:28:57:a0:ed:64:f8:
+        0a:81:29:73:f6:f6:97:32:87:39:b4:81:ef:d9:4d:1a:07:34:
+        f7:ba:42:35:de:57:dc:5c:d6:f7:c5:eb:0a:27:0c:81:a6:c2:
+        d0:68:4e:fd:92:5b:48:83:f6:16:8a:8f:36:5b:ed:31:6c:3f:
+        41:7a:71:f7:92:3f:31:a4:0a:40:4c:f3:86:e2:61:c1:3c:49:
+        81:2d:a5:b8:ef:ba:97:0f:bc:2b:1d:9b:89:f2:d2:8e:1e:4d:
+        86:f2:c2:ab:f6:2d:99:c0:1b:2a:0d:a1:b6:4f:f9:2c:58:4d:
+        3d:7d:37:0a
+
+GTE CyberTrust Root 5
+=====================
+MD5 Fingerprint: 7D:6C:86:E4:FC:4D:D1:0B:00:BA:22:BB:4E:7C:6A:8E
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDtjCCAp6gAwIBAgICAbYwDQYJKoZIhvcNAQEFBQAwcDELMAkGA1UEBhMCVVMx
+GDAWBgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1
+c3QgU29sdXRpb25zLCBJbmMuMR4wHAYDVQQDExVHVEUgQ3liZXJUcnVzdCBSb290
+IDUwHhcNOTgwODE0MTQ1MDAwWhcNMTMwODE0MjM1OTAwWjBwMQswCQYDVQQGEwJV
+UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU
+cnVzdCBTb2x1dGlvbnMsIEluYy4xHjAcBgNVBAMTFUdURSBDeWJlclRydXN0IFJv
+b3QgNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALwSbj+KfHqXAewe
+uzlaAvR4RKJIG457SVJ6uHtHs6+Um2+7lvoramVcuByUc76/iQoigO5X/IwFu3Cf
+lzkE2qOHXKjlyq/AM5rVN1xLrOSA0KYjYPv9ci6UncfOwgQy73hgXe2thw9FZR48
+mgqavl0dmezn8tHGehfZrZtUln/EfGC/haoVNR1A2hG87FQhKC0joajwzy3N3fx+
+D17hZQdWywe00lboXjHMGGPEhtIthc+Tkqtt/mg5+95zvYb45EZ66p8My/QZ/mO8
+0Sx7iDM29uThnAxTgWAc2i6rlqkWiBNQmbK9Vd8VMH7o5Zj7cH5stQf8/Ea30O03
+ln4y/iECAwEAAaNaMFgwEgYDVR0TAQH/BAgwBgEB/wIBBTAOBgNVHQ8BAf8EBAMC
+AQYwFwYDVR0gBBAwDjAMBgoqhkiG+GMBAgEDMBkGA1UdDgQSBBB2CkkhOEyf3vjE
+ScdxcZGdMA0GCSqGSIb3DQEBBQUAA4IBAQBBOtQYW9q43iEc4Y4J5fFoNP/elvQH
+9ac886xKsZv6kvqb7eYyIapKdsXcTzjl39WG5NXIdn2Y17HNj021kSNsi4rr6nzv
+FJTExvAfSi0ycWMrY5EmAgm2gB3t4sy4f9uHY8jh0GwmsTUdQGYQG82VVBgzYewT
+T9oT95mvPtDPjqZyorPDBZrJJ32SzH5SjbOrcG2eiZ9N6xp1wpiq1QIW1wyKvyXk
+6y28mOlYOBl8uTf+2+KZCHMGx5eDan0QAS8yuRcFSmXmL86+XlOmgumaUwqEdC2D
+ysiUFnZflGEo8IWnObvXi9moshMdVAk0JH0ggX1mfqKQdFwQxr3sqxvC
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 438 (0x1b6)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 5
+        Validity
+            Not Before: Aug 14 14:50:00 1998 GMT
+            Not After : Aug 14 23:59:00 2013 GMT
+        Subject: C=US, O=GTE Corporation, OU=GTE CyberTrust Solutions, Inc., CN=GTE CyberTrust Root 5
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:bc:12:6e:3f:8a:7c:7a:97:01:ec:1e:bb:39:5a:
+                    02:f4:78:44:a2:48:1b:8e:7b:49:52:7a:b8:7b:47:
+                    b3:af:94:9b:6f:bb:96:fa:2b:6a:65:5c:b8:1c:94:
+                    73:be:bf:89:0a:22:80:ee:57:fc:8c:05:bb:70:9f:
+                    97:39:04:da:a3:87:5c:a8:e5:ca:af:c0:33:9a:d5:
+                    37:5c:4b:ac:e4:80:d0:a6:23:60:fb:fd:72:2e:94:
+                    9d:c7:ce:c2:04:32:ef:78:60:5d:ed:ad:87:0f:45:
+                    65:1e:3c:9a:0a:9a:be:5d:1d:99:ec:e7:f2:d1:c6:
+                    7a:17:d9:ad:9b:54:96:7f:c4:7c:60:bf:85:aa:15:
+                    35:1d:40:da:11:bc:ec:54:21:28:2d:23:a1:a8:f0:
+                    cf:2d:cd:dd:fc:7e:0f:5e:e1:65:07:56:cb:07:b4:
+                    d2:56:e8:5e:31:cc:18:63:c4:86:d2:2d:85:cf:93:
+                    92:ab:6d:fe:68:39:fb:de:73:bd:86:f8:e4:46:7a:
+                    ea:9f:0c:cb:f4:19:fe:63:bc:d1:2c:7b:88:33:36:
+                    f6:e4:e1:9c:0c:53:81:60:1c:da:2e:ab:96:a9:16:
+                    88:13:50:99:b2:bd:55:df:15:30:7e:e8:e5:98:fb:
+                    70:7e:6c:b5:07:fc:fc:46:b7:d0:ed:37:96:7e:32:
+                    fe:21
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:5
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Certificate Policies: 
+                Policy: 1.2.840.113763.1.2.1.3
+
+            X509v3 Subject Key Identifier: 
+                76:0A:49:21:38:4C:9F:DE:F8:C4:49:C7:71:71:91:9D
+    Signature Algorithm: sha1WithRSAEncryption
+        41:3a:d4:18:5b:da:b8:de:21:1c:e1:8e:09:e5:f1:68:34:ff:
+        de:96:f4:07:f5:a7:3c:f3:ac:4a:b1:9b:fa:92:fa:9b:ed:e6:
+        32:21:aa:4a:76:c5:dc:4f:38:e5:df:d5:86:e4:d5:c8:76:7d:
+        98:d7:b1:cd:8f:4d:b5:91:23:6c:8b:8a:eb:ea:7c:ef:14:94:
+        c4:c6:f0:1f:4a:2d:32:71:63:2b:63:91:26:02:09:b6:80:1d:
+        ed:e2:cc:b8:7f:db:87:63:c8:e1:d0:6c:26:b1:35:1d:40:66:
+        10:1b:cd:95:54:18:33:61:ec:13:4f:da:13:f7:99:af:3e:d0:
+        cf:8e:a6:72:a2:b3:c3:05:9a:c9:27:7d:92:cc:7e:52:8d:b3:
+        ab:70:6d:9e:89:9f:4d:eb:1a:75:c2:98:aa:d5:02:16:d7:0c:
+        8a:bf:25:e4:eb:2d:bc:98:e9:58:38:19:7c:b9:37:fe:db:e2:
+        99:08:73:06:c7:97:83:6a:7d:10:01:2f:32:b9:17:05:4a:65:
+        e6:2f:ce:be:5e:53:a6:82:e9:9a:53:0a:84:74:2d:83:ca:c8:
+        94:16:76:5f:94:61:28:f0:85:a7:39:bb:d7:8b:d9:a8:b2:13:
+        1d:54:09:34:24:7d:20:81:7d:66:7e:a2:90:74:5c:10:c6:bd:
+        ec:ab:1b:c2
+
+GTE CyberTrust Root CA
+======================
+MD5 Fingerprint: C4:D7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIB+jCCAWMCAgGjMA0GCSqGSIb3DQEBBAUAMEUxCzAJBgNVBAYTAlVTMRgwFgYD
+VQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJv
+b3QwHhcNOTYwMjIzMjMwMTAwWhcNMDYwMjIzMjM1OTAwWjBFMQswCQYDVQQGEwJV
+UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMRwwGgYDVQQDExNHVEUgQ3liZXJU
+cnVzdCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC45k+625h8cXyv
+RLfTD0bZZOWTwUKOx7pJjTUteueLveUFMVnGsS8KDPufpz+iCWaEVh43KRuH6X4M
+ypqfpX/1FZSj1aJGgthoTNE3FQZor734sLPwKfWVWgkWYXcKIiXUT0Wqx73llt/5
+1KiOQswkwB6RJ0q1bQaAYznEol44AwIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABKz
+dcZfHeFhVYAA1IFLezEPI2PnPfMD+fQ2qLvZ46WXTeorKeDWanOB5sCJo9Px4KWl
+IjeaY8JIILTbcuPI9tl8vrGvU9oUtCG41tWW4/5ODFlitppK+ULdjG+BqXH/9Apy
+bW1EDp3zdHSo1TRJ6V6e6bR64eVaH4QwnNOfpSXY
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 419 (0x1a3)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=US, O=GTE Corporation, CN=GTE CyberTrust Root
+        Validity
+            Not Before: Feb 23 23:01:00 1996 GMT
+            Not After : Feb 23 23:59:00 2006 GMT
+        Subject: C=US, O=GTE Corporation, CN=GTE CyberTrust Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b8:e6:4f:ba:db:98:7c:71:7c:af:44:b7:d3:0f:
+                    46:d9:64:e5:93:c1:42:8e:c7:ba:49:8d:35:2d:7a:
+                    e7:8b:bd:e5:05:31:59:c6:b1:2f:0a:0c:fb:9f:a7:
+                    3f:a2:09:66:84:56:1e:37:29:1b:87:e9:7e:0c:ca:
+                    9a:9f:a5:7f:f5:15:94:a3:d5:a2:46:82:d8:68:4c:
+                    d1:37:15:06:68:af:bd:f8:b0:b3:f0:29:f5:95:5a:
+                    09:16:61:77:0a:22:25:d4:4f:45:aa:c7:bd:e5:96:
+                    df:f9:d4:a8:8e:42:cc:24:c0:1e:91:27:4a:b5:6d:
+                    06:80:63:39:c4:a2:5e:38:03
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md5WithRSAEncryption
+        12:b3:75:c6:5f:1d:e1:61:55:80:00:d4:81:4b:7b:31:0f:23:
+        63:e7:3d:f3:03:f9:f4:36:a8:bb:d9:e3:a5:97:4d:ea:2b:29:
+        e0:d6:6a:73:81:e6:c0:89:a3:d3:f1:e0:a5:a5:22:37:9a:63:
+        c2:48:20:b4:db:72:e3:c8:f6:d9:7c:be:b1:af:53:da:14:b4:
+        21:b8:d6:d5:96:e3:fe:4e:0c:59:62:b6:9a:4a:f9:42:dd:8c:
+        6f:81:a9:71:ff:f4:0a:72:6d:6d:44:0e:9d:f3:74:74:a8:d5:
+        34:49:e9:5e:9e:e9:b4:7a:e1:e5:5a:1f:84:30:9c:d3:9f:a5:
+        25:d8
+
+GlobalSign Partners CA
+======================
+MD5 Fingerprint: 3C:75:CD:4C:BD:A9:D0:8A:79:4F:50:16:37:84:F4:2B
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDnjCCAoagAwIBAgILAgAAAAAA1ni50a8wDQYJKoZIhvcNAQEEBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05OTAxMjgxMjAw
+MDBaFw0wOTAxMjgxMjAwMDBaMF8xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRQwEgYDVQQLEwtQYXJ0bmVycyBDQTEfMB0GA1UEAxMWR2xv
+YmFsU2lnbiBQYXJ0bmVycyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBANIs+DKsShJ6N8gpkaWujG4eDsA0M4jlM3EWHHiEaMMYNFAuFj6xlIJPsZqf
+APjGETXGaXuYAq0ABohs50wzKACIJ0Yfh7NxdWO8MruI3mYYDlAGk7T2vBQ3MD0i
+3z3/dX7ZChrFn7P80KyzCHqJ0wHoAFznSgs9TXsmordiBovaRt2TFz8/WwJLC7aI
+IBGSAK27xy7U40Wu9YlafI2krYVkMsAnjMbyioCShiRWWY10aKKDQrOePVBBhm8g
+bvb9ztMZ4zLMj+2aXm0fKPVSrG4YXvg90ZLlumwBiEsK8i3eZTMFQqBMqjF2vv2/
+gXj5cRxGXi0VlS0wWY5MQdFiqz0CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgAGMB0G
+A1UdDgQWBBRDJI1wFQhiVZxPDEAXXYZeD6JM+zAfBgNVHSMEGDAWgBRge2YaRQ2X
+yolQL30EzTSo//z9SzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBAUAA4IB
+AQBm7bSIaRGZgiGDrKFti5uErQ8tyB6Mynt+rarUjt4H1p5Fx6W4nAc5YCVVGsBP
+GeXPFylJiRg1ZuXrKEBOV8mvs+S4IAWjO5VQkUmUKX0s5YhBpUWIXp2CJ/fS71u1
+T5++/jVlLFVkn+FR2iJhd7pYTo/GeVlZbjCAok+QbiELrdBoOZAQm+0iZW8eETjm
+f4zS8zltR9Uh6Op1OkHRrfYWnV0LIb3zH2MGJR3BHzVxLOsgGdXBsOw95W/tAgc/
+E3tmktZEwZj3X1CLelvCb22w0fjldKBAN6MlD+Q9ymQxk5BcMHu5OTGaXkzNuUFP
+UOQ9OK7IZtnHO11RR6ybq/Kt
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            02:00:00:00:00:00:d6:78:b9:d1:af
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Validity
+            Not Before: Jan 28 12:00:00 1999 GMT
+            Not After : Jan 28 12:00:00 2009 GMT
+        Subject: C=BE, O=GlobalSign nv-sa, OU=Partners CA, CN=GlobalSign Partners CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d2:2c:f8:32:ac:4a:12:7a:37:c8:29:91:a5:ae:
+                    8c:6e:1e:0e:c0:34:33:88:e5:33:71:16:1c:78:84:
+                    68:c3:18:34:50:2e:16:3e:b1:94:82:4f:b1:9a:9f:
+                    00:f8:c6:11:35:c6:69:7b:98:02:ad:00:06:88:6c:
+                    e7:4c:33:28:00:88:27:46:1f:87:b3:71:75:63:bc:
+                    32:bb:88:de:66:18:0e:50:06:93:b4:f6:bc:14:37:
+                    30:3d:22:df:3d:ff:75:7e:d9:0a:1a:c5:9f:b3:fc:
+                    d0:ac:b3:08:7a:89:d3:01:e8:00:5c:e7:4a:0b:3d:
+                    4d:7b:26:a2:b7:62:06:8b:da:46:dd:93:17:3f:3f:
+                    5b:02:4b:0b:b6:88:20:11:92:00:ad:bb:c7:2e:d4:
+                    e3:45:ae:f5:89:5a:7c:8d:a4:ad:85:64:32:c0:27:
+                    8c:c6:f2:8a:80:92:86:24:56:59:8d:74:68:a2:83:
+                    42:b3:9e:3d:50:41:86:6f:20:6e:f6:fd:ce:d3:19:
+                    e3:32:cc:8f:ed:9a:5e:6d:1f:28:f5:52:ac:6e:18:
+                    5e:f8:3d:d1:92:e5:ba:6c:01:88:4b:0a:f2:2d:de:
+                    65:33:05:42:a0:4c:aa:31:76:be:fd:bf:81:78:f9:
+                    71:1c:46:5e:2d:15:95:2d:30:59:8e:4c:41:d1:62:
+                    ab:3d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                43:24:8D:70:15:08:62:55:9C:4F:0C:40:17:5D:86:5E:0F:A2:4C:FB
+            X509v3 Authority Key Identifier: 
+                keyid:60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        66:ed:b4:88:69:11:99:82:21:83:ac:a1:6d:8b:9b:84:ad:0f:
+        2d:c8:1e:8c:ca:7b:7e:ad:aa:d4:8e:de:07:d6:9e:45:c7:a5:
+        b8:9c:07:39:60:25:55:1a:c0:4f:19:e5:cf:17:29:49:89:18:
+        35:66:e5:eb:28:40:4e:57:c9:af:b3:e4:b8:20:05:a3:3b:95:
+        50:91:49:94:29:7d:2c:e5:88:41:a5:45:88:5e:9d:82:27:f7:
+        d2:ef:5b:b5:4f:9f:be:fe:35:65:2c:55:64:9f:e1:51:da:22:
+        61:77:ba:58:4e:8f:c6:79:59:59:6e:30:80:a2:4f:90:6e:21:
+        0b:ad:d0:68:39:90:10:9b:ed:22:65:6f:1e:11:38:e6:7f:8c:
+        d2:f3:39:6d:47:d5:21:e8:ea:75:3a:41:d1:ad:f6:16:9d:5d:
+        0b:21:bd:f3:1f:63:06:25:1d:c1:1f:35:71:2c:eb:20:19:d5:
+        c1:b0:ec:3d:e5:6f:ed:02:07:3f:13:7b:66:92:d6:44:c1:98:
+        f7:5f:50:8b:7a:5b:c2:6f:6d:b0:d1:f8:e5:74:a0:40:37:a3:
+        25:0f:e4:3d:ca:64:31:93:90:5c:30:7b:b9:39:31:9a:5e:4c:
+        cd:b9:41:4f:50:e4:3d:38:ae:c8:66:d9:c7:3b:5d:51:47:ac:
+        9b:ab:f2:ad
+
+GlobalSign Primary Class 1 CA
+=============================
+MD5 Fingerprint: 5C:AC:59:01:A4:86:53:CB:10:66:B5:D6:D6:71:FF:01
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDrDCCApSgAwIBAgILAgAAAAAA1ni4N88wDQYJKoZIhvcNAQEEBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MTUxMjAw
+MDBaFw0wOTAxMjgxMjAwMDBaMG0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRswGQYDVQQLExJQcmltYXJ5IENsYXNzIDEgQ0ExJjAkBgNV
+BAMTHUdsb2JhbFNpZ24gUHJpbWFyeSBDbGFzcyAxIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAvSA1R9Eo1gijEjkjRw29cCFSDlcxlaY0V2vsfkN5
+wwZSSM28taGZvdgfMrzP125ybS53IpCCTkuPmgwBQprZcFm2nR/mY9EMrR1O+IWB
++a7vn6ZSYUR5GnVF4GFWRW1CjD1yy6akErea9dZg0GBQs46mpuy09BLNf6jO77Ph
+hTD+csTm53eznlhB1lGDiAfGtmlPNt7RC0g/vdafIXRkbycGPkv9Dqabv6RIV4yQ
+7okYCwKBGL5n/lNgiCe6o3M0S1pWtN5zBe2Yll3sSudA/EsJYuvQ4zFPhdF6q1ln
+K/uID+uqg701/WEn7GYOQlf3acIM7/xqwm5J2o9BOK5IqQIDAQABo2MwYTAOBgNV
+HQ8BAf8EBAMCAAYwHQYDVR0OBBYEFPzgZvZaNZnrQB7SuB5DvJiOH4rDMB8GA1Ud
+IwQYMBaAFGB7ZhpFDZfKiVAvfQTNNKj//P1LMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
+KoZIhvcNAQEEBQADggEBAJujCETO8pCdcfMyswVqterPKZjeVT6gFn0GekTWr9L6
+E1iM+BzHqx20G+9paJhcCDmP4Pf7SMwh57gz2wWqNCRsSuXpe2Deg7MfCr5BdfzM
+MEi3wSYdBDOqtnjtKsu6VpcybvcxlS5G8hTuJ8f3Yom5XFrTOIpk9Te08bM0ctXV
+IT1L13iT1zFmNR6j2EdJbxyt4YB/+JgkbHOsDsIadwKjJge3x2tdvILVKkgdY89Q
+Mqb7HBhHFQpbDFw4JJoEmKgISF98NIdjqy2NTAB3lBt2uvUWGKMVry+U9ikAdsEV
+F9PpN0121MtLKVkkrNpKoOpj3l9Usfrz0UXLxWS0cyE=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            02:00:00:00:00:00:d6:78:b8:37:cf
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Validity
+            Not Before: Sep 15 12:00:00 1998 GMT
+            Not After : Jan 28 12:00:00 2009 GMT
+        Subject: C=BE, O=GlobalSign nv-sa, OU=Primary Class 1 CA, CN=GlobalSign Primary Class 1 CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:bd:20:35:47:d1:28:d6:08:a3:12:39:23:47:0d:
+                    bd:70:21:52:0e:57:31:95:a6:34:57:6b:ec:7e:43:
+                    79:c3:06:52:48:cd:bc:b5:a1:99:bd:d8:1f:32:bc:
+                    cf:d7:6e:72:6d:2e:77:22:90:82:4e:4b:8f:9a:0c:
+                    01:42:9a:d9:70:59:b6:9d:1f:e6:63:d1:0c:ad:1d:
+                    4e:f8:85:81:f9:ae:ef:9f:a6:52:61:44:79:1a:75:
+                    45:e0:61:56:45:6d:42:8c:3d:72:cb:a6:a4:12:b7:
+                    9a:f5:d6:60:d0:60:50:b3:8e:a6:a6:ec:b4:f4:12:
+                    cd:7f:a8:ce:ef:b3:e1:85:30:fe:72:c4:e6:e7:77:
+                    b3:9e:58:41:d6:51:83:88:07:c6:b6:69:4f:36:de:
+                    d1:0b:48:3f:bd:d6:9f:21:74:64:6f:27:06:3e:4b:
+                    fd:0e:a6:9b:bf:a4:48:57:8c:90:ee:89:18:0b:02:
+                    81:18:be:67:fe:53:60:88:27:ba:a3:73:34:4b:5a:
+                    56:b4:de:73:05:ed:98:96:5d:ec:4a:e7:40:fc:4b:
+                    09:62:eb:d0:e3:31:4f:85:d1:7a:ab:59:67:2b:fb:
+                    88:0f:eb:aa:83:bd:35:fd:61:27:ec:66:0e:42:57:
+                    f7:69:c2:0c:ef:fc:6a:c2:6e:49:da:8f:41:38:ae:
+                    48:a9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                FC:E0:66:F6:5A:35:99:EB:40:1E:D2:B8:1E:43:BC:98:8E:1F:8A:C3
+            X509v3 Authority Key Identifier: 
+                keyid:60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        9b:a3:08:44:ce:f2:90:9d:71:f3:32:b3:05:6a:b5:ea:cf:29:
+        98:de:55:3e:a0:16:7d:06:7a:44:d6:af:d2:fa:13:58:8c:f8:
+        1c:c7:ab:1d:b4:1b:ef:69:68:98:5c:08:39:8f:e0:f7:fb:48:
+        cc:21:e7:b8:33:db:05:aa:34:24:6c:4a:e5:e9:7b:60:de:83:
+        b3:1f:0a:be:41:75:fc:cc:30:48:b7:c1:26:1d:04:33:aa:b6:
+        78:ed:2a:cb:ba:56:97:32:6e:f7:31:95:2e:46:f2:14:ee:27:
+        c7:f7:62:89:b9:5c:5a:d3:38:8a:64:f5:37:b4:f1:b3:34:72:
+        d5:d5:21:3d:4b:d7:78:93:d7:31:66:35:1e:a3:d8:47:49:6f:
+        1c:ad:e1:80:7f:f8:98:24:6c:73:ac:0e:c2:1a:77:02:a3:26:
+        07:b7:c7:6b:5d:bc:82:d5:2a:48:1d:63:cf:50:32:a6:fb:1c:
+        18:47:15:0a:5b:0c:5c:38:24:9a:04:98:a8:08:48:5f:7c:34:
+        87:63:ab:2d:8d:4c:00:77:94:1b:76:ba:f5:16:18:a3:15:af:
+        2f:94:f6:29:00:76:c1:15:17:d3:e9:37:4d:76:d4:cb:4b:29:
+        59:24:ac:da:4a:a0:ea:63:de:5f:54:b1:fa:f3:d1:45:cb:c5:
+        64:b4:73:21
+
+GlobalSign Primary Class 2 CA
+=============================
+MD5 Fingerprint: A9:A9:42:59:7E:BE:5A:94:E4:2C:C6:8B:1C:2A:44:B6
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDrDCCApSgAwIBAgILAgAAAAAA1ni4jY0wDQYJKoZIhvcNAQEEBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05OTAxMjgxMjAw
+MDBaFw0wOTAxMjgxMjAwMDBaMG0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRswGQYDVQQLExJQcmltYXJ5IENsYXNzIDIgQ0ExJjAkBgNV
+BAMTHUdsb2JhbFNpZ24gUHJpbWFyeSBDbGFzcyAyIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAkoz+7/RFjhdBbvzYvyFvqwadUsEsAJ0/joW4f0qP
+vaBjKspJJ65agvR04lWS/8LRqnmitvrVnYIET8ayxl5jpzq62O7rim+ftrsoQcAi
++05IGgaS17/Xz7nZvThPOw1EblVB/vwJ29i/844h8egStfYTpdPGTJMisAL/7h0M
+xKhrT3VoVujcKBJQ96gknS4kOfsJBd7lo2RJIdBofnEwkbFg4Dn0UPh6TZgAa3x5
+uk7OSuK6Nh23xTYVlZxkQupfxLr1QAW+4TpZvYSnGbjeTVNQzgfR0lHT7w2BbObn
+bctdfD98zOxPgycl/3BQ9oNZdYQGZlgs3omNAKZJ+aVDdwIDAQABo2MwYTAOBgNV
+HQ8BAf8EBAMCAAYwHQYDVR0OBBYEFHznsrEs3rGna+l2DOGj/U5sx7n2MB8GA1Ud
+IwQYMBaAFGB7ZhpFDZfKiVAvfQTNNKj//P1LMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
+KoZIhvcNAQEEBQADggEBAGPdWc6KeaqYnU7FiWQ3foqTZy8Q6m8nw413bfJcVpQZ
+GmlgMEZdj/JtRTyONZd8L7hR4uiJvYjPJxwINFyIwWgk25GF5M/7+0ON6CUBG8QO
+9wBCSIYfJAhYWoyN8mtHLGiRsWlC/Q2NySbmkoamZG6Sxc4+PH1x4yOkq8fVqKnf
+gqc76IbVw08Y40TQ4NzzxWgu/qUvBYTIfkdCU2uHSv4y/14+cIy3qBXMF8L/RuzQ
+7C20bhIoqflA6evUZpdTqWlVwKmqsi7N0Wn0vvi7fGnuVKbbnvtapj7+mu+UUUt1
+7tjU4ZrxAlYTiQ6nQouWi4UMG4W+Jq6rppm8IvFz30I=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            02:00:00:00:00:00:d6:78:b8:8d:8d
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Validity
+            Not Before: Jan 28 12:00:00 1999 GMT
+            Not After : Jan 28 12:00:00 2009 GMT
+        Subject: C=BE, O=GlobalSign nv-sa, OU=Primary Class 2 CA, CN=GlobalSign Primary Class 2 CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:92:8c:fe:ef:f4:45:8e:17:41:6e:fc:d8:bf:21:
+                    6f:ab:06:9d:52:c1:2c:00:9d:3f:8e:85:b8:7f:4a:
+                    8f:bd:a0:63:2a:ca:49:27:ae:5a:82:f4:74:e2:55:
+                    92:ff:c2:d1:aa:79:a2:b6:fa:d5:9d:82:04:4f:c6:
+                    b2:c6:5e:63:a7:3a:ba:d8:ee:eb:8a:6f:9f:b6:bb:
+                    28:41:c0:22:fb:4e:48:1a:06:92:d7:bf:d7:cf:b9:
+                    d9:bd:38:4f:3b:0d:44:6e:55:41:fe:fc:09:db:d8:
+                    bf:f3:8e:21:f1:e8:12:b5:f6:13:a5:d3:c6:4c:93:
+                    22:b0:02:ff:ee:1d:0c:c4:a8:6b:4f:75:68:56:e8:
+                    dc:28:12:50:f7:a8:24:9d:2e:24:39:fb:09:05:de:
+                    e5:a3:64:49:21:d0:68:7e:71:30:91:b1:60:e0:39:
+                    f4:50:f8:7a:4d:98:00:6b:7c:79:ba:4e:ce:4a:e2:
+                    ba:36:1d:b7:c5:36:15:95:9c:64:42:ea:5f:c4:ba:
+                    f5:40:05:be:e1:3a:59:bd:84:a7:19:b8:de:4d:53:
+                    50:ce:07:d1:d2:51:d3:ef:0d:81:6c:e6:e7:6d:cb:
+                    5d:7c:3f:7c:cc:ec:4f:83:27:25:ff:70:50:f6:83:
+                    59:75:84:06:66:58:2c:de:89:8d:00:a6:49:f9:a5:
+                    43:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                7C:E7:B2:B1:2C:DE:B1:A7:6B:E9:76:0C:E1:A3:FD:4E:6C:C7:B9:F6
+            X509v3 Authority Key Identifier: 
+                keyid:60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        63:dd:59:ce:8a:79:aa:98:9d:4e:c5:89:64:37:7e:8a:93:67:
+        2f:10:ea:6f:27:c3:8d:77:6d:f2:5c:56:94:19:1a:69:60:30:
+        46:5d:8f:f2:6d:45:3c:8e:35:97:7c:2f:b8:51:e2:e8:89:bd:
+        88:cf:27:1c:08:34:5c:88:c1:68:24:db:91:85:e4:cf:fb:fb:
+        43:8d:e8:25:01:1b:c4:0e:f7:00:42:48:86:1f:24:08:58:5a:
+        8c:8d:f2:6b:47:2c:68:91:b1:69:42:fd:0d:8d:c9:26:e6:92:
+        86:a6:64:6e:92:c5:ce:3e:3c:7d:71:e3:23:a4:ab:c7:d5:a8:
+        a9:df:82:a7:3b:e8:86:d5:c3:4f:18:e3:44:d0:e0:dc:f3:c5:
+        68:2e:fe:a5:2f:05:84:c8:7e:47:42:53:6b:87:4a:fe:32:ff:
+        5e:3e:70:8c:b7:a8:15:cc:17:c2:ff:46:ec:d0:ec:2d:b4:6e:
+        12:28:a9:f9:40:e9:eb:d4:66:97:53:a9:69:55:c0:a9:aa:b2:
+        2e:cd:d1:69:f4:be:f8:bb:7c:69:ee:54:a6:db:9e:fb:5a:a6:
+        3e:fe:9a:ef:94:51:4b:75:ee:d8:d4:e1:9a:f1:02:56:13:89:
+        0e:a7:42:8b:96:8b:85:0c:1b:85:be:26:ae:ab:a6:99:bc:22:
+        f1:73:df:42
+
+GlobalSign Primary Class 3 CA
+=============================
+MD5 Fingerprint: 98:12:A3:4B:95:A9:96:64:94:E7:50:8C:3E:E1:83:5A
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDrDCCApSgAwIBAgILAgAAAAAA1ni41sMwDQYJKoZIhvcNAQEEBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05OTAxMjgxMjAw
+MDBaFw0wOTAxMjgxMjAwMDBaMG0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRswGQYDVQQLExJQcmltYXJ5IENsYXNzIDMgQ0ExJjAkBgNV
+BAMTHUdsb2JhbFNpZ24gUHJpbWFyeSBDbGFzcyAzIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAkV5WZdbAwAScv0fEXHt6MQH5WJaZ4xyEL9xWj631
+WYHVQ2ZdWpOMdcqp5xHBURAUYMks1HuvxneGq3onrm+VuQvKtkb7fhr0DRRt0slO
+sq7wVPZcQEw2SHToVIxlZhCnvSu3II0FSa14fdIkI1Dj8LR5mwE5/6870y3u4UmN
+jS88akFFL5vjPeES5JF1ns+gPjySgW+KLhjc4PKMjP2H2Qf0QJTJTk9D32dWb70D
+UHyZZ6S5PJFsAm6E1vxG98xvGD4X8O8LZBZX5qyG8UiqQ8HJJ3hzREXihX26/7Ph
++xsFpEs7mRIlAVAUaq9d6sgM7uTa7EuLXGgTldzDtTA61wIDAQABo2MwYTAOBgNV
+HQ8BAf8EBAMCAAYwHQYDVR0OBBYEFMw2zBe0RZEv7c87MEh3+7UUmb7jMB8GA1Ud
+IwQYMBaAFGB7ZhpFDZfKiVAvfQTNNKj//P1LMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
+KoZIhvcNAQEEBQADggEBAFeyVMy9lRdkYIm2U5EMRZLDPahsw8yyGPV4QXTYfaMn
+r3cNWT6UHWn6idMMvRoB9D/o4Hcagiha5mLXt+M2yQ6feuPC08xZiQzvFovwNnci
+yqS2t8FCZwFAY8znOGSHWxSWZnstFO69SW3/d9DiTlvTgMJND8q4nYGXpzRux+Oc
+SOW0qkX19mVMSPISwtKTjMIVJPMrUv/jCK64btYsEs85yxIq56l7X5g9o+HMpmOJ
+XH0xdfnV1l3y0NQ9355xqA7c5CCXeOZ/U6QNUU+OOwOuow1aTcN55zVYcELJXqFe
+tNkio0RTNaTQz3OAxc+fVph2+RRMd4eCydx+XTTVNnU=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            02:00:00:00:00:00:d6:78:b8:d6:c3
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Validity
+            Not Before: Jan 28 12:00:00 1999 GMT
+            Not After : Jan 28 12:00:00 2009 GMT
+        Subject: C=BE, O=GlobalSign nv-sa, OU=Primary Class 3 CA, CN=GlobalSign Primary Class 3 CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:91:5e:56:65:d6:c0:c0:04:9c:bf:47:c4:5c:7b:
+                    7a:31:01:f9:58:96:99:e3:1c:84:2f:dc:56:8f:ad:
+                    f5:59:81:d5:43:66:5d:5a:93:8c:75:ca:a9:e7:11:
+                    c1:51:10:14:60:c9:2c:d4:7b:af:c6:77:86:ab:7a:
+                    27:ae:6f:95:b9:0b:ca:b6:46:fb:7e:1a:f4:0d:14:
+                    6d:d2:c9:4e:b2:ae:f0:54:f6:5c:40:4c:36:48:74:
+                    e8:54:8c:65:66:10:a7:bd:2b:b7:20:8d:05:49:ad:
+                    78:7d:d2:24:23:50:e3:f0:b4:79:9b:01:39:ff:af:
+                    3b:d3:2d:ee:e1:49:8d:8d:2f:3c:6a:41:45:2f:9b:
+                    e3:3d:e1:12:e4:91:75:9e:cf:a0:3e:3c:92:81:6f:
+                    8a:2e:18:dc:e0:f2:8c:8c:fd:87:d9:07:f4:40:94:
+                    c9:4e:4f:43:df:67:56:6f:bd:03:50:7c:99:67:a4:
+                    b9:3c:91:6c:02:6e:84:d6:fc:46:f7:cc:6f:18:3e:
+                    17:f0:ef:0b:64:16:57:e6:ac:86:f1:48:aa:43:c1:
+                    c9:27:78:73:44:45:e2:85:7d:ba:ff:b3:e1:fb:1b:
+                    05:a4:4b:3b:99:12:25:01:50:14:6a:af:5d:ea:c8:
+                    0c:ee:e4:da:ec:4b:8b:5c:68:13:95:dc:c3:b5:30:
+                    3a:d7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                CC:36:CC:17:B4:45:91:2F:ED:CF:3B:30:48:77:FB:B5:14:99:BE:E3
+            X509v3 Authority Key Identifier: 
+                keyid:60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        57:b2:54:cc:bd:95:17:64:60:89:b6:53:91:0c:45:92:c3:3d:
+        a8:6c:c3:cc:b2:18:f5:78:41:74:d8:7d:a3:27:af:77:0d:59:
+        3e:94:1d:69:fa:89:d3:0c:bd:1a:01:f4:3f:e8:e0:77:1a:82:
+        28:5a:e6:62:d7:b7:e3:36:c9:0e:9f:7a:e3:c2:d3:cc:59:89:
+        0c:ef:16:8b:f0:36:77:22:ca:a4:b6:b7:c1:42:67:01:40:63:
+        cc:e7:38:64:87:5b:14:96:66:7b:2d:14:ee:bd:49:6d:ff:77:
+        d0:e2:4e:5b:d3:80:c2:4d:0f:ca:b8:9d:81:97:a7:34:6e:c7:
+        e3:9c:48:e5:b4:aa:45:f5:f6:65:4c:48:f2:12:c2:d2:93:8c:
+        c2:15:24:f3:2b:52:ff:e3:08:ae:b8:6e:d6:2c:12:cf:39:cb:
+        12:2a:e7:a9:7b:5f:98:3d:a3:e1:cc:a6:63:89:5c:7d:31:75:
+        f9:d5:d6:5d:f2:d0:d4:3d:df:9e:71:a8:0e:dc:e4:20:97:78:
+        e6:7f:53:a4:0d:51:4f:8e:3b:03:ae:a3:0d:5a:4d:c3:79:e7:
+        35:58:70:42:c9:5e:a1:5e:b4:d9:22:a3:44:53:35:a4:d0:cf:
+        73:80:c5:cf:9f:56:98:76:f9:14:4c:77:87:82:c9:dc:7e:5d:
+        34:d5:36:75
+
+GlobalSign Root CA
+==================
+MD5 Fingerprint: AB:BF:EA:E3:6B:29:A6:CC:A6:78:35:99:EF:AD:2B:80
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAl2gAwIBAgILAgAAAAAA1ni3lAUwDQYJKoZIhvcNAQEEBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
+MDBaFw0xNDAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
+aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
+jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
+xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
+1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
+snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
+U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
+9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIABjAdBgNVHQ4EFgQU
+YHtmGkUNl8qJUC99BM00qP/8/UswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQQFAAOCAQEArqqf/LfSyx9fOSkoGJ40yWxPbxrwZKJwSk8ThptgKJ7ogUmYfQq7
+5bCdPTbbjwVR/wkxKh/diXeeDy5slQTthsu0AD+EAk2AaioteAuubyuig0SDH81Q
+gkwkr733pbTIWg/050deSY43lv6aiAU62cDbKYfmGZZHpzqmjIs8d/5GY6dT2iHR
+rH5Jokvmw2dZL7OKDrssvamqQnw1wdh/1acxOk5jQzmvCLBhNIzTmKlDNPYPhyk7
+ncJWWJh3w/cbrPad+D6qp1RF8PX51TFl/mtYnHGzHtdS6jIX/EBgHcl5JLL2bP2o
+Zg6C3ZjL2sJETy6ge/L3ayx2EYRGinij4w==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            02:00:00:00:00:00:d6:78:b7:94:05
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Validity
+            Not Before: Sep  1 12:00:00 1998 GMT
+            Not After : Jan 28 12:00:00 2014 GMT
+        Subject: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:da:0e:e6:99:8d:ce:a3:e3:4f:8a:7e:fb:f1:8b:
+                    83:25:6b:ea:48:1f:f1:2a:b0:b9:95:11:04:bd:f0:
+                    63:d1:e2:67:66:cf:1c:dd:cf:1b:48:2b:ee:8d:89:
+                    8e:9a:af:29:80:65:ab:e9:c7:2d:12:cb:ab:1c:4c:
+                    70:07:a1:3d:0a:30:cd:15:8d:4f:f8:dd:d4:8c:50:
+                    15:1c:ef:50:ee:c4:2e:f7:fc:e9:52:f2:91:7d:e0:
+                    6d:d5:35:30:8e:5e:43:73:f2:41:e9:d5:6a:e3:b2:
+                    89:3a:56:39:38:6f:06:3c:88:69:5b:2a:4d:c5:a7:
+                    54:b8:6c:89:cc:9b:f9:3c:ca:e5:fd:89:f5:12:3c:
+                    92:78:96:d6:dc:74:6e:93:44:61:d1:8d:c7:46:b2:
+                    75:0e:86:e8:19:8a:d5:6d:6c:d5:78:16:95:a2:e9:
+                    c8:0a:38:eb:f2:24:13:4f:73:54:93:13:85:3a:1b:
+                    bc:1e:34:b5:8b:05:8c:b9:77:8b:b1:db:1f:20:91:
+                    ab:09:53:6e:90:ce:7b:37:74:b9:70:47:91:22:51:
+                    63:16:79:ae:b1:ae:41:26:08:c8:19:2b:d1:46:aa:
+                    48:d6:64:2a:d7:83:34:ff:2c:2a:c1:6c:19:43:4a:
+                    07:85:e7:d3:7c:f6:21:68:ef:ea:f2:52:9f:7f:93:
+                    90:cf
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                60:7B:66:1A:45:0D:97:CA:89:50:2F:7D:04:CD:34:A8:FF:FC:FD:4B
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        ae:aa:9f:fc:b7:d2:cb:1f:5f:39:29:28:18:9e:34:c9:6c:4f:
+        6f:1a:f0:64:a2:70:4a:4f:13:86:9b:60:28:9e:e8:81:49:98:
+        7d:0a:bb:e5:b0:9d:3d:36:db:8f:05:51:ff:09:31:2a:1f:dd:
+        89:77:9e:0f:2e:6c:95:04:ed:86:cb:b4:00:3f:84:02:4d:80:
+        6a:2a:2d:78:0b:ae:6f:2b:a2:83:44:83:1f:cd:50:82:4c:24:
+        af:bd:f7:a5:b4:c8:5a:0f:f4:e7:47:5e:49:8e:37:96:fe:9a:
+        88:05:3a:d9:c0:db:29:87:e6:19:96:47:a7:3a:a6:8c:8b:3c:
+        77:fe:46:63:a7:53:da:21:d1:ac:7e:49:a2:4b:e6:c3:67:59:
+        2f:b3:8a:0e:bb:2c:bd:a9:aa:42:7c:35:c1:d8:7f:d5:a7:31:
+        3a:4e:63:43:39:af:08:b0:61:34:8c:d3:98:a9:43:34:f6:0f:
+        87:29:3b:9d:c2:56:58:98:77:c3:f7:1b:ac:f6:9d:f8:3e:aa:
+        a7:54:45:f0:f5:f9:d5:31:65:fe:6b:58:9c:71:b3:1e:d7:52:
+        ea:32:17:fc:40:60:1d:c9:79:24:b2:f6:6c:fd:a8:66:0e:82:
+        dd:98:cb:da:c2:44:4f:2e:a0:7b:f2:f7:6b:2c:76:11:84:46:
+        8a:78:a3:e3
+
+National Retail Federation by DST
+=================================
+MD5 Fingerprint: AD:8E:0F:9E:01:6B:A0:C5:74:D5:0C:D3:68:65:4F:1E
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEAjCCAuoCEQDQHkCKAAACfAAAAAMAAAABMA0GCSqGSIb3DQEBBQUAMIG+MQsw
+CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp
+dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjEjMCEGA1UE
+CxMaTmF0aW9uYWwgUmV0YWlsIEZlZGVyYXRpb24xGTAXBgNVBAMTEERTVCAoTlJG
+KSBSb290Q0ExITAfBgkqhkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTAeFw05
+ODEyMTExNjE0MTZaFw0wODEyMDgxNjE0MTZaMIG+MQswCQYDVQQGEwJ1czENMAsG
+A1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxJDAiBgNVBAoTG0Rp
+Z2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjEjMCEGA1UECxMaTmF0aW9uYWwgUmV0
+YWlsIEZlZGVyYXRpb24xGTAXBgNVBAMTEERTVCAoTlJGKSBSb290Q0ExITAfBgkq
+hkiG9w0BCQEWEmNhQGRpZ3NpZ3RydXN0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBANmsm3f6UNPM3LlArLlyagCHI/wPliHQJq/k4rVf+tOmfSEw
+LswXgo+YdPxnpKbfiJeiQin1p9sRk/teIzDCqrwi50Eb5e0l3sg/295XRXhARoOy
+1Ro93w9FbdVjAnXYL8Zuq5WRdDcNy00JXNHUWzra3Q7Ia5nY1TnM34VVxJJTAqPh
+94DJcKPa3DPEf6JHCBw1lh+hAxwwg/TEzP+Yw7BGRKLAv63b0oH2TJgsp14k84bK
+Y9W6ffCawErQG1ju7Klnz2kCbCLAYCws0cgg6sgt+92cu8tRTNznVwQ7VJsRpTJ0
+7HQB85AVWy98LJNluWZntIGINeWekRh/gahByMsCAwEAATANBgkqhkiG9w0BAQUF
+AAOCAQEAhF4LO+ygjRyb0DwdcWnkGn9kvoFlYcWMatd8AHTgemJV7SR84GHj8t0U
+5hFugw7h6qmegK2aIL/gV37V0LWEYy3ZGOS9GzUsXq5hdqpnhTs44TGBHzF/5tf4
+W9K7Y3mGxIzF3gqu19H8AXT/trYNYoFnHLsm+CSA4Fxe2KSKOo99y/+So/18qTJp
+B1hYYUKZUgOxOD3GcW9s8uh9BqrBfFPLGi2IT8mpp6xpb/ekH9h0gfVKv7FVt9N3
+OKdvwkrI4nOJ01dy4UMvcjz2H7f4BEpuwemUF+SXF/QOE4ZvjavoXy20/2zWorQf
+7LmUaqoSTxrd9Xe1JYzyigrx/FJbWA==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            d0:1e:40:8a:00:00:02:7c:00:00:00:03:00:00:00:01
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=National Retail Federation, CN=DST (NRF) RootCA/Email=ca@digsigtrust.com
+        Validity
+            Not Before: Dec 11 16:14:16 1998 GMT
+            Not After : Dec  8 16:14:16 2008 GMT
+        Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=National Retail Federation, CN=DST (NRF) RootCA/Email=ca@digsigtrust.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d9:ac:9b:77:fa:50:d3:cc:dc:b9:40:ac:b9:72:
+                    6a:00:87:23:fc:0f:96:21:d0:26:af:e4:e2:b5:5f:
+                    fa:d3:a6:7d:21:30:2e:cc:17:82:8f:98:74:fc:67:
+                    a4:a6:df:88:97:a2:42:29:f5:a7:db:11:93:fb:5e:
+                    23:30:c2:aa:bc:22:e7:41:1b:e5:ed:25:de:c8:3f:
+                    db:de:57:45:78:40:46:83:b2:d5:1a:3d:df:0f:45:
+                    6d:d5:63:02:75:d8:2f:c6:6e:ab:95:91:74:37:0d:
+                    cb:4d:09:5c:d1:d4:5b:3a:da:dd:0e:c8:6b:99:d8:
+                    d5:39:cc:df:85:55:c4:92:53:02:a3:e1:f7:80:c9:
+                    70:a3:da:dc:33:c4:7f:a2:47:08:1c:35:96:1f:a1:
+                    03:1c:30:83:f4:c4:cc:ff:98:c3:b0:46:44:a2:c0:
+                    bf:ad:db:d2:81:f6:4c:98:2c:a7:5e:24:f3:86:ca:
+                    63:d5:ba:7d:f0:9a:c0:4a:d0:1b:58:ee:ec:a9:67:
+                    cf:69:02:6c:22:c0:60:2c:2c:d1:c8:20:ea:c8:2d:
+                    fb:dd:9c:bb:cb:51:4c:dc:e7:57:04:3b:54:9b:11:
+                    a5:32:74:ec:74:01:f3:90:15:5b:2f:7c:2c:93:65:
+                    b9:66:67:b4:81:88:35:e5:9e:91:18:7f:81:a8:41:
+                    c8:cb
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        84:5e:0b:3b:ec:a0:8d:1c:9b:d0:3c:1d:71:69:e4:1a:7f:64:
+        be:81:65:61:c5:8c:6a:d7:7c:00:74:e0:7a:62:55:ed:24:7c:
+        e0:61:e3:f2:dd:14:e6:11:6e:83:0e:e1:ea:a9:9e:80:ad:9a:
+        20:bf:e0:57:7e:d5:d0:b5:84:63:2d:d9:18:e4:bd:1b:35:2c:
+        5e:ae:61:76:aa:67:85:3b:38:e1:31:81:1f:31:7f:e6:d7:f8:
+        5b:d2:bb:63:79:86:c4:8c:c5:de:0a:ae:d7:d1:fc:01:74:ff:
+        b6:b6:0d:62:81:67:1c:bb:26:f8:24:80:e0:5c:5e:d8:a4:8a:
+        3a:8f:7d:cb:ff:92:a3:fd:7c:a9:32:69:07:58:58:61:42:99:
+        52:03:b1:38:3d:c6:71:6f:6c:f2:e8:7d:06:aa:c1:7c:53:cb:
+        1a:2d:88:4f:c9:a9:a7:ac:69:6f:f7:a4:1f:d8:74:81:f5:4a:
+        bf:b1:55:b7:d3:77:38:a7:6f:c2:4a:c8:e2:73:89:d3:57:72:
+        e1:43:2f:72:3c:f6:1f:b7:f8:04:4a:6e:c1:e9:94:17:e4:97:
+        17:f4:0e:13:86:6f:8d:ab:e8:5f:2d:b4:ff:6c:d6:a2:b4:1f:
+        ec:b9:94:6a:aa:12:4f:1a:dd:f5:77:b5:25:8c:f2:8a:0a:f1:
+        fc:52:5b:58
+
+TC TrustCenter, Germany, Class 0 CA
+===================================
+MD5 Fingerprint: 35:85:49:8E:6E:57:FE:BD:97:F1:C9:46:23:3A:B6:7D
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIENTCCA56gAwIBAgIBATANBgkqhkiG9w0BAQQFADCBvDELMAkGA1UEBhMCREUx
+EDAOBgNVBAgTB0hhbWJ1cmcxEDAOBgNVBAcTB0hhbWJ1cmcxOjA4BgNVBAoTMVRD
+IFRydXN0Q2VudGVyIGZvciBTZWN1cml0eSBpbiBEYXRhIE5ldHdvcmtzIEdtYkgx
+IjAgBgNVBAsTGVRDIFRydXN0Q2VudGVyIENsYXNzIDAgQ0ExKTAnBgkqhkiG9w0B
+CQEWGmNlcnRpZmljYXRlQHRydXN0Y2VudGVyLmRlMB4XDTk4MDMwOTEzNTQ0OFoX
+DTA1MTIzMTEzNTQ0OFowgbwxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdIYW1idXJn
+MRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFUQyBUcnVzdENlbnRlciBmb3Ig
+U2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJIMSIwIAYDVQQLExlUQyBUcnVz
+dENlbnRlciBDbGFzcyAwIENBMSkwJwYJKoZIhvcNAQkBFhpjZXJ0aWZpY2F0ZUB0
+cnVzdGNlbnRlci5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA333mvr/V
+8C9tTg7R4I0LfztU6IrisJ8oxYrGubMzJ/UnyhpMVBJrtLJGsx1Ls/QhC0sCLqHC
+NJyFoMR4EdvbaycrCSoYTkDMn3EZZ5l0onw/wdiLI8hjO4ohq1zeHvSN3LQYwwVz
+9Gq0ofoBCCsBD203W6o4hmc51+Vf+uR+zKMCAwEAAaOCAUMwggE/MEAGCWCGSAGG
++EIBAwQzFjFodHRwczovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL2NoZWNr
+LXJldi5jZ2k/MEAGCWCGSAGG+EIBBAQzFjFodHRwczovL3d3dy50cnVzdGNlbnRl
+ci5kZS9jZ2ktYmluL2NoZWNrLXJldi5jZ2k/MDwGCWCGSAGG+EIBBwQvFi1odHRw
+czovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL1JlbmV3LmNnaT8wPgYJYIZI
+AYb4QgEIBDEWL2h0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lcy9p
+bmRleC5odG1sMCgGCWCGSAGG+EIBDQQbFhlUQyBUcnVzdENlbnRlciBDbGFzcyAw
+IENBMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQQFAAOBgQBNB39fCTAZ
+kqoFR3qUdVQqrs/82AxC4UU4KySVssqHynnEw5eQXmIYxsk4YUxoNdNMFBHrxM2h
+qdjFnmgnMgc1RQT4XyGgYB4cAEgEWNLFy65tMm49d5WMhcflrlCddUp7/wsneepN
+pFn/7FrqJqU5g6TReM6nqX683SvKEpMDSg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 0 CA/Email=certificate@trustcenter.de
+        Validity
+            Not Before: Mar  9 13:54:48 1998 GMT
+            Not After : Dec 31 13:54:48 2005 GMT
+        Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 0 CA/Email=certificate@trustcenter.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:df:7d:e6:be:bf:d5:f0:2f:6d:4e:0e:d1:e0:8d:
+                    0b:7f:3b:54:e8:8a:e2:b0:9f:28:c5:8a:c6:b9:b3:
+                    33:27:f5:27:ca:1a:4c:54:12:6b:b4:b2:46:b3:1d:
+                    4b:b3:f4:21:0b:4b:02:2e:a1:c2:34:9c:85:a0:c4:
+                    78:11:db:db:6b:27:2b:09:2a:18:4e:40:cc:9f:71:
+                    19:67:99:74:a2:7c:3f:c1:d8:8b:23:c8:63:3b:8a:
+                    21:ab:5c:de:1e:f4:8d:dc:b4:18:c3:05:73:f4:6a:
+                    b4:a1:fa:01:08:2b:01:0f:6d:37:5b:aa:38:86:67:
+                    39:d7:e5:5f:fa:e4:7e:cc:a3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape CA Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape Renewal Url: 
+                https://www.trustcenter.de/cgi-bin/Renew.cgi?
+            Netscape CA Policy Url: 
+                http://www.trustcenter.de/guidelines/index.html
+            Netscape Comment: 
+                TC TrustCenter Class 0 CA
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        4d:07:7f:5f:09:30:19:92:aa:05:47:7a:94:75:54:2a:ae:cf:
+        fc:d8:0c:42:e1:45:38:2b:24:95:b2:ca:87:ca:79:c4:c3:97:
+        90:5e:62:18:c6:c9:38:61:4c:68:35:d3:4c:14:11:eb:c4:cd:
+        a1:a9:d8:c5:9e:68:27:32:07:35:45:04:f8:5f:21:a0:60:1e:
+        1c:00:48:04:58:d2:c5:cb:ae:6d:32:6e:3d:77:95:8c:85:c7:
+        e5:ae:50:9d:75:4a:7b:ff:0b:27:79:ea:4d:a4:59:ff:ec:5a:
+        ea:26:a5:39:83:a4:d1:78:ce:a7:a9:7e:bc:dd:2b:ca:12:93:
+        03:4a
+
+TC TrustCenter, Germany, Class 1 CA
+===================================
+MD5 Fingerprint: 64:3F:F8:3E:52:14:4A:59:BA:93:56:04:0B:23:02:D1
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIENTCCA56gAwIBAgIBAjANBgkqhkiG9w0BAQQFADCBvDELMAkGA1UEBhMCREUx
+EDAOBgNVBAgTB0hhbWJ1cmcxEDAOBgNVBAcTB0hhbWJ1cmcxOjA4BgNVBAoTMVRD
+IFRydXN0Q2VudGVyIGZvciBTZWN1cml0eSBpbiBEYXRhIE5ldHdvcmtzIEdtYkgx
+IjAgBgNVBAsTGVRDIFRydXN0Q2VudGVyIENsYXNzIDEgQ0ExKTAnBgkqhkiG9w0B
+CQEWGmNlcnRpZmljYXRlQHRydXN0Y2VudGVyLmRlMB4XDTk4MDMwOTEzNTYzM1oX
+DTA1MTIzMTEzNTYzM1owgbwxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdIYW1idXJn
+MRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFUQyBUcnVzdENlbnRlciBmb3Ig
+U2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJIMSIwIAYDVQQLExlUQyBUcnVz
+dENlbnRlciBDbGFzcyAxIENBMSkwJwYJKoZIhvcNAQkBFhpjZXJ0aWZpY2F0ZUB0
+cnVzdGNlbnRlci5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsCnrtHaz
+rte2W7Re573jsZxJBFdboavZfxMb/bphq9jncd8tAJRdUUh9I+91YoSQPAofWRF0
+L46Apf0wAj0pUs1yGkkhnLzLUo5IoWOWyBCFMGlXdEXAWobG1T3gaFd9MWokjUWX
+PjF+aGYybiRt7DI2yUHK8DFEyKNhyhugNh8CAwEAAaOCAUMwggE/MEAGCWCGSAGG
++EIBAwQzFjFodHRwczovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL2NoZWNr
+LXJldi5jZ2k/MEAGCWCGSAGG+EIBBAQzFjFodHRwczovL3d3dy50cnVzdGNlbnRl
+ci5kZS9jZ2ktYmluL2NoZWNrLXJldi5jZ2k/MDwGCWCGSAGG+EIBBwQvFi1odHRw
+czovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL1JlbmV3LmNnaT8wPgYJYIZI
+AYb4QgEIBDEWL2h0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lcy9p
+bmRleC5odG1sMCgGCWCGSAGG+EIBDQQbFhlUQyBUcnVzdENlbnRlciBDbGFzcyAx
+IENBMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQQFAAOBgQAFQlImpAwn
+AUSsXCUowkRCVAi5HcU+bFlmxLNOUKf4+JZ1oZZ16BY4oM1dbvp5pxt7HR7DALlm
+vlrWYg/n8nu470zgwD9Zrjm3hAmeq/GpLmtp4q3M8up4CQUgOEJxGH7Hspfm1QIF
+BlajX/GqwsRP/vfvFg+d7KqFzz0pJPEEzQ==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 1 CA/Email=certificate@trustcenter.de
+        Validity
+            Not Before: Mar  9 13:56:33 1998 GMT
+            Not After : Dec 31 13:56:33 2005 GMT
+        Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 1 CA/Email=certificate@trustcenter.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b0:29:eb:b4:76:b3:ae:d7:b6:5b:b4:5e:e7:bd:
+                    e3:b1:9c:49:04:57:5b:a1:ab:d9:7f:13:1b:fd:ba:
+                    61:ab:d8:e7:71:df:2d:00:94:5d:51:48:7d:23:ef:
+                    75:62:84:90:3c:0a:1f:59:11:74:2f:8e:80:a5:fd:
+                    30:02:3d:29:52:cd:72:1a:49:21:9c:bc:cb:52:8e:
+                    48:a1:63:96:c8:10:85:30:69:57:74:45:c0:5a:86:
+                    c6:d5:3d:e0:68:57:7d:31:6a:24:8d:45:97:3e:31:
+                    7e:68:66:32:6e:24:6d:ec:32:36:c9:41:ca:f0:31:
+                    44:c8:a3:61:ca:1b:a0:36:1f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape CA Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape Renewal Url: 
+                https://www.trustcenter.de/cgi-bin/Renew.cgi?
+            Netscape CA Policy Url: 
+                http://www.trustcenter.de/guidelines/index.html
+            Netscape Comment: 
+                TC TrustCenter Class 1 CA
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        05:42:52:26:a4:0c:27:01:44:ac:5c:25:28:c2:44:42:54:08:
+        b9:1d:c5:3e:6c:59:66:c4:b3:4e:50:a7:f8:f8:96:75:a1:96:
+        75:e8:16:38:a0:cd:5d:6e:fa:79:a7:1b:7b:1d:1e:c3:00:b9:
+        66:be:5a:d6:62:0f:e7:f2:7b:b8:ef:4c:e0:c0:3f:59:ae:39:
+        b7:84:09:9e:ab:f1:a9:2e:6b:69:e2:ad:cc:f2:ea:78:09:05:
+        20:38:42:71:18:7e:c7:b2:97:e6:d5:02:05:06:56:a3:5f:f1:
+        aa:c2:c4:4f:fe:f7:ef:16:0f:9d:ec:aa:85:cf:3d:29:24:f1:
+        04:cd
+
+TC TrustCenter, Germany, Class 2 CA
+===================================
+MD5 Fingerprint: E1:E9:96:53:77:E1:F0:38:A0:02:AB:94:C6:95:7B:FC
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIENTCCA56gAwIBAgIBAzANBgkqhkiG9w0BAQQFADCBvDELMAkGA1UEBhMCREUx
+EDAOBgNVBAgTB0hhbWJ1cmcxEDAOBgNVBAcTB0hhbWJ1cmcxOjA4BgNVBAoTMVRD
+IFRydXN0Q2VudGVyIGZvciBTZWN1cml0eSBpbiBEYXRhIE5ldHdvcmtzIEdtYkgx
+IjAgBgNVBAsTGVRDIFRydXN0Q2VudGVyIENsYXNzIDIgQ0ExKTAnBgkqhkiG9w0B
+CQEWGmNlcnRpZmljYXRlQHRydXN0Y2VudGVyLmRlMB4XDTk4MDMwOTEzNTc0NFoX
+DTA1MTIzMTEzNTc0NFowgbwxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdIYW1idXJn
+MRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFUQyBUcnVzdENlbnRlciBmb3Ig
+U2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJIMSIwIAYDVQQLExlUQyBUcnVz
+dENlbnRlciBDbGFzcyAyIENBMSkwJwYJKoZIhvcNAQkBFhpjZXJ0aWZpY2F0ZUB0
+cnVzdGNlbnRlci5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2jjo7TIA
+KXGDAQ2/jAHc2satOaSpii/Vi1xoX1DGYvVmvcqRIuyqHVHXPbNRsoNOXctJsPBM
+VeVrLceFCzAckk6C1MoC7fdvvtzg4xS4BVPymvRWi1qehZPRtIJWrk27qEtXFrz+
++Fie+CmNsHvNeMlPrItnDPGc+/xXm1dcTw0CAwEAAaOCAUMwggE/MEAGCWCGSAGG
++EIBAwQzFjFodHRwczovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL2NoZWNr
+LXJldi5jZ2k/MEAGCWCGSAGG+EIBBAQzFjFodHRwczovL3d3dy50cnVzdGNlbnRl
+ci5kZS9jZ2ktYmluL2NoZWNrLXJldi5jZ2k/MDwGCWCGSAGG+EIBBwQvFi1odHRw
+czovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL1JlbmV3LmNnaT8wPgYJYIZI
+AYb4QgEIBDEWL2h0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lcy9p
+bmRleC5odG1sMCgGCWCGSAGG+EIBDQQbFhlUQyBUcnVzdENlbnRlciBDbGFzcyAy
+IENBMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQQFAAOBgQCJG/Tv6Tji
+bAz2zW9JzinM+6YP+Y0+lUbW/EcyibLIBmF60ucNEwKUC9mLVkf0u+fFX3v0Y0yu
+fDTqDaKpsyyF8+P+J1QQkrCPksGYQhhwSNtOLOsNJGjk0fe+Cakph7vo2tw+o4hC
+MfXR43+u2I4AWnSYsE/G/yN7XHMAeMnbTg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/Email=certificate@trustcenter.de
+        Validity
+            Not Before: Mar  9 13:57:44 1998 GMT
+            Not After : Dec 31 13:57:44 2005 GMT
+        Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 2 CA/Email=certificate@trustcenter.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:da:38:e8:ed:32:00:29:71:83:01:0d:bf:8c:01:
+                    dc:da:c6:ad:39:a4:a9:8a:2f:d5:8b:5c:68:5f:50:
+                    c6:62:f5:66:bd:ca:91:22:ec:aa:1d:51:d7:3d:b3:
+                    51:b2:83:4e:5d:cb:49:b0:f0:4c:55:e5:6b:2d:c7:
+                    85:0b:30:1c:92:4e:82:d4:ca:02:ed:f7:6f:be:dc:
+                    e0:e3:14:b8:05:53:f2:9a:f4:56:8b:5a:9e:85:93:
+                    d1:b4:82:56:ae:4d:bb:a8:4b:57:16:bc:fe:f8:58:
+                    9e:f8:29:8d:b0:7b:cd:78:c9:4f:ac:8b:67:0c:f1:
+                    9c:fb:fc:57:9b:57:5c:4f:0d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape CA Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape Renewal Url: 
+                https://www.trustcenter.de/cgi-bin/Renew.cgi?
+            Netscape CA Policy Url: 
+                http://www.trustcenter.de/guidelines/index.html
+            Netscape Comment: 
+                TC TrustCenter Class 2 CA
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        89:1b:f4:ef:e9:38:e2:6c:0c:f6:cd:6f:49:ce:29:cc:fb:a6:
+        0f:f9:8d:3e:95:46:d6:fc:47:32:89:b2:c8:06:61:7a:d2:e7:
+        0d:13:02:94:0b:d9:8b:56:47:f4:bb:e7:c5:5f:7b:f4:63:4c:
+        ae:7c:34:ea:0d:a2:a9:b3:2c:85:f3:e3:fe:27:54:10:92:b0:
+        8f:92:c1:98:42:18:70:48:db:4e:2c:eb:0d:24:68:e4:d1:f7:
+        be:09:a9:29:87:bb:e8:da:dc:3e:a3:88:42:31:f5:d1:e3:7f:
+        ae:d8:8e:00:5a:74:98:b0:4f:c6:ff:23:7b:5c:73:00:78:c9:
+        db:4e
+
+TC TrustCenter, Germany, Class 3 CA
+===================================
+MD5 Fingerprint: 62:AB:B6:15:4A:B4:B0:16:77:FF:AE:CF:16:16:2B:8C
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIENTCCA56gAwIBAgIBBDANBgkqhkiG9w0BAQQFADCBvDELMAkGA1UEBhMCREUx
+EDAOBgNVBAgTB0hhbWJ1cmcxEDAOBgNVBAcTB0hhbWJ1cmcxOjA4BgNVBAoTMVRD
+IFRydXN0Q2VudGVyIGZvciBTZWN1cml0eSBpbiBEYXRhIE5ldHdvcmtzIEdtYkgx
+IjAgBgNVBAsTGVRDIFRydXN0Q2VudGVyIENsYXNzIDMgQ0ExKTAnBgkqhkiG9w0B
+CQEWGmNlcnRpZmljYXRlQHRydXN0Y2VudGVyLmRlMB4XDTk4MDMwOTEzNTg0OVoX
+DTA1MTIzMTEzNTg0OVowgbwxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdIYW1idXJn
+MRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFUQyBUcnVzdENlbnRlciBmb3Ig
+U2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJIMSIwIAYDVQQLExlUQyBUcnVz
+dENlbnRlciBDbGFzcyAzIENBMSkwJwYJKoZIhvcNAQkBFhpjZXJ0aWZpY2F0ZUB0
+cnVzdGNlbnRlci5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtrTBNQUu
+DY3soEBqHA4nplCSa1AbB94u53bM4Nr8hKhejGNqK03ZTgJ2EcEL8o15ygC28bAO
+1/ukFz2vq2l6lie/rzOhmipZqsS1NwjyEqUxtkP1MpZxKCirjSiG37vu4wx9MNbD
+UquPXSeca8Cj5wVrV0lEs27qZM/SjnpQd3cCAwEAAaOCAUMwggE/MEAGCWCGSAGG
++EIBAwQzFjFodHRwczovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL2NoZWNr
+LXJldi5jZ2k/MEAGCWCGSAGG+EIBBAQzFjFodHRwczovL3d3dy50cnVzdGNlbnRl
+ci5kZS9jZ2ktYmluL2NoZWNrLXJldi5jZ2k/MDwGCWCGSAGG+EIBBwQvFi1odHRw
+czovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL1JlbmV3LmNnaT8wPgYJYIZI
+AYb4QgEIBDEWL2h0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lcy9p
+bmRleC5odG1sMCgGCWCGSAGG+EIBDQQbFhlUQyBUcnVzdENlbnRlciBDbGFzcyAz
+IENBMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQQFAAOBgQCEhlBieaAn
+4SW6CbE0DxMJ7S3Ko+aV+TCszRelzj2Xnex8jyZ/wGHKIveR3Tw2WZqbdfe85Mjt
+7AK2IqfzLPHIknhttu7FKOyAIE+5awjnL6eGHn2xCJ9UuQA3PKDYGsiWHPQyFJw5
+lbfu8ENJwl7oy3lvU7/7SYos2EvZVfIScA==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/Email=certificate@trustcenter.de
+        Validity
+            Not Before: Mar  9 13:58:49 1998 GMT
+            Not After : Dec 31 13:58:49 2005 GMT
+        Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 3 CA/Email=certificate@trustcenter.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b6:b4:c1:35:05:2e:0d:8d:ec:a0:40:6a:1c:0e:
+                    27:a6:50:92:6b:50:1b:07:de:2e:e7:76:cc:e0:da:
+                    fc:84:a8:5e:8c:63:6a:2b:4d:d9:4e:02:76:11:c1:
+                    0b:f2:8d:79:ca:00:b6:f1:b0:0e:d7:fb:a4:17:3d:
+                    af:ab:69:7a:96:27:bf:af:33:a1:9a:2a:59:aa:c4:
+                    b5:37:08:f2:12:a5:31:b6:43:f5:32:96:71:28:28:
+                    ab:8d:28:86:df:bb:ee:e3:0c:7d:30:d6:c3:52:ab:
+                    8f:5d:27:9c:6b:c0:a3:e7:05:6b:57:49:44:b3:6e:
+                    ea:64:cf:d2:8e:7a:50:77:77
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape CA Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape Renewal Url: 
+                https://www.trustcenter.de/cgi-bin/Renew.cgi?
+            Netscape CA Policy Url: 
+                http://www.trustcenter.de/guidelines/index.html
+            Netscape Comment: 
+                TC TrustCenter Class 3 CA
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        84:86:50:62:79:a0:27:e1:25:ba:09:b1:34:0f:13:09:ed:2d:
+        ca:a3:e6:95:f9:30:ac:cd:17:a5:ce:3d:97:9d:ec:7c:8f:26:
+        7f:c0:61:ca:22:f7:91:dd:3c:36:59:9a:9b:75:f7:bc:e4:c8:
+        ed:ec:02:b6:22:a7:f3:2c:f1:c8:92:78:6d:b6:ee:c5:28:ec:
+        80:20:4f:b9:6b:08:e7:2f:a7:86:1e:7d:b1:08:9f:54:b9:00:
+        37:3c:a0:d8:1a:c8:96:1c:f4:32:14:9c:39:95:b7:ee:f0:43:
+        49:c2:5e:e8:cb:79:6f:53:bf:fb:49:8a:2c:d8:4b:d9:55:f2:
+        12:70
+
+TC TrustCenter, Germany, Class 4 CA
+===================================
+MD5 Fingerprint: BF:AF:EC:C4:DA:F9:30:F9:CA:35:CA:25:E4:3F:8D:89
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIENTCCA56gAwIBAgIBBTANBgkqhkiG9w0BAQQFADCBvDELMAkGA1UEBhMCREUx
+EDAOBgNVBAgTB0hhbWJ1cmcxEDAOBgNVBAcTB0hhbWJ1cmcxOjA4BgNVBAoTMVRD
+IFRydXN0Q2VudGVyIGZvciBTZWN1cml0eSBpbiBEYXRhIE5ldHdvcmtzIEdtYkgx
+IjAgBgNVBAsTGVRDIFRydXN0Q2VudGVyIENsYXNzIDQgQ0ExKTAnBgkqhkiG9w0B
+CQEWGmNlcnRpZmljYXRlQHRydXN0Y2VudGVyLmRlMB4XDTk4MDMwOTE0MDAyMFoX
+DTA1MTIzMTE0MDAyMFowgbwxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdIYW1idXJn
+MRAwDgYDVQQHEwdIYW1idXJnMTowOAYDVQQKEzFUQyBUcnVzdENlbnRlciBmb3Ig
+U2VjdXJpdHkgaW4gRGF0YSBOZXR3b3JrcyBHbWJIMSIwIAYDVQQLExlUQyBUcnVz
+dENlbnRlciBDbGFzcyA0IENBMSkwJwYJKoZIhvcNAQkBFhpjZXJ0aWZpY2F0ZUB0
+cnVzdGNlbnRlci5kZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvy9j1jZ7
+sg3TVfVkbOYlXca0yBS6JTiD61ZipVWpZaP0I5nCS7nQzVRnpqOgo6kzK3bkva13
+su1cEnTDxbYPUppyk0OQYmYVD0Wl3eDduG9AblfBeXKjYKq6dh0SiVNa/AK+4QkT
+xUov3D2LGa3XiyRF+0z0zVw1HSlMUfPybFUCAwEAAaOCAUMwggE/MEAGCWCGSAGG
++EIBAwQzFjFodHRwczovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL2NoZWNr
+LXJldi5jZ2k/MEAGCWCGSAGG+EIBBAQzFjFodHRwczovL3d3dy50cnVzdGNlbnRl
+ci5kZS9jZ2ktYmluL2NoZWNrLXJldi5jZ2k/MDwGCWCGSAGG+EIBBwQvFi1odHRw
+czovL3d3dy50cnVzdGNlbnRlci5kZS9jZ2ktYmluL1JlbmV3LmNnaT8wPgYJYIZI
+AYb4QgEIBDEWL2h0dHA6Ly93d3cudHJ1c3RjZW50ZXIuZGUvZ3VpZGVsaW5lcy9p
+bmRleC5odG1sMCgGCWCGSAGG+EIBDQQbFhlUQyBUcnVzdENlbnRlciBDbGFzcyA0
+IENBMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQQFAAOBgQCUaBQbJZ4p
+mbGyI9JEs5Wf0Z5VBN3jL4IzVZZ3GZ0rnmUc+orjx48l/LEeVUYPj/9PNy+kdlmm
+ZOvVFnC93ZUzDKQNJOtkULRDEfJDvg1xmCLsAa/s98dcccN1kVgZ6N2g9LTxvBBK
+85O0Bkm7H2bSvXRH4Zr569erbR+64R0s2g==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 5 (0x5)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 4 CA/Email=certificate@trustcenter.de
+        Validity
+            Not Before: Mar  9 14:00:20 1998 GMT
+            Not After : Dec 31 14:00:20 2005 GMT
+        Subject: C=DE, ST=Hamburg, L=Hamburg, O=TC TrustCenter for Security in Data Networks GmbH, OU=TC TrustCenter Class 4 CA/Email=certificate@trustcenter.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:bf:2f:63:d6:36:7b:b2:0d:d3:55:f5:64:6c:e6:
+                    25:5d:c6:b4:c8:14:ba:25:38:83:eb:56:62:a5:55:
+                    a9:65:a3:f4:23:99:c2:4b:b9:d0:cd:54:67:a6:a3:
+                    a0:a3:a9:33:2b:76:e4:bd:ad:77:b2:ed:5c:12:74:
+                    c3:c5:b6:0f:52:9a:72:93:43:90:62:66:15:0f:45:
+                    a5:dd:e0:dd:b8:6f:40:6e:57:c1:79:72:a3:60:aa:
+                    ba:76:1d:12:89:53:5a:fc:02:be:e1:09:13:c5:4a:
+                    2f:dc:3d:8b:19:ad:d7:8b:24:45:fb:4c:f4:cd:5c:
+                    35:1d:29:4c:51:f3:f2:6c:55
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Netscape Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape CA Revocation Url: 
+                https://www.trustcenter.de/cgi-bin/check-rev.cgi?
+            Netscape Renewal Url: 
+                https://www.trustcenter.de/cgi-bin/Renew.cgi?
+            Netscape CA Policy Url: 
+                http://www.trustcenter.de/guidelines/index.html
+            Netscape Comment: 
+                TC TrustCenter Class 4 CA
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+    Signature Algorithm: md5WithRSAEncryption
+        94:68:14:1b:25:9e:29:99:b1:b2:23:d2:44:b3:95:9f:d1:9e:
+        55:04:dd:e3:2f:82:33:55:96:77:19:9d:2b:9e:65:1c:fa:8a:
+        e3:c7:8f:25:fc:b1:1e:55:46:0f:8f:ff:4f:37:2f:a4:76:59:
+        a6:64:eb:d5:16:70:bd:dd:95:33:0c:a4:0d:24:eb:64:50:b4:
+        43:11:f2:43:be:0d:71:98:22:ec:01:af:ec:f7:c7:5c:71:c3:
+        75:91:58:19:e8:dd:a0:f4:b4:f1:bc:10:4a:f3:93:b4:06:49:
+        bb:1f:66:d2:bd:74:47:e1:9a:f9:eb:d7:ab:6d:1f:ba:e1:1d:
+        2c:da
+
+Thawte Personal Basic CA
+========================
+MD5 Fingerprint: E6:0B:D2:C9:CA:2D:88:DB:1A:71:0E:4B:78:EB:02:41
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDITCCAoqgAwIBAgIBADANBgkqhkiG9w0BAQQFADCByzELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD
+VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT
+ZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFBlcnNvbmFsIEJhc2lj
+IENBMSgwJgYJKoZIhvcNAQkBFhlwZXJzb25hbC1iYXNpY0B0aGF3dGUuY29tMB4X
+DTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgcsxCzAJBgNVBAYTAlpBMRUw
+EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UE
+ChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2Vy
+dmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQZXJzb25hbCBCYXNpYyBD
+QTEoMCYGCSqGSIb3DQEJARYZcGVyc29uYWwtYmFzaWNAdGhhd3RlLmNvbTCBnzAN
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvLyTU23AUE+CFeZIlDWmWr5vQvoPR+53
+dXLdjUmbllegeNTKP1GzaQuRdhciB5dqxFGTS+CN7zeVoQxN2jSQHReJl+A1OFdK
+wPQIcOk8RHtQfmGakOMj04gRRif1CwcOu93RfyAKiLlWCy4cgNrx454p7xS9CkT7
+G1sY0b8jkyECAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQF
+AAOBgQAt4plrsD16iddZopQBHyvdEktTwq1/qqcAXJFAVyVKOKqEcLnZgA+le1z7
+c8a914phXAPjLSeoF+CEhULcXpvGt7Jtu3Sv5D/Lp7ew4F2+eIMllNLbgQ95B21P
+9DkVWlIBe94y1k049hJcBlDfBVu9FEuh3ym6O0GN92NWod8isQ==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 0 (0x0)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/Email=personal-basic@thawte.com
+        Validity
+            Not Before: Jan  1 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 2020 GMT
+        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Basic CA/Email=personal-basic@thawte.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:bc:bc:93:53:6d:c0:50:4f:82:15:e6:48:94:35:
+                    a6:5a:be:6f:42:fa:0f:47:ee:77:75:72:dd:8d:49:
+                    9b:96:57:a0:78:d4:ca:3f:51:b3:69:0b:91:76:17:
+                    22:07:97:6a:c4:51:93:4b:e0:8d:ef:37:95:a1:0c:
+                    4d:da:34:90:1d:17:89:97:e0:35:38:57:4a:c0:f4:
+                    08:70:e9:3c:44:7b:50:7e:61:9a:90:e3:23:d3:88:
+                    11:46:27:f5:0b:07:0e:bb:dd:d1:7f:20:0a:88:b9:
+                    56:0b:2e:1c:80:da:f1:e3:9e:29:ef:14:bd:0a:44:
+                    fb:1b:5b:18:d1:bf:23:93:21
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        2d:e2:99:6b:b0:3d:7a:89:d7:59:a2:94:01:1f:2b:dd:12:4b:
+        53:c2:ad:7f:aa:a7:00:5c:91:40:57:25:4a:38:aa:84:70:b9:
+        d9:80:0f:a5:7b:5c:fb:73:c6:bd:d7:8a:61:5c:03:e3:2d:27:
+        a8:17:e0:84:85:42:dc:5e:9b:c6:b7:b2:6d:bb:74:af:e4:3f:
+        cb:a7:b7:b0:e0:5d:be:78:83:25:94:d2:db:81:0f:79:07:6d:
+        4f:f4:39:15:5a:52:01:7b:de:32:d6:4d:38:f6:12:5c:06:50:
+        df:05:5b:bd:14:4b:a1:df:29:ba:3b:41:8d:f7:63:56:a1:df:
+        22:b1
+
+Thawte Personal Freemail CA
+===========================
+MD5 Fingerprint: 1E:74:C3:86:3C:0C:35:C5:3E:C2:7F:EF:3C:AA:3C:D9
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDLTCCApagAwIBAgIBADANBgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD
+VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT
+ZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVt
+YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUu
+Y29tMB4XDTk2MDEwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYT
+AlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEa
+MBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp
+b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG
+cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh
+d3RlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfY
+DFG26nKRsIRefS0Nj3sS34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5E
+rHzmj+hND3EfQDimAKOHePb5lIZererAXnbr2RSjXW56fAylS1V/Bhkpf56aJtVq
+uzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zAN
+BgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBvjWBYYawmu1I1XAjP
+MPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgCneSa
+/RP0ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRznei
+gQ==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 0 (0x0)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/Email=personal-freemail@thawte.com
+        Validity
+            Not Before: Jan  1 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 2020 GMT
+        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Freemail CA/Email=personal-freemail@thawte.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d4:69:d7:d4:b0:94:64:5b:71:e9:47:d8:0c:51:
+                    b6:ea:72:91:b0:84:5e:7d:2d:0d:8f:7b:12:df:85:
+                    25:75:28:74:3a:42:2c:63:27:9f:95:7b:4b:ef:7e:
+                    19:87:1d:86:ea:a3:dd:b9:ce:96:64:1a:c2:14:6e:
+                    44:ac:7c:e6:8f:e8:4d:0f:71:1f:40:38:a6:00:a3:
+                    87:78:f6:f9:94:86:5e:ad:ea:c0:5e:76:eb:d9:14:
+                    a3:5d:6e:7a:7c:0c:a5:4b:55:7f:06:19:29:7f:9e:
+                    9a:26:d5:6a:bb:38:24:08:6a:98:c7:b1:da:a3:98:
+                    91:fd:79:db:e5:5a:c4:1c:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        c7:ec:92:7e:4e:f8:f5:96:a5:67:62:2a:a4:f0:4d:11:60:d0:
+        6f:8d:60:58:61:ac:26:bb:52:35:5c:08:cf:30:fb:a8:4a:96:
+        8a:1f:62:42:23:8c:17:0f:f4:ba:64:9c:17:ac:47:29:df:9d:
+        98:5e:d2:6c:60:71:5c:a2:ac:dc:79:e3:e7:6e:00:47:1f:b5:
+        0d:28:e8:02:9d:e4:9a:fd:13:f4:a6:d9:7c:b1:f8:dc:5f:23:
+        26:09:91:80:73:d0:14:1b:de:43:a9:83:25:f2:e6:9c:2f:15:
+        ca:fe:a6:ab:8a:07:75:8b:0c:dd:51:84:6b:e4:f8:d1:ce:77:
+        a2:81
+
+Thawte Personal Premium CA
+==========================
+MD5 Fingerprint: 3A:B2:DE:22:9A:20:93:49:F9:ED:C8:D2:8A:E7:68:0D
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDKTCCApKgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBzzELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYD
+VQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBT
+ZXJ2aWNlcyBEaXZpc2lvbjEjMCEGA1UEAxMaVGhhd3RlIFBlcnNvbmFsIFByZW1p
+dW0gQ0ExKjAoBgkqhkiG9w0BCQEWG3BlcnNvbmFsLXByZW1pdW1AdGhhd3RlLmNv
+bTAeFw05NjAxMDEwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMIHPMQswCQYDVQQGEwJa
+QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAY
+BgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9u
+IFNlcnZpY2VzIERpdmlzaW9uMSMwIQYDVQQDExpUaGF3dGUgUGVyc29uYWwgUHJl
+bWl1bSBDQTEqMCgGCSqGSIb3DQEJARYbcGVyc29uYWwtcHJlbWl1bUB0aGF3dGUu
+Y29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJZtn4B0TPuYwu8KHvE0Vs
+Bd/eJxZRNkERbGw77f4QfRKe5ZtCmv5gMcNmt3M6SK5O0DI3lIi1DbbZ8/JE2dWI
+Et12TfIa/G8jHnrx2JhFTgcQ7xZC0EN1bUre4qrJMf8fAHB8Zs8QJQi6+u4A6UYD
+ZicRFTuqW/KY3TZCstqIdQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
+SIb3DQEBBAUAA4GBAGk2ifc0KjNyL2071CKyuG+axTZmDhs8obF1Wub9NdP4qPIH
+b4Vnjt4rueIXsDqg8A6iAJrf8xQVbrvIhVqYgPn/vnQdPfP+MCXRNzRn+qVxeTBh
+KXLA4CxM+1bkOqhv5TJZUtt1KFBZDPgLGeSs2a+WjS9Q2wfD6h+rM+D1KzGJ
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 0 (0x0)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/Email=personal-premium@thawte.com
+        Validity
+            Not Before: Jan  1 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 2020 GMT
+        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting, OU=Certification Services Division, CN=Thawte Personal Premium CA/Email=personal-premium@thawte.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c9:66:d9:f8:07:44:cf:b9:8c:2e:f0:a1:ef:13:
+                    45:6c:05:df:de:27:16:51:36:41:11:6c:6c:3b:ed:
+                    fe:10:7d:12:9e:e5:9b:42:9a:fe:60:31:c3:66:b7:
+                    73:3a:48:ae:4e:d0:32:37:94:88:b5:0d:b6:d9:f3:
+                    f2:44:d9:d5:88:12:dd:76:4d:f2:1a:fc:6f:23:1e:
+                    7a:f1:d8:98:45:4e:07:10:ef:16:42:d0:43:75:6d:
+                    4a:de:e2:aa:c9:31:ff:1f:00:70:7c:66:cf:10:25:
+                    08:ba:fa:ee:00:e9:46:03:66:27:11:15:3b:aa:5b:
+                    f2:98:dd:36:42:b2:da:88:75
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        69:36:89:f7:34:2a:33:72:2f:6d:3b:d4:22:b2:b8:6f:9a:c5:
+        36:66:0e:1b:3c:a1:b1:75:5a:e6:fd:35:d3:f8:a8:f2:07:6f:
+        85:67:8e:de:2b:b9:e2:17:b0:3a:a0:f0:0e:a2:00:9a:df:f3:
+        14:15:6e:bb:c8:85:5a:98:80:f9:ff:be:74:1d:3d:f3:fe:30:
+        25:d1:37:34:67:fa:a5:71:79:30:61:29:72:c0:e0:2c:4c:fb:
+        56:e4:3a:a8:6f:e5:32:59:52:db:75:28:50:59:0c:f8:0b:19:
+        e4:ac:d9:af:96:8d:2f:50:db:07:c3:ea:1f:ab:33:e0:f5:2b:
+        31:89
+
+Thawte Premium Server CA
+========================
+MD5 Fingerprint: 06:9F:69:79:16:66:90:02:1B:8C:8C:A2:C3:07:6F:3A
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD
+VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
+biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2Vy
+dmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29t
+MB4XDTk2MDgwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgc4xCzAJBgNVBAYTAlpB
+MRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEdMBsG
+A1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp
+b24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl
+cnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv
+bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo847kkE
+VdbQ7xwblRZH7xhINTpS9CtqBo87L+pW46+GjZ4X9560ZXUCTe/LCaIhUdib0GfQ
+ug2SBhRz1JPLlyoAnFxODLz6FVL88kRu2hFKbgifLy3j+ao6hnO2RlNYyIkFvYMR
+uHM/qgeN9EJN50CdHDcCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
+9w0BAQQFAAOBgQAmSCwWwlj66BZ0DKqqX1Q/8tfJeGBeXm43YyJ3Nn6yF8Q0ufUI
+hfzJATj/Tb7yFkJD57taRvvBxhEf8UqwKEbJw8RCfbz6q1lu1bdRiBHjpIUZa4JM
+pAwSremkrj/xw0llmozFyD4lt5SZu5IycQfwhl7tUCemDaYj+bvLpgcUQg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/Email=premium-server@thawte.com
+        Validity
+            Not Before: Aug  1 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 2020 GMT
+        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/Email=premium-server@thawte.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d2:36:36:6a:8b:d7:c2:5b:9e:da:81:41:62:8f:
+                    38:ee:49:04:55:d6:d0:ef:1c:1b:95:16:47:ef:18:
+                    48:35:3a:52:f4:2b:6a:06:8f:3b:2f:ea:56:e3:af:
+                    86:8d:9e:17:f7:9e:b4:65:75:02:4d:ef:cb:09:a2:
+                    21:51:d8:9b:d0:67:d0:ba:0d:92:06:14:73:d4:93:
+                    cb:97:2a:00:9c:5c:4e:0c:bc:fa:15:52:fc:f2:44:
+                    6e:da:11:4a:6e:08:9f:2f:2d:e3:f9:aa:3a:86:73:
+                    b6:46:53:58:c8:89:05:bd:83:11:b8:73:3f:aa:07:
+                    8d:f4:42:4d:e7:40:9d:1c:37
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        26:48:2c:16:c2:58:fa:e8:16:74:0c:aa:aa:5f:54:3f:f2:d7:
+        c9:78:60:5e:5e:6e:37:63:22:77:36:7e:b2:17:c4:34:b9:f5:
+        08:85:fc:c9:01:38:ff:4d:be:f2:16:42:43:e7:bb:5a:46:fb:
+        c1:c6:11:1f:f1:4a:b0:28:46:c9:c3:c4:42:7d:bc:fa:ab:59:
+        6e:d5:b7:51:88:11:e3:a4:85:19:6b:82:4c:a4:0c:12:ad:e9:
+        a4:ae:3f:f1:c3:49:65:9a:8c:c5:c8:3e:25:b7:94:99:bb:92:
+        32:71:07:f0:86:5e:ed:50:27:a6:0d:a6:23:f9:bb:cb:a6:07:
+        14:42
+
+Thawte Server CA
+================
+MD5 Fingerprint: C5:70:C4:A2:ED:53:78:0C:C8:10:53:81:64:CB:D0:1D
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDEzCCAnygAwIBAgIBATANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD
+VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
+biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm
+MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTYwODAx
+MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCBxDELMAkGA1UEBhMCWkExFTATBgNVBAgT
+DFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3
+dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNl
+cyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEmMCQGCSqGSIb3
+DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQAD
+gY0AMIGJAoGBANOkUG7I/1Zr5s9dtuoMaHVHoqrC2oQl/Kj0R1HahbUgdJSGHg91
+yekIYfUGbTBuFRkC6VLAYttNmZ7iagxEOM3+vuNkCXDF/rFrKbYvScg71CcEJRCX
+L+eQbcAoQpnXTEPew/UhbVSfXcNY4cDk2VuwuNy0e982OsK1ZiIS1ocNAgMBAAGj
+EzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAB/pMaVz7lcxG
+7oWDTSEwjsrZqG9JGubaUeNgcGyEYRGhGshIPllDfU+VPaGLtwtimHp1it2ITk6e
+QNuozDJ0uW8NxuOzRAvZim+aKZuZGCg70eNAKJpaPNW15yAbi8qkq43pUdniTCxZ
+qdq5snUb9kLy78fyGPmJvKP/iiMucEc=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/Email=server-certs@thawte.com
+        Validity
+            Not Before: Aug  1 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 2020 GMT
+        Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Server CA/Email=server-certs@thawte.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d3:a4:50:6e:c8:ff:56:6b:e6:cf:5d:b6:ea:0c:
+                    68:75:47:a2:aa:c2:da:84:25:fc:a8:f4:47:51:da:
+                    85:b5:20:74:94:86:1e:0f:75:c9:e9:08:61:f5:06:
+                    6d:30:6e:15:19:02:e9:52:c0:62:db:4d:99:9e:e2:
+                    6a:0c:44:38:cd:fe:be:e3:64:09:70:c5:fe:b1:6b:
+                    29:b6:2f:49:c8:3b:d4:27:04:25:10:97:2f:e7:90:
+                    6d:c0:28:42:99:d7:4c:43:de:c3:f5:21:6d:54:9f:
+                    5d:c3:58:e1:c0:e4:d9:5b:b0:b8:dc:b4:7b:df:36:
+                    3a:c2:b5:66:22:12:d6:87:0d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: md5WithRSAEncryption
+        07:fa:4c:69:5c:fb:95:cc:46:ee:85:83:4d:21:30:8e:ca:d9:
+        a8:6f:49:1a:e6:da:51:e3:60:70:6c:84:61:11:a1:1a:c8:48:
+        3e:59:43:7d:4f:95:3d:a1:8b:b7:0b:62:98:7a:75:8a:dd:88:
+        4e:4e:9e:40:db:a8:cc:32:74:b9:6f:0d:c6:e3:b3:44:0b:d9:
+        8a:6f:9a:29:9b:99:18:28:3b:d1:e3:40:28:9a:5a:3c:d5:b5:
+        e7:20:1b:8b:ca:a4:ab:8d:e9:51:d9:e2:4c:2c:59:a9:da:b9:
+        b2:75:1b:f6:42:f2:ef:c7:f2:18:f9:89:bc:a3:ff:8a:23:2e:
+        70:47
+
+Thawte Universal CA Root
+========================
+MD5 Fingerprint: 17:AF:71:16:52:7B:73:65:22:05:29:28:84:71:9D:13
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIRIjCCCQoCAQAwDQYJKoZIhvcNAQEFBQAwVzEPMA0GA1UEChMGVGhhd3RlMSEw
+HwYDVQQLExhUaGF3dGUgVW5pdmVyc2FsIENBIFJvb3QxITAfBgNVBAMTGFRoYXd0
+ZSBVbml2ZXJzYWwgQ0EgUm9vdDAeFw05OTEyMDUxMzU2MDVaFw0zNzA0MDMxMzU2
+MDVaMFcxDzANBgNVBAoTBlRoYXd0ZTEhMB8GA1UECxMYVGhhd3RlIFVuaXZlcnNh
+bCBDQSBSb290MSEwHwYDVQQDExhUaGF3dGUgVW5pdmVyc2FsIENBIFJvb3Qwgggi
+MA0GCSqGSIb3DQEBAQUAA4IIDwAwgggKAoIIAQDiiQVtw3+tpok6/7vHzZ03seHS
+IR6bYSoV53tXT1U80Lv52T0+przstK1TmhYC6wty/Yryj0QFxevT5b22RDnm+0e/
+ap4KlRjiaOLWltYhrYj99Rf109pCpZDtKZWWdTrah6HU9dOH3gVipuNmdJLPpby7
+32j/cXVWQVk16zNaZlHy0qMKwYzOc1wRby2MlYyRsf3P5a1WlcyFkoOQVUHJwnft
++aN0QgpoCPPQ0WX9Zyw0/yR/53nIBzslV92kDJg9vuDMGWXb8lSir0LUneKuhCMl
+CTMStWoedsSL2UkAbF66H/Ib2mfKJ6qjRCMbg4LO8qsz7VSk3MmrWWXROA7BPhtn
+j9Z1AeBVIt12d+yO3fTPeSJtuVcD9ZkIpzw+NPvEF64jWM0k8yPKagIolAGBNLRs
+a66LGsOj0gk8FlT1Nl8k459KoeJkxhbDpoF6JDZHjsFeDvv5FXgE1g5Z2Z1YZmLS
+lCkyMsh4uWb2tVbhbMYUS5ZSWZECJGpVR9c/tiMaYHeXLuJAr54EV56tEcXJQ3Dv
+SLRerBxpLi6C1VuLvoK+GRRe5w0ix1Eb/x6b8TCPcTEGszQnj196ZoJPii0Tq0LP
+IVael45mNg+Wm+Ur9AKpKmqMLMTDuHAsLSkeP1B3Hm0qVORVCpE4ocW1ZqJ2Wu4P
+v7Rn4ShuD+E2oYLRv9R34cRnMpN4yOdUU/4jeeZozCaQ9hBjXSpvkS2kczJRIfK7
+Fd+qJAhIBt6hnia/uoO/fKTIoIy90v+8hGknEyQYxEUYIyZeGBTKLoiHYqNT5iG3
+uIV7moW7FSZy+Ln3anQPST+SvqkFt5knv78JF0uZTK0REHzfdDH2jyZfqoiuOFfI
+VS3T+9gbUZm+JRs6usB9G+3O0km5z/PFfYmQgdhpSCAQo/jvklEYMosRGMA/G4VW
+zlfJ8oJkxt8CCS5KES+xJ203UvDwFmHxZ43fh3Kvh9rP+1CUbtSUheuKLOoh9ZZK
+RNXgzmp0RE3QBdOHFe020KSLZlVwk+5HBsF+LqUYeWfzKIXxcPcOg6R+VJ5adjLL
+ZRu4zfvIKAPSVJHRp8WFQwgXdqXmL2cI2KGigi0M+MGvY9RQd21rRkpBhdWQX3kt
+xOzXEYdAiuFo4mT4VTL7b5Ms2nfZIcEX5TYsTn6Qf6yUKzJnvjhQdriuQbnXIcUJ
+TGDIo1HENJtXN9/LyTNXi+v7dp8ZTcVqHypFrivtL42npQDLBPolYi50SBvKKoy6
+27Z+9rsCfKnD21h4ob/w/hoQVRHO6GlOlmXGFwPWB2iMVIKuHCJVP/H0CZcowEb3
+TgslHfcH1wkdOhhXODvoMwbnj3hGHlv1BrbsuKYN8boTS9YYIN1pM0ozFa64yJiK
+JyyTvC377jO/ZuZNurabBlVgl0u8RM1+9KHYqi/AAighFmJ42whU8vz0NOPGjxxD
+V86QGkvcLjsokYk/eto1HY4s7kns9DOtyVOojJ8EUz4kHFLJEvliV6O87izrQHwg
+I3ArlflzF4rRwRxpprc4mmf3cB16WgxAz2IPhTzCAk5+tfbFKimEsx83KuGqckLE
+7Wsaj5IcXb7R8lvyq6qp0vW4pEErK5FuEkjKmNg3jcjtADC1tgROfpzahOzA+nvl
+HYikU0awlORcG6ElLA9IUneXCWzsWxgzgwLlgn7NhSEwEf0nT8/kHuw/pVds6Sow
+GSqI5cNpOKtvOXF/hOFBw+HMKokgUi6DD2w5P0stFqwt8CSsAHP0m7MGPwW4FIUf
+q55cPJ5inQ5tO4AJ/ALqopd0ysf541bhw8qlpprAkOAkElPSwovavu0CQ15n4YmY
+ee7LqsrDG9znpUalfGsWh7ZaKNfbJzxepb22Ud0fQ887Jsg6jSVhwUn0PBvJROqv
+HMIrlAEqDjDRW4srR+XD0QQDmw45LNYn1OZwWtl1zyrYyQAF5BOI7MM5+4dhMDZD
+A8ienKIGwi/F/PCAY7FUBKBMqS7G9XZ62NDk1JQR5RW1eAbcuICPmakgMz0QhUxl
+Cco+WF5gk5qqYl3AUQYcXWCgDZxLQ/anFiGkh6rywS7ukjC4nt/fEAGLhglw2Gyo
+t1AeFpa092f9NTohkCoyxwB7TQcQCbkvc9gYfmeZBE8G/FDHhZudQJ2zljf6pdyy
+ck7vTgks/ZH9Tfe7pqE+q3uiA0CmqVUn4vr5Gc6HdarxdTbz87iR+JHDi3UTjkxl
+mhY5auU06HqWWX81sAD9W2n8Qyb69Shu/ofZfiT7tKCCblSi/66/YrT0cgHCy5hH
+mOFMtReAgM6PpijuHkVq+9/xHfxaO9bq9GwdYklXO4qPhurwUwTOnBZo/7q5/IgP
+R/cCRHJAuMo7LVOd3DxWjFl7aBosjXG7bADHGs5vQJKxoy8P2UTyo3Aunu4OrjLQ
+Oz6LB+rmebNcKeJ9a6he+Vox6AiWoowDmEbxuH2QVCbtdmL+numabl7JScdcNFMp
+VNns5EbhgDt12d/7edWH8bqe6xnOTFJz5luHriVPOXnMxrj5EHvs8JtxpAWg0ynT
+Tn8f9C0oeMxVlXsekS/MVhhzi7LbvGkH5tDYT+2i/1iFo23gSlO3Z32NDFxbe3co
+AjVEegTTKEPIazAXXTK4KTW6dto7FEp2GFik+JI8nk0zb0ZrCNkxSGjd9PskVjSy
+z2lmvkjSimYizfJpzcJTE0UpQSLWXZgftqSyo8LuAi9RG9yDpOxwJajUCGEyb+Sh
+gS58Y3L6KWW8cETPXQIDAQABMA0GCSqGSIb3DQEBBQUAA4IIAQBVmjRqIgZpCUUz
+x66pXMcJTpuGvEGQ1JRS9s0jKZRLIs3ovf6dzVLyve2rh8mrq0YEtL2iPyIwR1DA
+S4x2DwP1ktKxLcR6NZzJc4frpp/eD3ON03+Z2LqPb8Tzvhqui6KUNpDi5euNBfT8
+Zd+V8cSUTRdW1588j1A853e/lYYmZPtq/8ba6YyuQrtp5TPG2OkNxlUhScEMtKP5
+m0tc3oNPQQPOKnloOH3wVEkg9bYQ/wjcM2aWm/8G3gCe185WQ5pR/HDN9vBRo7fN
+tFyFYs1xt8YrIyvdw25AQvo3/zcc9npXlIeFI9fUycdfwU0vyQ3XXOycJe6eMIKR
+lnK4dR34CWhXl7ItS+4l7HokKe5y1JwT26vcAwrYShTJCFdEXaG1U4A08hSXz1Le
+og6KEOkU79BgvmGh8SVd1RhzP5MQypbus0DS26NVz1dapQ5PdUff6veQmm31cC4d
+FBw3ZARZULDccoZvnDc9XSivc1Xv0u4kdHQT79zbMUn7P2P10wg+M6XnnQreUyxR
+jmfbm0FlQVC91KSWbIe8EuCUx9PA5MtzWACD4awnhdadU51cvQo+A0OcDJH1bXv4
+QHJ1qxF2kSvhxqofcGl2cBUJ/pPQ1i23FWqbZ1y0aZ8lpn2K+30iqXHyzk6MuCEt
+3v5BcQ3/nexzprsHT4gOWEcufqnCx3jdunqeTuAwTmNvhdQgQen6/kNF5/uverLO
+pAUdIppYht/kzkyp/tgWpW/72M5We/XWIO/kR81jJP+5vvFIo8EBcua9wK3tJg3K
+NJ/8Ai0gTwUgriE9DMIgPD/wBITcz4n9uSWRjtBD5rMgq1wt1UCeoEvY9LLMffFY
+Co6H7YisNpbkVqARivKa0LNXozS7Gas44XRrIsQxzgHVGzbjHjhMM5PfQONZV06s
+bnseWj3FHVusyBCCNQIisvx16BCRjcR9eJNHnhydrGtiAliM1hwj1q94woCcpKok
+VBS1FJjG+CsaJMtxMgrimw5pa91+jGTRLmPvDn+xPohMnVXlyW4XBLdB/72KQcsl
+MW9Edz9HsfyBiAeOBUkgtxHZaQMqA525M4Sa399640Zzo9iijFMZiFVMdLj2RIQr
+0RQtTjkukmj/afyFYhvrVU/vJYRiRZnW2E5vP1MIfR0GlYGAf09OdDaYteKHcJjc
+1/XcUhXmxtZ5ljl/j5XPq4BTrRsLRUAO1Bi9LN6Kd3b98kRHxiHQ5HTw2BgFyHww
+csff8bv8AjCp9EImWQ2TBYKhc+005ThdzVCQ/pT8E7y9/KiiiKdzxLKo0V2IxAKi
+evEEyf6MdMnvHWRBn6welmdkrKsoQced98CYG24HwmR9WoNmVig2nOf7HHcOKKDE
+92t5OQQghMdXk7wboOq860LlqBH+/KxlzP34KIj0pZrlc1HgqJsNA3dO5eCYs4ja
+febGnnwUZsEuU0qSBzegfuk9CeQVfM/9uEGl755mncReBx2H+EGt6ucv0kFjGDf5
+FONN0OX3Q/0V4/k2cwYm3wFPqcNO3iBGd5i0eiQrO3UrTliNm12kxxagvDKIP6GD
+8wDI+NhY6WNdTCu18HJB2Kt3N9ZydK62NpzIpoNJS+DJVgspvgAwy93WyEKKANns
+FdE0cfJbZIf2J9K364awkL8p2yGeNozjIC+VI1FsG8Kk1ebYAkNnoP6bUANEf7vk
+ctXR5NqPkhRk+10UEBJKlQbJZQgpyiGjJjgRySffcGcE/cpIMn9jskV0MVBPh9kg
+cNIhcLHWEJ0zXXiDkW1Vguza5GJjx4FG1xllcipDGZC41yNNTBzgRKlmZ6zucXkn
+Jnhtcg71XUsjtXx8ZekXxjoLDd1eHlHDhrjsf8cnSqVG6GotGcGHo8uZk4dkolUU
+TLdDpZPX59JOeUDKZZlGPT96gHqIaswe5WszRvRQwNUfCbjNii6hJ+tdc6foawrl
+V4IqsPziVFJW8KupEsYjlgcknOC8RqW0IATaCZNj5dQuwn7FMe21FXSGF7mz8yaK
+HQJq2ho/6LrxBG2UUVTiWrRZgx1g0C1zzAe1Joz518aIke+Az10PoWDLRdRCItGx
+cB390LcwkDrGSG1n5TLaj9vjqOMdICWiHOFMuaT2xj9cWA27xrJ3ARaRnxcGDbdA
+PsyPjpxL4J1+mx4Fq4gi+tMoG1cUZEo+JCw4TSFpAHMu0FUtdPIV6JRDPkAqxsa5
+alveoswYUFRdTiqFbPaSiykZfufqSuAiKyW892bPd5pBdPI8FA10afVQg83NLyHb
+IkaK0PdRGpVX8gWLGhntO0XoNsJufvtXIgAfBlOprpPGj3EqMUWS545t5pkiwIP8
+79xXZndPojYx+6ETjeXKo5V9AQxkcDtTQmiAx7udqAA1aZgMqGfYQ+Wqz5XgUZWk
+Fz9CnbgEztN5ecjTihYykuDXou7XN0wvrLh7vkX28RgznHs3piTZvECrAOnDN4ur
+2LbzXoFOsBRrBz4f7ML2RCKVu7Pmb9b5cGW6CoNlqg4TL4MTI1OLQBb6zi/8TQT4
+69isxTbCFVdIOOxVs7Qeuq3SQgYXDXPIV6a+lk2p8sD7eiEc9clwqYKQtfEM1HkQ
+voGm6VxhnHd5mqTDNyZXN8lSLPoI/9BfxmHA9Ha+/N5Oz6tRmXHH33701s8GVhkT
+UwttdFlIGZtTBS2dMlTT5SxTi2Q+1GR744AJFMz+FkZja3Fp+PnLJ/aIVLxFs84C
+yJTuQFv5QgLC/7DYLOsof17JJgGZpw==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 0 (0x0)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: O=Thawte, OU=Thawte Universal CA Root, CN=Thawte Universal CA Root
+        Validity
+            Not Before: Dec  5 13:56:05 1999 GMT
+            Not After : Apr  3 13:56:05 2037 GMT
+        Subject: O=Thawte, OU=Thawte Universal CA Root, CN=Thawte Universal CA Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (16384 bit)
+                Modulus (16384 bit):
+                    00:e2:89:05:6d:c3:7f:ad:a6:89:3a:ff:bb:c7:cd:
+                    9d:37:b1:e1:d2:21:1e:9b:61:2a:15:e7:7b:57:4f:
+                    55:3c:d0:bb:f9:d9:3d:3e:a6:bc:ec:b4:ad:53:9a:
+                    16:02:eb:0b:72:fd:8a:f2:8f:44:05:c5:eb:d3:e5:
+                    bd:b6:44:39:e6:fb:47:bf:6a:9e:0a:95:18:e2:68:
+                    e2:d6:96:d6:21:ad:88:fd:f5:17:f5:d3:da:42:a5:
+                    90:ed:29:95:96:75:3a:da:87:a1:d4:f5:d3:87:de:
+                    05:62:a6:e3:66:74:92:cf:a5:bc:bb:df:68:ff:71:
+                    75:56:41:59:35:eb:33:5a:66:51:f2:d2:a3:0a:c1:
+                    8c:ce:73:5c:11:6f:2d:8c:95:8c:91:b1:fd:cf:e5:
+                    ad:56:95:cc:85:92:83:90:55:41:c9:c2:77:ed:f9:
+                    a3:74:42:0a:68:08:f3:d0:d1:65:fd:67:2c:34:ff:
+                    24:7f:e7:79:c8:07:3b:25:57:dd:a4:0c:98:3d:be:
+                    e0:cc:19:65:db:f2:54:a2:af:42:d4:9d:e2:ae:84:
+                    23:25:09:33:12:b5:6a:1e:76:c4:8b:d9:49:00:6c:
+                    5e:ba:1f:f2:1b:da:67:ca:27:aa:a3:44:23:1b:83:
+                    82:ce:f2:ab:33:ed:54:a4:dc:c9:ab:59:65:d1:38:
+                    0e:c1:3e:1b:67:8f:d6:75:01:e0:55:22:dd:76:77:
+                    ec:8e:dd:f4:cf:79:22:6d:b9:57:03:f5:99:08:a7:
+                    3c:3e:34:fb:c4:17:ae:23:58:cd:24:f3:23:ca:6a:
+                    02:28:94:01:81:34:b4:6c:6b:ae:8b:1a:c3:a3:d2:
+                    09:3c:16:54:f5:36:5f:24:e3:9f:4a:a1:e2:64:c6:
+                    16:c3:a6:81:7a:24:36:47:8e:c1:5e:0e:fb:f9:15:
+                    78:04:d6:0e:59:d9:9d:58:66:62:d2:94:29:32:32:
+                    c8:78:b9:66:f6:b5:56:e1:6c:c6:14:4b:96:52:59:
+                    91:02:24:6a:55:47:d7:3f:b6:23:1a:60:77:97:2e:
+                    e2:40:af:9e:04:57:9e:ad:11:c5:c9:43:70:ef:48:
+                    b4:5e:ac:1c:69:2e:2e:82:d5:5b:8b:be:82:be:19:
+                    14:5e:e7:0d:22:c7:51:1b:ff:1e:9b:f1:30:8f:71:
+                    31:06:b3:34:27:8f:5f:7a:66:82:4f:8a:2d:13:ab:
+                    42:cf:21:56:9e:97:8e:66:36:0f:96:9b:e5:2b:f4:
+                    02:a9:2a:6a:8c:2c:c4:c3:b8:70:2c:2d:29:1e:3f:
+                    50:77:1e:6d:2a:54:e4:55:0a:91:38:a1:c5:b5:66:
+                    a2:76:5a:ee:0f:bf:b4:67:e1:28:6e:0f:e1:36:a1:
+                    82:d1:bf:d4:77:e1:c4:67:32:93:78:c8:e7:54:53:
+                    fe:23:79:e6:68:cc:26:90:f6:10:63:5d:2a:6f:91:
+                    2d:a4:73:32:51:21:f2:bb:15:df:aa:24:08:48:06:
+                    de:a1:9e:26:bf:ba:83:bf:7c:a4:c8:a0:8c:bd:d2:
+                    ff:bc:84:69:27:13:24:18:c4:45:18:23:26:5e:18:
+                    14:ca:2e:88:87:62:a3:53:e6:21:b7:b8:85:7b:9a:
+                    85:bb:15:26:72:f8:b9:f7:6a:74:0f:49:3f:92:be:
+                    a9:05:b7:99:27:bf:bf:09:17:4b:99:4c:ad:11:10:
+                    7c:df:74:31:f6:8f:26:5f:aa:88:ae:38:57:c8:55:
+                    2d:d3:fb:d8:1b:51:99:be:25:1b:3a:ba:c0:7d:1b:
+                    ed:ce:d2:49:b9:cf:f3:c5:7d:89:90:81:d8:69:48:
+                    20:10:a3:f8:ef:92:51:18:32:8b:11:18:c0:3f:1b:
+                    85:56:ce:57:c9:f2:82:64:c6:df:02:09:2e:4a:11:
+                    2f:b1:27:6d:37:52:f0:f0:16:61:f1:67:8d:df:87:
+                    72:af:87:da:cf:fb:50:94:6e:d4:94:85:eb:8a:2c:
+                    ea:21:f5:96:4a:44:d5:e0:ce:6a:74:44:4d:d0:05:
+                    d3:87:15:ed:36:d0:a4:8b:66:55:70:93:ee:47:06:
+                    c1:7e:2e:a5:18:79:67:f3:28:85:f1:70:f7:0e:83:
+                    a4:7e:54:9e:5a:76:32:cb:65:1b:b8:cd:fb:c8:28:
+                    03:d2:54:91:d1:a7:c5:85:43:08:17:76:a5:e6:2f:
+                    67:08:d8:a1:a2:82:2d:0c:f8:c1:af:63:d4:50:77:
+                    6d:6b:46:4a:41:85:d5:90:5f:79:2d:c4:ec:d7:11:
+                    87:40:8a:e1:68:e2:64:f8:55:32:fb:6f:93:2c:da:
+                    77:d9:21:c1:17:e5:36:2c:4e:7e:90:7f:ac:94:2b:
+                    32:67:be:38:50:76:b8:ae:41:b9:d7:21:c5:09:4c:
+                    60:c8:a3:51:c4:34:9b:57:37:df:cb:c9:33:57:8b:
+                    eb:fb:76:9f:19:4d:c5:6a:1f:2a:45:ae:2b:ed:2f:
+                    8d:a7:a5:00:cb:04:fa:25:62:2e:74:48:1b:ca:2a:
+                    8c:ba:db:b6:7e:f6:bb:02:7c:a9:c3:db:58:78:a1:
+                    bf:f0:fe:1a:10:55:11:ce:e8:69:4e:96:65:c6:17:
+                    03:d6:07:68:8c:54:82:ae:1c:22:55:3f:f1:f4:09:
+                    97:28:c0:46:f7:4e:0b:25:1d:f7:07:d7:09:1d:3a:
+                    18:57:38:3b:e8:33:06:e7:8f:78:46:1e:5b:f5:06:
+                    b6:ec:b8:a6:0d:f1:ba:13:4b:d6:18:20:dd:69:33:
+                    4a:33:15:ae:b8:c8:98:8a:27:2c:93:bc:2d:fb:ee:
+                    33:bf:66:e6:4d:ba:b6:9b:06:55:60:97:4b:bc:44:
+                    cd:7e:f4:a1:d8:aa:2f:c0:02:28:21:16:62:78:db:
+                    08:54:f2:fc:f4:34:e3:c6:8f:1c:43:57:ce:90:1a:
+                    4b:dc:2e:3b:28:91:89:3f:7a:da:35:1d:8e:2c:ee:
+                    49:ec:f4:33:ad:c9:53:a8:8c:9f:04:53:3e:24:1c:
+                    52:c9:12:f9:62:57:a3:bc:ee:2c:eb:40:7c:20:23:
+                    70:2b:95:f9:73:17:8a:d1:c1:1c:69:a6:b7:38:9a:
+                    67:f7:70:1d:7a:5a:0c:40:cf:62:0f:85:3c:c2:02:
+                    4e:7e:b5:f6:c5:2a:29:84:b3:1f:37:2a:e1:aa:72:
+                    42:c4:ed:6b:1a:8f:92:1c:5d:be:d1:f2:5b:f2:ab:
+                    aa:a9:d2:f5:b8:a4:41:2b:2b:91:6e:12:48:ca:98:
+                    d8:37:8d:c8:ed:00:30:b5:b6:04:4e:7e:9c:da:84:
+                    ec:c0:fa:7b:e5:1d:88:a4:53:46:b0:94:e4:5c:1b:
+                    a1:25:2c:0f:48:52:77:97:09:6c:ec:5b:18:33:83:
+                    02:e5:82:7e:cd:85:21:30:11:fd:27:4f:cf:e4:1e:
+                    ec:3f:a5:57:6c:e9:2a:30:19:2a:88:e5:c3:69:38:
+                    ab:6f:39:71:7f:84:e1:41:c3:e1:cc:2a:89:20:52:
+                    2e:83:0f:6c:39:3f:4b:2d:16:ac:2d:f0:24:ac:00:
+                    73:f4:9b:b3:06:3f:05:b8:14:85:1f:ab:9e:5c:3c:
+                    9e:62:9d:0e:6d:3b:80:09:fc:02:ea:a2:97:74:ca:
+                    c7:f9:e3:56:e1:c3:ca:a5:a6:9a:c0:90:e0:24:12:
+                    53:d2:c2:8b:da:be:ed:02:43:5e:67:e1:89:98:79:
+                    ee:cb:aa:ca:c3:1b:dc:e7:a5:46:a5:7c:6b:16:87:
+                    b6:5a:28:d7:db:27:3c:5e:a5:bd:b6:51:dd:1f:43:
+                    cf:3b:26:c8:3a:8d:25:61:c1:49:f4:3c:1b:c9:44:
+                    ea:af:1c:c2:2b:94:01:2a:0e:30:d1:5b:8b:2b:47:
+                    e5:c3:d1:04:03:9b:0e:39:2c:d6:27:d4:e6:70:5a:
+                    d9:75:cf:2a:d8:c9:00:05:e4:13:88:ec:c3:39:fb:
+                    87:61:30:36:43:03:c8:9e:9c:a2:06:c2:2f:c5:fc:
+                    f0:80:63:b1:54:04:a0:4c:a9:2e:c6:f5:76:7a:d8:
+                    d0:e4:d4:94:11:e5:15:b5:78:06:dc:b8:80:8f:99:
+                    a9:20:33:3d:10:85:4c:65:09:ca:3e:58:5e:60:93:
+                    9a:aa:62:5d:c0:51:06:1c:5d:60:a0:0d:9c:4b:43:
+                    f6:a7:16:21:a4:87:aa:f2:c1:2e:ee:92:30:b8:9e:
+                    df:df:10:01:8b:86:09:70:d8:6c:a8:b7:50:1e:16:
+                    96:b4:f7:67:fd:35:3a:21:90:2a:32:c7:00:7b:4d:
+                    07:10:09:b9:2f:73:d8:18:7e:67:99:04:4f:06:fc:
+                    50:c7:85:9b:9d:40:9d:b3:96:37:fa:a5:dc:b2:72:
+                    4e:ef:4e:09:2c:fd:91:fd:4d:f7:bb:a6:a1:3e:ab:
+                    7b:a2:03:40:a6:a9:55:27:e2:fa:f9:19:ce:87:75:
+                    aa:f1:75:36:f3:f3:b8:91:f8:91:c3:8b:75:13:8e:
+                    4c:65:9a:16:39:6a:e5:34:e8:7a:96:59:7f:35:b0:
+                    00:fd:5b:69:fc:43:26:fa:f5:28:6e:fe:87:d9:7e:
+                    24:fb:b4:a0:82:6e:54:a2:ff:ae:bf:62:b4:f4:72:
+                    01:c2:cb:98:47:98:e1:4c:b5:17:80:80:ce:8f:a6:
+                    28:ee:1e:45:6a:fb:df:f1:1d:fc:5a:3b:d6:ea:f4:
+                    6c:1d:62:49:57:3b:8a:8f:86:ea:f0:53:04:ce:9c:
+                    16:68:ff:ba:b9:fc:88:0f:47:f7:02:44:72:40:b8:
+                    ca:3b:2d:53:9d:dc:3c:56:8c:59:7b:68:1a:2c:8d:
+                    71:bb:6c:00:c7:1a:ce:6f:40:92:b1:a3:2f:0f:d9:
+                    44:f2:a3:70:2e:9e:ee:0e:ae:32:d0:3b:3e:8b:07:
+                    ea:e6:79:b3:5c:29:e2:7d:6b:a8:5e:f9:5a:31:e8:
+                    08:96:a2:8c:03:98:46:f1:b8:7d:90:54:26:ed:76:
+                    62:fe:9e:e9:9a:6e:5e:c9:49:c7:5c:34:53:29:54:
+                    d9:ec:e4:46:e1:80:3b:75:d9:df:fb:79:d5:87:f1:
+                    ba:9e:eb:19:ce:4c:52:73:e6:5b:87:ae:25:4f:39:
+                    79:cc:c6:b8:f9:10:7b:ec:f0:9b:71:a4:05:a0:d3:
+                    29:d3:4e:7f:1f:f4:2d:28:78:cc:55:95:7b:1e:91:
+                    2f:cc:56:18:73:8b:b2:db:bc:69:07:e6:d0:d8:4f:
+                    ed:a2:ff:58:85:a3:6d:e0:4a:53:b7:67:7d:8d:0c:
+                    5c:5b:7b:77:28:02:35:44:7a:04:d3:28:43:c8:6b:
+                    30:17:5d:32:b8:29:35:ba:76:da:3b:14:4a:76:18:
+                    58:a4:f8:92:3c:9e:4d:33:6f:46:6b:08:d9:31:48:
+                    68:dd:f4:fb:24:56:34:b2:cf:69:66:be:48:d2:8a:
+                    66:22:cd:f2:69:cd:c2:53:13:45:29:41:22:d6:5d:
+                    98:1f:b6:a4:b2:a3:c2:ee:02:2f:51:1b:dc:83:a4:
+                    ec:70:25:a8:d4:08:61:32:6f:e4:a1:81:2e:7c:63:
+                    72:fa:29:65:bc:70:44:cf:5d
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        55:9a:34:6a:22:06:69:09:45:33:c7:ae:a9:5c:c7:09:4e:9b:
+        86:bc:41:90:d4:94:52:f6:cd:23:29:94:4b:22:cd:e8:bd:fe:
+        9d:cd:52:f2:bd:ed:ab:87:c9:ab:ab:46:04:b4:bd:a2:3f:22:
+        30:47:50:c0:4b:8c:76:0f:03:f5:92:d2:b1:2d:c4:7a:35:9c:
+        c9:73:87:eb:a6:9f:de:0f:73:8d:d3:7f:99:d8:ba:8f:6f:c4:
+        f3:be:1a:ae:8b:a2:94:36:90:e2:e5:eb:8d:05:f4:fc:65:df:
+        95:f1:c4:94:4d:17:56:d7:9f:3c:8f:50:3c:e7:77:bf:95:86:
+        26:64:fb:6a:ff:c6:da:e9:8c:ae:42:bb:69:e5:33:c6:d8:e9:
+        0d:c6:55:21:49:c1:0c:b4:a3:f9:9b:4b:5c:de:83:4f:41:03:
+        ce:2a:79:68:38:7d:f0:54:49:20:f5:b6:10:ff:08:dc:33:66:
+        96:9b:ff:06:de:00:9e:d7:ce:56:43:9a:51:fc:70:cd:f6:f0:
+        51:a3:b7:cd:b4:5c:85:62:cd:71:b7:c6:2b:23:2b:dd:c3:6e:
+        40:42:fa:37:ff:37:1c:f6:7a:57:94:87:85:23:d7:d4:c9:c7:
+        5f:c1:4d:2f:c9:0d:d7:5c:ec:9c:25:ee:9e:30:82:91:96:72:
+        b8:75:1d:f8:09:68:57:97:b2:2d:4b:ee:25:ec:7a:24:29:ee:
+        72:d4:9c:13:db:ab:dc:03:0a:d8:4a:14:c9:08:57:44:5d:a1:
+        b5:53:80:34:f2:14:97:cf:52:de:a2:0e:8a:10:e9:14:ef:d0:
+        60:be:61:a1:f1:25:5d:d5:18:73:3f:93:10:ca:96:ee:b3:40:
+        d2:db:a3:55:cf:57:5a:a5:0e:4f:75:47:df:ea:f7:90:9a:6d:
+        f5:70:2e:1d:14:1c:37:64:04:59:50:b0:dc:72:86:6f:9c:37:
+        3d:5d:28:af:73:55:ef:d2:ee:24:74:74:13:ef:dc:db:31:49:
+        fb:3f:63:f5:d3:08:3e:33:a5:e7:9d:0a:de:53:2c:51:8e:67:
+        db:9b:41:65:41:50:bd:d4:a4:96:6c:87:bc:12:e0:94:c7:d3:
+        c0:e4:cb:73:58:00:83:e1:ac:27:85:d6:9d:53:9d:5c:bd:0a:
+        3e:03:43:9c:0c:91:f5:6d:7b:f8:40:72:75:ab:11:76:91:2b:
+        e1:c6:aa:1f:70:69:76:70:15:09:fe:93:d0:d6:2d:b7:15:6a:
+        9b:67:5c:b4:69:9f:25:a6:7d:8a:fb:7d:22:a9:71:f2:ce:4e:
+        8c:b8:21:2d:de:fe:41:71:0d:ff:9d:ec:73:a6:bb:07:4f:88:
+        0e:58:47:2e:7e:a9:c2:c7:78:dd:ba:7a:9e:4e:e0:30:4e:63:
+        6f:85:d4:20:41:e9:fa:fe:43:45:e7:fb:af:7a:b2:ce:a4:05:
+        1d:22:9a:58:86:df:e4:ce:4c:a9:fe:d8:16:a5:6f:fb:d8:ce:
+        56:7b:f5:d6:20:ef:e4:47:cd:63:24:ff:b9:be:f1:48:a3:c1:
+        01:72:e6:bd:c0:ad:ed:26:0d:ca:34:9f:fc:02:2d:20:4f:05:
+        20:ae:21:3d:0c:c2:20:3c:3f:f0:04:84:dc:cf:89:fd:b9:25:
+        91:8e:d0:43:e6:b3:20:ab:5c:2d:d5:40:9e:a0:4b:d8:f4:b2:
+        cc:7d:f1:58:0a:8e:87:ed:88:ac:36:96:e4:56:a0:11:8a:f2:
+        9a:d0:b3:57:a3:34:bb:19:ab:38:e1:74:6b:22:c4:31:ce:01:
+        d5:1b:36:e3:1e:38:4c:33:93:df:40:e3:59:57:4e:ac:6e:7b:
+        1e:5a:3d:c5:1d:5b:ac:c8:10:82:35:02:22:b2:fc:75:e8:10:
+        91:8d:c4:7d:78:93:47:9e:1c:9d:ac:6b:62:02:58:8c:d6:1c:
+        23:d6:af:78:c2:80:9c:a4:aa:24:54:14:b5:14:98:c6:f8:2b:
+        1a:24:cb:71:32:0a:e2:9b:0e:69:6b:dd:7e:8c:64:d1:2e:63:
+        ef:0e:7f:b1:3e:88:4c:9d:55:e5:c9:6e:17:04:b7:41:ff:bd:
+        8a:41:cb:25:31:6f:44:77:3f:47:b1:fc:81:88:07:8e:05:49:
+        20:b7:11:d9:69:03:2a:03:9d:b9:33:84:9a:df:df:7a:e3:46:
+        73:a3:d8:a2:8c:53:19:88:55:4c:74:b8:f6:44:84:2b:d1:14:
+        2d:4e:39:2e:92:68:ff:69:fc:85:62:1b:eb:55:4f:ef:25:84:
+        62:45:99:d6:d8:4e:6f:3f:53:08:7d:1d:06:95:81:80:7f:4f:
+        4e:74:36:98:b5:e2:87:70:98:dc:d7:f5:dc:52:15:e6:c6:d6:
+        79:96:39:7f:8f:95:cf:ab:80:53:ad:1b:0b:45:40:0e:d4:18:
+        bd:2c:de:8a:77:76:fd:f2:44:47:c6:21:d0:e4:74:f0:d8:18:
+        05:c8:7c:30:72:c7:df:f1:bb:fc:02:30:a9:f4:42:26:59:0d:
+        93:05:82:a1:73:ed:34:e5:38:5d:cd:50:90:fe:94:fc:13:bc:
+        bd:fc:a8:a2:88:a7:73:c4:b2:a8:d1:5d:88:c4:02:a2:7a:f1:
+        04:c9:fe:8c:74:c9:ef:1d:64:41:9f:ac:1e:96:67:64:ac:ab:
+        28:41:c7:9d:f7:c0:98:1b:6e:07:c2:64:7d:5a:83:66:56:28:
+        36:9c:e7:fb:1c:77:0e:28:a0:c4:f7:6b:79:39:04:20:84:c7:
+        57:93:bc:1b:a0:ea:bc:eb:42:e5:a8:11:fe:fc:ac:65:cc:fd:
+        f8:28:88:f4:a5:9a:e5:73:51:e0:a8:9b:0d:03:77:4e:e5:e0:
+        98:b3:88:da:7d:e6:c6:9e:7c:14:66:c1:2e:53:4a:92:07:37:
+        a0:7e:e9:3d:09:e4:15:7c:cf:fd:b8:41:a5:ef:9e:66:9d:c4:
+        5e:07:1d:87:f8:41:ad:ea:e7:2f:d2:41:63:18:37:f9:14:e3:
+        4d:d0:e5:f7:43:fd:15:e3:f9:36:73:06:26:df:01:4f:a9:c3:
+        4e:de:20:46:77:98:b4:7a:24:2b:3b:75:2b:4e:58:8d:9b:5d:
+        a4:c7:16:a0:bc:32:88:3f:a1:83:f3:00:c8:f8:d8:58:e9:63:
+        5d:4c:2b:b5:f0:72:41:d8:ab:77:37:d6:72:74:ae:b6:36:9c:
+        c8:a6:83:49:4b:e0:c9:56:0b:29:be:00:30:cb:dd:d6:c8:42:
+        8a:00:d9:ec:15:d1:34:71:f2:5b:64:87:f6:27:d2:b7:eb:86:
+        b0:90:bf:29:db:21:9e:36:8c:e3:20:2f:95:23:51:6c:1b:c2:
+        a4:d5:e6:d8:02:43:67:a0:fe:9b:50:03:44:7f:bb:e4:72:d5:
+        d1:e4:da:8f:92:14:64:fb:5d:14:10:12:4a:95:06:c9:65:08:
+        29:ca:21:a3:26:38:11:c9:27:df:70:67:04:fd:ca:48:32:7f:
+        63:b2:45:74:31:50:4f:87:d9:20:70:d2:21:70:b1:d6:10:9d:
+        33:5d:78:83:91:6d:55:82:ec:da:e4:62:63:c7:81:46:d7:19:
+        65:72:2a:43:19:90:b8:d7:23:4d:4c:1c:e0:44:a9:66:67:ac:
+        ee:71:79:27:26:78:6d:72:0e:f5:5d:4b:23:b5:7c:7c:65:e9:
+        17:c6:3a:0b:0d:dd:5e:1e:51:c3:86:b8:ec:7f:c7:27:4a:a5:
+        46:e8:6a:2d:19:c1:87:a3:cb:99:93:87:64:a2:55:14:4c:b7:
+        43:a5:93:d7:e7:d2:4e:79:40:ca:65:99:46:3d:3f:7a:80:7a:
+        88:6a:cc:1e:e5:6b:33:46:f4:50:c0:d5:1f:09:b8:cd:8a:2e:
+        a1:27:eb:5d:73:a7:e8:6b:0a:e5:57:82:2a:b0:fc:e2:54:52:
+        56:f0:ab:a9:12:c6:23:96:07:24:9c:e0:bc:46:a5:b4:20:04:
+        da:09:93:63:e5:d4:2e:c2:7e:c5:31:ed:b5:15:74:86:17:b9:
+        b3:f3:26:8a:1d:02:6a:da:1a:3f:e8:ba:f1:04:6d:94:51:54:
+        e2:5a:b4:59:83:1d:60:d0:2d:73:cc:07:b5:26:8c:f9:d7:c6:
+        88:91:ef:80:cf:5d:0f:a1:60:cb:45:d4:42:22:d1:b1:70:1d:
+        fd:d0:b7:30:90:3a:c6:48:6d:67:e5:32:da:8f:db:e3:a8:e3:
+        1d:20:25:a2:1c:e1:4c:b9:a4:f6:c6:3f:5c:58:0d:bb:c6:b2:
+        77:01:16:91:9f:17:06:0d:b7:40:3e:cc:8f:8e:9c:4b:e0:9d:
+        7e:9b:1e:05:ab:88:22:fa:d3:28:1b:57:14:64:4a:3e:24:2c:
+        38:4d:21:69:00:73:2e:d0:55:2d:74:f2:15:e8:94:43:3e:40:
+        2a:c6:c6:b9:6a:5b:de:a2:cc:18:50:54:5d:4e:2a:85:6c:f6:
+        92:8b:29:19:7e:e7:ea:4a:e0:22:2b:25:bc:f7:66:cf:77:9a:
+        41:74:f2:3c:14:0d:74:69:f5:50:83:cd:cd:2f:21:db:22:46:
+        8a:d0:f7:51:1a:95:57:f2:05:8b:1a:19:ed:3b:45:e8:36:c2:
+        6e:7e:fb:57:22:00:1f:06:53:a9:ae:93:c6:8f:71:2a:31:45:
+        92:e7:8e:6d:e6:99:22:c0:83:fc:ef:dc:57:66:77:4f:a2:36:
+        31:fb:a1:13:8d:e5:ca:a3:95:7d:01:0c:64:70:3b:53:42:68:
+        80:c7:bb:9d:a8:00:35:69:98:0c:a8:67:d8:43:e5:aa:cf:95:
+        e0:51:95:a4:17:3f:42:9d:b8:04:ce:d3:79:79:c8:d3:8a:16:
+        32:92:e0:d7:a2:ee:d7:37:4c:2f:ac:b8:7b:be:45:f6:f1:18:
+        33:9c:7b:37:a6:24:d9:bc:40:ab:00:e9:c3:37:8b:ab:d8:b6:
+        f3:5e:81:4e:b0:14:6b:07:3e:1f:ec:c2:f6:44:22:95:bb:b3:
+        e6:6f:d6:f9:70:65:ba:0a:83:65:aa:0e:13:2f:83:13:23:53:
+        8b:40:16:fa:ce:2f:fc:4d:04:f8:eb:d8:ac:c5:36:c2:15:57:
+        48:38:ec:55:b3:b4:1e:ba:ad:d2:42:06:17:0d:73:c8:57:a6:
+        be:96:4d:a9:f2:c0:fb:7a:21:1c:f5:c9:70:a9:82:90:b5:f1:
+        0c:d4:79:10:be:81:a6:e9:5c:61:9c:77:79:9a:a4:c3:37:26:
+        57:37:c9:52:2c:fa:08:ff:d0:5f:c6:61:c0:f4:76:be:fc:de:
+        4e:cf:ab:51:99:71:c7:df:7e:f4:d6:cf:06:56:19:13:53:0b:
+        6d:74:59:48:19:9b:53:05:2d:9d:32:54:d3:e5:2c:53:8b:64:
+        3e:d4:64:7b:e3:80:09:14:cc:fe:16:46:63:6b:71:69:f8:f9:
+        cb:27:f6:88:54:bc:45:b3:ce:02:c8:94:ee:40:5b:f9:42:02:
+        c2:ff:b0:d8:2c:eb:28:7f:5e:c9:26:01:99:a7
+
+UPS Document Exchange by DST
+============================
+MD5 Fingerprint: 78:A5:FB:10:4B:E4:63:2E:D2:6B:FB:F2:B6:C2:4B:8E
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIID+DCCAuACEQDQHkCLAAACfAAAAAcAAAABMA0GCSqGSIb3DQEBBQUAMIG5MQsw
+CQYDVQQGEwJ1czENMAsGA1UECBMEVXRhaDEXMBUGA1UEBxMOU2FsdCBMYWtlIENp
+dHkxJDAiBgNVBAoTG0RpZ2l0YWwgU2lnbmF0dXJlIFRydXN0IENvLjEeMBwGA1UE
+CxMVVW5pdGVkIFBhcmNlbCBTZXJ2aWNlMRkwFwYDVQQDExBEU1QgKFVQUykgUm9v
+dENBMSEwHwYJKoZIhvcNAQkBFhJjYUBkaWdzaWd0cnVzdC5jb20wHhcNOTgxMjEw
+MDAyNTQ2WhcNMDgxMjA3MDAyNTQ2WjCBuTELMAkGA1UEBhMCdXMxDTALBgNVBAgT
+BFV0YWgxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MSQwIgYDVQQKExtEaWdpdGFs
+IFNpZ25hdHVyZSBUcnVzdCBDby4xHjAcBgNVBAsTFVVuaXRlZCBQYXJjZWwgU2Vy
+dmljZTEZMBcGA1UEAxMQRFNUIChVUFMpIFJvb3RDQTEhMB8GCSqGSIb3DQEJARYS
+Y2FAZGlnc2lndHJ1c3QuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA7xfsrynm2SsnwNt7JJ9m9ASjwq0KyrDNhCuqN/OAoWDvQo/lXXdfV0JU3Svb
+YbJxXpN7b1/rJCvnpPLr8XOzC431Wdcy36yQjk4xuiVNtgym8eWvDOHlb1IDFcHf
+vn5KpqYYRnA/76dNqNz1dNlhekA8oZQo6sKUiMs3FQUZPJViuhwt+yiM0ciekjxb
+EVQ7eNlHO5stSuY+e2vf9PYFzyj2upg2AJ48N4UKnN63pIXFY/23YhRtFx7MioCF
+QjIRsCHinXfJgBZBnuvlFIl/t8O8T8Gfh5uW7GP2+ZBWDpWjIwqMZNqbuxx3sExd
+5sjo9X15LVckP8zjPSyYzxKfFwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQC7OI4E
+IiZYDiFEVsy9WXwpaMtcD8iGVD+BeKetj8xG9xxUuHktW3IFaugh0OwdHf6kNFG+
+7u3OzJwWaOJddXMIQzGRahArEMJLafjJrZio/bjv9qvwXyHvy4VrCe0vSGa1YHLA
+6KDHmNsO9xtzjTQICnvFd2KqMCObsB6LgJhU3AWHs6liWfyLtxWarETszzUa9w8u
+XZJLAch77qA37eQdgg2ZQUMXrdTVyuP5fReiAdAwD0C53LkEgmmDtvkP+gaS96j0
+1hcc8F5/xCnI5uHi/zZoIVGu/6m6hJKtinsz2JDSwXltMzM5dKwbOHGfLAeQ6h3g
+04lfy+8UjSdUpb1G
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            d0:1e:40:8b:00:00:02:7c:00:00:00:07:00:00:00:01
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=United Parcel Service, CN=DST (UPS) RootCA/Email=ca@digsigtrust.com
+        Validity
+            Not Before: Dec 10 00:25:46 1998 GMT
+            Not After : Dec  7 00:25:46 2008 GMT
+        Subject: C=us, ST=Utah, L=Salt Lake City, O=Digital Signature Trust Co., OU=United Parcel Service, CN=DST (UPS) RootCA/Email=ca@digsigtrust.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ef:17:ec:af:29:e6:d9:2b:27:c0:db:7b:24:9f:
+                    66:f4:04:a3:c2:ad:0a:ca:b0:cd:84:2b:aa:37:f3:
+                    80:a1:60:ef:42:8f:e5:5d:77:5f:57:42:54:dd:2b:
+                    db:61:b2:71:5e:93:7b:6f:5f:eb:24:2b:e7:a4:f2:
+                    eb:f1:73:b3:0b:8d:f5:59:d7:32:df:ac:90:8e:4e:
+                    31:ba:25:4d:b6:0c:a6:f1:e5:af:0c:e1:e5:6f:52:
+                    03:15:c1:df:be:7e:4a:a6:a6:18:46:70:3f:ef:a7:
+                    4d:a8:dc:f5:74:d9:61:7a:40:3c:a1:94:28:ea:c2:
+                    94:88:cb:37:15:05:19:3c:95:62:ba:1c:2d:fb:28:
+                    8c:d1:c8:9e:92:3c:5b:11:54:3b:78:d9:47:3b:9b:
+                    2d:4a:e6:3e:7b:6b:df:f4:f6:05:cf:28:f6:ba:98:
+                    36:00:9e:3c:37:85:0a:9c:de:b7:a4:85:c5:63:fd:
+                    b7:62:14:6d:17:1e:cc:8a:80:85:42:32:11:b0:21:
+                    e2:9d:77:c9:80:16:41:9e:eb:e5:14:89:7f:b7:c3:
+                    bc:4f:c1:9f:87:9b:96:ec:63:f6:f9:90:56:0e:95:
+                    a3:23:0a:8c:64:da:9b:bb:1c:77:b0:4c:5d:e6:c8:
+                    e8:f5:7d:79:2d:57:24:3f:cc:e3:3d:2c:98:cf:12:
+                    9f:17
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        bb:38:8e:04:22:26:58:0e:21:44:56:cc:bd:59:7c:29:68:cb:
+        5c:0f:c8:86:54:3f:81:78:a7:ad:8f:cc:46:f7:1c:54:b8:79:
+        2d:5b:72:05:6a:e8:21:d0:ec:1d:1d:fe:a4:34:51:be:ee:ed:
+        ce:cc:9c:16:68:e2:5d:75:73:08:43:31:91:6a:10:2b:10:c2:
+        4b:69:f8:c9:ad:98:a8:fd:b8:ef:f6:ab:f0:5f:21:ef:cb:85:
+        6b:09:ed:2f:48:66:b5:60:72:c0:e8:a0:c7:98:db:0e:f7:1b:
+        73:8d:34:08:0a:7b:c5:77:62:aa:30:23:9b:b0:1e:8b:80:98:
+        54:dc:05:87:b3:a9:62:59:fc:8b:b7:15:9a:ac:44:ec:cf:35:
+        1a:f7:0f:2e:5d:92:4b:01:c8:7b:ee:a0:37:ed:e4:1d:82:0d:
+        99:41:43:17:ad:d4:d5:ca:e3:f9:7d:17:a2:01:d0:30:0f:40:
+        b9:dc:b9:04:82:69:83:b6:f9:0f:fa:06:92:f7:a8:f4:d6:17:
+        1c:f0:5e:7f:c4:29:c8:e6:e1:e2:ff:36:68:21:51:ae:ff:a9:
+        ba:84:92:ad:8a:7b:33:d8:90:d2:c1:79:6d:33:33:39:74:ac:
+        1b:38:71:9f:2c:07:90:ea:1d:e0:d3:89:5f:cb:ef:14:8d:27:
+        54:a5:bd:46
+
+ValiCert Class 1 VA
+===================
+MD5 Fingerprint: 65:58:AB:15:AD:57:6C:1E:A8:A7:B5:69:AC:BF:FF:EB
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0
+IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz
+BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y
+aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG
+9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNTIyMjM0OFoXDTE5MDYy
+NTIyMjM0OFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y
+azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs
+YXNzIDEgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw
+Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl
+cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYWYJ6ibiWuqYvaG9Y
+LqdUHAZu9OqNSLwxlBfw8068srg1knaw0KWlAdcAAxIiGQj4/xEjm84H9b9pGib+
+TunRf50sQB1ZaG6m+FiwnRqP0z/x3BkGgagO4DrdyFNFCQbmD3DD+kCmDuJWBQ8Y
+TfwggtFzVXSNdnKgHZ0dwN0/cQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFBoPUn0
+LBwGlN+VYH+Wexf+T3GtZMjdd9LvWVXoP+iOBSoh8gfStadS/pyxtuJbdxdA6nLW
+I8sogTLDAHkY7FkXicnGah5xyf23dKUlRWnFSKsZ4UWKJWsZ7uW7EvV/96aNUcPw
+nXS3qT6gpf+2SQMT2iLM7XGCK5nPOrf1LXLI
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Validity
+            Not Before: Jun 25 22:23:48 1999 GMT
+            Not After : Jun 25 22:23:48 2019 GMT
+        Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 1 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d8:59:82:7a:89:b8:96:ba:a6:2f:68:6f:58:2e:
+                    a7:54:1c:06:6e:f4:ea:8d:48:bc:31:94:17:f0:f3:
+                    4e:bc:b2:b8:35:92:76:b0:d0:a5:a5:01:d7:00:03:
+                    12:22:19:08:f8:ff:11:23:9b:ce:07:f5:bf:69:1a:
+                    26:fe:4e:e9:d1:7f:9d:2c:40:1d:59:68:6e:a6:f8:
+                    58:b0:9d:1a:8f:d3:3f:f1:dc:19:06:81:a8:0e:e0:
+                    3a:dd:c8:53:45:09:06:e6:0f:70:c3:fa:40:a6:0e:
+                    e2:56:05:0f:18:4d:fc:20:82:d1:73:55:74:8d:76:
+                    72:a0:1d:9d:1d:c0:dd:3f:71
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        50:68:3d:49:f4:2c:1c:06:94:df:95:60:7f:96:7b:17:fe:4f:
+        71:ad:64:c8:dd:77:d2:ef:59:55:e8:3f:e8:8e:05:2a:21:f2:
+        07:d2:b5:a7:52:fe:9c:b1:b6:e2:5b:77:17:40:ea:72:d6:23:
+        cb:28:81:32:c3:00:79:18:ec:59:17:89:c9:c6:6a:1e:71:c9:
+        fd:b7:74:a5:25:45:69:c5:48:ab:19:e1:45:8a:25:6b:19:ee:
+        e5:bb:12:f5:7f:f7:a6:8d:51:c3:f0:9d:74:b7:a9:3e:a0:a5:
+        ff:b6:49:03:13:da:22:cc:ed:71:82:2b:99:cf:3a:b7:f5:2d:
+        72:c8
+
+ValiCert Class 2 VA
+===================
+MD5 Fingerprint: A9:23:75:9B:BA:49:36:6E:31:C2:DB:F2:E7:66:BA:87
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0
+IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz
+BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y
+aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG
+9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMTk1NFoXDTE5MDYy
+NjAwMTk1NFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y
+azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs
+YXNzIDIgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw
+Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl
+cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOOnHK5avIWZJV16vY
+dA757tn2VUdZZUcOBVXc65g2PFxTXdMwzzjsvUGJ7SVCCSRrCl6zfN1SLUzm1NZ9
+WlmpZdRJEy0kTRxQb7XBhVQ7/nHk01xC+YDgkRoKWzk2Z/M/VXwbP7RfZHM047QS
+v4dk+NoS/zcnwbNDu+97bi5p9wIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADt/UG9v
+UJSZSWI4OB9L+KXIPqeCgfYrx+jFzug6EILLGACOTb2oWH+heQC1u+mNr0HZDzTu
+IYEZoDJJKPTEjlbVUjP9UNV+mWwD5MlM/Mtsq2azSiGM5bUMMj4QssxsodyamEwC
+W/POuZ6lcg5Ktz885hZo+L7tdEy8W9ViH0Pd
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Validity
+            Not Before: Jun 26 00:19:54 1999 GMT
+            Not After : Jun 26 00:19:54 2019 GMT
+        Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 2 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ce:3a:71:ca:e5:ab:c8:59:92:55:d7:ab:d8:74:
+                    0e:f9:ee:d9:f6:55:47:59:65:47:0e:05:55:dc:eb:
+                    98:36:3c:5c:53:5d:d3:30:cf:38:ec:bd:41:89:ed:
+                    25:42:09:24:6b:0a:5e:b3:7c:dd:52:2d:4c:e6:d4:
+                    d6:7d:5a:59:a9:65:d4:49:13:2d:24:4d:1c:50:6f:
+                    b5:c1:85:54:3b:fe:71:e4:d3:5c:42:f9:80:e0:91:
+                    1a:0a:5b:39:36:67:f3:3f:55:7c:1b:3f:b4:5f:64:
+                    73:34:e3:b4:12:bf:87:64:f8:da:12:ff:37:27:c1:
+                    b3:43:bb:ef:7b:6e:2e:69:f7
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        3b:7f:50:6f:6f:50:94:99:49:62:38:38:1f:4b:f8:a5:c8:3e:
+        a7:82:81:f6:2b:c7:e8:c5:ce:e8:3a:10:82:cb:18:00:8e:4d:
+        bd:a8:58:7f:a1:79:00:b5:bb:e9:8d:af:41:d9:0f:34:ee:21:
+        81:19:a0:32:49:28:f4:c4:8e:56:d5:52:33:fd:50:d5:7e:99:
+        6c:03:e4:c9:4c:fc:cb:6c:ab:66:b3:4a:21:8c:e5:b5:0c:32:
+        3e:10:b2:cc:6c:a1:dc:9a:98:4c:02:5b:f3:ce:b9:9e:a5:72:
+        0e:4a:b7:3f:3c:e6:16:68:f8:be:ed:74:4c:bc:5b:d5:62:1f:
+        43:dd
+
+ValiCert Class 3 VA
+===================
+MD5 Fingerprint: A2:6F:53:B7:EE:40:DB:4A:68:E7:FA:18:D9:10:4B:72
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAlACAQEwDQYJKoZIhvcNAQEFBQAwgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0
+IFZhbGlkYXRpb24gTmV0d29yazEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAz
+BgNVBAsTLFZhbGlDZXJ0IENsYXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9y
+aXR5MSEwHwYDVQQDExhodHRwOi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG
+9w0BCQEWEWluZm9AdmFsaWNlcnQuY29tMB4XDTk5MDYyNjAwMjIzM1oXDTE5MDYy
+NjAwMjIzM1owgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0d29y
+azEXMBUGA1UEChMOVmFsaUNlcnQsIEluYy4xNTAzBgNVBAsTLFZhbGlDZXJ0IENs
+YXNzIDMgUG9saWN5IFZhbGlkYXRpb24gQXV0aG9yaXR5MSEwHwYDVQQDExhodHRw
+Oi8vd3d3LnZhbGljZXJ0LmNvbS8xIDAeBgkqhkiG9w0BCQEWEWluZm9AdmFsaWNl
+cnQuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjmFGWHOjVsQaBalfD
+cnWTq8+epvzzFlLWLU2fNUSoLgRNB0mKOCn1dzfnt6td3zZxFJmP3MKS8edgkpfs
+2Ejcv8ECIMYkpChMMFp2bbFc893enhBxoYjHW5tBbcqwuI4V7q0zK89HBFx1cQqY
+JJgpp0lZpd34t0NiYfPT4tBVPwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAFa7AliE
+Zwgs3x/be0kz9dNnnfS0ChCzycUs4pJqcXgn8nCDQtM+z6lU9PHYkhaM0QTLS6vJ
+n0WuPIqpsHEzXcjFV9+vqDWzf4mH6eglkrh/hXqu1rweN1gqZ8mRzyqBPu3GOd/A
+PhmcGcwTTYJBtYze4D1gCCAPRX5ron+jjBXu
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Validity
+            Not Before: Jun 26 00:22:33 1999 GMT
+            Not After : Jun 26 00:22:33 2019 GMT
+        Subject: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert Class 3 Policy Validation Authority, CN=http://www.valicert.com//Email=info@valicert.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:e3:98:51:96:1c:e8:d5:b1:06:81:6a:57:c3:72:
+                    75:93:ab:cf:9e:a6:fc:f3:16:52:d6:2d:4d:9f:35:
+                    44:a8:2e:04:4d:07:49:8a:38:29:f5:77:37:e7:b7:
+                    ab:5d:df:36:71:14:99:8f:dc:c2:92:f1:e7:60:92:
+                    97:ec:d8:48:dc:bf:c1:02:20:c6:24:a4:28:4c:30:
+                    5a:76:6d:b1:5c:f3:dd:de:9e:10:71:a1:88:c7:5b:
+                    9b:41:6d:ca:b0:b8:8e:15:ee:ad:33:2b:cf:47:04:
+                    5c:75:71:0a:98:24:98:29:a7:49:59:a5:dd:f8:b7:
+                    43:62:61:f3:d3:e2:d0:55:3f
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        56:bb:02:58:84:67:08:2c:df:1f:db:7b:49:33:f5:d3:67:9d:
+        f4:b4:0a:10:b3:c9:c5:2c:e2:92:6a:71:78:27:f2:70:83:42:
+        d3:3e:cf:a9:54:f4:f1:d8:92:16:8c:d1:04:cb:4b:ab:c9:9f:
+        45:ae:3c:8a:a9:b0:71:33:5d:c8:c5:57:df:af:a8:35:b3:7f:
+        89:87:e9:e8:25:92:b8:7f:85:7a:ae:d6:bc:1e:37:58:2a:67:
+        c9:91:cf:2a:81:3e:ed:c6:39:df:c0:3e:19:9c:19:cc:13:4d:
+        82:41:b5:8c:de:e0:3d:60:08:20:0f:45:7e:6b:a2:7f:a3:8c:
+        15:ee
+
+VeriSign Class 4 Primary CA
+===========================
+MD5 Fingerprint: 1B:D1:AD:17:8B:7F:22:13:24:F5:26:E2:5D:4E:B9:10
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICMTCCAZoCBQKmAAABMA0GCSqGSIb3DQEBAgUAMF8xCzAJBgNVBAYTAlVTMRcw
+FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgNCBQdWJsaWMg
+UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NjAxMjkwMDAwMDBa
+Fw05OTEyMzEyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2ln
+biwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgNCBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0LJ1
+9njQrlpQ9OlQqZ+M1++RlHDo0iSQdomF1t+s5gEXMoDwnZNHvJplnR+Xrr/phnVj
+IIm9gFidBAydqMEk6QvlMXi9/C0MN2qeeIDpRnX57aP7E3vIwUzSo+/1PLBij0pd
+O92VZ48TucE81qcmm+zDO3rZTbxtm+gVAePwR6kCAwEAATANBgkqhkiG9w0BAQIF
+AAOBgQBT3dPwnCR+QKri/AAa19oM/DJhuBUNlvP6Vxt/M3yv6ZiaYch6s7f/sdyZ
+g9ysEvxwyR84Qu1E9oAuW2szaayc01znX1oYx7EteQSWQZGZQbE8DbqEOcY7l/Am
+yY7uvcxClf8exwI/VAx49byqYHwCaejcrOICdmHEPgPq0ook0Q==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            02:a6:00:00:01
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority
+        Validity
+            Not Before: Jan 29 00:00:00 1996 GMT
+            Not After : Dec 31 23:59:59 1999 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d0:b2:75:f6:78:d0:ae:5a:50:f4:e9:50:a9:9f:
+                    8c:d7:ef:91:94:70:e8:d2:24:90:76:89:85:d6:df:
+                    ac:e6:01:17:32:80:f0:9d:93:47:bc:9a:65:9d:1f:
+                    97:ae:bf:e9:86:75:63:20:89:bd:80:58:9d:04:0c:
+                    9d:a8:c1:24:e9:0b:e5:31:78:bd:fc:2d:0c:37:6a:
+                    9e:78:80:e9:46:75:f9:ed:a3:fb:13:7b:c8:c1:4c:
+                    d2:a3:ef:f5:3c:b0:62:8f:4a:5d:3b:dd:95:67:8f:
+                    13:b9:c1:3c:d6:a7:26:9b:ec:c3:3b:7a:d9:4d:bc:
+                    6d:9b:e8:15:01:e3:f0:47:a9
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        53:dd:d3:f0:9c:24:7e:40:aa:e2:fc:00:1a:d7:da:0c:fc:32:
+        61:b8:15:0d:96:f3:fa:57:1b:7f:33:7c:af:e9:98:9a:61:c8:
+        7a:b3:b7:ff:b1:dc:99:83:dc:ac:12:fc:70:c9:1f:38:42:ed:
+        44:f6:80:2e:5b:6b:33:69:ac:9c:d3:5c:e7:5f:5a:18:c7:b1:
+        2d:79:04:96:41:91:99:41:b1:3c:0d:ba:84:39:c6:3b:97:f0:
+        26:c9:8e:ee:bd:cc:42:95:ff:1e:c7:02:3f:54:0c:78:f5:bc:
+        aa:60:7c:02:69:e8:dc:ac:e2:02:76:61:c4:3e:03:ea:d2:8a:
+        24:d1
+
+Verisign Class 1 Public Primary Certification Authority
+=======================================================
+MD5 Fingerprint: 97:60:E8:57:5F:D3:50:47:E5:43:0C:94:36:8A:B0:62
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICPTCCAaYCEQDNun9W8N/kvFT+IqyzcqpVMA0GCSqGSIb3DQEBAgUAMF8xCzAJ
+BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xh
+c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05
+NjAxMjkwMDAwMDBaFw0yODA4MDEyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYD
+VQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJp
+bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEA5Rm/baNWYS2ZSHH2Z965jeu3noaACpEO+jglr0aIguVzqKCbJF0N
+H8xlbgyw0FaEGIeaBpsQoXPftFg5a27B9hXVqKg/qhIGjTGsf7A01480Z4gJzRQR
+4k5FVmkfeAKA2txHkSm7NsljXMXg1y2He6G3MrB7MLoqLzGq7qNn2tsCAwEAATAN
+BgkqhkiG9w0BAQIFAAOBgQBMP7iLxmjf7kMzDl3ppssHhE16M/+SG/Q2rdiVIjZo
+EWx8QszznC7EBz8UsA9P/5CSdvnivErpj82ggAr3xSnxgiJduLHdgSOjeyUVRjB5
+FvjqBUuUfx3CHMjjt/QQQDwTw18fU+hI5Ia0e6E1sHslurjTjqs/OJ0ANACY89Fx
+lA==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            cd:ba:7f:56:f0:df:e4:bc:54:fe:22:ac:b3:72:aa:55
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority
+        Validity
+            Not Before: Jan 29 00:00:00 1996 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:e5:19:bf:6d:a3:56:61:2d:99:48:71:f6:67:de:
+                    b9:8d:eb:b7:9e:86:80:0a:91:0e:fa:38:25:af:46:
+                    88:82:e5:73:a8:a0:9b:24:5d:0d:1f:cc:65:6e:0c:
+                    b0:d0:56:84:18:87:9a:06:9b:10:a1:73:df:b4:58:
+                    39:6b:6e:c1:f6:15:d5:a8:a8:3f:aa:12:06:8d:31:
+                    ac:7f:b0:34:d7:8f:34:67:88:09:cd:14:11:e2:4e:
+                    45:56:69:1f:78:02:80:da:dc:47:91:29:bb:36:c9:
+                    63:5c:c5:e0:d7:2d:87:7b:a1:b7:32:b0:7b:30:ba:
+                    2a:2f:31:aa:ee:a3:67:da:db
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        4c:3f:b8:8b:c6:68:df:ee:43:33:0e:5d:e9:a6:cb:07:84:4d:
+        7a:33:ff:92:1b:f4:36:ad:d8:95:22:36:68:11:6c:7c:42:cc:
+        f3:9c:2e:c4:07:3f:14:b0:0f:4f:ff:90:92:76:f9:e2:bc:4a:
+        e9:8f:cd:a0:80:0a:f7:c5:29:f1:82:22:5d:b8:b1:dd:81:23:
+        a3:7b:25:15:46:30:79:16:f8:ea:05:4b:94:7f:1d:c2:1c:c8:
+        e3:b7:f4:10:40:3c:13:c3:5f:1f:53:e8:48:e4:86:b4:7b:a1:
+        35:b0:7b:25:ba:b8:d3:8e:ab:3f:38:9d:00:34:00:98:f3:d1:
+        71:94
+
+Verisign Class 1 Public Primary Certification Authority - G2
+============================================================
+MD5 Fingerprint: F2:7D:E9:54:E4:A3:22:0D:76:9F:E7:0B:BB:B3:24:2B
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDAjCCAmsCEDnKVIn+UCIy/jLZ2/sbhBkwDQYJKoZIhvcNAQEFBQAwgcExCzAJ
+BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh
+c3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy
+MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp
+emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X
+DTk4MDUxODAwMDAwMFoXDTE4MDUxODIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw
+FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMSBQdWJsaWMg
+UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo
+YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5
+MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB
+AQUAA4GNADCBiQKBgQCq0Lq+Fi24g9TK0g+8djHKlNgdk4xWArzZbxpvUjZudVYK
+VdPfQ4chEWWKfo+9Id5rMj8bhDSVBZ1BNeuS65bdqlk/AVNtmU/t5eIqWpDBucSm
+Fc/IReumXY6cPvBkJHalzasab7bYe1FhbqZ/h8jit+U03EGI6glAvnOSPWvndQID
+AQABMA0GCSqGSIb3DQEBBQUAA4GBAIv3GhDOdlwHq4OZ3BeAbzQ5XZg+a3Is4cei
+e0ApuXiIukzFo2penm574/ICQQxmvq37rqIUzpLzojSLtLK2JPLl1eDI5WJthHvL
+vrsDi3xXyvA3qZCviu4Dvh0onNkmdqDNxJ1O8K4HFtW+r1cIatCgQkJCHvQgzKV4
+gpUmOIpH
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            39:ca:54:89:fe:50:22:32:fe:32:d9:db:fb:1b:84:19
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Validity
+            Not Before: May 18 00:00:00 1998 GMT
+            Not After : May 18 23:59:59 2018 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 1 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:aa:d0:ba:be:16:2d:b8:83:d4:ca:d2:0f:bc:76:
+                    31:ca:94:d8:1d:93:8c:56:02:bc:d9:6f:1a:6f:52:
+                    36:6e:75:56:0a:55:d3:df:43:87:21:11:65:8a:7e:
+                    8f:bd:21:de:6b:32:3f:1b:84:34:95:05:9d:41:35:
+                    eb:92:eb:96:dd:aa:59:3f:01:53:6d:99:4f:ed:e5:
+                    e2:2a:5a:90:c1:b9:c4:a6:15:cf:c8:45:eb:a6:5d:
+                    8e:9c:3e:f0:64:24:76:a5:cd:ab:1a:6f:b6:d8:7b:
+                    51:61:6e:a6:7f:87:c8:e2:b7:e5:34:dc:41:88:ea:
+                    09:40:be:73:92:3d:6b:e7:75
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        8b:f7:1a:10:ce:76:5c:07:ab:83:99:dc:17:80:6f:34:39:5d:
+        98:3e:6b:72:2c:e1:c7:a2:7b:40:29:b9:78:88:ba:4c:c5:a3:
+        6a:5e:9e:6e:7b:e3:f2:02:41:0c:66:be:ad:fb:ae:a2:14:ce:
+        92:f3:a2:34:8b:b4:b2:b6:24:f2:e5:d5:e0:c8:e5:62:6d:84:
+        7b:cb:be:bb:03:8b:7c:57:ca:f0:37:a9:90:af:8a:ee:03:be:
+        1d:28:9c:d9:26:76:a0:cd:c4:9d:4e:f0:ae:07:16:d5:be:af:
+        57:08:6a:d0:a0:42:42:42:1e:f4:20:cc:a5:78:82:95:26:38:
+        8a:47
+
+Verisign Class 1 Public Primary Certification Authority - G3
+============================================================
+MD5 Fingerprint: B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEGjCCAwICEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAMIHKMQsw
+CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
+cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
+LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
+aWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
+dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
+VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
+aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
+bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
+IENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
+LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN2E1Lm0+afY8wR4
+nN493GwTFtl63SRRZsDHJlkNrAYIwpTRMx/wgzUfbhvI3qpuFU5UJ+/EbRrsC+MO
+8ESlV8dAWB6jRx9x7GD2bZTIGDnt/kIYVt/kTEkQeE4BdjVjEjbdZrwBBDajVWjV
+ojYJrKshJlQGrT/KFOCsyq0GHZXi+J3x4GD/wn91K0zM2v6HmSHquv4+VNfSWXjb
+PG7PoBMAGrgnoeS+Z5bKoMWznN3JdZ7rMJpfo83ZrngZPyPpXNspva1VyBtUjGP2
+6KbqxzcSXKMpHgLZ2x87tNcPVkeBFQRKr4Mn0cVYiMHd9qqnoxjaaKptEVHhv2Vr
+n5Z20T0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAq2aN17O6x5q25lXQBfGfMY1a
+qtmqRiYPce2lrVNWYgFHKkTp/j90CxObufRNG7LRX7K20ohcs5/Ny9Sn2WCVhDr4
+wTcdYcrnsMXlkdpUpqwxga6X3s0IrLjAl4B/bnKk52kTlWUfxJM8/XmPBNQ+T+r3
+ns7NZ3xPZQL/kYVUc8f/NveGLezQXk//EZ9yBta4GvFMDSZl4kSAHsef493oCtrs
+pSCAaWihT37ha88HQfqDjrw43bAuEbFrskLMmrz5SCJ5ShkPshw+IHTZasO+8ih4
+E1Z5T21Q6huwtVexN2ZYI/PcD98Kh8TvhgXVOBRgmaNL3gaWcSzy27YfpO8/7g==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            8b:5b:75:56:84:54:85:0b:00:cf:af:38:48:ce:b1:a4
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3
+        Validity
+            Not Before: Oct  1 00:00:00 1999 GMT
+            Not After : Jul 16 23:59:59 2036 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 1 Public Primary Certification Authority - G3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:dd:84:d4:b9:b4:f9:a7:d8:f3:04:78:9c:de:3d:
+                    dc:6c:13:16:d9:7a:dd:24:51:66:c0:c7:26:59:0d:
+                    ac:06:08:c2:94:d1:33:1f:f0:83:35:1f:6e:1b:c8:
+                    de:aa:6e:15:4e:54:27:ef:c4:6d:1a:ec:0b:e3:0e:
+                    f0:44:a5:57:c7:40:58:1e:a3:47:1f:71:ec:60:f6:
+                    6d:94:c8:18:39:ed:fe:42:18:56:df:e4:4c:49:10:
+                    78:4e:01:76:35:63:12:36:dd:66:bc:01:04:36:a3:
+                    55:68:d5:a2:36:09:ac:ab:21:26:54:06:ad:3f:ca:
+                    14:e0:ac:ca:ad:06:1d:95:e2:f8:9d:f1:e0:60:ff:
+                    c2:7f:75:2b:4c:cc:da:fe:87:99:21:ea:ba:fe:3e:
+                    54:d7:d2:59:78:db:3c:6e:cf:a0:13:00:1a:b8:27:
+                    a1:e4:be:67:96:ca:a0:c5:b3:9c:dd:c9:75:9e:eb:
+                    30:9a:5f:a3:cd:d9:ae:78:19:3f:23:e9:5c:db:29:
+                    bd:ad:55:c8:1b:54:8c:63:f6:e8:a6:ea:c7:37:12:
+                    5c:a3:29:1e:02:d9:db:1f:3b:b4:d7:0f:56:47:81:
+                    15:04:4a:af:83:27:d1:c5:58:88:c1:dd:f6:aa:a7:
+                    a3:18:da:68:aa:6d:11:51:e1:bf:65:6b:9f:96:76:
+                    d1:3d
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        ab:66:8d:d7:b3:ba:c7:9a:b6:e6:55:d0:05:f1:9f:31:8d:5a:
+        aa:d9:aa:46:26:0f:71:ed:a5:ad:53:56:62:01:47:2a:44:e9:
+        fe:3f:74:0b:13:9b:b9:f4:4d:1b:b2:d1:5f:b2:b6:d2:88:5c:
+        b3:9f:cd:cb:d4:a7:d9:60:95:84:3a:f8:c1:37:1d:61:ca:e7:
+        b0:c5:e5:91:da:54:a6:ac:31:81:ae:97:de:cd:08:ac:b8:c0:
+        97:80:7f:6e:72:a4:e7:69:13:95:65:1f:c4:93:3c:fd:79:8f:
+        04:d4:3e:4f:ea:f7:9e:ce:cd:67:7c:4f:65:02:ff:91:85:54:
+        73:c7:ff:36:f7:86:2d:ec:d0:5e:4f:ff:11:9f:72:06:d6:b8:
+        1a:f1:4c:0d:26:65:e2:44:80:1e:c7:9f:e3:dd:e8:0a:da:ec:
+        a5:20:80:69:68:a1:4f:7e:e1:6b:cf:07:41:fa:83:8e:bc:38:
+        dd:b0:2e:11:b1:6b:b2:42:cc:9a:bc:f9:48:22:79:4a:19:0f:
+        b2:1c:3e:20:74:d9:6a:c3:be:f2:28:78:13:56:79:4f:6d:50:
+        ea:1b:b0:b5:57:b1:37:66:58:23:f3:dc:0f:df:0a:87:c4:ef:
+        86:05:d5:38:14:60:99:a3:4b:de:06:96:71:2c:f2:db:b6:1f:
+        a4:ef:3f:ee
+
+Verisign Class 2 Public Primary Certification Authority
+=======================================================
+MD5 Fingerprint: B3:9C:25:B1:C3:2E:32:53:80:15:30:9D:4D:02:77:3E
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICPDCCAaUCEC0b/EoXjaOR6+f/9YtFvgswDQYJKoZIhvcNAQECBQAwXzELMAkG
+A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz
+cyAyIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2
+MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV
+BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAyIFB1YmxpYyBQcmlt
+YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN
+ADCBiQKBgQC2WoujDWojg4BrzzmH9CETMwZMJaLtVRKXxaeAufqDwSCg+i8VDXyh
+YGt+eSz6Bg86rvYbb7HS/y8oUl+DfUvEerf4Zh+AVPy3wo5ZShRXRtGak75BkQO7
+FYCTXOvnzAhsPz6zSvz/S2wj1VCCJkQZjiPDceoZJEcEnnW/yKYAHwIDAQABMA0G
+CSqGSIb3DQEBAgUAA4GBAIobK/o5wXTXXtgZZKJYSi034DNHD6zt96rbHuSLBlxg
+J8pFUs4W7z8GZOeUaHxgMxURaa+dYo2jA1Rrpr7l7gUYYAS/QoD90KioHgE796Nc
+r6Pc5iaAIzy4RHT3Cq5Ji2F4zCS/iIqnDupzGUH9TQPwiNHleI2lKk/2lw0Xd8rY
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            2d:1b:fc:4a:17:8d:a3:91:eb:e7:ff:f5:8b:45:be:0b
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority
+        Validity
+            Not Before: Jan 29 00:00:00 1996 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b6:5a:8b:a3:0d:6a:23:83:80:6b:cf:39:87:f4:
+                    21:13:33:06:4c:25:a2:ed:55:12:97:c5:a7:80:b9:
+                    fa:83:c1:20:a0:fa:2f:15:0d:7c:a1:60:6b:7e:79:
+                    2c:fa:06:0f:3a:ae:f6:1b:6f:b1:d2:ff:2f:28:52:
+                    5f:83:7d:4b:c4:7a:b7:f8:66:1f:80:54:fc:b7:c2:
+                    8e:59:4a:14:57:46:d1:9a:93:be:41:91:03:bb:15:
+                    80:93:5c:eb:e7:cc:08:6c:3f:3e:b3:4a:fc:ff:4b:
+                    6c:23:d5:50:82:26:44:19:8e:23:c3:71:ea:19:24:
+                    47:04:9e:75:bf:c8:a6:00:1f
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        8a:1b:2b:fa:39:c1:74:d7:5e:d8:19:64:a2:58:4a:2d:37:e0:
+        33:47:0f:ac:ed:f7:aa:db:1e:e4:8b:06:5c:60:27:ca:45:52:
+        ce:16:ef:3f:06:64:e7:94:68:7c:60:33:15:11:69:af:9d:62:
+        8d:a3:03:54:6b:a6:be:e5:ee:05:18:60:04:bf:42:80:fd:d0:
+        a8:a8:1e:01:3b:f7:a3:5c:af:a3:dc:e6:26:80:23:3c:b8:44:
+        74:f7:0a:ae:49:8b:61:78:cc:24:bf:88:8a:a7:0e:ea:73:19:
+        41:fd:4d:03:f0:88:d1:e5:78:8d:a5:2a:4f:f6:97:0d:17:77:
+        ca:d8
+
+Verisign Class 2 Public Primary Certification Authority - G2
+============================================================
+MD5 Fingerprint: 2D:BB:E5:25:D3:D1:65:82:3A:B7:0E:FA:E6:EB:E2:E1
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDAzCCAmwCEQC5L2DMiJ+hekYJuFtwbIqvMA0GCSqGSIb3DQEBBQUAMIHBMQsw
+CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0Ns
+YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH
+MjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y
+aXplZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAe
+Fw05ODA1MTgwMDAwMDBaFw0yODA4MDEyMzU5NTlaMIHBMQswCQYDVQQGEwJVUzEX
+MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGlj
+IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjE6MDgGA1UECxMx
+KGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s
+eTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazCBnzANBgkqhkiG9w0B
+AQEFAAOBjQAwgYkCgYEAp4gBIXQs5xoD8JjhlzwPIQjxnNuX6Zr8wgQGE75fUsjM
+HiwSViy4AWkszJkfrbCWrnkE8hM5wXuYuggs6MKEEyyqaekJ9MepAqRCwiNPStjw
+DqL7MWzJ5m+ZJwf15vRMeJ5t60aG+rmGyVTyssSv1EYcWskVMP8NbPUtDm3Of3cC
+AwEAATANBgkqhkiG9w0BAQUFAAOBgQByLvl/0fFx+8Se9sVeUYpAmLho+Jscg9ji
+nb3/7aHmZuovCfTK1+qlK5X2JGCGTUQug6XELaDTrnhpb3LabK4I8GOSN+a7xDAX
+rXfMSTWqz9iP0b63GJZHc2pUIjRkLbYWm1lbtFFZOrMLFPQS32eg9K0yZF6xRnIn
+jBJ7xUS0rg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            b9:2f:60:cc:88:9f:a1:7a:46:09:b8:5b:70:6c:8a:af
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Validity
+            Not Before: May 18 00:00:00 1998 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 2 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:a7:88:01:21:74:2c:e7:1a:03:f0:98:e1:97:3c:
+                    0f:21:08:f1:9c:db:97:e9:9a:fc:c2:04:06:13:be:
+                    5f:52:c8:cc:1e:2c:12:56:2c:b8:01:69:2c:cc:99:
+                    1f:ad:b0:96:ae:79:04:f2:13:39:c1:7b:98:ba:08:
+                    2c:e8:c2:84:13:2c:aa:69:e9:09:f4:c7:a9:02:a4:
+                    42:c2:23:4f:4a:d8:f0:0e:a2:fb:31:6c:c9:e6:6f:
+                    99:27:07:f5:e6:f4:4c:78:9e:6d:eb:46:86:fa:b9:
+                    86:c9:54:f2:b2:c4:af:d4:46:1c:5a:c9:15:30:ff:
+                    0d:6c:f5:2d:0e:6d:ce:7f:77
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        72:2e:f9:7f:d1:f1:71:fb:c4:9e:f6:c5:5e:51:8a:40:98:b8:
+        68:f8:9b:1c:83:d8:e2:9d:bd:ff:ed:a1:e6:66:ea:2f:09:f4:
+        ca:d7:ea:a5:2b:95:f6:24:60:86:4d:44:2e:83:a5:c4:2d:a0:
+        d3:ae:78:69:6f:72:da:6c:ae:08:f0:63:92:37:e6:bb:c4:30:
+        17:ad:77:cc:49:35:aa:cf:d8:8f:d1:be:b7:18:96:47:73:6a:
+        54:22:34:64:2d:b6:16:9b:59:5b:b4:51:59:3a:b3:0b:14:f4:
+        12:df:67:a0:f4:ad:32:64:5e:b1:46:72:27:8c:12:7b:c5:44:
+        b4:ae
+
+Verisign Class 2 Public Primary Certification Authority - G3
+============================================================
+MD5 Fingerprint: F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEGTCCAwECEGFwy0mMX5hFKeewptlQW3owDQYJKoZIhvcNAQEFBQAwgcoxCzAJ
+BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy
+aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s
+IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNp
+Z24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
+eSAtIEczMB4XDTk5MTAwMTAwMDAwMFoXDTM2MDcxNjIzNTk1OVowgcoxCzAJBgNV
+BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp
+Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIElu
+Yy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24g
+Q2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt
+IEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwoNwtUs22e5LeWU
+J92lvuCwTY+zYVY81nzD9M0+hsuiiOLh2KRpxbXiv8GmR1BeRjmL1Za6tW8UvxDO
+JxOeBUebMXoT2B/Z0wI3i60sR/COgQanDTAM6/c8DyAd3HJG7qUCyFvDyVZpTMUY
+wZF7C9UTAJu878NIPkZgIIUq1ZC2zYugzDLdt/1AVbJQHFauzI13TccgTacxdu9o
+koqQHgiBVrKtaaNS0MscxCM9H5n+TOgWY47GCI72MfbS+uV23bUckqNJzc0BzWjN
+qWm6o+sdDZykIKbBoMXRRkwXbdKsZj+WjOCE1Db/IlnF+RFgqF8EffIa9iVCYQ/E
+Srg+iQIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA0JhU8wI1NQ0kdvekhktdmnLfe
+xbjQ5F1fdiLAJvmEOjr5jLX77GDx6M4EsMjdpwOPMPOY36TmpDHf0xwLRtxyID+u
+7gU8pDM/CzmscHhzS5kr3zDCVLCoO1Wh/hYozUK9dG6A2ydEp85EXdQbkJgNHkKU
+sQAsBNB0owIFImNjzYO1+8FtYmtpdf1dcEG59b98377BMnMiIYtYgXsVkXq642RI
+sH/7NiXaldDxJBQX3RiAa0YjOVT1jmIJBB2UkKab5iXiQkWquJCtvgiPqQtCGJTP
+cjnhsUPgKM+351psE2tJs//jGHyJizNdrDPXp/naOlXJWBD5qu9ats9LS98q
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            61:70:cb:49:8c:5f:98:45:29:e7:b0:a6:d9:50:5b:7a
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3
+        Validity
+            Not Before: Oct  1 00:00:00 1999 GMT
+            Not After : Jul 16 23:59:59 2036 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 2 Public Primary Certification Authority - G3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:af:0a:0d:c2:d5:2c:db:67:b9:2d:e5:94:27:dd:
+                    a5:be:e0:b0:4d:8f:b3:61:56:3c:d6:7c:c3:f4:cd:
+                    3e:86:cb:a2:88:e2:e1:d8:a4:69:c5:b5:e2:bf:c1:
+                    a6:47:50:5e:46:39:8b:d5:96:ba:b5:6f:14:bf:10:
+                    ce:27:13:9e:05:47:9b:31:7a:13:d8:1f:d9:d3:02:
+                    37:8b:ad:2c:47:f0:8e:81:06:a7:0d:30:0c:eb:f7:
+                    3c:0f:20:1d:dc:72:46:ee:a5:02:c8:5b:c3:c9:56:
+                    69:4c:c5:18:c1:91:7b:0b:d5:13:00:9b:bc:ef:c3:
+                    48:3e:46:60:20:85:2a:d5:90:b6:cd:8b:a0:cc:32:
+                    dd:b7:fd:40:55:b2:50:1c:56:ae:cc:8d:77:4d:c7:
+                    20:4d:a7:31:76:ef:68:92:8a:90:1e:08:81:56:b2:
+                    ad:69:a3:52:d0:cb:1c:c4:23:3d:1f:99:fe:4c:e8:
+                    16:63:8e:c6:08:8e:f6:31:f6:d2:fa:e5:76:dd:b5:
+                    1c:92:a3:49:cd:cd:01:cd:68:cd:a9:69:ba:a3:eb:
+                    1d:0d:9c:a4:20:a6:c1:a0:c5:d1:46:4c:17:6d:d2:
+                    ac:66:3f:96:8c:e0:84:d4:36:ff:22:59:c5:f9:11:
+                    60:a8:5f:04:7d:f2:1a:f6:25:42:61:0f:c4:4a:b8:
+                    3e:89
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        34:26:15:3c:c0:8d:4d:43:49:1d:bd:e9:21:92:d7:66:9c:b7:
+        de:c5:b8:d0:e4:5d:5f:76:22:c0:26:f9:84:3a:3a:f9:8c:b5:
+        fb:ec:60:f1:e8:ce:04:b0:c8:dd:a7:03:8f:30:f3:98:df:a4:
+        e6:a4:31:df:d3:1c:0b:46:dc:72:20:3f:ae:ee:05:3c:a4:33:
+        3f:0b:39:ac:70:78:73:4b:99:2b:df:30:c2:54:b0:a8:3b:55:
+        a1:fe:16:28:cd:42:bd:74:6e:80:db:27:44:a7:ce:44:5d:d4:
+        1b:90:98:0d:1e:42:94:b1:00:2c:04:d0:74:a3:02:05:22:63:
+        63:cd:83:b5:fb:c1:6d:62:6b:69:75:fd:5d:70:41:b9:f5:bf:
+        7c:df:be:c1:32:73:22:21:8b:58:81:7b:15:91:7a:ba:e3:64:
+        48:b0:7f:fb:36:25:da:95:d0:f1:24:14:17:dd:18:80:6b:46:
+        23:39:54:f5:8e:62:09:04:1d:94:90:a6:9b:e6:25:e2:42:45:
+        aa:b8:90:ad:be:08:8f:a9:0b:42:18:94:cf:72:39:e1:b1:43:
+        e0:28:cf:b7:e7:5a:6c:13:6b:49:b3:ff:e3:18:7c:89:8b:33:
+        5d:ac:33:d7:a7:f9:da:3a:55:c9:58:10:f9:aa:ef:5a:b6:cf:
+        4b:4b:df:2a
+
+Verisign Class 3 Public Primary Certification Authority
+=======================================================
+MD5 Fingerprint: 10:FC:63:5D:F6:26:3E:0D:F3:25:BE:5F:79:CD:67:67
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkG
+A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFz
+cyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2
+MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNV
+BAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmlt
+YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GN
+ADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhE
+BarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/is
+I19wKTakyYbnsZogy1Olhec9vn2a/iRFM9x2Fe0PonFkTGUugWhFpwIDAQABMA0G
+CSqGSIb3DQEBAgUAA4GBALtMEivPLCYATxQT3ab7/AoRhIzzKBxnki98tsX63/Do
+lbwdj2wsqFHMc9ikwFPwTtYmwHYBV4GSXiHx0bH/59AhWM1pF+NEHJwZRDmJXNyc
+AA9WjQKZ7aKQRUzkuxCkPfAyAw7xzvjoyVGM5mKf5p/AfbdynMk2OmufTqj/ZA1k
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
+        Validity
+            Not Before: Jan 29 00:00:00 1996 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40:
+                    db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9:
+                    11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03:
+                    1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2:
+                    63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f:
+                    42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23:
+                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:
+                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:
+                    71:64:4c:65:2e:81:68:45:a7
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        bb:4c:12:2b:cf:2c:26:00:4f:14:13:dd:a6:fb:fc:0a:11:84:
+        8c:f3:28:1c:67:92:2f:7c:b6:c5:fa:df:f0:e8:95:bc:1d:8f:
+        6c:2c:a8:51:cc:73:d8:a4:c0:53:f0:4e:d6:26:c0:76:01:57:
+        81:92:5e:21:f1:d1:b1:ff:e7:d0:21:58:cd:69:17:e3:44:1c:
+        9c:19:44:39:89:5c:dc:9c:00:0f:56:8d:02:99:ed:a2:90:45:
+        4c:e4:bb:10:a4:3d:f0:32:03:0e:f1:ce:f8:e8:c9:51:8c:e6:
+        62:9f:e6:9f:c0:7d:b7:72:9c:c9:36:3a:6b:9f:4e:a8:ff:64:
+        0d:64
+
+Verisign Class 3 Public Primary Certification Authority - G2
+============================================================
+MD5 Fingerprint: A2:33:9B:4C:74:78:73:D4:6C:E7:C1:F3:8D:CB:5C:E9
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDAjCCAmsCEH3Z/gfPqB63EHln+6eJNMYwDQYJKoZIhvcNAQEFBQAwgcExCzAJ
+BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh
+c3MgMyBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy
+MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp
+emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X
+DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw
+FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgMyBQdWJsaWMg
+UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo
+YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5
+MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB
+AQUAA4GNADCBiQKBgQDMXtERXVxp0KvTuWpMmR9ZmDCOFoUgRm1HP9SFIIThbbP4
+pO0M8RcPO/mn+SXXwc+EY/J8Y8+iR/LGWzOOZEAEaMGAuWQcRXfH2G71lSk8UOg0
+13gfqLptQ5GVj0VXXn7F+8qkBOvqlzdUMG+7AUcyM83cV5tkaWH4mx0ciU9cZwID
+AQABMA0GCSqGSIb3DQEBBQUAA4GBAFFNzb5cy5gZnBWyATl4Lk0PZ3BwmcYQWpSk
+U01UbSuvDV1Ai2TT1+7eVmGSX6bEHRBhNtMsJzzoKQm5EWR0zLVznxxIqbxhAe7i
+F6YM40AIOw7n60RzKprxaZLvcRTDOaxxp5EJb+RxBrO6WVcmeQD2+A2iMzAo1KpY
+oJ2daZH9
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            7d:d9:fe:07:cf:a8:1e:b7:10:79:67:fb:a7:89:34:c6
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Validity
+            Not Before: May 18 00:00:00 1998 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:cc:5e:d1:11:5d:5c:69:d0:ab:d3:b9:6a:4c:99:
+                    1f:59:98:30:8e:16:85:20:46:6d:47:3f:d4:85:20:
+                    84:e1:6d:b3:f8:a4:ed:0c:f1:17:0f:3b:f9:a7:f9:
+                    25:d7:c1:cf:84:63:f2:7c:63:cf:a2:47:f2:c6:5b:
+                    33:8e:64:40:04:68:c1:80:b9:64:1c:45:77:c7:d8:
+                    6e:f5:95:29:3c:50:e8:34:d7:78:1f:a8:ba:6d:43:
+                    91:95:8f:45:57:5e:7e:c5:fb:ca:a4:04:eb:ea:97:
+                    37:54:30:6f:bb:01:47:32:33:cd:dc:57:9b:64:69:
+                    61:f8:9b:1d:1c:89:4f:5c:67
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        51:4d:cd:be:5c:cb:98:19:9c:15:b2:01:39:78:2e:4d:0f:67:
+        70:70:99:c6:10:5a:94:a4:53:4d:54:6d:2b:af:0d:5d:40:8b:
+        64:d3:d7:ee:de:56:61:92:5f:a6:c4:1d:10:61:36:d3:2c:27:
+        3c:e8:29:09:b9:11:64:74:cc:b5:73:9f:1c:48:a9:bc:61:01:
+        ee:e2:17:a6:0c:e3:40:08:3b:0e:e7:eb:44:73:2a:9a:f1:69:
+        92:ef:71:14:c3:39:ac:71:a7:91:09:6f:e4:71:06:b3:ba:59:
+        57:26:79:00:f6:f8:0d:a2:33:30:28:d4:aa:58:a0:9d:9d:69:
+        91:fd
+
+Verisign Class 3 Public Primary Certification Authority - G3
+============================================================
+MD5 Fingerprint: CD:68:B6:A7:C7:C4:CE:75:E0:1D:4F:57:44:61:92:09
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw
+CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
+cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
+LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
+aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
+dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
+VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
+aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
+bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
+IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
+LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b
+N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t
+KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu
+kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm
+CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ
+Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu
+imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te
+2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe
+DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC
+/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p
+F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt
+TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            9b:7e:06:49:a3:3e:62:b9:d5:ee:90:48:71:29:ef:57
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
+        Validity
+            Not Before: Oct  1 00:00:00 1999 GMT
+            Not After : Jul 16 23:59:59 2036 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:cb:ba:9c:52:fc:78:1f:1a:1e:6f:1b:37:73:bd:
+                    f8:c9:6b:94:12:30:4f:f0:36:47:f5:d0:91:0a:f5:
+                    17:c8:a5:61:c1:16:40:4d:fb:8a:61:90:e5:76:20:
+                    c1:11:06:7d:ab:2c:6e:a6:f5:11:41:8e:fa:2d:ad:
+                    2a:61:59:a4:67:26:4c:d0:e8:bc:52:5b:70:20:04:
+                    58:d1:7a:c9:a4:69:bc:83:17:64:ad:05:8b:bc:d0:
+                    58:ce:8d:8c:f5:eb:f0:42:49:0b:9d:97:27:67:32:
+                    6e:e1:ae:93:15:1c:70:bc:20:4d:2f:18:de:92:88:
+                    e8:6c:85:57:11:1a:e9:7e:e3:26:11:54:a2:45:96:
+                    55:83:ca:30:89:e8:dc:d8:a3:ed:2a:80:3f:7f:79:
+                    65:57:3e:15:20:66:08:2f:95:93:bf:aa:47:2f:a8:
+                    46:97:f0:12:e2:fe:c2:0a:2b:51:e6:76:e6:b7:46:
+                    b7:e2:0d:a6:cc:a8:c3:4c:59:55:89:e6:e8:53:5c:
+                    1c:ea:9d:f0:62:16:0b:a7:c9:5f:0c:f0:de:c2:76:
+                    ce:af:f7:6a:f2:fa:41:a6:a2:33:14:c9:e5:7a:63:
+                    d3:9e:62:37:d5:85:65:9e:0e:e6:53:24:74:1b:5e:
+                    1d:12:53:5b:c7:2c:e7:83:49:3b:15:ae:8a:68:b9:
+                    57:97
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        11:14:96:c1:ab:92:08:f7:3f:2f:c9:b2:fe:e4:5a:9f:64:de:
+        db:21:4f:86:99:34:76:36:57:dd:d0:15:2f:c5:ad:7f:15:1f:
+        37:62:73:3e:d4:e7:5f:ce:17:03:db:35:fa:2b:db:ae:60:09:
+        5f:1e:5f:8f:6e:bb:0b:3d:ea:5a:13:1e:0c:60:6f:b5:c0:b5:
+        23:22:2e:07:0b:cb:a9:74:cb:47:bb:1d:c1:d7:a5:6b:cc:2f:
+        d2:42:fd:49:dd:a7:89:cf:53:ba:da:00:5a:28:bf:82:df:f8:
+        ba:13:1d:50:86:82:fd:8e:30:8f:29:46:b0:1e:3d:35:da:38:
+        62:16:18:4a:ad:e6:b6:51:6c:de:af:62:eb:01:d0:1e:24:fe:
+        7a:8f:12:1a:12:68:b8:fb:66:99:14:14:45:5c:ae:e7:ae:69:
+        17:81:2b:5a:37:c9:5e:2a:f4:c6:e2:a1:5c:54:9b:a6:54:00:
+        cf:f0:f1:c1:c7:98:30:1a:3b:36:16:db:a3:6e:ea:fd:ad:b2:
+        c2:da:ef:02:47:13:8a:c0:f1:b3:31:ad:4f:1c:e1:4f:9c:af:
+        0f:0c:9d:f7:78:0d:d8:f4:35:56:80:da:b7:6d:17:8f:9d:1e:
+        81:64:e1:fe:c5:45:ba:ad:6b:b9:0a:7a:4e:4f:4b:84:ee:4b:
+        f1:7d:dd:11
+
+Verisign Class 4 Public Primary Certification Authority - G2
+============================================================
+MD5 Fingerprint: 26:6D:2C:19:98:B6:70:68:38:50:54:19:EC:90:34:60
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIDAjCCAmsCEDKIjprS9esTR/h/xCA3JfgwDQYJKoZIhvcNAQEFBQAwgcExCzAJ
+BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xh
+c3MgNCBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcy
+MTowOAYDVQQLEzEoYykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3Jp
+emVkIHVzZSBvbmx5MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4X
+DTk4MDUxODAwMDAwMFoXDTI4MDgwMTIzNTk1OVowgcExCzAJBgNVBAYTAlVTMRcw
+FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1UECxMzQ2xhc3MgNCBQdWJsaWMg
+UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEcyMTowOAYDVQQLEzEo
+YykgMTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5
+MR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMIGfMA0GCSqGSIb3DQEB
+AQUAA4GNADCBiQKBgQC68OTP+cSuhVS5B1f5j8V/aBH4xBewRNzjMHPVKmIquNDM
+HO0oW369atyzkSTKQWI8/AIBvxwWMZQFl3Zuoq29YRdsTjCG8FE3KlDHqGKB3FtK
+qsGgtG7rL+VXxbErQHDbWk2hjh+9Ax/YA9SPTJlxvOKCzFjomDqG04Y48wApHwID
+AQABMA0GCSqGSIb3DQEBBQUAA4GBAIWMEsGnuVAVess+rLhDityq3RS6iYF+ATwj
+cSGIL4LcY/oCRaxFWdcqWERbt5+BO5JoPeI3JPV7bI92NZYJqFmduc4jq3TWg/0y
+cyfYaT5DdPauxYma51N86Xv2S/PBZYPejYqcPIiNOVn8qj8ijaHBZlCBckztImRP
+T8qAkbYp
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            32:88:8e:9a:d2:f5:eb:13:47:f8:7f:c4:20:37:25:f8
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Validity
+            Not Before: May 18 00:00:00 1998 GMT
+            Not After : Aug  1 23:59:59 2028 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=Class 4 Public Primary Certification Authority - G2, OU=(c) 1998 VeriSign, Inc. - For authorized use only, OU=VeriSign Trust Network
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ba:f0:e4:cf:f9:c4:ae:85:54:b9:07:57:f9:8f:
+                    c5:7f:68:11:f8:c4:17:b0:44:dc:e3:30:73:d5:2a:
+                    62:2a:b8:d0:cc:1c:ed:28:5b:7e:bd:6a:dc:b3:91:
+                    24:ca:41:62:3c:fc:02:01:bf:1c:16:31:94:05:97:
+                    76:6e:a2:ad:bd:61:17:6c:4e:30:86:f0:51:37:2a:
+                    50:c7:a8:62:81:dc:5b:4a:aa:c1:a0:b4:6e:eb:2f:
+                    e5:57:c5:b1:2b:40:70:db:5a:4d:a1:8e:1f:bd:03:
+                    1f:d8:03:d4:8f:4c:99:71:bc:e2:82:cc:58:e8:98:
+                    3a:86:d3:86:38:f3:00:29:1f
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        85:8c:12:c1:a7:b9:50:15:7a:cb:3e:ac:b8:43:8a:dc:aa:dd:
+        14:ba:89:81:7e:01:3c:23:71:21:88:2f:82:dc:63:fa:02:45:
+        ac:45:59:d7:2a:58:44:5b:b7:9f:81:3b:92:68:3d:e2:37:24:
+        f5:7b:6c:8f:76:35:96:09:a8:59:9d:b9:ce:23:ab:74:d6:83:
+        fd:32:73:27:d8:69:3e:43:74:f6:ae:c5:89:9a:e7:53:7c:e9:
+        7b:f6:4b:f3:c1:65:83:de:8d:8a:9c:3c:88:8d:39:59:fc:aa:
+        3f:22:8d:a1:c1:66:50:81:72:4c:ed:22:64:4f:4f:ca:80:91:
+        b6:29
+
+Verisign Class 4 Public Primary Certification Authority - G3
+============================================================
+MD5 Fingerprint: DB:C8:F2:27:2E:B1:EA:6A:29:23:5D:FE:56:3E:33:DF
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIIEGjCCAwICEQDsoKeLbnVqAc/EfMwvlF7XMA0GCSqGSIb3DQEBBQUAMIHKMQsw
+CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
+cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
+LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
+aWduIENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
+dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
+VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
+aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
+bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
+IENsYXNzIDQgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
+LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3LpRFpxlmr8Y+1
+GQ9Wzsy1HyDkniYlS+BzZYlZ3tCD5PUPtbut8XzoIfzk6AzufEUiGXaStBO3IFsJ
++mGuqPKljYXCKtbeZjbSmwL0qJJgfJxptI8kHtCGUvYynEFYHiK9zUVilQhu0Gbd
+U6LM8BDcVHOLBKFGMzNcF0C5nk3T875Vg+ixiY5afJqWIpA7iCXy0lOIAgwLePLm
+NxdLMEYH5IBtptiWLugs+BGzOA1mppvqySNb247i8xOOGlktqgLw7KSHZtzBP/XY
+ufTsgsbSPZUd5cBPhMnZo0QoBmrXRazwa2rvTl/4EYIeOGM0ZlDUPpNz+jDDZq3/
+ky2X7wMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAj/ola09b5KROJ1WrIhVZPMq1
+CtRK26vdoV9TxaBXOcLORyu+OshWv8LZJxA6sQU8wHcxuzrTBXttmhwwjIDLk5Mq
+g6sFUYICABFna/OIYUdfA5PVWw3g8dShMjWFsjrbsIKr0csKvE+MW8VLADsfKoKm
+fjaF3H48ZwC15DtS4KjrXRX5xm3wrR0OhbepmnMUWluPQSjA1egtTaRezarZ7c7c
+2NU8Qh0XwRJdRTjDOPP8hS6DRkiy1yBfkjaP53kPmF6Z6PDQpLv1U70qzlmwr25/
+bLvSHgCwIe34QWKCudiyxLtGUPMxxY8BqHTr9Xgn2uf3ZkPznoM+IKrDNWCRzg==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            ec:a0:a7:8b:6e:75:6a:01:cf:c4:7c:cc:2f:94:5e:d7
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3
+        Validity
+            Not Before: Oct  1 00:00:00 1999 GMT
+            Not After : Jul 16 23:59:59 2036 GMT
+        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 4 Public Primary Certification Authority - G3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:ad:cb:a5:11:69:c6:59:ab:f1:8f:b5:19:0f:56:
+                    ce:cc:b5:1f:20:e4:9e:26:25:4b:e0:73:65:89:59:
+                    de:d0:83:e4:f5:0f:b5:bb:ad:f1:7c:e8:21:fc:e4:
+                    e8:0c:ee:7c:45:22:19:76:92:b4:13:b7:20:5b:09:
+                    fa:61:ae:a8:f2:a5:8d:85:c2:2a:d6:de:66:36:d2:
+                    9b:02:f4:a8:92:60:7c:9c:69:b4:8f:24:1e:d0:86:
+                    52:f6:32:9c:41:58:1e:22:bd:cd:45:62:95:08:6e:
+                    d0:66:dd:53:a2:cc:f0:10:dc:54:73:8b:04:a1:46:
+                    33:33:5c:17:40:b9:9e:4d:d3:f3:be:55:83:e8:b1:
+                    89:8e:5a:7c:9a:96:22:90:3b:88:25:f2:d2:53:88:
+                    02:0c:0b:78:f2:e6:37:17:4b:30:46:07:e4:80:6d:
+                    a6:d8:96:2e:e8:2c:f8:11:b3:38:0d:66:a6:9b:ea:
+                    c9:23:5b:db:8e:e2:f3:13:8e:1a:59:2d:aa:02:f0:
+                    ec:a4:87:66:dc:c1:3f:f5:d8:b9:f4:ec:82:c6:d2:
+                    3d:95:1d:e5:c0:4f:84:c9:d9:a3:44:28:06:6a:d7:
+                    45:ac:f0:6b:6a:ef:4e:5f:f8:11:82:1e:38:63:34:
+                    66:50:d4:3e:93:73:fa:30:c3:66:ad:ff:93:2d:97:
+                    ef:03
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: sha1WithRSAEncryption
+        8f:fa:25:6b:4f:5b:e4:a4:4e:27:55:ab:22:15:59:3c:ca:b5:
+        0a:d4:4a:db:ab:dd:a1:5f:53:c5:a0:57:39:c2:ce:47:2b:be:
+        3a:c8:56:bf:c2:d9:27:10:3a:b1:05:3c:c0:77:31:bb:3a:d3:
+        05:7b:6d:9a:1c:30:8c:80:cb:93:93:2a:83:ab:05:51:82:02:
+        00:11:67:6b:f3:88:61:47:5f:03:93:d5:5b:0d:e0:f1:d4:a1:
+        32:35:85:b2:3a:db:b0:82:ab:d1:cb:0a:bc:4f:8c:5b:c5:4b:
+        00:3b:1f:2a:82:a6:7e:36:85:dc:7e:3c:67:00:b5:e4:3b:52:
+        e0:a8:eb:5d:15:f9:c6:6d:f0:ad:1d:0e:85:b7:a9:9a:73:14:
+        5a:5b:8f:41:28:c0:d5:e8:2d:4d:a4:5e:cd:aa:d9:ed:ce:dc:
+        d8:d5:3c:42:1d:17:c1:12:5d:45:38:c3:38:f3:fc:85:2e:83:
+        46:48:b2:d7:20:5f:92:36:8f:e7:79:0f:98:5e:99:e8:f0:d0:
+        a4:bb:f5:53:bd:2a:ce:59:b0:af:6e:7f:6c:bb:d2:1e:00:b0:
+        21:ed:f8:41:62:82:b9:d8:b2:c4:bb:46:50:f3:31:c5:8f:01:
+        a8:74:eb:f5:78:27:da:e7:f7:66:43:f3:9e:83:3e:20:aa:c3:
+        35:60:91:ce
+
+Verisign/RSA Commercial CA
+==========================
+MD5 Fingerprint: 5A:0B:DD:42:9E:B2:B4:62:97:32:7F:7F:0A:AA:9A:39
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICIzCCAZACBQJBAAAWMA0GCSqGSIb3DQEBAgUAMFwxCzAJBgNVBAYTAlVTMSAw
+HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjErMCkGA1UECxMiQ29tbWVy
+Y2lhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NDExMDQxODU4MzRaFw05
+OTExMDMxODU4MzRaMFwxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdSU0EgRGF0YSBT
+ZWN1cml0eSwgSW5jLjErMCkGA1UECxMiQ29tbWVyY2lhbCBDZXJ0aWZpY2F0aW9u
+IEF1dGhvcml0eTCBmzANBgkqhkiG9w0BAQEFAAOBiQAwgYUCfgCk+4Fie84QJ93o
+975sbsZwmdu41QUDaSiCnHJ/lj+O7Kwpkj+KFPhCdr69XQO5kNTQvAayUTNfxMK/
+touPmbZiImDd298ggrTKoi8tUO2UMt7gVY3UaOLgTNLNBRYulWZcYVI4HlGogqHE
+7yXpCuaLK44xZtn42f29O2nZ6wIDAQABMA0GCSqGSIb3DQEBAgUAA34AdrW2EP4j
+9/dZYkuwX5zBaLxJu7NJbyFHXSudVMQAKD+YufKKg5tgf+tQx6sFEC097TgCwaVI
+0v5loMC86qYjFmZsGySp8+x5NRhPJsjjr1BKx6cxa9B8GJ1Qv6km+iYrRpwUqbtb
+MJhCKLVLU7tDCZJAuqiqWqTGtotXTcU=
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            02:41:00:00:16
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=RSA Data Security, Inc., OU=Commercial Certification Authority
+        Validity
+            Not Before: Nov  4 18:58:34 1994 GMT
+            Not After : Nov  3 18:58:34 1999 GMT
+        Subject: C=US, O=RSA Data Security, Inc., OU=Commercial Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1000 bit)
+                Modulus (1000 bit):
+                    00:a4:fb:81:62:7b:ce:10:27:dd:e8:f7:be:6c:6e:
+                    c6:70:99:db:b8:d5:05:03:69:28:82:9c:72:7f:96:
+                    3f:8e:ec:ac:29:92:3f:8a:14:f8:42:76:be:bd:5d:
+                    03:b9:90:d4:d0:bc:06:b2:51:33:5f:c4:c2:bf:b6:
+                    8b:8f:99:b6:62:22:60:dd:db:df:20:82:b4:ca:a2:
+                    2f:2d:50:ed:94:32:de:e0:55:8d:d4:68:e2:e0:4c:
+                    d2:cd:05:16:2e:95:66:5c:61:52:38:1e:51:a8:82:
+                    a1:c4:ef:25:e9:0a:e6:8b:2b:8e:31:66:d9:f8:d9:
+                    fd:bd:3b:69:d9:eb
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        76:b5:b6:10:fe:23:f7:f7:59:62:4b:b0:5f:9c:c1:68:bc:49:
+        bb:b3:49:6f:21:47:5d:2b:9d:54:c4:00:28:3f:98:b9:f2:8a:
+        83:9b:60:7f:eb:50:c7:ab:05:10:2d:3d:ed:38:02:c1:a5:48:
+        d2:fe:65:a0:c0:bc:ea:a6:23:16:66:6c:1b:24:a9:f3:ec:79:
+        35:18:4f:26:c8:e3:af:50:4a:c7:a7:31:6b:d0:7c:18:9d:50:
+        bf:a9:26:fa:26:2b:46:9c:14:a9:bb:5b:30:98:42:28:b5:4b:
+        53:bb:43:09:92:40:ba:a8:aa:5a:a4:c6:b6:8b:57:4d:c5
+
+Verisign/RSA Secure Server CA
+=============================
+MD5 Fingerprint: 74:7B:82:03:43:F0:00:9E:6B:B3:EC:47:BF:85:A5:93
+PEM Data:
+-----BEGIN CERTIFICATE-----
+MIICNDCCAaECEAKtZn5ORf5eV288mBle3cAwDQYJKoZIhvcNAQECBQAwXzELMAkG
+A1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYD
+VQQLEyVTZWN1cmUgU2VydmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk0
+MTEwOTAwMDAwMFoXDTEwMDEwNzIzNTk1OVowXzELMAkGA1UEBhMCVVMxIDAeBgNV
+BAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMS4wLAYDVQQLEyVTZWN1cmUgU2Vy
+dmVyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGbMA0GCSqGSIb3DQEBAQUAA4GJ
+ADCBhQJ+AJLOesGugz5aqomDV6wlAXYMra6OLDfO6zV4ZFQD5YRAUcm/jwjiioII
+0haGN1XpsSECrXZogZoFokvJSyVmIlZsiAeP94FZbYQHZXATcXY+m3dM41CJVphI
+uR2nKRoTLkoRWZweFdVJVCxzOmmCsZc5nG1wZ0jl3S3WyB57AgMBAAEwDQYJKoZI
+hvcNAQECBQADfgBl3X7hsuyw4jrg7HFGmhkRuNPHoLQDQCYCPgmc4RKz0Vr2N6W3
+YQO2WxZpO8ZECAyIUwxrl0nHPjXcbLm7qt9cuzovk2C2qUtN8iD3zV9/ZHuO3ABc
+1/p3yjkWWW8O6tO1g39NTUJWdrTJXwT4OPjr0l91X817/OWOgHz8UA==
+-----END CERTIFICATE-----
+Certificate Ingredients:
+    Data:
+        Version: 1 (0x0)
+        Serial Number:
+            02:ad:66:7e:4e:45:fe:5e:57:6f:3c:98:19:5e:dd:c0
+        Signature Algorithm: md2WithRSAEncryption
+        Issuer: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority
+        Validity
+            Not Before: Nov  9 00:00:00 1994 GMT
+            Not After : Jan  7 23:59:59 2010 GMT
+        Subject: C=US, O=RSA Data Security, Inc., OU=Secure Server Certification Authority
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1000 bit)
+                Modulus (1000 bit):
+                    00:92:ce:7a:c1:ae:83:3e:5a:aa:89:83:57:ac:25:
+                    01:76:0c:ad:ae:8e:2c:37:ce:eb:35:78:64:54:03:
+                    e5:84:40:51:c9:bf:8f:08:e2:8a:82:08:d2:16:86:
+                    37:55:e9:b1:21:02:ad:76:68:81:9a:05:a2:4b:c9:
+                    4b:25:66:22:56:6c:88:07:8f:f7:81:59:6d:84:07:
+                    65:70:13:71:76:3e:9b:77:4c:e3:50:89:56:98:48:
+                    b9:1d:a7:29:1a:13:2e:4a:11:59:9c:1e:15:d5:49:
+                    54:2c:73:3a:69:82:b1:97:39:9c:6d:70:67:48:e5:
+                    dd:2d:d6:c8:1e:7b
+                Exponent: 65537 (0x10001)
+    Signature Algorithm: md2WithRSAEncryption
+        65:dd:7e:e1:b2:ec:b0:e2:3a:e0:ec:71:46:9a:19:11:b8:d3:
+        c7:a0:b4:03:40:26:02:3e:09:9c:e1:12:b3:d1:5a:f6:37:a5:
+        b7:61:03:b6:5b:16:69:3b:c6:44:08:0c:88:53:0c:6b:97:49:
+        c7:3e:35:dc:6c:b9:bb:aa:df:5c:bb:3a:2f:93:60:b6:a9:4b:
+        4d:f2:20:f7:cd:5f:7f:64:7b:8e:dc:00:5c:d7:fa:77:ca:39:
+        16:59:6f:0e:ea:d3:b5:83:7f:4d:4d:42:56:76:b4:c9:5f:04:
+        f8:38:f8:eb:d2:5f:75:5f:cd:7b:fc:e5:8e:80:7c:fc:50
+
+CA WEB.DE TrustCenter
+=======================================
+MD5 Fingerprint=BD:D4:F5:1A:7D:70:46:50:DB:6F:4D:68:41:83:99:93
+PEM-Data:
+-----BEGIN CERTIFICATE-----
+MIIH1TCCBb2gAwIBAgIBATANBgkqhkiG9w0BAQQFADCBjTELMAkGA1UEBhMCREUx
+GjAYBgNVBAcTEUQtNzYyMjcgS2FybHNydWhlMRIwEAYDVQQKEwlXRUIuREUgQUcx
+FDASBgNVBAsTC1RydXN0Q2VudGVyMRswGQYDVQQDExJXRUIuREUgVHJ1c3RDZW50
+ZXIxGzAZBgkqhkiG9w0BCQEWDHRydXN0QHdlYi5kZTAeFw05OTA2MjMwOTE5NTRa
+Fw0wOTA2MjAwOTE5NTRaMIGNMQswCQYDVQQGEwJERTEaMBgGA1UEBxMRRC03NjIy
+NyBLYXJsc3J1aGUxEjAQBgNVBAoTCVdFQi5ERSBBRzEUMBIGA1UECxMLVHJ1c3RD
+ZW50ZXIxGzAZBgNVBAMTEldFQi5ERSBUcnVzdENlbnRlcjEbMBkGCSqGSIb3DQEJ
+ARYMdHJ1c3RAd2ViLmRlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+wSWKmSp6XW+aYJsfYWhvxNgo3uViORtbNcpnkcLeAA4zobLEdqno80YInjFgWq8d
+f5U6jOFIAzPdRCFqsj6LQDppQq22q/sal4rOVVt3t6XlWgDBfF8K+iQEQQd2TNMS
+J7pd+MUY2IyBGjGqGINRKsoU/sd1nwPRm2tv3VhIlDOcxhJIx9pm2+hNmaJEz55a
+ma+sQl8+odtfsNNrYv1LitbqELP/hsRwWzE30m1cHvcy6yczH0GmKB8seSD69qjK
+HJlYa+qPrSjIwEhhUNOcoNx227B9ZJFETrTdW2q5vp4BAPoX2nvRm5ynAdaHn0LI
+pYrhwpEiTb121ksguyDH+AasBMZ6gVP0qTvI9awRfUPyZsxWXeBDaNpw2zkqnIaj
+QIlXzVYKSBaR4TSDQ9L+bYNDSCyERdSFyJeQ2UPL/jxuS94jIbGiWE07X7wuSoA2
+BB0NKtUviZT/jyNzOGfu2TNcHkjc6x6NQMJanxKO5VZDfnfQUyWshQb99IelpjsS
+tPc//U04zMfEoJFvhosBIXKwthN7F7WE7KRhILTBwX2i+4d2doVA25OZHlcZI1L5
+K391IzzqeJdrM4Nrc0MnAsRY+sZJVmUi8u9lHsxCjMht3DpJ1JALGhj7hTDPsxjX
+eGAUZIbq9rQ/fhN0UxXkO/wQfWVsq1ZO3XfgL4tE5OkCAwEAAaOCAjwwggI4MAwG
+A1UdEwQFMAMBAf8wSQYDVR0gBEIwQDA+BgtghkgBhvhFAQcBATAvMC0GCCsGAQUF
+BwIBFiFodHRwOi8vdHJ1c3Qud2ViLmRlL0hpbGZlL1BvbGljeS8wggEpBglghkgB
+hvhCAQ0EggEaFoIBFlRydXN0Q2VudGVyIHZvbiBXRUIuREUgLSBSb290LVplcnRp
+ZmlrYXQKCkRpZSBOdXR6dW5nIGRpZXNlcyBaZXJ0aWZpa2F0ZXMgd2lyZCB2b24g
+ZGVuIEFsbGdlbWVpbmVuIEdlc2No5GZ0c2JlZGluZ3VuZ2VuIChBR0IpIC8gWmVy
+dGlmaXppZXJ1bmdzcmljaHRsaW5pZW4gZGVzIFdFQi5ERSBUcnVzdENlbnRlcnMg
+Z2VyZWdlbHQuCkRpZSBBR0JzIHVuZCBaZXJ0aWZpemllcnVuZ3NyaWNodGxpbmll
+biBzaW5kIHVudGVyIGh0dHA6Ly90cnVzdC53ZWIuZGUvSGlsZmUvIGVpbnNlaGJh
+ci4KMBoGCWCGSAGG+EIBCAQNFgsvSGlsZmUvQUdCLzAWBglghkgBhvhCAQcECRYH
+L3JuLz9zPTAWBglghkgBhvhCAQMECRYHL3J2Lz9zPTAjBglghkgBhvhCAQIEFhYU
+aHR0cHM6Ly90cnVzdC53ZWIuZGUwEQYJYIZIAYb4QgEBBAQDAgAHMCwGCWCGSAGG
++EIBBAQfFh1odHRwczovL3RydXN0LndlYi5kZS9ydkNBLz9zPTANBgkqhkiG9w0B
+AQQFAAOCAgEALT0XbRQJA+pMrUUT4tm1nCnPkm3+iz6Av2tf3BcONJrNVDgQGDN4
+HL3iRMfLZvzSuvJ06BXl3ogqAkSUJxfBd7fYRi+rhgjKxuJZwUNS06a0eGlo12ol
+G4DOz2VrNFDmRzEIRv6DgnnIj7cjo9MPefFi/RJgRHQYP33dyP9dycKKsA0Q7xAI
+6JvBduOaeAx/LrGE2JkcPk26oDkpPDFOh5FoQ6LffwFv5086IIa6uK6X9QPdwtzy
+apBp0YXeB/S+o2ggwA4n88Ht+U/aBbsCEoy6tbdosLqmLD2SkE4rFNJNBPLcw37o
+ITLKogpZnIEYWaz0Tcavvk90ytaCP5vXmSaQSjmeUQCgK/cXJwfp1QRUhkG4UU+U
+CvsmnhmGnwQLrnpUgQehw1M/KP2bRr9akBVIabic+yjKOUJuap1uhOosaQjsThgq
+9uqYIYZGS9YjN50kRjxndbNuJVuhMgJSDCPE+74feCcySfjhVxGVJVnJUDQZoqVW
+/NqHaR07wAB6D1b+inaaKyz58Nw3D6yzBxpttZDTguWn+ry5eN6Um1Ez22Fs65Uo
+eszLk3hHFUnImzdd5QtFJ40JGxuiZoCpZhyJNpAvGUwUMsbdrY+iEqisKGVF07rQ
+D2H0VMBBKfqZr4BilkYTmnnciBN7OhOg2VDnyUNHxiIr3dT12oviZU8=
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: md5WithRSAEncryption
+        Issuer: C=DE, L=D-76227 Karlsruhe, O=WEB.DE AG, OU=TrustCenter, CN=WEB.DE TrustCenter/Email=trust@web.de
+        Validity
+            Not Before: Jun 23 09:19:54 1999 GMT
+            Not After : Jun 20 09:19:54 2009 GMT
+        Subject: C=DE, L=D-76227 Karlsruhe, O=WEB.DE AG, OU=TrustCenter, CN=WEB.DE TrustCenter/Email=trust@web.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:c1:25:8a:99:2a:7a:5d:6f:9a:60:9b:1f:61:68:
+                    6f:c4:d8:28:de:e5:62:39:1b:5b:35:ca:67:91:c2:
+                    de:00:0e:33:a1:b2:c4:76:a9:e8:f3:46:08:9e:31:
+                    60:5a:af:1d:7f:95:3a:8c:e1:48:03:33:dd:44:21:
+                    6a:b2:3e:8b:40:3a:69:42:ad:b6:ab:fb:1a:97:8a:
+                    ce:55:5b:77:b7:a5:e5:5a:00:c1:7c:5f:0a:fa:24:
+                    04:41:07:76:4c:d3:12:27:ba:5d:f8:c5:18:d8:8c:
+                    81:1a:31:aa:18:83:51:2a:ca:14:fe:c7:75:9f:03:
+                    d1:9b:6b:6f:dd:58:48:94:33:9c:c6:12:48:c7:da:
+                    66:db:e8:4d:99:a2:44:cf:9e:5a:99:af:ac:42:5f:
+                    3e:a1:db:5f:b0:d3:6b:62:fd:4b:8a:d6:ea:10:b3:
+                    ff:86:c4:70:5b:31:37:d2:6d:5c:1e:f7:32:eb:27:
+                    33:1f:41:a6:28:1f:2c:79:20:fa:f6:a8:ca:1c:99:
+                    58:6b:ea:8f:ad:28:c8:c0:48:61:50:d3:9c:a0:dc:
+                    76:db:b0:7d:64:91:44:4e:b4:dd:5b:6a:b9:be:9e:
+                    01:00:fa:17:da:7b:d1:9b:9c:a7:01:d6:87:9f:42:
+                    c8:a5:8a:e1:c2:91:22:4d:bd:76:d6:4b:20:bb:20:
+                    c7:f8:06:ac:04:c6:7a:81:53:f4:a9:3b:c8:f5:ac:
+                    11:7d:43:f2:66:cc:56:5d:e0:43:68:da:70:db:39:
+                    2a:9c:86:a3:40:89:57:cd:56:0a:48:16:91:e1:34:
+                    83:43:d2:fe:6d:83:43:48:2c:84:45:d4:85:c8:97:
+                    90:d9:43:cb:fe:3c:6e:4b:de:23:21:b1:a2:58:4d:
+                    3b:5f:bc:2e:4a:80:36:04:1d:0d:2a:d5:2f:89:94:
+                    ff:8f:23:73:38:67:ee:d9:33:5c:1e:48:dc:eb:1e:
+                    8d:40:c2:5a:9f:12:8e:e5:56:43:7e:77:d0:53:25:
+                    ac:85:06:fd:f4:87:a5:a6:3b:12:b4:f7:3f:fd:4d:
+                    38:cc:c7:c4:a0:91:6f:86:8b:01:21:72:b0:b6:13:
+                    7b:17:b5:84:ec:a4:61:20:b4:c1:c1:7d:a2:fb:87:
+                    76:76:85:40:db:93:99:1e:57:19:23:52:f9:2b:7f:
+                    75:23:3c:ea:78:97:6b:33:83:6b:73:43:27:02:c4:
+                    58:fa:c6:49:56:65:22:f2:ef:65:1e:cc:42:8c:c8:
+                    6d:dc:3a:49:d4:90:0b:1a:18:fb:85:30:cf:b3:18:
+                    d7:78:60:14:64:86:ea:f6:b4:3f:7e:13:74:53:15:
+                    e4:3b:fc:10:7d:65:6c:ab:56:4e:dd:77:e0:2f:8b:
+                    44:e4:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:TRUE
+            X509v3 Certificate Policies: 
+                Policy: 2.16.840.1.113733.1.7.1.1
+                  CPS: http://trust.web.de/Hilfe/Policy/
+
+            Netscape Comment: 
+                TrustCenter von WEB.DE - Root-Zertifikat
+
+Die Nutzung dieses Zertifikates wird von den Allgemeinen Geschäftsbedingungen (AGB) / Zertifizierungsrichtlinien des WEB.DE TrustCenters geregelt.
+Die AGBs und Zertifizierungsrichtlinien sind unter http://trust.web.de/Hilfe/ einsehbar.
+
+            Netscape CA Policy Url: 
+                /Hilfe/AGB/
+            Netscape Renewal Url: 
+                /rn/?s=
+            Netscape Revocation Url: 
+                /rv/?s=
+            Netscape Base Url: 
+                https://trust.web.de
+            Netscape Cert Type: 
+                SSL CA, S/MIME CA, Object Signing CA
+            Netscape CA Revocation Url: 
+                https://trust.web.de/rvCA/?s=
+    Signature Algorithm: md5WithRSAEncryption
+        2d:3d:17:6d:14:09:03:ea:4c:ad:45:13:e2:d9:b5:9c:29:cf:
+        92:6d:fe:8b:3e:80:bf:6b:5f:dc:17:0e:34:9a:cd:54:38:10:
+        18:33:78:1c:bd:e2:44:c7:cb:66:fc:d2:ba:f2:74:e8:15:e5:
+        de:88:2a:02:44:94:27:17:c1:77:b7:d8:46:2f:ab:86:08:ca:
+        c6:e2:59:c1:43:52:d3:a6:b4:78:69:68:d7:6a:25:1b:80:ce:
+        cf:65:6b:34:50:e6:47:31:08:46:fe:83:82:79:c8:8f:b7:23:
+        a3:d3:0f:79:f1:62:fd:12:60:44:74:18:3f:7d:dd:c8:ff:5d:
+        c9:c2:8a:b0:0d:10:ef:10:08:e8:9b:c1:76:e3:9a:78:0c:7f:
+        2e:b1:84:d8:99:1c:3e:4d:ba:a0:39:29:3c:31:4e:87:91:68:
+        43:a2:df:7f:01:6f:e7:4f:3a:20:86:ba:b8:ae:97:f5:03:dd:
+        c2:dc:f2:6a:90:69:d1:85:de:07:f4:be:a3:68:20:c0:0e:27:
+        f3:c1:ed:f9:4f:da:05:bb:02:12:8c:ba:b5:b7:68:b0:ba:a6:
+        2c:3d:92:90:4e:2b:14:d2:4d:04:f2:dc:c3:7e:e8:21:32:ca:
+        a2:0a:59:9c:81:18:59:ac:f4:4d:c6:af:be:4f:74:ca:d6:82:
+        3f:9b:d7:99:26:90:4a:39:9e:51:00:a0:2b:f7:17:27:07:e9:
+        d5:04:54:86:41:b8:51:4f:94:0a:fb:26:9e:19:86:9f:04:0b:
+        ae:7a:54:81:07:a1:c3:53:3f:28:fd:9b:46:bf:5a:90:15:48:
+        69:b8:9c:fb:28:ca:39:42:6e:6a:9d:6e:84:ea:2c:69:08:ec:
+        4e:18:2a:f6:ea:98:21:86:46:4b:d6:23:37:9d:24:46:3c:67:
+        75:b3:6e:25:5b:a1:32:02:52:0c:23:c4:fb:be:1f:78:27:32:
+        49:f8:e1:57:11:95:25:59:c9:50:34:19:a2:a5:56:fc:da:87:
+        69:1d:3b:c0:00:7a:0f:56:fe:8a:76:9a:2b:2c:f9:f0:dc:37:
+        0f:ac:b3:07:1a:6d:b5:90:d3:82:e5:a7:fa:bc:b9:78:de:94:
+        9b:51:33:db:61:6c:eb:95:28:7a:cc:cb:93:78:47:15:49:c8:
+        9b:37:5d:e5:0b:45:27:8d:09:1b:1b:a2:66:80:a9:66:1c:89:
+        36:90:2f:19:4c:14:32:c6:dd:ad:8f:a2:12:a8:ac:28:65:45:
+        d3:ba:d0:0f:61:f4:54:c0:41:29:fa:99:af:80:62:96:46:13:
+        9a:79:dc:88:13:7b:3a:13:a0:d9:50:e7:c9:43:47:c6:22:2b:
+        dd:d4:f5:da:8b:e2:65:4f

diff --git a/contrib/smime.rc b/contrib/smime.rc
new file mode 100644 (file)
index 0000000..90b55bf
--- /dev/null
+++ b/contrib/smime.rc
@@ -0,0 +1,92 @@
+# -*-muttrc-*-
+## The following options are only available if you have
+## compiled in S/MIME support
+
+set smime_is_default
+
+# Passphrase expiration
+set smime_timeout=300
+
+# Global crypto options -- these affect PGP operations as well.
+set crypt_autosign = yes
+set crypt_replyencrypt = yes
+set crypt_replysign = yes
+set crypt_replysignencrypted = yes
+set crypt_verify_sig = yes
+
+# Section A: Key Management.
+
+# The (default) keyfile for signing/decrypting.  Uncomment the following
+# line and replace the keyid with your own.
+#set smime_sign_as="12345678.0"
+
+# Path to where all known certificates go. (must exist!)
+set smime_certificates="~/.smime/certificates"
+
+# Path to where all private keys go. (must exist!)
+set smime_keys="~/.smime/keys"
+
+# These are used to extract a certificate from a message.
+# First generate a PKCS#7 structure from the message.
+set smime_pk7out_command="openssl smime -verify -in %f -noverify -pk7out"
+
+# Extract the included certificate(s) from a PKCS#7 structure.
+set smime_get_cert_command="openssl pkcs7 -print_certs -in %f"
+
+# Extract the signer's certificate only from a S/MIME signature (sender verification)
+set smime_get_signer_cert_command="openssl smime -verify -in %f -noverify -signer %c -out /dev/null"
+
+# This is used to get a filename for certificates that get stored in the
+# above directory
+set smime_hash_cert_command="openssl x509 -in  %f -noout -hash"
+
+# This is used to get the email address the certificate was issued to.
+set smime_get_cert_email_command="openssl x509 -in  %f -noout -email"
+
+
+
+# Sction B: Outgoing messages
+
+# Algorithm to use for encryption.
+# valid choices are rc2-40, rc2-64, rc2-128, des, des3
+set smime_encrypt_with="des3"
+
+# Encrypt a message. Input file is a MIME entity.
+set smime_encrypt_command="openssl smime -encrypt -%a -outform DER -in %f %c"
+
+# Sign.
+set smime_sign_command="openssl smime -sign -signer %c -inkey %k -passin stdin -in %f -certfile %i -outform DER"
+
+
+
+#Section C: Incoming messages
+
+# Decrypt a message. Output is a MIME entity.
+set smime_decrypt_command="openssl smime -decrypt  -passin stdin -inform DER -in %f -inkey %k -recip %c"
+
+# Verify a signature of type multipart/signed
+set smime_verify_command="openssl smime -verify -inform DER -in %s -CAfile ~/.smime/ca-bundle.crt -content %f"
+
+# Verify a signature of type application/x-pkcs7-mime
+set smime_verify_opaque_command="openssl smime -verify -inform DER -in %s -CAfile ~/.smime/ca-bundle.crt"
+
+
+
+# Section D: Alternatives
+
+# Sign.  If you wish to NOT include the certificate your CA used in signing
+# your public key, use this command instead.
+# set smime_sign_command="openssl smime -sign -signer %c -inkey %k -passin stdin -in %f -outform DER"
+#
+# In order to verify the signature only and skip checking the certificate  chain:
+#
+# set smime_verify_command="openssl smime -verify -inform DER -in %s -content %f -noverify"
+# set smime_verify_opaque_command="openssl smime -verify -inform DER -in %s -noverify"
+#
+# setup with the directory flag:
+#
+# Verify a signature of type multipart/signed
+# set smime_verify_command="openssl smime -verify -inform DER -in %s -CApath ~/.smime/root_certs -content %f"
+#
+# Verify a signature of type application/x-pkcs7-mime
+# set smime_verify_opaque_command="openssl smime -verify -inform DER -in %s -CApath ~/.smime/root_certs"

diff --git a/copy.c b/copy.c
index 4b880df05d0329306220c3004abbcaa88f29dadc..831062a7bee76e79f705747bfb4c6c5d8546b112 100644 (file)
--- a/copy.c
+++ b/copy.c
@@ -27,6 +27,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #include <string.h>
 #include <stdlib.h>
 #include <ctype.h>
@@ -527,23 +531,36 @@ _mutt_copy_message (FILE *fpout, FILE *fpin, HEADER *hdr, BODY *body,
     if (flags & M_CM_CHARCONV)
       s.flags |= M_CHARCONV;
     
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     if (flags & M_CM_VERIFY)
       s.flags |= M_VERIFY;
 #endif
 
     mutt_body_handler (body, &s);
   }
-#ifdef HAVE_PGP
-  else if ((flags & M_CM_DECODE_PGP) && (hdr->pgp & PGPENCRYPT) &&
-      hdr->content->type == TYPEMULTIPART)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  else if ((flags & M_CM_DECODE_CRYPT) && (hdr->security & ENCRYPT))
   {
     BODY *cur;
     FILE *fp;
 
-    if (pgp_decrypt_mime (fpin, &fp, hdr->content, &cur))
-      return (-1);
-    fputs ("Mime-Version: 1.0\n", fpout);
+#ifdef HAVE_PGP
+    if ((flags & M_CM_DECODE_PGP) && (hdr->security & APPLICATION_PGP) &&
+       hdr->content->type == TYPEMULTIPART)
+    {
+      if (pgp_decrypt_mime (fpin, &fp, hdr->content, &cur))
+       return (-1);
+      fputs ("Mime-Version: 1.0\n", fpout);
+    }
+#endif
+#ifdef HAVE_SMIME
+    if ((flags & M_CM_DECODE_SMIME) && (hdr->security & APPLICATION_SMIME)
+            && hdr->content->type == TYPEAPPLICATION)
+    {
+      if (smime_decrypt_mime (fpin, &fp, hdr->content, &cur))
+       return (-1);
+    }
+#endif
     mutt_write_mime_header (cur, fpout);
     fputc ('\n', fpout);
 

diff --git a/copy.h b/copy.h
index ccbe550d33bc8ec56696c88988f24607decf6ce0..dfbd43767ce8dc2fe2bdbe7e637204a223c3b223 100644 (file)
--- a/copy.h
+++ b/copy.h
@@ -29,10 +29,30 @@
 
 #ifdef HAVE_PGP
 #define M_CM_DECODE_PGP        (1<<8)  /* used for decoding PGP messages */
-#define M_CM_VERIFY    (1<<9)  /* do signature verification */
+#define M_CM_DECODE_CRYPT      (1<<8)
 #endif
 
 
+#ifdef HAVE_SMIME
+#ifdef M_CM_DECODE_CRYPT
+#undef M_CM_DECODE_CRYPT
+#endif
+#define M_CM_DECODE_SMIME      (1<<9)  /* used for decoding S/MIME messages */
+#ifdef HAVE_PGP
+#undef M_CM_DECODE_CRYPT
+#define M_CM_DECODE_CRYPT  (M_CM_DECODE_PGP | M_CM_DECODE_SMIME)
+#else
+#define M_CM_DECODE_CRYPT      (1<<9)  /* used for decoding S/MIME messages */
+#endif
+#endif
+
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+#define M_CM_VERIFY    (1<<10) /* do signature verification */
+#endif
+
+
+
 
 int mutt_copy_hdr (FILE *, FILE *, long, long, int, const char *);
 

diff --git a/crypt.c b/crypt.c
new file mode 100644 (file)
index 0000000..43164b3
--- /dev/null
+++ b/crypt.c
@@ -0,0 +1,770 @@
+/*
+ * Copyright (C) 1996,1997 Michael R. Elkins <me@cs.hmc.edu>
+ * Copyright (C) 1999-2000 Thomas Roessler <roessler@guug.de>
+ * Copyright (C) 2001  Thomas Roessler <roessler@guug.de>
+ *                     Oliver Ehli <elmy@acm.org>
+ *
+ *     This program is free software; you can redistribute it and/or modify
+ *     it under the terms of the GNU General Public License as published by
+ *     the Free Software Foundation; either version 2 of the License, or
+ *     (at your option) any later version.
+ * 
+ *     This program is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ * 
+ *     You should have received a copy of the GNU General Public License
+ *     along with this program; if not, write to the Free Software
+ *     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+ */
+
+
+#include "mutt.h"
+#include "mutt_curses.h"
+#include "crypt.h"
+#include "mime.h"
+#include "copy.h"
+
+#include <sys/wait.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <ctype.h>
+
+#ifdef HAVE_PGP
+#include "pgp.h"
+#endif
+
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
+#ifdef HAVE_LOCALE_H
+#include <locale.h>
+#endif
+
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+
+#ifdef HAVE_SYS_RESOURCE_H
+# include <sys/resource.h>
+#endif
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+
+
+/* print the current time to avoid spoofing of the signature output */
+void crypt_current_time(STATE *s, char *app_name)
+{
+  time_t t;
+  char p[STRING], tmp[STRING];
+
+  t = time(NULL);
+  setlocale (LC_TIME, "");
+  snprintf (tmp, sizeof (tmp), _("[-- %s output follows(current time: %%c) --]\n"), NONULL(app_name));
+  strftime (p, sizeof (p), tmp, localtime (&t));
+  setlocale (LC_TIME, "C");
+  state_attach_puts (p, s);
+}
+
+
+
+void crypt_forget_passphrase (void)
+{
+    
+#ifdef HAVE_PGP
+  pgp_void_passphrase ();
+#endif
+
+#ifdef HAVE_SMIME
+  smime_void_passphrase ();
+#endif
+
+  mutt_message _("Passphrase(s) forgotten.");
+}
+
+
+# if defined(HAVE_SETRLIMIT) && (!defined(DEBUG))
+
+static void disable_coredumps (void)
+{
+  struct rlimit rl = {0, 0};
+  static short done = 0;
+
+  if (!done)
+  {
+    setrlimit (RLIMIT_CORE, &rl);
+    done = 1;
+  }
+}
+
+# endif /* HAVE_SETRLIMIT */
+
+
+int crypt_valid_passphrase(int flags)
+{
+  time_t now = time (NULL);
+
+# if defined(HAVE_SETRLIMIT) &&(!defined(DEBUG))
+  disable_coredumps ();
+# endif
+
+
+#ifdef HAVE_PGP
+  if (flags & APPLICATION_PGP)
+  {
+    extern char PgpPass[STRING];
+    extern time_t PgpExptime;
+
+    if (now < PgpExptime) return 1; /* just use the cached copy. */
+    pgp_void_passphrase ();
+      
+    if (mutt_get_password (_("Enter PGP passphrase:"), PgpPass, sizeof (PgpPass)) == 0)
+    {
+      PgpExptime = time (NULL) + PgpTimeout;
+      return (1);
+    }
+    else
+      PgpExptime = 0;
+    }
+#endif
+#ifdef HAVE_SMIME
+  if (flags & APPLICATION_SMIME)
+  {
+    extern char SmimePass[STRING];
+    extern time_t SmimeExptime;
+
+    if (now < SmimeExptime) return (1);
+    smime_void_passphrase ();
+      
+    if (mutt_get_password (_("Enter SMIME passphrase:"), SmimePass,
+                          sizeof (SmimePass)) == 0)
+    {
+      SmimeExptime = time (NULL) + SmimeTimeout;
+      return (1);
+    }
+    else
+      SmimeExptime = 0;
+  }
+#endif
+  return (0);
+}
+
+
+
+int mutt_protect (HEADER *msg, char *keylist)
+{
+  BODY *pbody = NULL, *tmp_pbody = NULL;
+#ifdef HAVE_SMIME
+  BODY *tmp_smime_pbody = NULL;
+#endif
+#ifdef HAVE_PGP
+  BODY *tmp_pgp_pbody = NULL;
+  int traditional = 0;
+  int flags = msg->security, i;
+#endif
+  if ((msg->security & SIGN) && !crypt_valid_passphrase (msg->security))
+    return (-1);
+
+#ifdef HAVE_PGP
+  if (msg->security & APPLICATION_PGP)
+  {
+    if ((msg->content->type == TYPETEXT) &&
+       !mutt_strcasecmp (msg->content->subtype, "plain") &&
+       ((flags & ENCRYPT) || (msg->content->content && msg->content->content->hibin == 0)))
+    {
+      if ((i = query_quadoption (OPT_PGPTRADITIONAL, _("Create an application/pgp message?"))) == -1)
+       return -1;
+      else if (i == M_YES)
+       traditional = 1;
+    }
+    if (traditional)
+    {
+      mutt_message _("Invoking PGP...");
+      if (!(pbody = pgp_traditional_encryptsign (msg->content, flags, keylist)))
+       return -1;
+    
+      msg->content = pbody;
+      return 0;
+    }
+  }
+#endif
+
+  if (!isendwin ()) mutt_endwin (NULL);
+
+#ifdef HAVE_SMIME
+  tmp_smime_pbody = msg->content;
+#endif
+
+
+  if (msg->security & SIGN)
+  {
+#ifdef HAVE_SMIME
+    if (msg->security & APPLICATION_SMIME)
+    {
+      if (!(tmp_pbody = smime_sign_message (msg->content)))
+       return -1;
+      pbody = tmp_smime_pbody = tmp_pbody;
+    }
+#endif
+#ifdef HAVE_PGP
+    if ((msg->security & APPLICATION_PGP) &&
+        (!(flags & ENCRYPT) || option (OPTPGPRETAINABLESIG)))
+    {
+      if (!(tmp_pbody = pgp_sign_message (msg->content)))
+        return -1;
+
+      flags &= ~SIGN;
+      pbody = tmp_pgp_pbody = tmp_pbody;
+    }
+#endif
+
+#if defined(HAVE_SMIME) && defined(HAVE_PGP)
+    if ((msg->security & APPLICATION_SMIME) &&
+       (msg->security & APPLICATION_PGP))
+    {
+       /* here comes the draft ;-) */
+    }
+#endif
+  }
+
+
+  if (msg->security & ENCRYPT)
+  {
+#ifdef HAVE_SMIME
+    if (msg->security & APPLICATION_SMIME)
+    {
+      if (!(tmp_pbody = smime_build_smime_entity (tmp_smime_pbody, keylist)))
+      {
+       /* signed ? free it! */
+       return (-1);
+      }
+      /* free tmp_body if messages was signed AND encrypted ... */
+      if (tmp_smime_pbody != msg->content && tmp_smime_pbody != tmp_pbody)
+      {
+       /* detatch and dont't delete msg->content,
+          which tmp_smime_pbody->parts after signing. */
+       tmp_smime_pbody->parts = tmp_smime_pbody->parts->next;
+       msg->content->next = NULL;
+       mutt_free_body (&tmp_smime_pbody);
+      }
+      pbody = tmp_pbody;
+    }
+#endif
+
+#ifdef HAVE_PGP
+    if (msg->security & APPLICATION_PGP)
+    {
+      if (!(pbody = pgp_encrypt_message (msg->content, keylist, flags & SIGN)))
+      {
+
+       /* did we perform a retainable signature? */
+       if (flags != msg->security)
+       {
+         /* remove the outer multipart layer */
+         msg->content = mutt_remove_multipart (msg->content);
+         /* get rid of the signature */
+         mutt_free_body (&msg->content->next);
+       }
+
+       return (-1);
+      }
+
+      /* destroy temporary signature envelope when doing retainable 
+       * signatures.
+       */
+      if (flags != msg->security)
+      {
+       mutt_remove_multipart (msg->content);
+       mutt_free_body (&msg->content->next);
+      }
+    }
+#endif
+  }
+
+  if(pbody)
+      msg->content = pbody;
+
+  return 0;
+}
+
+
+   
+     
+int mutt_is_multipart_signed (BODY *b)
+{
+  char *p;
+
+  if (!b || !(b->type == TYPEMULTIPART) ||
+      !b->subtype || mutt_strcasecmp(b->subtype, "signed"))
+    return 0;
+
+  if (!(p = mutt_get_parameter("protocol", b->parameter)))
+    return 0;
+
+  if (!(mutt_strcasecmp (p, "multipart/mixed")))
+    return SIGN;
+
+#ifdef HAVE_PGP
+  if (!(mutt_strcasecmp (p, "application/pgp-signature")))
+    return PGPSIGN;
+#endif
+    
+#ifdef HAVE_SMIME
+  if (!(mutt_strcasecmp(p, "application/x-pkcs7-signature")))
+    return SMIMESIGN;
+#endif
+
+  return 0;
+}
+   
+     
+int mutt_is_multipart_encrypted (BODY *b)
+{
+  int ret=0;
+#ifdef HAVE_PGP
+  ret = pgp_is_multipart_encrypted (b);
+#endif
+
+  return ret;
+}
+
+
+
+
+int crypt_query (BODY *m)
+{
+  int t = 0;
+
+
+  if (m->type == TYPEAPPLICATION)
+  {
+#ifdef HAVE_PGP
+    t |= mutt_is_application_pgp(m);
+#endif
+#ifdef HAVE_SMIME
+    t |= mutt_is_application_smime(m);
+    if (t && m->goodsig) t |= GOODSIGN;
+    if (t && m->badsig) t |= BADSIGN;
+#endif
+  }
+  
+  if (m->type == TYPEMULTIPART)
+  {
+    t |= mutt_is_multipart_encrypted(m);
+    t |= mutt_is_multipart_signed (m);
+
+    if (t && m->goodsig) t |= GOODSIGN;
+  }
+
+  if (m->type == TYPEMULTIPART || m->type == TYPEMESSAGE)
+  {
+    BODY *p;
+ 
+    for (p = m->parts; p; p = p->next)
+      t |= crypt_query (p) & ~GOODSIGN;
+  }
+
+  return t;
+}
+
+
+
+
+int crypt_write_signed(BODY *a, STATE *s, const char *tempfile)
+{
+  FILE *fp;
+  int c;
+  short hadcr;
+  size_t bytes;
+
+  if (!(fp = safe_fopen (tempfile, "w")))
+  {
+    mutt_perror (tempfile);
+    return -1;
+  }
+      
+  fseek (s->fpin, a->hdr_offset, 0);
+  bytes = a->length + a->offset - a->hdr_offset;
+  hadcr = 0;
+  while (bytes > 0)
+  {
+    if ((c = fgetc (s->fpin)) == EOF)
+      break;
+    
+    bytes--;
+    
+    if  (c == '\r')
+      hadcr = 1;
+    else 
+    {
+      if (c == '\n' && !hadcr)
+       fputc ('\r', fp);
+      
+      hadcr = 0;
+    }
+    
+    fputc (c, fp);
+    
+  }
+  fclose (fp);
+
+  return 0;
+}
+
+
+
+void convert_to_7bit (BODY *a)
+{
+  while (a)
+  {
+    if (a->type == TYPEMULTIPART)
+    {
+      if (a->encoding != ENC7BIT)
+      {
+        a->encoding = ENC7BIT;
+       convert_to_7bit(a->parts);
+      }
+#ifdef HAVE_PGP
+      else if (option (OPTPGPSTRICTENC))
+       convert_to_7bit (a->parts);
+#endif
+    } 
+    else if (a->type == TYPEMESSAGE &&
+            mutt_strcasecmp(a->subtype, "delivery-status"))
+    {
+      if(a->encoding != ENC7BIT)
+       mutt_message_to_7bit (a, NULL);
+    }
+    else if (a->encoding == ENC8BIT)
+      a->encoding = ENCQUOTEDPRINTABLE;
+    else if (a->encoding == ENCBINARY)
+      a->encoding = ENCBASE64;
+    else if (a->content && a->encoding != ENCBASE64 &&
+            (a->content->from || (a->content->space && 
+                                  option (OPTPGPSTRICTENC))))
+      a->encoding = ENCQUOTEDPRINTABLE;
+    a = a->next;
+  }
+}
+
+
+
+
+void crypt_extract_keys_from_messages (HEADER * h)
+{
+  int i;
+  char tempfname[_POSIX_PATH_MAX], *mbox;
+  ADDRESS *tmp = NULL;
+  FILE *fpout;
+
+  mutt_mktemp (tempfname);
+  if (!(fpout = safe_fopen (tempfname, "w")))
+  {
+    mutt_perror (tempfname);
+    return;
+  }
+
+#ifdef HAVE_PGP
+  set_option (OPTDONTHANDLEPGPKEYS);
+#endif  
+
+  if (!h)
+  {
+    for (i = 0; i < Context->vcount; i++)
+    {
+      if (Context->hdrs[Context->v2r[i]]->tagged)
+      {
+       mutt_parse_mime_message (Context, Context->hdrs[Context->v2r[i]]);
+       if (Context->hdrs[Context->v2r[i]]->security & ENCRYPT &&
+           !crypt_valid_passphrase (Context->hdrs[Context->v2r[i]]->security))
+       {
+         fclose (fpout);
+         break;
+       }
+#ifdef HAVE_PGP
+       if (Context->hdrs[Context->v2r[i]]->security & APPLICATION_PGP)
+       {
+         mutt_copy_message (fpout, Context, Context->hdrs[Context->v2r[i]], 
+                            M_CM_DECODE|M_CM_CHARCONV, 0);
+         fflush(fpout);
+         
+         mutt_endwin (_("Trying to extract PGP keys...\n"));
+         pgp_invoke_import (tempfname);
+       }
+#endif
+#ifdef HAVE_SMIME
+       if (Context->hdrs[Context->v2r[i]]->security & APPLICATION_SMIME)
+       {
+         if (Context->hdrs[Context->v2r[i]]->security & ENCRYPT)
+           mutt_copy_message (fpout, Context, Context->hdrs[Context->v2r[i]],
+                              M_CM_NOHEADER|M_CM_DECODE_CRYPT|M_CM_DECODE_SMIME, 0);
+         else
+           mutt_copy_message (fpout, Context,
+                              Context->hdrs[Context->v2r[i]], 0, 0);
+         fflush(fpout);
+
+          if (Context->hdrs[Context->v2r[i]]->env->from)
+           tmp = mutt_expand_aliases (h->env->from);
+         else if (Context->hdrs[Context->v2r[i]]->env->sender)
+           tmp = mutt_expand_aliases (Context->hdrs[Context->v2r[i]]->env->sender);
+          mbox = tmp ? tmp->mailbox : NULL;
+         if (mbox)
+         {
+           mutt_endwin (_("Trying to extract S/MIME certificates...\n"));
+           smime_invoke_import (tempfname, mbox);
+           tmp = NULL;
+         }
+       }
+#endif
+       rewind (fpout);
+      }
+    }
+  }
+  else
+  {
+    mutt_parse_mime_message (Context, h);
+    if (!(h->security & ENCRYPT && !crypt_valid_passphrase (h->security)))
+    {
+#ifdef HAVE_PGP
+      if (h->security & APPLICATION_PGP)
+      {
+       mutt_copy_message (fpout, Context, h, M_CM_DECODE|M_CM_CHARCONV, 0);
+       fflush(fpout);
+       mutt_message (_("Trying to extract PGP keys...\n"));
+       pgp_invoke_import (tempfname);
+      }
+#endif  
+#ifdef HAVE_SMIME
+      if (h->security & APPLICATION_SMIME)
+      {
+       if (h->security & ENCRYPT)
+         mutt_copy_message (fpout, Context, h, M_CM_NOHEADER|M_CM_DECODE_CRYPT|M_CM_DECODE_SMIME, 0);
+       else
+         mutt_copy_message (fpout, Context, h, 0, 0);
+
+       fflush(fpout);
+       if (h->env->from) tmp = mutt_expand_aliases (h->env->from);
+       else if (h->env->sender)  tmp = mutt_expand_aliases (h->env->sender); 
+       mbox = tmp ? tmp->mailbox : NULL;
+       if (mbox) /* else ? */
+       {
+         mutt_message (_("Trying to extract S/MIME certificates...\n"));
+         smime_invoke_import (tempfname, mbox);
+       }
+      }
+#endif  
+    }
+  }
+      
+  fclose (fpout);
+  mutt_any_key_to_continue (NULL);
+
+  mutt_unlink (tempfname);
+
+#ifdef HAVE_PGP
+  unset_option (OPTDONTHANDLEPGPKEYS);
+#endif  
+}
+
+
+
+int crypt_get_keys (HEADER *msg, char **keylist)
+{
+  /* Do a quick check to make sure that we can find all of the encryption
+   * keys if the user has requested this service.
+   */
+
+#ifdef HAVE_SMIME
+    extern char *smime_findKeys (ADDRESS *to, ADDRESS *cc, ADDRESS *bcc);
+#endif
+#ifdef HAVE_PGP
+    extern char *pgp_findKeys (ADDRESS *to, ADDRESS *cc, ADDRESS *bcc);
+
+    set_option (OPTPGPCHECKTRUST);
+
+#endif
+
+    *keylist = NULL;
+
+
+    if (msg->security & ENCRYPT)
+    {
+#ifdef HAVE_PGP
+       if (msg->security & APPLICATION_PGP)
+       {
+         if ((*keylist = pgp_findKeys (msg->env->to, msg->env->cc,
+                                      msg->env->bcc)) == NULL)
+            return (-1);
+        unset_option (OPTPGPCHECKTRUST);
+       }
+#endif
+#ifdef HAVE_SMIME
+       if (msg->security & APPLICATION_SMIME)
+       {
+        if ((*keylist = smime_findKeys (msg->env->to, msg->env->cc,
+                                        msg->env->bcc)) == NULL)
+            return (-1);
+       }
+#endif
+    }
+    
+    return (0);
+}
+
+
+
+static void crypt_fetch_signatures (BODY ***signatures, BODY *a, int *n)
+{
+  for (; a; a = a->next)
+  {
+    if (a->type == TYPEMULTIPART)
+      crypt_fetch_signatures (signatures, a->parts, n);
+    else
+    {
+      if((*n % 5) == 0)
+       safe_realloc ((void **) signatures, (*n + 6) * sizeof (BODY **));
+
+      (*signatures)[(*n)++] = a;
+    }
+  }
+}
+
+
+/*
+ * This routine verifies a  "multipart/signed"  body.
+ */
+
+void mutt_signed_handler (BODY *a, STATE *s)
+{
+  char tempfile[_POSIX_PATH_MAX];
+  char *protocol;
+  int protocol_major = TYPEOTHER;
+  char *protocol_minor = NULL;
+  
+  BODY *b = a;
+  BODY **signatures = NULL;
+  int sigcnt = 0;
+  int i;
+  short goodsig = 1;
+
+  protocol = mutt_get_parameter ("protocol", a->parameter);
+  a = a->parts;
+
+  /* extract the protocol information */
+  
+  if (protocol)
+  {
+    char major[STRING];
+    char *t;
+
+    if ((protocol_minor = strchr (protocol, '/'))) protocol_minor++;
+    
+    strfcpy (major, protocol, sizeof(major));
+    if((t = strchr(major, '/')))
+      *t = '\0';
+    
+    protocol_major = mutt_check_mime_type (major);
+  }
+
+  /* consistency check */
+
+  if (!(a && a->next && a->next->type == protocol_major && 
+      !mutt_strcasecmp (a->next->subtype, protocol_minor)))
+  {
+    state_attach_puts (_("[-- Error: Inconsistent multipart/signed structure! --]\n\n"), s);
+    mutt_body_handler (a, s);
+    return;
+  }
+
+  
+#ifdef HAVE_PGP
+  if (protocol_major == TYPEAPPLICATION &&
+      !mutt_strcasecmp (protocol_minor, "pgp-signature"));
+#endif
+#if defined(HAVE_PGP) && defined(HAVE_SMIME)
+  else
+#endif
+#ifdef HAVE_SMIME
+        if (protocol_major == TYPEAPPLICATION &&
+           !mutt_strcasecmp (protocol_minor, "x-pkcs7-signature"));
+  
+#endif
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  else
+#endif
+        if (protocol_major == TYPEMULTIPART &&
+           !mutt_strcasecmp (protocol_minor, "mixed"));
+
+  else
+  {
+    state_printf (s, _("[-- Error: Unknown multipart/signed protocol %s! --]\n\n"), protocol);
+    mutt_body_handler (a, s);
+    return;
+  }
+  
+  if (s->flags & M_DISPLAY)
+  {
+    
+    crypt_fetch_signatures (&signatures, a->next, &sigcnt);
+    
+    if (sigcnt)
+    {
+      mutt_mktemp (tempfile);
+      if (crypt_write_signed (a, s, tempfile) == 0)
+      {
+       for (i = 0; i < sigcnt; i++)
+       {
+#ifdef HAVE_PGP
+         if (signatures[i]->type == TYPEAPPLICATION 
+             && !mutt_strcasecmp (signatures[i]->subtype, "pgp-signature"))
+         {
+           if (pgp_verify_one (signatures[i], s, tempfile) != 0)
+             goodsig = 0;
+           
+           continue;
+         }
+#endif
+#ifdef HAVE_SMIME
+         if (signatures[i]->type == TYPEAPPLICATION 
+             && !mutt_strcasecmp(signatures[i]->subtype, "x-pkcs7-signature"))
+         {
+           if (smime_verify_one (signatures[i], s, tempfile) != 0)
+             goodsig = 0;
+           
+           continue;
+         }
+#endif
+         state_printf (s, _("[-- Warning: We can't verify %s/%s signatures. --]\n\n"),
+                         TYPE(signatures[i]), signatures[i]->subtype);
+       }
+      }
+      
+      mutt_unlink (tempfile);
+
+      b->goodsig = goodsig;
+      b->badsig = goodsig;
+      
+      /* Now display the signed body */
+      state_attach_puts (_("[-- The following data is signed --]\n\n"), s);
+
+
+      safe_free((void **) &signatures);
+    }
+    else
+      state_attach_puts (_("[-- Warning: Can't find any signatures. --]\n\n"), s);
+  }
+  
+  mutt_body_handler (a, s);
+  
+  if (s->flags & M_DISPLAY && sigcnt)
+    state_attach_puts (_("\n[-- End of signed data --]\n"), s);
+}
+
+
+
+#endif

diff --git a/crypt.h b/crypt.h
new file mode 100644 (file)
index 0000000..42427e6
--- /dev/null
+++ b/crypt.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 1996,1997 Michael R. Elkins <me@cs.hmc.edu>
+ * Copyright (C) 1999-2000 Thomas Roessler <roessler@guug.de>
+ * Copyright (C) 2001 Thomas Roessler <roessler@guug.de>
+ *                    Oliver Ehli <elmy@acm.org>
+ *
+ *     This program is free software; you can redistribute it and/or modify
+ *     it under the terms of the GNU General Public License as published by
+ *     the Free Software Foundation; either version 2 of the License, or
+ *     (at your option) any later version.
+ * 
+ *     This program is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ * 
+ *     You should have received a copy of the GNU General Public License
+ *     along with this program; if not, write to the Free Software
+ *     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+ */
+
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+
+#define ENCRYPT  (1 << 0)
+#define SIGN     (1 << 1)
+#define GOODSIGN (1 << 2)
+#define BADSIGN  (1 << 3)
+
+int mutt_protect (HEADER *, char *);
+
+int mutt_is_multipart_encrypted (BODY *);
+
+int mutt_is_multipart_signed (BODY *);
+
+void mutt_signed_handler (BODY *, STATE *);
+
+int mutt_parse_crypt_hdr (char *, int);
+
+int crypt_query (BODY *);
+
+void crypt_extract_keys_from_messages (HEADER *);
+
+int crypt_get_keys (HEADER *, char **);
+
+
+void crypt_forget_passphrase (void);
+
+int crypt_valid_passphrase (int);
+
+
+int crypt_write_signed(BODY *, STATE *, const char *);
+
+void convert_to_7bit (BODY *);
+
+
+/* private ? */
+
+void crypt_current_time(STATE *, char *);
+
+
+#endif

diff --git a/curs_main.c b/curs_main.c
index 185756e3b293bb41d0214be905a8e1a8d447fe98..ca908c5a4ecafdc8564b76934844d5989abcae66 100644 (file)
--- a/curs_main.c
+++ b/curs_main.c
@@ -39,6 +39,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 
 
@@ -1207,25 +1211,25 @@ int mutt_index_menu (void)
       case OP_SAVE:
       case OP_DECODE_COPY:
       case OP_DECODE_SAVE:
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_DECRYPT_COPY:
       case OP_DECRYPT_SAVE:
 #endif
        CHECK_MSGCOUNT;
         CHECK_VISIBLE;
         if (mutt_save_message (tag ? NULL : CURHDR,
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
                               (op == OP_DECRYPT_SAVE) ||
 #endif
                               (op == OP_SAVE) || (op == OP_DECODE_SAVE),
                               (op == OP_DECODE_SAVE) || (op == OP_DECODE_COPY),
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
                               (op == OP_DECRYPT_SAVE) || (op == OP_DECRYPT_COPY) ||
 #endif
                               0,
                               &menu->redraw) == 0 &&
            (op == OP_SAVE || op == OP_DECODE_SAVE
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
             || op == OP_DECRYPT_SAVE
 #endif
             ))
@@ -1723,10 +1727,10 @@ int mutt_index_menu (void)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_FORGET_PASSPHRASE:
 
-       mutt_forget_passphrase ();
+       crypt_forget_passphrase ();
        break;
 #endif /* HAVE_PGP */
 
@@ -1770,15 +1774,21 @@ int mutt_index_menu (void)
        ci_send_message (SENDKEY, NULL, NULL, NULL, NULL);
        menu->redraw = REDRAW_FULL;
        break;
+#endif /* HAVE_PGP */
+
       
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_EXTRACT_KEYS:
       
         CHECK_MSGCOUNT;
         CHECK_VISIBLE;
-        pgp_extract_keys_from_messages(tag ? NULL : CURHDR);
+        crypt_extract_keys_from_messages(tag ? NULL : CURHDR);
         menu->redraw = REDRAW_FULL;
         break;
 
+#endif /* HAVE_PGP || HAVE_SMIME */
+
+#ifdef HAVE_PGP
       case OP_CHECK_TRADITIONAL:
       
         CHECK_MSGCOUNT; 

diff --git a/doc/Makefile.in b/doc/Makefile.in
index a8f22c0bf4f1dc0beef6d25e8f0e5f5f588e8b21..9fa55874d7eaa176b5fba66888e6e2d2f0415a65 100644 (file)
--- a/doc/Makefile.in
+++ b/doc/Makefile.in
@@ -51,10 +51,11 @@ DISTFILES = Makefile.in dotlock.man         \
        stamp-doc-sgml                  \
        stamp-doc-man                   \
        instdoc.sh.in                   \
-       patch-notes.txt
+       patch-notes.txt                 \
+       smime-notes.txt
 
 srcdir_DOCFILES = PGP-Notes.txt applying-patches.txt   \
-       devel-notes.txt patch-notes.txt
+       devel-notes.txt patch-notes.txt smime-notes.txt
 
 
 topsrcdir_DOCFILES = COPYRIGHT GPL INSTALL ChangeLog   \

diff --git a/doc/smime-notes.txt b/doc/smime-notes.txt
new file mode 100644 (file)
index 0000000..131272b
--- /dev/null
+++ b/doc/smime-notes.txt
@@ -0,0 +1,76 @@
+From raldi@research.netsol.com Thu Jan 24 18:33:03 2002
+Date: Thu, 24 Jan 2002 11:44:40 -0500
+From: Mike Schiraldi <raldi@research.netsol.com>
+To: Thomas Roessler <roessler@does-not-exist.org>
+Subject: Re: Where's the S/MIME patch? ;-)
+User-Agent: Mutt/1.3.27i
+Mime-Version: 1.0
+
+I wanted to test this patch off CVS, but with or without the patch, i
+couldn't get autoconf/automake/aclocal/configure to work. 
+
+
+Files:
+
+smime.patch   -- the S/MIME patch
+smime_keys.pl -- the perl script
+smime.rc      -- a bunch of commands you'll need to source into your .muttrc
+
+ca-bundle.crt -- a collection of root certificates
+
+color.patch   -- the color patch
+color.rc      -- the muttrc commands it uses
+
+Okay, here's what you do:
+
+Apply smime.patch. 
+
+Build.
+
+Get yourself a certificate (You can get one for free from www.thawte.com, or
+i could buy you a VeriSign certificate, or you could go to one of our
+competitors). The way this process works, the certificate will be installed
+"into" your web browser.
+
+Assuming you're using Mozilla on Linux, follow the instructions at
+www.verisignlabs.com/Projects/smime_docs/linux.html to export the
+certificate into a file called cert.p12.
+
+Run smime_keys.pl add_p12 cert.p12
+
+    * When the script asks for the "Import password", enter the one you
+      provided when you exported the certificate.
+
+    * When it asks for a "PEM pass phrase", make up a new password. Every
+      time you sign or decrypt a message, mutt will ask for the PEM pass
+      phrase.
+
+    * Finally, when the script asks for a label, enter an easy-to-remember
+      name for the certificate, such as "me". The script output will include
+      a line like:
+
+      added private key: /home/raldi/.smime/keys/12345678.0 for raldi@verisignlabs.com
+
+      The number is your keyid. You will need this number in the next step.
+
+Put your keyid into smime.muttrc's smime_sign_as line.
+
+Source smime.muttrc into your .muttrc
+
+
+You probably want to import the trusted roots in ca-bundle.crt. Use
+"smime_keys.pl add_root" to do so. That makes you trust anything that was
+ultimately signed by one of them.
+
+To try out the color patch, just apply it and source the color.rc. You can
+see the results in any folder with signed messages.
+
+
+-- 
+Mike Schiraldi
+VeriSign Applied Research
+
+
+
+
+

diff --git a/functions.h b/functions.h
index aa54ed6979845202d65639ec219af7e260369578..d38ce8d81d84a7443388c2630d9a43d4c58cf431 100644 (file)
--- a/functions.h
+++ b/functions.h
@@ -135,11 +135,13 @@ struct binding_t OpMain[] = {
   { "parent-message",          OP_MAIN_PARENT_MESSAGE,         "P" },
 
 
-#ifdef HAVE_PGP
-  { "check-traditional-pgp",   OP_CHECK_TRADITIONAL,           "\033P" },
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   { "extract-keys",            OP_EXTRACT_KEYS,                "\013" },
   { "forget-passphrase",       OP_FORGET_PASSPHRASE,           "\006" },
+#ifdef HAVE_PGP
+  { "check-traditional-pgp",   OP_CHECK_TRADITIONAL,           "\033P" },
   { "mail-key",                        OP_MAIL_KEY,                    "\033k" },
+#endif
   { "decrypt-copy",            OP_DECRYPT_COPY,                NULL },
   { "decrypt-save",            OP_DECRYPT_SAVE,                NULL },
 #endif
@@ -229,9 +231,11 @@ struct binding_t OpPager[] = {
 
 #ifdef HAVE_PGP
   { "check-traditional-pgp",   OP_CHECK_TRADITIONAL,           "\033P"   },
+  { "mail-key",                OP_MAIL_KEY,                    "\033k" },
+#endif
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   { "extract-keys",    OP_EXTRACT_KEYS,                "\013" },
   { "forget-passphrase",OP_FORGET_PASSPHRASE,          "\006" },
-  { "mail-key",                OP_MAIL_KEY,                    "\033k" },
   { "decrypt-copy",            OP_DECRYPT_COPY,                NULL },
   { "decrypt-save",            OP_DECRYPT_SAVE,                NULL },
 #endif
@@ -264,6 +268,8 @@ struct binding_t OpAttach[] = {
 
 #ifdef HAVE_PGP
   { "check-traditional-pgp",   OP_CHECK_TRADITIONAL,           "\033P"   },
+#endif
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   { "extract-keys",            OP_EXTRACT_KEYS,                "\013" },
   { "forget-passphrase",       OP_FORGET_PASSPHRASE,           "\006" },
 #endif
@@ -311,10 +317,17 @@ struct binding_t OpCompose[] = {
 
 #ifdef HAVE_PGP
   { "attach-key",      OP_COMPOSE_ATTACH_KEY,          "\033k" },
-  { "forget-passphrase",OP_FORGET_PASSPHRASE,          "\006"  },
   { "pgp-menu",                OP_COMPOSE_PGP_MENU,            "p"     },
 #endif
 
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  { "forget-passphrase",OP_FORGET_PASSPHRASE,          "\006"  },
+#endif
+
+#ifdef HAVE_SMIME
+  { "smime-menu",      OP_COMPOSE_SMIME_MENU,          "S"     },
+#endif
+
 #ifdef MIXMASTER
   { "mix",             OP_COMPOSE_MIX,                 "M" },
 #endif
@@ -401,6 +414,12 @@ struct binding_t OpPgp[] = {
 };
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+/* Don't know an useful key binding yet. But. just in case, adding this already */
+struct binding_t OpSmime[] = {
+  { NULL,      0,      NULL }
+};
+#endif
 
 #ifdef MIXMASTER
 struct binding_t OpMix[] = {

diff --git a/globals.h b/globals.h
index b69a6dfb15c18bdf134b9c95e96aacf47110fe0b..a654686a26f750ea51f51d4fc20054a994490d43 100644 (file)
--- a/globals.h
+++ b/globals.h
@@ -197,4 +197,7 @@ extern const char *Months[];
 #ifdef HAVE_PGP
 #include "pgp.h"
 #endif
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
 #endif /* MAIN_C */

diff --git a/handler.c b/handler.c
index 6933edd895aaf699c63c2c92b6fe9873349b3d9d..2b1e661d28607c1478b165b71f3e75db279ef23d 100644 (file)
--- a/handler.c
+++ b/handler.c
@@ -37,6 +37,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 #define BUFI_SIZE 1000
 #define BUFO_SIZE 2000
@@ -1385,7 +1389,7 @@ int mutt_can_decode (BODY *a)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
     if (ascii_strcasecmp (a->subtype, "signed") == 0 ||
        ascii_strcasecmp (a->subtype, "encrypted") == 0)
       return (1);
@@ -1407,16 +1411,24 @@ int mutt_can_decode (BODY *a)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   else if (a->type == TYPEAPPLICATION)
   {
+#ifdef HAVE_PGP
     if (mutt_is_application_pgp(a))
       return (1);
+#ifdef HAVE_SMIME
+    if (mutt_is_application_smime(a))
+      return (1);
+#endif
+#endif
   }
 #endif
 
 
 
+
+
   return (0);
 }
 
@@ -1797,9 +1809,9 @@ void mutt_body_handler (BODY *b, STATE *s)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     char *p;
-#endif /* HAVE_PGP */
+#endif /* HAVE_(PGP||SMIME) */
 
 
 
@@ -1808,21 +1820,18 @@ void mutt_body_handler (BODY *b, STATE *s)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     else if (ascii_strcasecmp ("signed", b->subtype) == 0)
     {
       p = mutt_get_parameter ("protocol", b->parameter);
 
       if (!p)
         mutt_error _("Error: multipart/signed has no protocol.");
-      else if (ascii_strcasecmp ("application/pgp-signature", p) == 0 ||
-              ascii_strcasecmp ("multipart/mixed", p) == 0)
-      {
-       if (s->flags & M_VERIFY)
-         handler = pgp_signed_handler;
-      }
+      else if (s->flags & M_VERIFY)
+       handler = mutt_signed_handler;
     }
-    else if (ascii_strcasecmp ("encrypted", b->subtype) == 0)
+#ifdef HAVE_PGP
+    else if (mutt_strcasecmp ("encrypted", b->subtype) == 0)
     {
       p = mutt_get_parameter ("protocol", b->parameter);
 
@@ -1832,7 +1841,7 @@ void mutt_body_handler (BODY *b, STATE *s)
         handler = pgp_encrypted_handler;
     }
 #endif /* HAVE_PGP */
-
+#endif /* HAVE_(PGP||SMIME) */
 
 
     if (!handler)
@@ -1841,13 +1850,20 @@ void mutt_body_handler (BODY *b, STATE *s)
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   else if (b->type == TYPEAPPLICATION)
   {
+#ifdef HAVE_PGP
     if (mutt_is_application_pgp(b))
       handler = pgp_application_pgp_handler;
-  }
 #endif /* HAVE_PGP */
+#ifdef HAVE_SMIME
+    if (mutt_is_application_smime(b))
+      handler = smime_application_smime_handler;
+#endif /* HAVE_SMIME */
+  }
+#endif /* HAVE_(PGP||SMIME) */
+
 
 
 

diff --git a/hdrline.c b/hdrline.c
index c9b0783fa57a856dcfc206fe706a23ede2d295d5..619d57cfa99a7b536fdc1468d0834912d14cf6e1 100644 (file)
--- a/hdrline.c
+++ b/hdrline.c
@@ -26,6 +26,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 
 #include <ctype.h>
@@ -618,15 +622,17 @@ hdr_format_str (char *dest,
     
       ch = ' ';
 
-#ifdef HAVE_PGP
-      if (hdr->pgp & PGPGOODSIGN)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      if (hdr->security & GOODSIGN)
         ch = 'S';
-      else if (hdr->pgp & PGPENCRYPT)
+      else if (hdr->security & ENCRYPT)
        ch = 'P';
-      else if (hdr->pgp & PGPSIGN)
+      else if (hdr->security & SIGN)
         ch = 's';
-      else if (hdr->pgp & PGPKEY)
+#ifdef HAVE_PGP
+      else if (hdr->security & PGPKEY)
         ch = 'K';
+#endif
 #endif
 
       snprintf (buf2, sizeof (buf2),

diff --git a/headers.c b/headers.c
index c3d23e57aa07b43c264d55bc29847b34c028d4c6..2062f468116f13238c57e9e1cdc0be52f5629513 100644 (file)
--- a/headers.c
+++ b/headers.c
@@ -182,7 +182,7 @@ void mutt_edit_headers (const char *editor,
 #ifdef HAVE_PGP
     else if (ascii_strncasecmp ("pgp:", cur->data, 4) == 0)
     {
-      msg->pgp = mutt_parse_pgp_hdr (cur->data + 4, 0);
+      msg->security = mutt_parse_crypt_hdr (cur->data + 4, 0);
       keep = 0;
     }
 #endif

diff --git a/hook.c b/hook.c
index 01f2f3ecb6cd50c879fdfbd8bdd93c169d3f08d1..9972a23a94dcab7b8ea7c82ab334a323cfae56af 100644 (file)
--- a/hook.c
+++ b/hook.c
@@ -87,8 +87,11 @@ int mutt_parse_hook (BUFFER *buf, BUFFER *s, unsigned long data, BUFFER *err)
     memset (&pattern, 0, sizeof (pattern));
     pattern.data = safe_strdup (path);
   }
-  else if (DefaultHook && (data & (M_FOLDERHOOK | M_MBOXHOOK | M_SENDHOOK |
-                                  M_FCCHOOK | M_SAVEHOOK | M_MESSAGEHOOK)))
+  else if (DefaultHook && !(data & M_CHARSETHOOK)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      && !(data & M_CRYPTHOOK)
+#endif /* HAVE_PGP */
+      )
   {
     char tmp[HUGE_STRING];
 
@@ -441,10 +444,10 @@ char *mutt_iconv_hook (const char *chs)
   return _mutt_string_hook (chs, M_ICONVHOOK);
 }
 
-#ifdef HAVE_PGP
-char *mutt_pgp_hook (ADDRESS *adr)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+char *mutt_crypt_hook (ADDRESS *adr)
 {
-  return _mutt_string_hook (adr->mailbox, M_PGPHOOK);
+  return _mutt_string_hook (adr->mailbox, M_CRYPTHOOK);
 }
 #endif /* HAVE_PGP */
 

diff --git a/imap/message.c b/imap/message.c
index 65b74bd8c6c84497d296f8a2eb4fccd7279e247b..540de7a9017a87cd9b8123c66af47768c0f08c0c 100644 (file)
--- a/imap/message.c
+++ b/imap/message.c
@@ -378,9 +378,9 @@ int imap_fetch_message (MESSAGE *msg, CONTEXT *ctx, int msgno)
   h->content->length = ftell (msg->fp) - h->content->offset;
 
   /* This needs to be done in case this is a multipart message */
-#ifdef HAVE_PGP
-  h->pgp = pgp_query (h->content);
-#endif /* HAVE_PGP */
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  h->security = crypt_query (h->content);
+#endif
 
   mutt_clear_error();
   rewind (msg->fp);

diff --git a/init.c b/init.c
index a96bc049ae98d8d1167d3ca65ab53639825d09ec..a665a899ea1a222dcaa8f69a27ad76672469ea00 100644 (file)
--- a/init.c
+++ b/init.c
@@ -31,6 +31,11 @@
 #endif
 
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
+
 #if defined(USE_SSL) || defined(USE_NSS)
 #include "mutt_ssl.h"
 #endif

diff --git a/init.h b/init.h
index b119d76f08957ee6f17ea505ed8ac1265ba253f8..de8e031acd951c4ed143e9e8596d31130be2d682 100644 (file)
--- a/init.h
+++ b/init.h
@@ -90,6 +90,9 @@ struct option_t
 # ifndef HAVE_PGP
 #  define HAVE_PGP
 # endif
+# ifndef HAVE_SMIME
+#  define HAVE_SMIME
+# endif
 # ifndef USE_POP
 #  define USE_POP
 # endif
@@ -501,7 +504,7 @@ struct option_t MuttVars[] = {
   ** This variable controls whether or not attachments on outgoing messages
   ** are saved along with the main body of your message.
   */
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   { "fcc_clear",       DT_BOOL, R_NONE, OPTFCCCLEAR, 0 },
   /*
   ** .pp
@@ -1146,25 +1149,35 @@ struct option_t MuttVars[] = {
   */
   
 
-#ifdef HAVE_PGP
-
-  { "pgp_autosign",    DT_BOOL, R_NONE, OPTPGPAUTOSIGN, 0 },
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+# ifdef HAVE_PGP
+  { "pgp_autosign",    DT_SYN,  R_NONE, UL "crypt_autosign", 0 },
+# endif  
+  { "crypt_autosign",  DT_BOOL, R_NONE, OPTCRYPTAUTOSIGN, 0 },
   /*
   ** .pp
-  ** Setting this variable will cause Mutt to always attempt to PGP/MIME
-  ** sign outgoing messages.  This can be overridden by use of the \fIpgp-
-  ** menu\fP, when signing is not required or encryption is requested as
-  ** well.
+  ** Setting this variable will cause Mutt to always attempt to
+  ** cryptographically sign outgoing messages.  This can be overridden
+  ** by use of the \fIpgp-menu\fP, when signing is not required or
+  ** encryption is requested as well. IF ``$$smime_is_default'' is set,
+  ** then OpenSSL is used instead to create S/MIME messages and settings can
+  ** be overridden by use of the \fIsmime-menu\fP.
   */
-  { "pgp_autoencrypt", DT_BOOL, R_NONE, OPTPGPAUTOENCRYPT, 0 },
+# ifdef HAVE_PGP
+  { "pgp_autoencrypt",         DT_SYN,  R_NONE, UL "crypt_autoencrypt", 0 },
+# endif
+  { "crypt_autoencrypt",       DT_BOOL, R_NONE, OPTCRYPTAUTOENCRYPT, 0 },
   /*
   ** .pp
   ** Setting this variable will cause Mutt to always attempt to PGP/MIME
   ** encrypt outgoing messages.  This is probably only useful in connection
   ** to the \fIsend-hook\fP command.  It can be overridden by use of the
   ** \fIpgp-menu\fP, when encryption is not required or signing is
-  ** requested as well.
+  ** requested as well.  IF ``$$smime_is_default'' is set, then
+  ** OpenSSL is used instead to create S/MIME messages and settings can
+  ** be overridden by use of the \fIsmime-menu\fP.
   */
+#ifdef HAVE_PGP
   { "pgp_ignore_subkeys", DT_BOOL, R_NONE, OPTPGPIGNORESUB, 1},
   /*
   ** .pp
@@ -1172,6 +1185,64 @@ struct option_t MuttVars[] = {
   ** the principal key will inherit the subkeys' capabilities.  Unset this
   ** if you want to play interesting key selection games.
   */
+#endif
+#ifdef HAVE_PGP
+  { "pgp_replyencrypt",                DT_SYN,  R_NONE, UL "crypt_replyencrypt", 0 },
+#endif
+  { "crypt_replyencrypt",      DT_BOOL, R_NONE, OPTCRYPTREPLYENCRYPT, 0 },
+  /*
+  ** .pp
+  ** If set, automatically PGP or OpenSSL encrypt replies to messages which are
+  ** encrypted.
+  */
+#ifdef HAVE_PGP
+  { "pgp_replysign",   DT_SYN, R_NONE, UL "crypt_replysign", 0 },
+#endif
+  { "crypt_replysign", DT_BOOL, R_NONE, OPTCRYPTREPLYSIGN, 0 },
+  /*
+  ** .pp
+  ** If set, automatically PGP or OpenSSL sign replies to messages which are
+  ** signed.
+  ** .pp
+  ** \fBNote:\fP this does not work on messages that are encrypted
+  ** \fBand\fP signed!
+  */
+#ifdef HAVE_PGP
+  { "pgp_replysignencrypted",   DT_SYN,  R_NONE, UL "crypt_replysignencrypted", 0},
+#endif
+  { "crypt_replysignencrypted", DT_BOOL, R_NONE, OPTCRYPTREPLYSIGNENCRYPTED, 0 },
+  /*
+  ** .pp
+  ** If set, automatically PGP/OpenSSL sign replies to messages which are
+  ** encrypted. This makes sense in combination with
+  ** ``$$crypt_replyencrypt'', because it allows you to sign all messages
+  ** which are automatically encrypted.  This works around the problem
+  ** noted in ``$$crypt_replysign'', that mutt is not able to find out
+  ** whether an encrypted message is also signed.
+  */
+#ifdef HAVE_PGP
+  { "pgp_verify_sig",   DT_SYN,  R_NONE, UL "crypt_verify_sig", 0},
+#endif
+  { "crypt_verify_sig",        DT_QUAD, R_NONE, OPT_VERIFYSIG, M_YES },
+  /*
+  ** .pp
+  ** If ``yes'', always attempt to verify PGP/MIME or S/MIME signatures.
+  ** If ``ask'', ask whether or not to verify the signature. 
+  ** If ``no'', never attempt to verify cryptographic signatures.
+  */
+#endif /*  defined(HAVE_PGP) || defined(HAVE_SMIME) */
+#ifdef HAVE_SMIME
+  { "smime_is_default", DT_BOOL,  R_NONE, OPTSMIMEISDEFAULT, 0},
+  /*
+  ** .pp
+  ** The default behaviour of mutt is to use PGP on all auto-sign/encryption
+  ** operations. To override and to use OpenSSL instead this must be set.
+  ** However, this has no effect while replying, since mutt will automatically 
+  ** select the same application that was used to sign/encrypt the original
+  ** message.
+  */
+#endif
+#ifdef HAVE_PGP
   { "pgp_entry_format", DT_STR,  R_NONE, UL &PgpEntryFormat, UL "%4n %t%f %4l/0x%k %-4a %2c %u" },
   /*
   ** .pp
@@ -1204,30 +1275,6 @@ struct option_t MuttVars[] = {
   ** .pp
   ** If set, use 64 bit PGP key IDs. Unset uses the normal 32 bit Key IDs.
   */
-  { "pgp_replyencrypt",        DT_BOOL, R_NONE, OPTPGPREPLYENCRYPT, 1 },
-  /*
-  ** .pp
-  ** If set, automatically PGP encrypt replies to messages which are
-  ** encrypted.
-  */
-  { "pgp_replysign",   DT_BOOL, R_NONE, OPTPGPREPLYSIGN, 0 },
-  /*
-  ** .pp
-  ** If set, automatically PGP sign replies to messages which are signed.
-  ** .pp
-  ** \fBNote:\fP this does not work on messages that are encrypted
-  ** \fBand\fP signed!
-  */
-  { "pgp_replysignencrypted", DT_BOOL, R_NONE, OPTPGPREPLYSIGNENCRYPTED, 0 },
-  /*
-  ** .pp
-  ** If set, automatically PGP sign replies to messages which are
-  ** encrypted. This makes sense in combination with
-  ** ``$$pgp_replyencrypt'', because it allows you to sign all messages
-  ** which are automatically encrypted.  This works around the problem
-  ** noted in ``$$pgp_replysign'', that mutt is not able to find out
-  ** whether an encrypted message is also signed.
-  */
   { "pgp_retainable_sigs", DT_BOOL, R_NONE, OPTPGPRETAINABLESIG, 0 },
   /*
   ** .pp
@@ -1266,14 +1313,6 @@ struct option_t MuttVars[] = {
   ** The number of seconds after which a cached passphrase will expire if
   ** not used.
   */
-  { "pgp_verify_sig",  DT_QUAD, R_NONE, OPT_VERIFYSIG, M_YES },
-  /*
-  ** .pp
-  ** If ``yes'', always attempt to verify PGP/MIME signatures.  If ``ask-yes''
-  ** or ``ask-no'',
-  ** ask whether or not to verify the signature.  If ``no'', never attempt
-  ** to verify PGP/MIME signatures.
-  */
   { "pgp_sort_keys",   DT_SORT|DT_SORT_KEYS, R_NONE, UL &PgpSortKeys, SORT_ADDRESS },
   /*
   ** .pp
@@ -1418,6 +1457,130 @@ struct option_t MuttVars[] = {
   */
 #endif /* HAVE_PGP */
   
+#ifdef HAVE_SMIME
+  { "smime_timeout",           DT_NUM,  R_NONE, UL &SmimeTimeout, 300 },
+  /*
+  ** .pp
+  ** The number of seconds after which a cached passphrase will expire if
+  ** not used.
+  */
+  { "smime_encrypt_with",      DT_STR,  R_NONE, UL &SmimeCryptAlg, 0 },
+  /*
+  ** .pp
+  ** This sets the algorithm that should be used for encryption.
+  ** Valid choices are "des", "des3", "rc2-40", "rc2-64", "rc2-128".
+  ** If unset "3des" (TrippleDES) is used.
+  */
+  { "smime_keys",              DT_PATH, R_NONE, UL &SmimeKeys, 0 },
+  /*
+  ** .pp
+  ** Since there is no pubring/secring as with PGP, mutt has to handle
+  ** storage ad retrieval of keys by itself. This is very basic right now,
+  ** and stores keys and certificates in two different directories, both
+  ** named as the hash-value retrieved from OpenSSl. There is an index file
+  ** which contains mailbox-address keyid pai, and which can be manually
+  ** edited.
+  */
+  { "smime_certificates",      DT_PATH, R_NONE, UL &SmimeCertificates, 0 },
+  /*
+  ** .pp
+  ** Since there is no pubring/secring as with PGP, mutt has to handle
+  ** storage ad retrieval of keys by itself. This is very basic right now,
+  ** and stores keys and certificates in two different directories, both
+  ** named as the hash-value retrieved from OpenSSl. There is an index file
+  ** which contains mailbox-address keyid pai, and which can be manually
+  ** edited.
+  */
+  { "smime_decrypt_command",   DT_STR, R_NONE, UL &SmimeDecryptCommand, 0},
+  /*
+  ** .pp
+  ** This format strings specifies a command which is used to decrypt
+  ** application/x-pkcs7-mime attachments.
+  ** .pp
+  ** The OpenSSL command formats have their own set of printf-like sequences
+  ** similar to PGP's:
+  ** .pp
+  ** .dl
+  ** .dt %f .dd Expands to the name of a file containing a message.
+  ** .dt %s .dd Expands to the name of a file containing the signature part
+  ** .          of a multipart/signed attachment when verifying it.
+  ** .dt %k .dd The key-pair specified with $$smime_sign_as.
+  ** .dt %c .dd One or more certificate IDs.
+  ** .dt %a .dd The algorithm used for encryption.
+  ** .de
+  ** .pp
+  ** For examples on how to configure these formats, see the smime.rc
+  ** the samples/ subdirectory which has been installed on your system
+  ** alongside the documentation.
+  */
+  { "smime_verify_command",    DT_STR, R_NONE, UL &SmimeVerifyCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to verify S/MIME signatures of type multipart/signed.
+  */
+  { "smime_verify_opaque_command",     DT_STR, R_NONE, UL &SmimeVerifyOpaqueCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to verify S/MIME signatures of type
+  ** application/x-pkcs7-mime.
+  */
+  { "smime_sign_command",      DT_STR, R_NONE, UL &SmimeSignCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to created S/MIME signatures of type
+  ** multipart/signed, which can be read by all mail clients.
+  */
+  { "smime_sign_opaque_command",       DT_STR, R_NONE, UL &SmimeSignOpaqueCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to created S/MIME signatures of type
+  ** applicatipn/x-pkcs7-signature, which can only be handled by mail
+  ** clients supporting the S/MIME extension
+  */
+  { "smime_encrypt_command",   DT_STR, R_NONE, UL &SmimeEncryptCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to create encrypted  S/MIME messages.
+  */
+  { "smime_pk7out_command",    DT_STR, R_NONE, UL &SmimePk7outCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to extract PKCS7 structures of S/MIME signatures,
+  ** in Order to extract the public X509 certificate(s).
+  */
+  { "smime_get_cert_command",  DT_STR, R_NONE, UL &SmimeGetCertCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to extract X509 certificates from a PKCS7 structure.
+  */
+  { "smime_get_signer_cert_command",   DT_STR, R_NONE, UL &SmimeGetSignerCertCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to extract only the signers X509 certificate from a S/MIME signature,
+  ** so that the certificate's owner may get compared to the email's from field.
+  */
+  { "smime_hash_cert_command",         DT_STR, R_NONE, UL &SmimeHashCertCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to calculate a hash value used for storing
+  ** X509 certificates.
+  */
+  { "smime_get_cert_email_command",    DT_STR, R_NONE, UL &SmimeGetCertEmailCommand, 0},
+  /*
+  ** .pp
+  ** This command is used to extract the mail address used for storing
+  ** X509 certificates, abd for verification purposes (to see if the
+  ** certifacate was issued for the sender's mailbox.
+  */
+  { "smime_sign_as",           DT_STR,  R_NONE, UL &SmimeSignAs, 0 },
+  /*
+  ** .pp
+  ** This is the default key-pair to use vor signing. This must be set to the
+  ** keyid (the hash-value, OpenSSL generates) to work properly (key handling
+  ** is very limited right now.)
+  */
+#endif /* HAVE_SMIME */
+  
 #if defined(USE_SSL)||defined(USE_NSS)
 # ifndef USE_NSS  
   { "ssl_starttls", DT_QUAD, R_NONE, OPT_SSLSTARTTLS, M_YES },
@@ -2460,7 +2623,10 @@ struct command_t Commands[] = {
   { "mono",            mutt_parse_mono,        0 },
   { "my_hdr",          parse_my_hdr,           0 },
 #ifdef HAVE_PGP
-  { "pgp-hook",                mutt_parse_hook,        M_PGPHOOK },
+  { "pgp-hook",                mutt_parse_hook,        M_CRYPTHOOK },
+#endif
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  { "crypt-hook",      mutt_parse_hook,        M_CRYPTHOOK },
 #endif /* HAVE_PGP */
   { "push",            mutt_parse_push,        0 },
   { "reset",           parse_set,              M_SET_RESET },

diff --git a/keymap.c b/keymap.c
index dd3cc3053909bb71bdab040a50dc34f70f92030a..6a4ba0d9a6db583c62860a4ab6f022404360758e 100644 (file)
--- a/keymap.c
+++ b/keymap.c
@@ -43,6 +43,10 @@ struct mapping_t Menus[] = {
  { "pgp",      MENU_PGP },
 #endif  
   
+#ifdef HAVE_SMIME
+ { "smime",    MENU_SMIME },
+#endif
+ 
 #ifdef MIXMASTER
   { "mix",     MENU_MIX },
 #endif
@@ -533,6 +537,10 @@ void km_init (void)
   create_bindings (OpPgp, MENU_PGP);
 #endif
 
+#ifdef HAVE_SMIME
+  create_bindings (OpSmime, MENU_SMIME);
+#endif
+
 #ifdef MIXMASTER
   create_bindings (OpMix, MENU_MIX);
   

diff --git a/keymap.h b/keymap.h
index 34937e7551bf37c96c9b6a96424db873b9838429..1908d87a8f49d83d379784d1ba3f54e119ecea15 100644 (file)
--- a/keymap.h
+++ b/keymap.h
@@ -65,6 +65,10 @@ enum
   MENU_PGP,
 #endif
 
+#ifdef HAVE_SMIME
+  MENU_SMIME,
+#endif
+
 #ifdef MIXMASTER
   MENU_MIX,
 #endif
@@ -106,6 +110,10 @@ extern struct binding_t OpAlias[];
 extern struct binding_t OpPgp[];
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+extern struct binding_t OpSmime[];
+#endif /* HAVE_SMIME */
+
 #ifdef MIXMASTER
 extern struct binding_t OpMix[];
 #endif

diff --git a/main.c b/main.c
index 1bd9fc05ca7e4de22b2af1335d9460466cff28c7..bbea082b1302f69ee43fa503cee497683b799d12 100644 (file)
--- a/main.c
+++ b/main.c
@@ -297,6 +297,17 @@ static void show_version (void)
 #else
        "-HAVE_PGP  "
 #endif
+#ifdef HAVE_SMIME
+       "+HAVE_SMIME  "
+#else
+       "-HAVE_SMIME  "
+#endif
+
+#ifdef HAVE_SMIME
+       "+HAVE_SMIME  "
+#else
+       "-HAVE_SMIME  "
+#endif
 
 #ifdef BUFFY_SIZE
        "+BUFFY_SIZE "

diff --git a/mutt.h b/mutt.h
index 6c2eb4ffa5646764831ba54c95d322db96aebfa7..a3f8902e1b8635aaaa2cfba7cb90acb28729d87a 100644 (file)
--- a/mutt.h
+++ b/mutt.h
@@ -139,8 +139,8 @@ typedef enum
 #define M_CHARSETHOOK  (1<<5)
 #define M_ICONVHOOK    (1<<6)
 #define M_MESSAGEHOOK  (1<<7)
-#ifdef HAVE_PGP
-#define M_PGPHOOK      (1<<8)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+#define M_CRYPTHOOK    (1<<8)
 #endif
 #define M_ACCOUNTHOOK  (1<<9)
 
@@ -253,10 +253,12 @@ enum
 enum
 {
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP)||  defined(HAVE_SMIME)
   OPT_VERIFYSIG,      /* verify PGP signatures */
+#ifdef HAVE_PGP
   OPT_PGPTRADITIONAL, /* create old-style PGP messages */
 #endif
+#endif
 
 #ifdef USE_SSL
   OPT_SSLSTARTTLS,
@@ -411,14 +413,19 @@ enum
 
   /* PGP options */
   
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  OPTCRYPTAUTOSIGN,
+  OPTCRYPTAUTOENCRYPT,
+  OPTCRYPTREPLYENCRYPT,
+  OPTCRYPTREPLYSIGN,
+  OPTCRYPTREPLYSIGNENCRYPTED,
+#ifdef HAVE_SMIME
+  OPTSMIMEISDEFAULT,
+#endif
 #ifdef HAVE_PGP
-  OPTPGPAUTOSIGN,
-  OPTPGPAUTOENCRYPT,
   OPTPGPIGNORESUB,
   OPTPGPLONGIDS,
-  OPTPGPREPLYENCRYPT,
-  OPTPGPREPLYSIGN,
-  OPTPGPREPLYSIGNENCRYPTED,
+#endif
 #if 0
   OPTPGPENCRYPTSELF,
 #endif
@@ -600,8 +607,9 @@ typedef struct body
                                 * set when in send-mode.
                                 */
 
-#ifdef HAVE_PGP
-  unsigned int goodsig : 1;    /* good PGP signature */
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  unsigned int goodsig : 1;    /* good cryptographic signature */
+  unsigned int badsig : 1;     /* bad cryptographic signature (needed to check encrypted s/mime-signatures */
 #endif
 
   unsigned int collapsed : 1;  /* used by recvattach */
@@ -610,8 +618,9 @@ typedef struct body
 
 typedef struct header
 {
-#ifdef HAVE_PGP
-  unsigned int pgp : 4;
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  unsigned int security : 7;  /* bit 0-4: flags, bit 5,6: application.
+                                see: crypt.h pgplib.h, smime.h */
 #endif
 
   unsigned int mime : 1;               /* has a Mime-Version header? */
@@ -791,7 +800,7 @@ typedef struct
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
 #define M_VERIFY       (1<<1) /* perform signature verification */
 #endif
 

diff --git a/muttlib.c b/muttlib.c
index 53d696c3453508ca8b39221df84b7e331f30297c..58637801da0f1516fcf0790f004047170db4a31c 100644 (file)
--- a/muttlib.c
+++ b/muttlib.c
@@ -28,12 +28,16 @@
 
 #ifdef USE_IMAP
 #include "imap.h"
-#endif
+ #endif
 
 #ifdef HAVE_PGP
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #include <string.h>
 #include <ctype.h>
 #include <unistd.h>
@@ -594,9 +598,14 @@ int mutt_needs_mailcap (BODY *m)
     case TYPEAPPLICATION:
       if(mutt_is_application_pgp(m))
        return 0;
-      break;
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+      if(mutt_is_application_smime(m))
+       return 0;
+      break;
+#endif /* HAVE_SMIME */
+
 
     case TYPEMULTIPART:
     case TYPEMESSAGE:

diff --git a/mx.c b/mx.c
index ce2147da1a7a19788cecabc2f8e340d69ecdae72..2ec41afebb424e3423102ad2e69e70a2ebc9033f 100644 (file)
--- a/mx.c
+++ b/mx.c
@@ -30,6 +30,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #ifdef USE_IMAP
 #include "imap.h"
 #endif
@@ -1570,10 +1574,10 @@ void mx_update_context (CONTEXT *ctx, int new_messages)
 
 
 
-#ifdef HAVE_PGP
+#ifdef HAVE_PGP || defined(HAVE_SMIME)
     /* NOTE: this _must_ be done before the check for mailcap! */
-    h->pgp = pgp_query (h->content);
-#endif /* HAVE_PGP */
+    h->security = crypt_query (h->content);
+#endif /* HAVE_PGP || HAVE_SMIME */
 
     if (!ctx->pattern)
     {

diff --git a/pager.c b/pager.c
index 2c5f1183429a3522ae5a4e83f78a72778c82cb6c..d3a74cdb985490a49fcfc11dbb13ae63a41a2ed9 100644 (file)
--- a/pager.c
+++ b/pager.c
@@ -38,6 +38,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 
 
@@ -2383,7 +2387,7 @@ mutt_pager (const char *banner, const char *fname, int flags, pager_t *extra)
        redraw = REDRAW_FULL;
        break;
 
-#ifdef HAVE_PGP      
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_DECRYPT_SAVE:
 #endif
       case OP_SAVE:
@@ -2396,22 +2400,22 @@ mutt_pager (const char *banner, const char *fname, int flags, pager_t *extra)
       case OP_COPY_MESSAGE:
       case OP_DECODE_SAVE:
       case OP_DECODE_COPY:
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_DECRYPT_COPY:
 #endif
        CHECK_MODE(IsHeader (extra));
        if (mutt_save_message (extra->hdr,
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
                               (ch == OP_DECRYPT_SAVE) ||
 #endif                        
                               (ch == OP_SAVE) || (ch == OP_DECODE_SAVE),
                               (ch == OP_DECODE_SAVE) || (ch == OP_DECODE_COPY),
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
                               (ch == OP_DECRYPT_SAVE) || (ch == OP_DECRYPT_COPY) ||
 #endif
                               0,
                               &redraw) == 0 && (ch == OP_SAVE || ch == OP_DECODE_SAVE
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
                                                 || ch == OP_DECRYPT_SAVE
 #endif
                                                 ))
@@ -2517,23 +2521,26 @@ mutt_pager (const char *banner, const char *fname, int flags, pager_t *extra)
 
 
 #ifdef HAVE_PGP
-      case OP_FORGET_PASSPHRASE:
-       mutt_forget_passphrase ();
-       break;
-
       case OP_MAIL_KEY:
        CHECK_MODE(IsHeader(extra));
         CHECK_ATTACH;
        ci_send_message (SENDKEY, NULL, NULL, extra->ctx, extra->hdr);
        redraw = REDRAW_FULL;
        break;
-      
+#endif /* HAVE_PGP || HAVE_SMIME */
+
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      case OP_FORGET_PASSPHRASE:
+       crypt_forget_passphrase ();
+       break;
+
       case OP_EXTRACT_KEYS:
         CHECK_MODE(IsHeader(extra));
-        pgp_extract_keys_from_messages(extra->hdr);
+       crypt_extract_keys_from_messages(extra->hdr);
         redraw = REDRAW_FULL;
         break;
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
 
 
 

diff --git a/parse.c b/parse.c
index 4aa3173ec668a8f4d2b9333c2a8979e0da5c18e0..0b20f63e01b0346eb7a71552dcad9c2a1c222260 100644 (file)
--- a/parse.c
+++ b/parse.c
@@ -28,6 +28,10 @@
 #include "pgp.h"
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif /* HAVE_SMIME */
+
 
 
 #include <string.h>
@@ -934,11 +938,9 @@ void mutt_parse_mime_message (CONTEXT *ctx, HEADER *cur)
   {
     mutt_parse_part (msg->fp, cur->content);
 
-
-#ifdef HAVE_PGP
-    cur->pgp = pgp_query (cur->content);
-#endif /* HAVE_PGP */
-
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
+    cur->security = crypt_query (cur->content);
+#endif
 
     mx_close_message (&msg);
   }

diff --git a/pattern.c b/pattern.c
index 1803bbcdb602c17796bb62e880d5948456b3fac4..2f0335e8f0b7bf33955d1a3130dcac10910e2861 100644 (file)
--- a/pattern.c
+++ b/pattern.c
@@ -35,6 +35,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 
 static int eat_regexp (pattern_t *pat, BUFFER *, BUFFER *);
@@ -173,8 +177,8 @@ msg_search (CONTEXT *ctx, regex_t *rx, char *buf, size_t blen, int op, int msgno
 
 
 
-#ifdef HAVE_PGP
-       if (h->pgp & PGPENCRYPT && !pgp_valid_passphrase())
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+       if (h->security & ENCRYPT && !crypt_valid_passphrase(h->security))
        {
          mx_close_message (&msg);
          if (fp)
@@ -1043,11 +1047,11 @@ mutt_pattern_exec (struct pattern_t *pat, pattern_exec_flag flags, CONTEXT *ctx,
       return (pat->not ^ (h->collapsed && h->num_hidden > 1));
 #ifdef HAVE_PGP
    case M_PGP_SIGN:
-     return (pat->not ^ (h->pgp & PGPSIGN));
+     return (pat->not ^ (h->security & APPLICATION_PGP && h->security & SIGN));
    case M_PGP_ENCRYPT:
-     return (pat->not ^ (h->pgp & PGPENCRYPT));
+     return (pat->not ^ (h->security & APPLICATION_PGP && h->security & ENCRYPT));
    case M_PGP_KEY:
-     return (pat->not ^ (h->pgp & PGPKEY));
+     return (pat->not ^ (h->security & APPLICATION_PGP && h->security & PGPKEY));
 #endif
     case M_XLABEL:
       return (pat->not ^ (h->env->x_label && regexec (pat->rx, h->env->x_label, 0, NULL, 0) == 0));

diff --git a/pgp.c b/pgp.c
index 49fe657ba58e73282c02dac90a8d674a55881041..5f4b3650022d92e3d40cf2174deb624a13a787f1 100644 (file)
--- a/pgp.c
+++ b/pgp.c
@@ -53,9 +53,12 @@
 
 #ifdef HAVE_PGP
 
+#include "crypt.h"
+
+
 
 char PgpPass[STRING];
-static time_t PgpExptime = 0; /* when does the cached passphrase expire? */
+time_t PgpExptime = 0; /* when does the cached passphrase expire? */
 
 void pgp_void_passphrase (void)
 {
@@ -63,47 +66,8 @@ void pgp_void_passphrase (void)
   PgpExptime = 0;
 }
 
-# if defined(HAVE_SETRLIMIT) && (!defined(DEBUG))
-
-static void disable_coredumps (void)
-{
-  struct rlimit rl = {0, 0};
-  static short done = 0;
-
-  if (!done)
-  {
-    setrlimit (RLIMIT_CORE, &rl);
-    done = 1;
-  }
-}
-
-# endif /* HAVE_SETRLIMIT */
 
-int pgp_valid_passphrase (void)
-{
-  time_t now = time (NULL);
-
-# if defined(HAVE_SETRLIMIT) && (!defined(DEBUG))
-  disable_coredumps ();
-# endif
-
-  if (now < PgpExptime) return 1; /* just use the cached copy. */
-  pgp_void_passphrase ();
-
-  if (mutt_get_password (_("Enter PGP passphrase:"), PgpPass, sizeof (PgpPass)) == 0)
-  {
-    PgpExptime = time (NULL) + PgpTimeout;
-    return (1);
-  }
-  else
-  {
-    PgpExptime = 0;
-    return (0);
-  }
-  /* not reached */
-}
-
-void mutt_forget_passphrase (void)
+void pgp_forget_passphrase (void)
 {
   pgp_void_passphrase ();
   mutt_message _("PGP passphrase forgotten.");
@@ -130,20 +94,6 @@ char *_pgp_keyid(pgp_key_t *k)
  * Routines for handing PGP input.
  */
 
-/* print the current time to avoid spoofing of the signature output */
-static void pgp_current_time (STATE *s)
-{
-  time_t t;
-  char p[STRING];
-
-  t = time (NULL);
-  setlocale (LC_TIME, "");
-  strftime (p, sizeof (p),
-           _("[-- PGP output follows (current time: %c) --]\n"),
-           localtime (&t));
-  setlocale (LC_TIME, "C");
-  state_attach_puts (p, s);
-}
 
 
 /* Copy PGP output messages and look for signs of a good signature */
@@ -378,7 +328,7 @@ void pgp_application_pgp_handler (BODY *m, STATE *s)
          safe_fclose (&pgpin);
          
          if (s->flags & M_DISPLAY)
-           pgp_current_time (s);
+           crypt_current_time (s, "PGP");
          
          rv = mutt_wait_filter (thepid);
          
@@ -547,22 +497,8 @@ int pgp_check_traditional (FILE *fp, BODY *b, int tagged_only)
   return rv;
 }
 
-int mutt_is_multipart_signed (BODY *b)
-{
-  char *p;
-
-  if (!b || b->type != TYPEMULTIPART ||
-      !b->subtype || ascii_strcasecmp (b->subtype, "signed") ||
-      !(p = mutt_get_parameter ("protocol", b->parameter)) ||
-      (ascii_strcasecmp (p, "application/pgp-signature")
-      && ascii_strcasecmp (p, "multipart/mixed")))
-    return 0;
-
-  return PGPSIGN;
-}
-   
      
-int mutt_is_multipart_encrypted (BODY *b)
+int pgp_is_multipart_encrypted (BODY *b)
 {
   char *p;
   
@@ -604,96 +540,10 @@ int mutt_is_application_pgp (BODY *m)
   return t;
 }
 
-int pgp_query (BODY *m)
-{
-  int t = 0;
-
-  t |= mutt_is_application_pgp (m);
-
-  if ((t & (PGPSIGN|PGPENCRYPT)) && m->goodsig)
-    t |= PGPGOODSIGN|PGPSIGN;
-  else if (m->type == TYPEMULTIPART)
-  {
-    if (mutt_is_multipart_signed(m))
-      t |= PGPSIGN;
-    else if (mutt_is_multipart_encrypted(m))
-      t |= PGPENCRYPT;
-
-    if (m->goodsig && 
-       (mutt_is_multipart_signed (m) || mutt_is_multipart_encrypted (m)))
-      t |= PGPGOODSIGN;
-  }
-  
-  if (m->type == TYPEMULTIPART || m->type == TYPEMESSAGE)
-  {
-    BODY *p;
- 
-    for (p = m->parts; p; p = p->next)
-      t |= pgp_query(p) & ~PGPGOODSIGN;
-  }
-
-  return t;
-}
-
-static void pgp_fetch_signatures (BODY ***signatures, BODY *a, int *n)
-{
-  for (; a; a = a->next)
-  {
-    if(a->type == TYPEMULTIPART)
-      pgp_fetch_signatures (signatures, a->parts, n);
-    else
-    {
-      if((*n % 5) == 0)
-       safe_realloc((void **) signatures, (*n + 6) * sizeof(BODY **));
 
-      (*signatures)[(*n)++] = a;
-    }
-  }
-}
 
-static int pgp_write_signed(BODY *a, STATE *s, const char *tempfile)
-{
-  FILE *fp;
-  int c;
-  short hadcr;
-  size_t bytes;
 
-  if(!(fp = safe_fopen (tempfile, "w")))
-  {
-    mutt_perror(tempfile);
-    return -1;
-  }
-      
-  fseek (s->fpin, a->hdr_offset, 0);
-  bytes = a->length + a->offset - a->hdr_offset;
-  hadcr = 0;
-  while (bytes > 0)
-  {
-    if((c = fgetc(s->fpin)) == EOF)
-      break;
-    
-    bytes--;
-    
-    if(c == '\r')
-      hadcr = 1;
-    else 
-    {
-      if(c == '\n' && !hadcr)
-       fputc('\r', fp);
-      
-      hadcr = 0;
-    }
-    
-    fputc(c, fp);
-    
-  }
-  fclose (fp);
-
-  return 0;
-}
-
-
-static int pgp_verify_one (BODY *sigbdy, STATE *s, const char *tempfile)
+int pgp_verify_one (BODY *sigbdy, STATE *s, const char *tempfile)
 {
   char sigfile[_POSIX_PATH_MAX], pgperrfile[_POSIX_PATH_MAX];
   FILE *fp, *pgpout, *pgperr;
@@ -721,7 +571,7 @@ static int pgp_verify_one (BODY *sigbdy, STATE *s, const char *tempfile)
     return -1;
   }
   
-  pgp_current_time (s);
+  crypt_current_time (s, "PGP");
   
   if((thepid = pgp_invoke_verify (NULL, &pgpout, NULL, 
                                   -1, -1, fileno(pgperr),
@@ -756,111 +606,6 @@ static int pgp_verify_one (BODY *sigbdy, STATE *s, const char *tempfile)
   return badsig;
 }
 
-/*
- * This routine verifies a PGP/MIME signed body.
- */
-void pgp_signed_handler (BODY *a, STATE *s)
-{
-  char tempfile[_POSIX_PATH_MAX];
-  char *protocol;
-  int protocol_major = TYPEOTHER;
-  char *protocol_minor = NULL;
-  
-  BODY *b = a;
-  BODY **signatures = NULL;
-  int sigcnt = 0;
-  int i;
-  short goodsig = 1;
-
-  protocol = mutt_get_parameter ("protocol", a->parameter);
-  a = a->parts;
-
-  /* extract the protocol information */
-  
-  if (protocol)
-  {
-    char major[STRING];
-    char *t;
-
-    if ((protocol_minor = strchr(protocol, '/'))) protocol_minor++;
-    
-    strfcpy(major, protocol, sizeof(major));
-    if((t = strchr(major, '/')))
-      *t = '\0';
-    
-    protocol_major = mutt_check_mime_type (major);
-  }
-
-  /* consistency check */
-
-  if (!(a && a->next && a->next->type == protocol_major && 
-      !ascii_strcasecmp(a->next->subtype, protocol_minor)))
-  {
-    state_attach_puts(_("[-- Error: Inconsistent multipart/signed structure! --]\n\n"), s);
-    mutt_body_handler (a, s);
-    return;
-  }
-
-  if(!(protocol_major == TYPEAPPLICATION && !ascii_strcasecmp(protocol_minor, "pgp-signature"))
-     && !(protocol_major == TYPEMULTIPART && !ascii_strcasecmp(protocol_minor, "mixed")))
-  {
-    state_mark_attach (s);
-    state_printf(s, _("[-- Error: Unknown multipart/signed protocol %s! --]\n\n"), protocol);
-    mutt_body_handler (a, s);
-    return;
-  }
-  
-  if (s->flags & M_DISPLAY)
-  {
-    
-    pgp_fetch_signatures(&signatures, a->next, &sigcnt);
-    
-    if (sigcnt)
-    {
-      mutt_mktemp (tempfile);
-      if (pgp_write_signed (a, s, tempfile) == 0)
-      {
-       for (i = 0; i < sigcnt; i++)
-       {
-         if (signatures[i]->type == TYPEAPPLICATION 
-             && !ascii_strcasecmp(signatures[i]->subtype, "pgp-signature"))
-         {
-           if (pgp_verify_one (signatures[i], s, tempfile) != 0)
-             goodsig = 0;
-         }
-         else
-         {
-           state_mark_attach (s);
-           state_printf (s, _("[-- Warning: We can't verify %s/%s signatures. --]\n\n"),
-                         TYPE(signatures[i]), signatures[i]->subtype);
-         }
-       }
-      }
-      
-      mutt_unlink (tempfile);
-
-      b->goodsig = goodsig;
-      
-      dprint (2, (debugfile, "pgp_signed_handler: goodsig = %d\n", goodsig));
-      
-      /* Now display the signed body */
-      state_attach_puts (_("[-- The following data is signed --]\n\n"), s);
-
-
-      safe_free((void **) &signatures);
-    }
-    else
-      state_attach_puts (_("[-- Warning: Can't find any signatures. --]\n\n"), s);
-  }
-  
-  mutt_body_handler (a, s);
-  
-  if (s->flags & M_DISPLAY && sigcnt)
-  {
-    state_putc ('\n', s);
-    state_attach_puts (_("[-- End of signed data --]\n"), s);
-  }
-}
 
 /* Extract pgp public keys from messages or attachments */
 
@@ -873,7 +618,7 @@ void pgp_extract_keys_from_messages (HEADER *h)
   if (h)
   {
     mutt_parse_mime_message (Context, h);
-    if(h->pgp & PGPENCRYPT && !pgp_valid_passphrase ())
+    if(h->security & PGPENCRYPT && !pgp_valid_passphrase ())
       return;
   }
 
@@ -893,7 +638,7 @@ void pgp_extract_keys_from_messages (HEADER *h)
       if (Context->hdrs[Context->v2r[i]]->tagged)
       {
        mutt_parse_mime_message (Context, Context->hdrs[Context->v2r[i]]);
-       if (Context->hdrs[Context->v2r[i]]->pgp & PGPENCRYPT
+       if (Context->hdrs[Context->v2r[i]]->security & PGPENCRYPT
           && !pgp_valid_passphrase())
        {
          fclose (fpout);
@@ -907,7 +652,7 @@ void pgp_extract_keys_from_messages (HEADER *h)
   else
   {
     mutt_parse_mime_message (Context, h);
-    if (h->pgp & PGPENCRYPT && !pgp_valid_passphrase())
+    if (h->security & PGPENCRYPT && !pgp_valid_passphrase())
     {
       fclose (fpout);
       goto bailout;
@@ -1132,7 +877,7 @@ void pgp_encrypted_handler (BODY *a, STATE *s)
     return;
   }
 
-  if (s->flags & M_DISPLAY) pgp_current_time (s);
+  if (s->flags & M_DISPLAY) crypt_current_time (s, "PGP");
 
   if ((tattach = pgp_decrypt_part (a, s, fpout, p)) != NULL)
   {
@@ -1171,39 +916,8 @@ void pgp_encrypted_handler (BODY *a, STATE *s)
  * Routines for sending PGP/MIME messages.
  */
 
-static void convert_to_7bit (BODY *a)
-{
-  while (a)
-  {
-    if (a->type == TYPEMULTIPART)
-    {
-      if (a->encoding != ENC7BIT)
-      {
-        a->encoding = ENC7BIT;
-       convert_to_7bit(a->parts);
-      }
-      else if (option (OPTPGPSTRICTENC))
-       convert_to_7bit (a->parts);
-    } 
-    else if (a->type == TYPEMESSAGE
-            && ascii_strcasecmp(a->subtype, "delivery-status"))
-    {
-      if(a->encoding != ENC7BIT)
-       mutt_message_to_7bit(a, NULL);
-    }
-    else if (a->encoding == ENC8BIT)
-      a->encoding = ENCQUOTEDPRINTABLE;
-    else if (a->encoding == ENCBINARY)
-      a->encoding = ENCBASE64;
-    else if (a->content && a->encoding != ENCBASE64 &&
-            (a->content->from || (a->content->space && 
-                                  option (OPTPGPSTRICTENC))))
-      a->encoding = ENCQUOTEDPRINTABLE;
-    a = a->next;
-  }
-}
 
-static BODY *pgp_sign_message (BODY *a)
+BODY *pgp_sign_message (BODY *a)
 {
   BODY *t;
   char buffer[LONG_STRING];
@@ -1362,7 +1076,7 @@ char *pgp_findKeys (ADDRESS *to, ADDRESS *cc, ADDRESS *bcc)
     q = p;
     k_info = NULL;
 
-    if ((keyID = mutt_pgp_hook (p)) != NULL)
+    if ((keyID = mutt_crypt_hook (p)) != NULL)
     {
       int r;
       snprintf (buf, sizeof (buf), _("Use keyID = \"%s\" for %s?"), keyID, p->mailbox);
@@ -1425,7 +1139,7 @@ char *pgp_findKeys (ADDRESS *to, ADDRESS *cc, ADDRESS *bcc)
 /* Warning: "a" is no longer freed in this routine, you need
  * to free it later.  This is necessary for $fcc_attach. */
 
-static BODY *pgp_encrypt_message (BODY *a, char *keylist, int sign)
+BODY *pgp_encrypt_message (BODY *a, char *keylist, int sign)
 {
   char buf[LONG_STRING];
   char tempfile[_POSIX_PATH_MAX], pgperrfile[_POSIX_PATH_MAX];
@@ -1543,7 +1257,7 @@ static BODY *pgp_encrypt_message (BODY *a, char *keylist, int sign)
   return (t);
 }
 
-static BODY *pgp_traditional_encryptsign (BODY *a, int flags, char *keylist)
+BODY *pgp_traditional_encryptsign (BODY *a, int flags, char *keylist)
 {
   BODY *b;
 
@@ -1608,7 +1322,7 @@ static BODY *pgp_traditional_encryptsign (BODY *a, int flags, char *keylist)
     return NULL;
   }
 
-  if (flags & PGPSIGN)
+  if (flags & SIGN)
     fprintf (pgpin, "%s\n", PgpPass);
   fclose (pgpin);
 
@@ -1652,7 +1366,7 @@ static BODY *pgp_traditional_encryptsign (BODY *a, int flags, char *keylist)
   b->subtype = safe_strdup ("pgp");
 
   mutt_set_parameter ("format", "text", &b->parameter);
-  mutt_set_parameter ("x-action", flags & PGPENCRYPT ? "encrypt" : "sign",
+  mutt_set_parameter ("x-action", flags & ENCRYPT ? "encrypt" : "sign",
                      &b->parameter);
 
   b->filename = safe_strdup (pgpoutfile);
@@ -1671,98 +1385,5 @@ static BODY *pgp_traditional_encryptsign (BODY *a, int flags, char *keylist)
 
 
 
-int pgp_get_keys (HEADER *msg, char **pgpkeylist)
-{
-  /* Do a quick check to make sure that we can find all of the encryption
-   * keys if the user has requested this service.
-   */
-
-  set_option (OPTPGPCHECKTRUST);
-
-  *pgpkeylist = NULL;
-  if (msg->pgp & PGPENCRYPT)
-  {
-    if ((*pgpkeylist = pgp_findKeys (msg->env->to, msg->env->cc,
-                                     msg->env->bcc)) == NULL)
-      return (-1);
-  }
-
-  return (0);
-}
-
-int pgp_protect (HEADER *msg, char *pgpkeylist)
-{
-  BODY *pbody = NULL;
-  int flags = msg->pgp;
-  int traditional = 0;
-  int i;
-
-  if ((msg->pgp & PGPSIGN) && !pgp_valid_passphrase ())
-    return (-1);
-
-  if ((msg->content->type == TYPETEXT) &&
-      !ascii_strcasecmp (msg->content->subtype, "plain") &&
-      ((flags & PGPENCRYPT) || (msg->content->content && msg->content->content->hibin == 0)))
-  {
-    if ((i = query_quadoption (OPT_PGPTRADITIONAL, _("Create an application/pgp message?"))) == -1)
-      return -1;
-    else if (i == M_YES)
-      traditional = 1;
-  }
-
-  mutt_message _("Invoking PGP...");
-
-  if (!isendwin ())
-    mutt_endwin (NULL);
-
-  if (traditional)
-  {
-    if (!(pbody = pgp_traditional_encryptsign (msg->content, flags, pgpkeylist)))
-      return -1;
-    
-    msg->content = pbody;
-    return 0;
-  }
-
-  if ((flags & PGPSIGN) && (!(flags & PGPENCRYPT) || option (OPTPGPRETAINABLESIG)))
-  {
-    if (!(pbody = pgp_sign_message (msg->content)))
-      return -1;
-
-    msg->content = pbody;
-    flags &= ~PGPSIGN;
-  }
-
-  if (flags & PGPENCRYPT)
-  {
-    if (!(pbody = pgp_encrypt_message (msg->content, pgpkeylist, flags & PGPSIGN)))
-    {
-
-      /* did we perform a retainable signature? */
-      if (flags != msg->pgp)
-      {
-       /* remove the outer multipart layer */
-       msg->content = mutt_remove_multipart (msg->content);
-       /* get rid of the signature */
-       mutt_free_body (&msg->content->next);
-      }
-
-      return (-1);
-    }
-
-    /* destroy temporary signature envelope when doing retainable 
-     * signatures.
-     */
-    if (flags != msg->pgp)
-    {
-      mutt_remove_multipart (msg->content);
-      mutt_free_body (&msg->content->next);
-    }
-    
-    msg->content = pbody;
-  }
-
-  return (0);
-}
 
 #endif /* HAVE_PGP */

diff --git a/pgp.h b/pgp.h
index fe5996d7001def7fcbf96ae15969477717cd2dc2..7621381cfa31eb02c38506992b7f3bee9f22a2e2 100644 (file)
--- a/pgp.h
+++ b/pgp.h
@@ -19,6 +19,7 @@
 
 #ifdef HAVE_PGP
 
+#include "crypt.h"
 #include "pgplib.h"
 
 WHERE REGEXP PgpGoodSign;
@@ -57,15 +58,15 @@ char *pgp_keyid (pgp_key_t *);
 
 int mutt_check_pgp (HEADER * h);
 int mutt_is_application_pgp (BODY *);
-int mutt_is_multipart_encrypted (BODY *);
-int mutt_is_multipart_signed (BODY *);
-int mutt_parse_pgp_hdr (char *, int);
+
+int pgp_is_multipart_encrypted (BODY *);
+
+
 int pgp_decrypt_mime (FILE *, FILE **, BODY *, BODY **);
-int pgp_get_keys (HEADER *, char **);
-int pgp_protect (HEADER *, char *);
-int pgp_query (BODY *);
+
 /* int pgp_string_matches_hint (const char *s, LIST * hints); */
-int pgp_valid_passphrase (void);
+
+#define pgp_valid_passphrase() crypt_valid_passphrase(APPLICATION_PGP)
 
 /* pgp_key_t *gpg_get_candidates (struct pgp_vinfo *, pgp_ring_t, LIST *); */
 pgp_key_t *pgp_ask_for_key (char *, char *, short, pgp_ring_t);
@@ -73,16 +74,15 @@ pgp_key_t *pgp_get_candidates (pgp_ring_t, LIST *);
 pgp_key_t *pgp_getkeybyaddr (ADDRESS *, short, pgp_ring_t);
 pgp_key_t *pgp_getkeybystr (char *, short, pgp_ring_t);
 
-void mutt_forget_passphrase (void);
+void pgp_forget_passphrase (void);
 void pgp_application_pgp_handler (BODY *, STATE *);
 void pgp_encrypted_handler (BODY *, STATE *);
 void pgp_extract_keys_from_attachment_list (FILE * fp, int tag, BODY * top);
-void pgp_extract_keys_from_messages (HEADER * hdr);
-void pgp_signed_handler (BODY *, STATE *);
 void pgp_void_passphrase (void);
 
 
 
+
 /* The PGP invocation interface - not really beautiful. */
 
 pid_t pgp_invoke_decode (FILE **pgpin, FILE **pgpout, FILE **pgperr,
@@ -117,4 +117,12 @@ pid_t pgp_invoke_traditional (FILE **pgpin, FILE **pgpout, FILE **pgperr,
 void pgp_invoke_import (const char *fname);
 void pgp_invoke_getkeys (ADDRESS *);
 
+
+/* private ? */
+int pgp_verify_one (BODY *, STATE *, const char *);
+BODY *pgp_traditional_encryptsign (BODY *, int, char *);
+BODY *pgp_encrypt_message (BODY *, char *, int);
+BODY *pgp_sign_message (BODY *);
+
+
 #endif /* HAVE_PGP */

diff --git a/pgplib.h b/pgplib.h
index 0f0641864ba2d365c74f38d9842029012d5273ea..f7a906b1626eaee1a6d904dcbacc1b34ecff6576 100644 (file)
--- a/pgplib.h
+++ b/pgplib.h
@@ -19,10 +19,12 @@
 
 #ifdef HAVE_PGP
 
-#define PGPENCRYPT  (1 << 0)
-#define PGPSIGN     (1 << 1)
-#define PGPKEY      (1 << 2)
-#define PGPGOODSIGN (1 << 3)
+#define APPLICATION_PGP  (1 << 5)
+
+#define PGPENCRYPT  (APPLICATION_PGP | ENCRYPT)
+#define PGPSIGN     (APPLICATION_PGP | SIGN)
+#define PGPGOODSIGN (APPLICATION_PGP | GOODSIGN)
+#define PGPKEY      (APPLICATION_PGP | (1 << 3))
 
 #define KEYFLAG_CANSIGN                (1 <<  0)
 #define KEYFLAG_CANENCRYPT             (1 <<  1)

diff --git a/pop.c b/pop.c
index 5c52afc592dc6e4ee177b36a774c8b3856070a9d..2bb645f046088f0a7ccf2cbe848c8e470c9f5825 100644 (file)
--- a/pop.c
+++ b/pop.c
@@ -24,6 +24,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #include <string.h>
 #include <unistd.h>
 
@@ -438,9 +442,9 @@ int pop_fetch_message (MESSAGE* msg, CONTEXT* ctx, int msgno)
   h->content->length = ftell (msg->fp) - h->content->offset;
 
   /* This needs to be done in case this is a multipart message */
-#ifdef HAVE_PGP
-  h->pgp = pgp_query (h->content);
-#endif /* HAVE_PGP */
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  h->security = crypt_query (h->content);
+#endif
 
   mutt_clear_error();
   rewind (msg->fp);

diff --git a/postpone.c b/postpone.c
index 5ed79e855a57b5d4fb33a7ed671e3e6be8cc8723..3bcee64d5b249b0e7d3800326baab4ead21a187c 100644 (file)
--- a/postpone.c
+++ b/postpone.c
@@ -47,6 +47,10 @@ static struct mapping_t PostponeHelp[] = {
 #include "pgp.h"
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif /* HAVE_SMIME */
+
 
 static short PostCount = 0;
 static CONTEXT *PostContext = NULL;
@@ -334,7 +338,8 @@ int mutt_get_postponed (CONTEXT *ctx, HEADER *hdr, HEADER **cur, char *fcc, size
                                                       */
             || mutt_strncmp ("X-Mutt-PGP:", tmp->data, 11) == 0)
     {
-      hdr->pgp = mutt_parse_pgp_hdr (strchr (tmp->data, ':') + 1, 1);
+      hdr->security = mutt_parse_crypt_hdr (strchr (tmp->data, ':') + 1, 1);
+      hdr->security |= APPLICATION_PGP;
        
       /* remove the pgp field */
       next = tmp->next;
@@ -348,6 +353,26 @@ int mutt_get_postponed (CONTEXT *ctx, HEADER *hdr, HEADER **cur, char *fcc, size
     }
 #endif /* HAVE_PGP */
 
+
+#ifdef HAVE_SMIME
+    else if (mutt_strncmp ("X-Mutt-SMIME:", tmp->data, 13) == 0)
+    {
+      hdr->security = mutt_parse_crypt_hdr (strchr (tmp->data, ':') + 1, 1);
+      hdr->security |= APPLICATION_SMIME;
+       
+      /* remove the smime field */
+      next = tmp->next;
+      if (last)
+       last->next = tmp->next;
+      else
+       hdr->env->userhdrs = tmp->next;
+      tmp->next = NULL;
+      mutt_free_list (&tmp);
+      tmp = next;
+    }
+#endif /* HAVE_SMIME */
+
+
 #ifdef MIXMASTER
     else if (mutt_strncmp ("X-Mutt-Mix:", tmp->data, 11) == 0)
     {
@@ -383,12 +408,13 @@ int mutt_get_postponed (CONTEXT *ctx, HEADER *hdr, HEADER **cur, char *fcc, size
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
 
-int mutt_parse_pgp_hdr (char *p, int set_signas)
+int mutt_parse_crypt_hdr (char *p, int set_signas)
 {
   int pgp = 0;
   char pgp_sign_as[LONG_STRING] = "\0", *q;
+  char smime_cryptalg[LONG_STRING] = "\0";
    
   SKIPWS (p);
   for (; *p; p++)
@@ -398,12 +424,12 @@ int mutt_parse_pgp_hdr (char *p, int set_signas)
     {
       case 'e':
       case 'E':
-        pgp |= PGPENCRYPT;
+        pgp |= ENCRYPT;
         break;
 
       case 's':    
       case 'S':
-        pgp |= PGPSIGN;
+        pgp |= SIGN;
         q = pgp_sign_as;
       
         if (*(p+1) == '<')
@@ -443,6 +469,27 @@ int mutt_parse_pgp_hdr (char *p, int set_signas)
 
        break;
          
+         
+      case 'c':
+      case 'C':
+       q = smime_cryptalg;
+       
+        if(*(p+1) == '<')
+       {
+         for(p += 2; *p && *p != '>' && q < smime_cryptalg + sizeof(smime_cryptalg) - 1;
+             *q++ = *p++)
+           ;
+         
+         if(*p != '>')
+         {
+           mutt_error _("Illegal S/MIME header");
+           return 0;
+         }
+       }
+
+       *q = '\0';
+       break;
+
       default:
         mutt_error _("Illegal PGP header");
         return 0;
@@ -450,12 +497,22 @@ int mutt_parse_pgp_hdr (char *p, int set_signas)
      
   }
  
+  /* the cryptalg field must not be empty */
+#ifdef HAVE_SMIME
+  if (*smime_cryptalg)
+    mutt_str_replace (&SmimeCryptAlg, smime_cryptalg);
+#endif /*  HAVE_SMIME */
+
+#ifdef HAVE_PGP
   if (set_signas || *pgp_sign_as)
     mutt_str_replace (&PgpSignAs, pgp_sign_as);
+#endif /* HAVE_PGP */
 
   return pgp;
 }
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP ||  HAVE_SMIME */
+
+
 
 int mutt_prepare_template (FILE *fp, CONTEXT *ctx, HEADER *newhdr, HEADER *hdr,
                               short weed)
@@ -509,10 +566,10 @@ int mutt_prepare_template (FILE *fp, CONTEXT *ctx, HEADER *newhdr, HEADER *hdr,
 
 #ifdef HAVE_PGP
   /* decrypt pgp/mime encoded messages */
-  if ((hdr->pgp & PGPENCRYPT) && 
+  if ((hdr->security & APPLICATION_PGP) && 
       mutt_is_multipart_encrypted (newhdr->content))
   {
-    newhdr->pgp |= PGPENCRYPT;
+    newhdr->security |= PGPENCRYPT;
     if (!pgp_valid_passphrase())
       goto err;
 
@@ -531,6 +588,9 @@ int mutt_prepare_template (FILE *fp, CONTEXT *ctx, HEADER *newhdr, HEADER *hdr,
 
     mutt_clear_error ();
   }
+#endif
+
+#if defined(HAVE_PGP)|| defined(HAVE_SMIME)
 
   /* 
    * remove a potential multipart/signed layer - useful when
@@ -539,8 +599,8 @@ int mutt_prepare_template (FILE *fp, CONTEXT *ctx, HEADER *newhdr, HEADER *hdr,
   
   if (mutt_is_multipart_signed (newhdr->content))
   {
-    newhdr->pgp |= PGPSIGN;
-    
+    newhdr->security |= SIGN;
+
     /* destroy the signature */
     mutt_free_body (&newhdr->content->parts->next);
     newhdr->content = mutt_remove_multipart (newhdr->content);

diff --git a/protos.h b/protos.h
index c34223e14576276cffe4e9dfde36eeeadf84f0b0..3d3e677f0afaaa3b5497a4d1fa1a9ea24d498220 100644 (file)
--- a/protos.h
+++ b/protos.h
@@ -134,8 +134,8 @@ char *mutt_gen_msgid (void);
 char *mutt_get_body_charset (char *, size_t, BODY *);
 char *mutt_get_name (ADDRESS *);
 char *mutt_get_parameter (const char *, PARAMETER *);
-#ifdef HAVE_PGP
-char *mutt_pgp_hook (ADDRESS *);
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+char *mutt_crypt_hook (ADDRESS *);
 #endif /* HAVE_PGP */
 char *mutt_make_date (char *, size_t);
 

diff --git a/recvattach.c b/recvattach.c
index b1c0ccd19cdef051b2cbac4d38c4e2a68ab05dd8..537e09a84ee72c6cd6fb9b2e4efa048d4f92489c 100644 (file)
--- a/recvattach.c
+++ b/recvattach.c
@@ -34,6 +34,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 
 
 #include <ctype.h>
@@ -835,8 +839,9 @@ void mutt_view_attachments (HEADER *hdr)
 
 
 
-#ifdef HAVE_PGP
-  int pgp = 0;
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  int secured = 0;
 #endif
 
 
@@ -862,24 +867,40 @@ void mutt_view_attachments (HEADER *hdr)
 
 
 
-#ifdef HAVE_PGP
-  if((hdr->pgp & PGPENCRYPT) && !pgp_valid_passphrase())
-  {
-    mx_close_message (&msg);
-    return;
-  }
-  
-  if ((hdr->pgp & PGPENCRYPT) && mutt_is_multipart_encrypted(hdr->content))
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  if (hdr->security & ENCRYPT)
   {
-    if (pgp_decrypt_mime (msg->fp, &fp, hdr->content, &cur))
+    if (!crypt_valid_passphrase(hdr->security))
+    {
+      mx_close_message (&msg);
+      return;
+    }
+#ifdef HAVE_SMIME
+    if (hdr->security & APPLICATION_SMIME)
+    {
+      if (hdr->env->to)
+         smime_getkeys (hdr->env->to->mailbox);
+
+      if (mutt_is_application_smime(hdr->content))
+       secured = ! smime_decrypt_mime (msg->fp, &fp, hdr->content, &cur);
+    }
+#endif  
+#ifdef HAVE_PGP
+    if (hdr->security & APPLICATION_PGP)
+    {
+      if (mutt_is_multipart_encrypted(hdr->content))
+       secured = !pgp_decrypt_mime (msg->fp, &fp, hdr->content, &cur);
+    }
+#endif
+
+    if (!secured)
     {
       mx_close_message (&msg);
       return;
     }
-    pgp = 1;
   }
   else
-#endif /* HAVE_PGP */
+#endif /* HAVE_SMIME || HAVVE_PGP */
   {
     fp = msg->fp;
     cur = hdr->content;
@@ -934,11 +955,14 @@ void mutt_view_attachments (HEADER *hdr)
         break;
       
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       case OP_FORGET_PASSPHRASE:
-        mutt_forget_passphrase ();
+        crypt_forget_passphrase ();
         break;
+#endif
       
+
+#ifdef HAVE_PGP
       case OP_EXTRACT_KEYS:
         pgp_extract_keys_from_attachment_list (fp, menu->tagprefix, 
                  menu->tagprefix ? cur : idx[menu->current]->content);
@@ -949,7 +973,7 @@ void mutt_view_attachments (HEADER *hdr)
         if (pgp_check_traditional (fp, menu->tagprefix ? cur : idx[menu->current]->content,
                                   menu->tagprefix))
         {
-         hdr->pgp = pgp_query (cur);
+         hdr->security = crypt_query (cur);
          menu->redraw = REDRAW_FULL;
        }
         break;
@@ -991,11 +1015,11 @@ void mutt_view_attachments (HEADER *hdr)
 
 
 
-#ifdef HAVE_PGP
-        if (hdr->pgp)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+        if (hdr->security)
         {
          mutt_message _(
-           "Deletion of attachments from PGP messages is unsupported.");
+           "Deletion of attachments from encrypted messages is unsupported.");
        }
         else
 #endif
@@ -1126,13 +1150,14 @@ void mutt_view_attachments (HEADER *hdr)
 
 
 
-#ifdef HAVE_PGP
-       if (pgp)
+
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+        if (secured)
        {
          fclose (fp);
          mutt_free_body (&cur);
        }
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
 
 
 

diff --git a/send.c b/send.c
index 1370d0288b2d00a78504c3685a5fa8d99aba9351..3dcd7f611ad5a57cf5a8ff2d1e9e2abd38bde8b8 100644 (file)
--- a/send.c
+++ b/send.c
@@ -41,6 +41,10 @@
 #include "pgp.h"
 #endif
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif
+
 #ifdef MIXMASTER
 #include "remailer.h"
 #endif
@@ -343,12 +347,12 @@ static int include_forward (CONTEXT *ctx, HEADER *cur, FILE *out)
   mutt_message_hook (ctx, cur, M_MESSAGEHOOK);
 
 #ifdef HAVE_PGP
-  if ((cur->pgp & PGPENCRYPT) && option (OPTFORWDECODE))
+  if ((cur->security & ENCRYPT) && option (OPTFORWDECODE))
   {
     /* make sure we have the user's passphrase before proceeding... */
-    pgp_valid_passphrase ();
+    crypt_valid_passphrase (cur->security);
   }
-#endif /* HAVE_PGP */
+#endif /* HAVE_SMIME */
 
   mutt_forward_intro (out, cur);
 
@@ -397,15 +401,12 @@ static int include_reply (CONTEXT *ctx, HEADER *cur, FILE *out)
   int chflags = CH_DECODE;
 
 #ifdef HAVE_PGP
-  if (cur->pgp)
-  {
-    if (cur->pgp & PGPENCRYPT)
+    if (cur->security & ENCRYPT)
     {
       /* make sure we have the user's passphrase before proceeding... */
-      pgp_valid_passphrase ();
+      crypt_valid_passphrase (cur->security);
     }
-  }
-#endif /* HAVE_PGP */
+#endif /* HAVE_SMIME */
 
   mutt_parse_mime_message (ctx, cur);
   mutt_message_hook (ctx, cur, M_MESSAGEHOOK);
@@ -801,12 +802,15 @@ generate_body (FILE *tempfp,      /* stream for outgoing message */
 
 
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP)
+/*  || defined(HAVE_SMIME) */
   else if (flags & SENDKEY) 
   {
     BODY *tmp;
+#ifdef HAVE_PGP
     if ((tmp = pgp_make_key_attachment (NULL)) == NULL)
       return -1;
+#endif
 
     tmp->next = msg->content;
     msg->content = tmp;
@@ -1021,46 +1025,6 @@ int mutt_resend_message (FILE *fp, CONTEXT *ctx, HEADER *cur)
   return ci_send_message (SENDRESEND, msg, NULL, ctx, cur);
 }
 
-#ifdef HAVE_PGP
-
-static int _set_pgp_flags (HEADER *cur)
-{
-  int flags = 0;
-  
-  if (option (OPTPGPREPLYENCRYPT) && cur && cur->pgp & PGPENCRYPT)
-    flags |= PGPENCRYPT;
-  if (option (OPTPGPREPLYSIGN) && cur && cur->pgp & PGPSIGN)
-    flags |= PGPSIGN;
-  if (option (OPTPGPREPLYSIGNENCRYPTED) && cur && cur->pgp & PGPENCRYPT)
-    flags |= PGPSIGN;
-
-  return flags;
-
-}
-
-static int set_pgp_flags (HEADER *cur, CONTEXT *ctx)
-{
-  int i;
-  int flags = 0;
-  
-  if (cur) 
-    return _set_pgp_flags (cur);
-  
-  if (!ctx)
-    return 0;
-    
-  for (i = 0; i < ctx->vcount; i++)
-  {
-    cur = ctx->hdrs[ctx->v2r[i]];
-    if (cur->tagged)
-      flags |= _set_pgp_flags (cur);
-  }
-
-  return flags;
-}
-
-#endif /* HAVE_PGP */
-
 int
 ci_send_message (int flags,            /* send mode */
                 HEADER *msg,           /* template to use for new message */
@@ -1074,7 +1038,7 @@ ci_send_message (int flags,               /* send mode */
   BODY *pbody;
   int i, killfrom = 0;
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
   BODY *save_content = NULL;
   BODY *clear_content = NULL;
   char *pgpkeylist = NULL;
@@ -1244,19 +1208,38 @@ ci_send_message (int flags,             /* send mode */
      * can take effect.
      */
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP)|| defined(HAVE_SMIME)
     if (! (flags & SENDMAILX))
     {
-      if (option (OPTPGPAUTOSIGN))
-       msg->pgp |= PGPSIGN;
-      if (option (OPTPGPAUTOENCRYPT))
-       msg->pgp |= PGPENCRYPT;
+      if (option (OPTCRYPTAUTOSIGN))
+       msg->security |= SIGN;
+      if (option (OPTCRYPTAUTOENCRYPT))
+       msg->security |= ENCRYPT;
+      if (option (OPTCRYPTREPLYENCRYPT) && cur && cur->security & ENCRYPT)
+       msg->security |= ENCRYPT;
+      if (option (OPTCRYPTREPLYSIGN) && cur && cur->security & SIGN)
+       msg->security |= SIGN;
+      if (option (OPTCRYPTREPLYSIGNENCRYPTED) && cur && cur->security & ENCRYPT)
+       msg->security |= SIGN;
       
-      msg->pgp |= set_pgp_flags (cur, ctx);
-    }
+#ifdef HAVE_PGP
+      if (msg->security)
+       msg->security |= APPLICATION_PGP;   // default is PGP
+#endif
 
-#endif /* HAVE_PGP */
-      
+#ifdef HAVE_SMIME
+      if (msg->security && ((cur && cur->security & APPLICATION_SMIME) ||
+         option (OPTSMIMEISDEFAULT)))
+      {
+#ifdef HAVE_PGP
+    /* if not both.. */
+       msg->security ^= APPLICATION_PGP;
+#endif
+       msg->security |= APPLICATION_SMIME;
+      }
+#endif /* HAVE_SMIME */
+    }
+#endif /* HAVE_PGP || HAVE_SMIME */
 
 
 
@@ -1414,14 +1397,14 @@ main_loop:
 
   encode_descriptions (msg->content, 1);
   
-#ifdef HAVE_PGP
-  if (msg->pgp)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  if (msg->security)  
   {
     /* save the decrypted attachments */
     clear_content = msg->content;
 
-    if ((pgp_get_keys (msg, &pgpkeylist) == -1) ||
-       (pgp_protect (msg, pgpkeylist) == -1))
+    if ((crypt_get_keys (msg, &pgpkeylist) == -1) ||
+       mutt_protect (msg, pgpkeylist) == -1)
     {
       msg->content = mutt_remove_multipart (msg->content);
       
@@ -1472,26 +1455,26 @@ main_loop:
   if (*fcc && mutt_strcmp ("/dev/null", fcc) != 0)
   {
     BODY *tmpbody = msg->content;
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     BODY *save_sig = NULL;
     BODY *save_parts = NULL;
 #endif /* HAVE_PGP */
 
-#ifdef HAVE_PGP
-    if (msg->pgp && option (OPTFCCCLEAR))
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+    if (msg->security && option (OPTFCCCLEAR))
       msg->content = clear_content;
 #endif
 
     /* check to see if the user wants copies of all attachments */
     if (!option (OPTFCCATTACH) && msg->content->type == TYPEMULTIPART)
     {
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
       if (mutt_strcmp (msg->content->subtype, "encrypted") == 0 ||
          mutt_strcmp (msg->content->subtype, "signed") == 0)
       {
        if (clear_content->type == TYPEMULTIPART)
        {
-         if (!(msg->pgp & PGPENCRYPT) && (msg->pgp & PGPSIGN))
+         if(!(msg->security & ENCRYPT) && (msg->security & SIGN))
          {
            /* save initial signature and attachments */
            save_sig = msg->content->parts->next;
@@ -1501,7 +1484,7 @@ main_loop:
          /* this means writing only the main part */
          msg->content = clear_content->parts;
 
-         if (pgp_protect (msg, pgpkeylist) == -1)
+         if (mutt_protect (msg, pgpkeylist) == -1)
          {
            /* we can't do much about it at this point, so
             * fallback to saving the whole thing to fcc
@@ -1515,19 +1498,19 @@ main_loop:
        }
       }
       else
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
        msg->content = msg->content->parts;
     }
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
 full_fcc:
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
     if (msg->content)
       mutt_write_fcc (fcc, msg, NULL, 0, NULL);
 
     msg->content = tmpbody;
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
     if (save_sig)
     {
       /* cleanup the second signature structures */
@@ -1548,7 +1531,7 @@ full_fcc:
       mutt_free_body (&save_content);
     }
       
-#endif /* HAVE_PGP */
+#endif /* HAVE_PGP || HAVE_SMIME */
   }
 
 
@@ -1556,14 +1539,14 @@ full_fcc:
   {
     if (!(flags & SENDBATCH))
     {
-#ifdef HAVE_PGP
-      if ((msg->pgp & PGPENCRYPT) || 
-         ((msg->pgp & PGPSIGN) && msg->content->type == TYPEAPPLICATION))
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+      if ((msg->security & ENCRYPT) || 
+         ((msg->security & SIGN)  && msg->content->type == TYPEAPPLICATION))
       {
        mutt_free_body (&msg->content); /* destroy PGP data */
        msg->content = clear_content;   /* restore clear text. */
       }
-      else if ((msg->pgp & PGPSIGN) && msg->content->type == TYPEMULTIPART)
+      else if ((msg->security & SIGN) && msg->content->type == TYPEMULTIPART)
       {
        mutt_free_body (&msg->content->parts->next);            /* destroy sig */
        msg->content = mutt_remove_multipart (msg->content);    /* remove multipart */
@@ -1583,14 +1566,14 @@ full_fcc:
   else if (!option (OPTNOCURSES) && ! (flags & SENDMAILX))
     mutt_message (i == 0 ? _("Mail sent.") : _("Sending in background."));
 
-#ifdef HAVE_PGP
-  if (msg->pgp & PGPENCRYPT)
+#if defined(HAVE_PGP) || defined(HAVE_SMIME)
+  if (msg->security & ENCRYPT)
   {
     /* cleanup structures from the first encryption */
     mutt_free_body (&clear_content);
     FREE (&pgpkeylist);
   }
-#endif /* HAVE_PGP */
+#endif
 
   if (flags & SENDREPLY)
   {

diff --git a/sendlib.c b/sendlib.c
index 3cb4df91f102382b8f2cbd194290f8de607e6d42..ec816ecd020a6c3a039894664ed2977bfdb5b235 100644 (file)
--- a/sendlib.c
+++ b/sendlib.c
@@ -119,6 +119,11 @@ sysexits_h[] =
 #endif /* HAVE_PGP */
 
 
+#ifdef HAVE_SMIME
+#include "smime.h"
+#endif /* HAVE_SMIME */
+
+
 
 #define DISPOSITION(X) X==DISPATTACH?"attachment":"inline"
 
@@ -1286,15 +1291,17 @@ BODY *mutt_make_message_attach (CONTEXT *ctx, HEADER *hdr, int attach_msg)
   BODY *body;
   FILE *fp;
   int cmflags, chflags;
-#ifdef HAVE_PGP
-  int pgp = hdr->pgp;
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
+  int pgp = hdr->security;
 #endif
 
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
   if ((option(OPTMIMEFORWDECODE) || option(OPTFORWDECRYPT)) &&
-      (hdr->pgp & PGPENCRYPT) && !pgp_valid_passphrase())
-    return (NULL);
-#endif /* HAVE_PGP */
+      (hdr->security & ENCRYPT)) {
+    if (!crypt_valid_passphrase(hdr->security))
+      return (NULL);
+  }
+#endif /* defined(HAVE_PGP) ||  defined(HAVE_SMIME) */
 
   mutt_mktemp (buffer);
   if ((fp = safe_fopen (buffer, "w+")) == NULL)
@@ -1320,13 +1327,17 @@ BODY *mutt_make_message_attach (CONTEXT *ctx, HEADER *hdr, int attach_msg)
     cmflags = M_CM_DECODE | M_CM_CHARCONV;
 #ifdef HAVE_PGP
     pgp &= ~PGPENCRYPT;
+#endif
+#ifdef HAVE_SMIME
+    pgp &= ~SMIMEENCRYPT;
 #endif
   }
-#ifdef HAVE_PGP
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
   else
     if (option (OPTFORWDECRYPT)
-       && (hdr->pgp & PGPENCRYPT))
+       && (hdr->security & ENCRYPT))
   {
+#ifdef HAVE_PGP
     if (mutt_is_multipart_encrypted (hdr->content))
     {
       chflags |= CH_MIME | CH_NONEWLINE;
@@ -1339,6 +1350,18 @@ BODY *mutt_make_message_attach (CONTEXT *ctx, HEADER *hdr, int attach_msg)
       cmflags = M_CM_DECODE | M_CM_CHARCONV;
       pgp &= ~PGPENCRYPT;
     }
+#endif
+#if defined(HAVE_PGP) &&  defined(HAVE_SMIME)
+    else
+#endif
+#ifdef HAVE_SMIME
+    if (mutt_is_application_smime (hdr->content) & SMIMEENCRYPT)
+    {
+      chflags |= CH_MIME | CH_TXTPLAIN;
+      cmflags = M_CM_DECODE | M_CM_CHARCONV;
+      pgp &= ~SMIMEENCRYPT;
+    }
+#endif
   }
 #endif
 
@@ -1351,8 +1374,8 @@ BODY *mutt_make_message_attach (CONTEXT *ctx, HEADER *hdr, int attach_msg)
   body->hdr->offset = 0;
   /* we don't need the user headers here */
   body->hdr->env = mutt_read_rfc822_header(fp, body->hdr, 0, 0);
-#ifdef HAVE_PGP
-  body->hdr->pgp = pgp;
+#if defined(HAVE_PGP) ||  defined(HAVE_SMIME)
+  body->hdr->security = pgp;
 #endif /* HAVE_PGP */
   mutt_update_encoding (body);
   body->parts = body->hdr->content;
@@ -2356,12 +2379,12 @@ int mutt_write_fcc (const char *path, HEADER *hdr, const char *msgid, int post,
 
 #ifdef HAVE_PGP
   /* (postponment) if the mail is to be signed or encrypted, save this info */
-  if (post && (hdr->pgp & (PGPENCRYPT | PGPSIGN)))
+  if (post && (hdr->security & APPLICATION_PGP))
   {
     fputs ("X-Mutt-PGP: ", msg->fp);
-    if (hdr->pgp & PGPENCRYPT) 
+    if (hdr->security & ENCRYPT) 
       fputc ('E', msg->fp);
-    if (hdr->pgp & PGPSIGN)
+    if (hdr->security & SIGN)
     {
       fputc ('S', msg->fp);
       if (PgpSignAs && *PgpSignAs)
@@ -2371,6 +2394,25 @@ int mutt_write_fcc (const char *path, HEADER *hdr, const char *msgid, int post,
   }
 #endif /* HAVE_PGP */
 
+#ifdef HAVE_SMIME
+  /* (postponment) if the mail is to be signed or encrypted, save this info */
+  if (post && (hdr->security & APPLICATION_SMIME))
+  {
+    fputs ("X-Mutt-SMIME: ", msg->fp);
+    if (hdr->security & ENCRYPT) {
+       fputc ('E', msg->fp);
+       if (SmimeCryptAlg && *SmimeCryptAlg)
+           fprintf (msg->fp, "C<%s>", SmimeCryptAlg);
+    }
+    if (hdr->security & SIGN) {
+       fputc ('S', msg->fp);
+       if (SmimeSignAs && *SmimeSignAs)
+           fprintf (msg->fp, "<%s>", SmimeSignAs);
+    }
+    fputc ('\n', msg->fp);
+  }
+#endif /* HAVE_SMIME */
+
 #ifdef MIXMASTER
   /* (postponement) if the mail is to be sent through a mixmaster 
    * chain, save that information

diff --git a/smime.c b/smime.c
new file mode 100644 (file)
index 0000000..2e2411e
--- /dev/null
+++ b/smime.c
@@ -0,0 +1,1995 @@
+/*
+ * Copyright (C) 2001 Oliver Ehli <elmy@acm.org>
+ *
+ *     This program is free software; you can redistribute it and/or modify
+ *     it under the terms of the GNU General Public License as published by
+ *     the Free Software Foundation; either version 2 of the License, or
+ *     (at your option) any later version.
+ * 
+ *     This program is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ * 
+ *     You should have received a copy of the GNU General Public License
+ *     along with this program; if not, write to the Free Software
+ *     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+ */
+
+#include "mutt.h"
+#include "mutt_curses.h"
+#include "mutt_menu.h"
+#include "smime.h"
+#include "mime.h"
+#include "copy.h"
+
+#include <sys/wait.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <ctype.h>
+
+#ifdef HAVE_LOCALE_H
+#include <locale.h>
+#endif
+
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+
+#ifdef HAVE_SYS_RESOURCE_H
+# include <sys/resource.h>
+#endif
+
+#ifdef HAVE_SMIME
+
+#include "crypt.h"
+
+
+struct smime_command_context {
+  const char *key;                 /* %k */
+  const char *cryptalg;                    /* %a */
+  const char *fname;               /* %f */
+  const char *sig_fname;           /* %s */
+  const char *certificates;        /* %c */
+  const char *intermediates;        /* %i */
+};
+
+
+typedef struct {
+  unsigned int hash;
+  char suffix;
+  char email[256];
+  char nick[256];
+  char trust; /* i=Invalid r=revoked e=expired u=unverified v=verified t=trusted */
+  short public; /* 1=public 0=private */
+} smime_id;
+
+
+char SmimePass[STRING];
+time_t SmimeExptime = 0; /* when does the cached passphrase expire? */
+
+
+static char SmimeKeyToUse[_POSIX_PATH_MAX];
+static char SmimeCertToUse[_POSIX_PATH_MAX];
+static char SmimeIntermediateToUse[_POSIX_PATH_MAX];
+
+
+/*
+ *     Queries and passphrase handling.
+ */
+
+
+
+
+/* these are copies from pgp.c */
+
+
+void smime_void_passphrase (void)
+{
+  memset (SmimePass, 0, sizeof (SmimePass));
+  SmimeExptime = 0;
+}
+
+
+
+int mutt_is_application_smime (BODY *m)
+{
+  char *t=NULL;
+  int len, complain=0;
+
+  if (m->type & TYPEAPPLICATION && m->subtype)
+  {
+    if (!mutt_strcasecmp (m->subtype, "x-pkcs7-mime"))
+    {
+      if ((t = mutt_get_parameter ("smime-type", m->parameter)))
+      {
+       if (!mutt_strcasecmp (t, "enveloped-data"))
+         return SMIMEENCRYPT;
+       else if (!mutt_strcasecmp (t, "signed-data"))
+         return (SMIMESIGN|SMIMEOPAQUE);
+       else return 0;
+      }
+      complain = 1;
+    }
+    else if (mutt_strcasecmp (m->subtype, "octet-stream"))
+      return 0;
+
+    t = mutt_get_parameter ("name", m->parameter);
+
+    if (!t) t = m->d_filename;
+    if (!t) t = m->filename;
+    if (!t) {
+      if (complain)
+       mutt_message (_("S/MIME messages with no hints on content are unsupported."));
+      return 0;
+    }
+
+    /* no .p7c, .p10 support yet. */
+
+    len = mutt_strlen (t) - 4;
+    if (len > 0 && *(t+len) == '.')
+    {
+      len++;
+      if (!mutt_strcasecmp ((t+len), "p7m"))
+#if 0
+       return SMIMEENCRYPT;
+#else
+      /* Not sure if this is the correct thing to do, but 
+         it's required for compatibility with Outlook */
+       return (SMIMESIGN|SMIMEOPAQUE);
+#endif
+      else if (!mutt_strcasecmp ((t+len), "p7s"))
+       return (SMIMESIGN|SMIMEOPAQUE);
+    }
+  }
+
+  return 0;
+}
+
+
+
+
+
+
+/*
+ *     The OpenSSL interface
+ */
+
+/* This is almost identical to ppgp's invoking interface. */
+
+static const char *_mutt_fmt_smime_command (char *dest,
+                                           size_t destlen,
+                                           char op,
+                                           const char *src,
+                                           const char *prefix,
+                                           const char *ifstring,
+                                           const char *elsestring,
+                                           unsigned long data,
+                                           format_flag flags)
+{
+  char fmt[16];
+  struct smime_command_context *cctx = (struct smime_command_context *) data;
+  int optional = (flags & M_FORMAT_OPTIONAL);
+  
+  switch (op)
+  {
+    case 'c':
+    {           /* certificate (list) */
+      if (!optional) {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL(cctx->certificates));
+      }
+      else if (!cctx->certificates)
+       optional = 0;
+      break;
+    }
+    
+    case 'i':
+    {           /* intermediate certificates  */
+      if (!optional) {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL(cctx->intermediates));
+      }
+      else if (!cctx->intermediates)
+       optional = 0;
+      break;
+    }
+    
+    case 's':
+    {           /* detached signature */
+      if (!optional)
+      {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL (cctx->sig_fname));
+      }
+      else if (!cctx->sig_fname)
+       optional = 0;
+      break;
+    }
+    
+    case 'k':
+    {           /* private key */
+      if (!optional)
+      {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL (cctx->key));
+      }
+      else if (!cctx->key)
+       optional = 0;
+      break;
+    }
+    
+    case 'a':
+    {           /* algorithm for encryption */
+      if (!optional) {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL (cctx->cryptalg));
+      }
+      else if (!cctx->key)
+       optional = 0;
+      break;
+    }
+    
+    case 'f':
+    {           /* file to process */
+      if (!optional)
+      {
+       snprintf (fmt, sizeof (fmt), "%%%ss", prefix);
+       snprintf (dest, destlen, fmt, NONULL (cctx->fname));
+      }
+      else if (!cctx->fname)
+       optional = 0;
+      break;
+    }
+    
+    default:
+      *dest = '\0';
+      break;
+  }
+
+  if (optional)
+    mutt_FormatString (dest, destlen, ifstring, _mutt_fmt_smime_command,
+                      data, 0);
+  else if (flags & M_FORMAT_OPTIONAL)
+    mutt_FormatString (dest, destlen, elsestring, _mutt_fmt_smime_command,
+                      data, 0);
+
+  return (src);
+}
+
+
+
+static void mutt_smime_command (char *d, size_t dlen,
+                               struct smime_command_context *cctx, const char *fmt)
+{
+  mutt_FormatString (d, dlen, NONULL(fmt), _mutt_fmt_smime_command,
+                   (unsigned long) cctx, 0);
+  dprint (2,(debugfile, "mutt_smime_command: %s\n", d));
+}
+
+
+
+
+static pid_t smime_invoke (FILE **smimein, FILE **smimeout, FILE **smimeerr,
+                          int smimeinfd, int smimeoutfd, int smimeerrfd,
+                          const char *fname,
+                          const char *sig_fname,
+                          const char *cryptalg,
+                          const char *key,
+                          const char *certificates,
+                          const char *intermediates,
+                          const char *format)
+{
+  struct smime_command_context cctx;
+  char cmd[HUGE_STRING];
+  
+  memset (&cctx, 0, sizeof (cctx));
+
+  if (!format || !*format)
+    return (pid_t) -1;
+  
+  cctx.fname          = fname;
+  cctx.sig_fname       = sig_fname;
+  cctx.key            = key;
+  cctx.cryptalg               = cryptalg;
+  cctx.certificates    = certificates;
+  cctx.intermediates   = intermediates;
+  
+  mutt_smime_command (cmd, sizeof (cmd), &cctx, format);
+
+  return mutt_create_filter_fd (cmd, smimein, smimeout, smimeerr,
+                               smimeinfd, smimeoutfd, smimeerrfd);
+}
+
+
+
+
+
+
+/*
+ *    Key and certificate handling.
+ */
+
+
+
+/* 
+   Search the certificate index for given mailbox.
+   return certificate file name.
+*/
+
+static void smime_entry (char *s, size_t l, MUTTMENU * menu, int num)
+{
+  smime_id *Table = (smime_id*) menu->data;
+  smime_id this = Table[num];
+  char* truststate;
+  switch(this.trust) {
+    case 't':
+      truststate = N_("Trusted   ");
+      break;
+    case 'v':
+      truststate = N_("Verified  ");
+      break;
+    case 'u':
+      truststate = N_("Unverified");
+      break;
+    case 'e':
+      truststate = N_("Expired   ");
+      break;
+    case 'r':
+      truststate = N_("Revoked   ");
+      break;
+    case 'i':
+      truststate = N_("Invalid   ");
+      break;
+    default:
+      truststate = N_("Unknown   ");
+  }
+  if (this.public)
+    snprintf(s, l, "0x%.8X%i %s %-35.35s %s", this.hash, this.suffix, _(truststate), this.email, this.nick);
+  else
+    snprintf(s, l, "0x%.8X%i %-35.35s %s", this.hash, this.suffix, this.email, this.nick);
+}
+
+
+
+
+
+char* smime_ask_for_key (char *prompt, char *mailbox, short public)
+{
+  char *fname;
+  smime_id *Table;
+  long cert_num; /* Will contain the number of certificates.
+      * To be able to get it, the .index file will be read twice... */
+  char index_file[_POSIX_PATH_MAX];
+  FILE *index;
+  char buf[256];
+  char fields[5][STRING];
+  int numFields, hash_suffix, done, cur; /* The current entry */
+  MUTTMENU* menu;
+  unsigned int hash;
+  char helpstr[128];
+  char qry[256];
+  char title[256];
+
+  if (!prompt) prompt = _("Enter keyID:");
+  snprintf(index_file, sizeof (index_file), "%s/.index",
+    public ? NONULL(SmimeCertificates) : NONULL(SmimeKeys));
+  
+  index = fopen(index_file, "r");
+  if (index == NULL) return NULL;
+  /* Count Lines */
+  cert_num = 0;
+  while (!feof(index)) {
+    if (fgets(buf, sizeof(buf), index)) cert_num++;
+  }
+  fclose(index);
+
+  FOREVER
+  {
+    *qry = 0;
+    if (mutt_get_field(prompt,
+      qry, sizeof(qry), 0))
+      return NULL;
+    snprintf(title, sizeof(title), "S/MIME certificates matching \"%s\".",
+      qry);
+
+    
+    index = fopen(index_file, "r");
+    if (!index) return NULL; /* should never happen */
+    /* Read Entries */
+    cur = 0;
+    Table = safe_malloc(sizeof (smime_id) * cert_num);
+    while (!feof(index)) {
+        numFields = fscanf (index, "%s %x.%i %s", fields[0], &hash,
+          &hash_suffix, fields[2]);
+        if (public)
+          fscanf (index, "%s %s\n", fields[3], fields[4]);
+  
+      /* 0=email 1=name 2=nick 3=intermediate 4=trust */
+      if (numFields < 2) continue;
+  
+      /* Check if query matches this certificate */
+      if (!mutt_stristr(fields[0], qry) &&
+          !mutt_stristr(fields[2], qry))
+        continue;
+  
+      Table[cur].hash = hash;
+      Table[cur].suffix = hash_suffix;
+      strncpy(Table[cur].email, fields[0], sizeof(Table[cur].email));
+      strncpy(Table[cur].nick, fields[2], sizeof(Table[cur].nick));
+      Table[cur].trust = *fields[4];
+      Table[cur].public = public;
+  
+      cur++;
+    }
+    fclose(index);
+  
+    /* Make Helpstring */
+    helpstr[0] = 0;
+    mutt_make_help (buf, sizeof (buf), _("Exit  "), MENU_SMIME, OP_EXIT);
+    strcat (helpstr, buf);
+    mutt_make_help (buf, sizeof (buf), _("Select  "), MENU_SMIME,
+        OP_GENERIC_SELECT_ENTRY);
+    strcat (helpstr, buf);
+    mutt_make_help (buf, sizeof(buf), _("Help"), MENU_SMIME, OP_HELP);
+    strcat (helpstr, buf);
+  
+    /* Create the menu */
+    menu = mutt_new_menu();
+    menu->max = cur;
+    menu->make_entry = smime_entry;
+    menu->menu = MENU_SMIME;
+    menu->help = helpstr;
+    menu->data = Table;
+    menu->title = title;
+    /* sorting keys might be done later - TODO */
+  
+    mutt_clear_error();
+  
+    done = 0;
+    hash = 0;
+    while (!done) {
+      switch (mutt_menuLoop (menu)) {
+        case OP_GENERIC_SELECT_ENTRY:
+          cur = menu->current;
+       hash = 1;
+          done = 1;
+          break;
+        case OP_EXIT:
+          hash = 0;
+          done = 1;
+          break;
+      }
+    }
+    if (hash) {
+      fname = safe_malloc(14); /* Hash + '.' + Suffix + \n + \0 */
+      sprintf(fname, "%.8x.%i\n", Table[cur].hash, Table[cur].suffix);
+    }
+    else fname = NULL;
+  
+    mutt_menuDestroy (&menu);
+    safe_free ((void**)&Table);
+    set_option (OPTNEEDREDRAW);
+  
+    if (fname) return fname;
+  }
+}
+
+
+
+
+char *smime_get_field_from_db (char *mailbox, char *query, short public)
+{
+  int addr_len, query_len, found = 0, ask = 0, choice = 0;
+  char cert_path[_POSIX_PATH_MAX];
+  char buf[LONG_STRING], prompt[STRING];
+  char fields[5][STRING];
+  int numFields;
+  struct stat info;
+  char *key=NULL, key_trust_level = 0;
+  FILE *fp;
+
+  if(!mailbox && !query) return(NULL);
+
+  addr_len = mailbox ? mutt_strlen (mailbox) : 0;
+  query_len = query ? mutt_strlen (query) : 0;
+
+  /* index-file format:
+     mailbox certfile label issuer_certfile trust_flags\n
+
+     \n is also copied here, serving as delimitation.
+     
+     certfile is a hash value generated by openssl.
+     Note that this was done according to the OpenSSL
+     specs on their CA-directory.
+
+  */
+  snprintf (cert_path, sizeof (cert_path),_("%s/.index"),
+           (public ? NONULL(SmimeCertificates) : NONULL(SmimeKeys)));
+
+  if (!stat (cert_path, &info))
+  {
+    if ((fp = safe_fopen (cert_path, "r")) == NULL)
+    {
+      mutt_perror (cert_path);
+      return (NULL);
+    }
+
+    while (fgets (buf, sizeof (buf) - 1, fp) != NULL)
+      if (mailbox && !(mutt_strncasecmp (mailbox, buf, addr_len)))
+      {
+       numFields = sscanf (buf, "%s %s %s %s %s\n", fields[0], fields[1],
+                          fields[2], fields[3], fields[4]);
+       if (numFields < 2)
+           continue;
+       if (mailbox && public && 
+           (!fields[4] ||
+            *fields[4] == 'i' || *fields[4] == 'e' || *fields[4] == 'r'))
+           continue;
+
+       if (found)
+       {
+         if (public && *fields[4] == 'u' )
+           snprintf (prompt, sizeof (prompt),
+                     _("ID %s is unverified. Do you want to use it for %s ?"),
+                     fields[1], mailbox);
+         else if (public && *fields[4] == 'v' )
+           snprintf (prompt, sizeof (prompt),
+                     _("Use (untrusted!) ID %s for %s ?"),
+                     fields[1], mailbox);
+         else
+           snprintf (prompt, sizeof (prompt), _("Use ID %s for %s ?"),
+                     fields[1], mailbox);
+         if ((choice = mutt_yesorno (prompt, M_NO)) == -1)
+         {
+           found = 0;
+           ask = 0;
+           safe_free((void **) &key);
+           key = NULL;
+           break;
+         }
+         else if (choice == M_NO) 
+         {
+           ask = 1;
+           continue;
+         }
+         else if (choice == M_YES)
+         {
+           snprintf (key,mutt_strlen(key), fields[1]);
+           ask = 0;
+           break;
+         }
+       }
+       else
+       {
+         key = safe_calloc(1, mutt_strlen(fields[1])+2);
+         if (public) key_trust_level = *fields[4];
+         snprintf(key, mutt_strlen(fields[1])+1, "%s", fields[1]);
+       }
+       found = 1;
+      }
+      else if(query)
+      {
+       numFields = sscanf (buf, "%s %s %s %s %s\n", fields[0], fields[1],
+                           fields[2], fields[3], fields[4]);
+
+       /* query = label: return certificate. */
+       if (numFields >= 3 && 
+           !(mutt_strncasecmp (query, fields[2], query_len)))
+       {
+         ask = 0;
+         key = safe_calloc(1, mutt_strlen(fields[1])+2);
+         snprintf(key, mutt_strlen(fields[1])+1, "%s", fields[1]);
+       }
+       /* query = certificate: return intermediate certificate. */
+       else if (numFields >= 4 && 
+                !(mutt_strncasecmp (query, fields[1], query_len)))
+       {
+         ask = 0;
+         key = safe_calloc(1, mutt_strlen(fields[3])+2);
+         snprintf(key, mutt_strlen(fields[3])+1, "%s", fields[3]);
+       }
+      }
+
+    fclose (fp);
+
+    if (ask)
+    {
+      if (public && *fields[4] == 'u' )
+       snprintf (prompt, sizeof (prompt),
+                 _("ID %s is unverified. Do you want to use it for %s ?"),
+                 fields[1], mailbox);
+      else if (public && *fields[4] == 'v' )
+       snprintf (prompt, sizeof (prompt),
+                 _("Use (untrusted!) ID %s for %s ?"),
+                 fields[1], mailbox);
+      else
+       snprintf (prompt, sizeof(prompt), _("Use ID %s for %s ?"), key,
+                 mailbox);
+      choice = mutt_yesorno (prompt, M_NO);
+      if (choice == -1 || choice == M_NO)
+      {
+       safe_free ((void **) &key);
+       key = NULL;
+      }
+    }
+    else if (key_trust_level)
+    {
+      if (key_trust_level == 'u' )
+      {
+       snprintf (prompt, sizeof (prompt),
+                 _("ID %s is unverified. Do you want to use it for %s ?"),
+                 key, mailbox);
+       choice = mutt_yesorno (prompt, M_NO);
+       if (choice != M_YES)
+       {
+         safe_free ((void **) &key);
+         key = NULL;
+       }
+
+      }
+      else if (key_trust_level == 'v' )
+      {
+       snprintf (prompt, sizeof (prompt),
+                 _("Warning: You have not yet decided to trust ID %s. (any key to continue)"), key);
+
+       mutt_error (prompt);
+       mutt_any_key_to_continue ("");
+/*     mutt_any_key_to_continue (prompt); */
+      }
+    }
+
+  }
+
+  if (key)
+  {
+    key[mutt_strlen(key)+1] = 0;
+    key[mutt_strlen(key)] = '\n';
+  }
+
+  return key;
+}
+
+
+
+
+/* 
+   This sets the '*ToUse' variables for an upcoming decryption, where
+   the reuquired key is different from SmimeSignAs.
+*/
+
+static int SmimeFirstTime = 1;  /* sucks... */
+void smime_getkeys (char *mailbox)
+{
+  char *k = smime_get_field_from_db (mailbox, NULL, 0);
+  char buf[STRING];
+
+  if (!k)
+  {
+    snprintf(buf, sizeof(buf), "Enter keyID for \'%s\':",
+            mailbox);
+    k = smime_ask_for_key(buf, mailbox, 0);
+  }
+
+  if (k)
+  {
+    k[mutt_strlen (k)-1] = '\0';
+    
+    /* the key used last time. */
+    if (!SmimeFirstTime &&
+       !mutt_strcasecmp (k, SmimeKeyToUse + mutt_strlen (SmimeKeys)+1))
+    {
+      safe_free ((void **) &k);
+      return;
+    }
+    else smime_void_passphrase ();
+
+    SmimeFirstTime = 0;
+    snprintf (SmimeKeyToUse, sizeof (SmimeKeyToUse), "%s/%s", 
+             NONULL(SmimeKeys), k);
+    
+    snprintf (SmimeCertToUse, sizeof (SmimeCertToUse), "%s/%s",
+             NONULL(SmimeCertificates), k);
+
+    if (mutt_strcasecmp (k, SmimeSignAs))
+    {
+      endwin ();
+      mutt_clear_error ();
+      snprintf (buf, sizeof (buf), "This message seems to require key"
+               " \'%s\'. (Any key to continue)", k);
+      mutt_any_key_to_continue (buf);
+      endwin ();
+      smime_void_passphrase ();
+    }
+
+    safe_free ((void **) &k);
+    return;
+  }
+
+  if (!SmimeFirstTime && !mutt_strcasecmp (SmimeSignAs, SmimeKeyToUse +
+                                          mutt_strlen (SmimeKeys)+1))
+    return;
+  else if (!SmimeFirstTime) smime_void_passphrase ();
+  else if (SmimeFirstTime) SmimeFirstTime = 0;
+    
+  snprintf (SmimeKeyToUse, sizeof (SmimeKeyToUse), "%s/%s", 
+           NONULL (SmimeKeys), SmimeSignAs);
+  
+  snprintf (SmimeCertToUse, sizeof (SmimeCertToUse), "%s/%s",
+           NONULL (SmimeCertificates), SmimeSignAs);
+}
+
+
+
+/* This routine attempts to find the keyids of the recipients of a message.
+ * It returns NULL if any of the keys can not be found.
+ */
+
+char *smime_findKeys (ADDRESS *to, ADDRESS *cc, ADDRESS *bcc)
+{
+  char *keyID, *keylist = NULL;
+  size_t keylist_size = 0;
+  size_t keylist_used = 0;
+  ADDRESS *tmp = NULL, *addr = NULL;
+  ADDRESS **last = &tmp;
+  ADDRESS *p, *q;
+  int i;
+
+  const char *fqdn = mutt_fqdn (1);
+  
+  for (i = 0; i < 3; i++)
+  {
+    switch (i)
+    {
+      case 0: p = to; break;
+      case 1: p = cc; break;
+      case 2: p = bcc; break;
+      default: abort ();
+    }
+    
+    *last = rfc822_cpy_adr (p);
+    while (*last)
+      last = &((*last)->next);
+  }
+
+  if (fqdn)
+    rfc822_qualify (tmp, fqdn);
+
+  tmp = mutt_remove_duplicates (tmp);
+  
+  for (p = tmp; p ; p = p->next)
+  {
+    char buf[LONG_STRING];
+
+    q = p;
+
+    if ((keyID = smime_get_field_from_db (q->mailbox, NULL, 1)) == NULL)
+    {
+      snprintf(buf, sizeof(buf),
+              _("Enter keyID for \'%s\':"),
+              q->mailbox);
+      keyID = smime_ask_for_key(buf, q->mailbox, 1);
+    }
+    if(!keyID)
+    {
+      snprintf (buf, sizeof (buf), _("No (valid) certificate found for %s."),
+               q->mailbox);
+      mutt_message (buf);
+      safe_free ((void **)&keylist);
+      rfc822_free_address (&tmp);
+      rfc822_free_address (&addr);
+      return NULL;
+    }
+    
+    keylist_size += mutt_strlen (keyID) + 1;
+    safe_realloc ((void **)&keylist, keylist_size);
+    sprintf (keylist + keylist_used, "%s", keyID);
+    keylist_used = mutt_strlen (keylist);
+
+    rfc822_free_address (&addr);
+
+  }
+  rfc822_free_address (&tmp);
+  return (keylist);
+}
+
+
+
+
+
+
+static int smime_check_cert_email (char *certificate, char *mailbox)
+{
+  FILE *fpout = NULL, *fperr = NULL;
+  char tmpfname[_POSIX_PATH_MAX];
+  char email[STRING];
+  int ret = 0;
+  pid_t thepid;
+
+  mutt_mktemp (tmpfname);
+  if ((fperr = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    mutt_perror (tmpfname);
+    return 1;
+  }
+  mutt_unlink (tmpfname);
+
+  mutt_mktemp (tmpfname);
+  if ((fpout = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    fclose (fperr);
+    mutt_perror (tmpfname);
+    return 1;
+  }
+  mutt_unlink (tmpfname);
+
+  if ((thepid =  smime_invoke (NULL, NULL, NULL,
+                              -1, fileno (fpout), fileno (fperr),
+                              certificate, NULL, NULL, NULL, NULL, NULL,
+                              SmimeGetCertEmailCommand))== -1)
+  {
+    mutt_message (_("Error: unable to create OpenSSL subprocess!"));
+    fclose (fperr);
+    fclose (fpout);
+    return 1;
+  }
+
+  mutt_wait_filter (thepid);
+
+  fflush (fpout);
+  rewind (fpout);
+  rewind (fperr);
+  fflush (fperr);
+
+
+  if (!(fgets (email, sizeof (email), fpout)))
+  {
+    mutt_copy_stream (fperr, stdout);
+    fclose (fpout);
+    fclose (fperr);
+    mutt_endwin(NULL);
+    printf ("Alert: No mailbox specified in certificate.\n");
+    return 1;
+  }
+  *(email+mutt_strlen(email)-1) = '\0';
+
+
+  if(mutt_strncasecmp (email, mailbox, mutt_strlen (mailbox)))
+  {
+    mutt_endwin(NULL);
+    printf ("Alert: Certificate belongs to \"%s\".\n"
+           "       But sender was \"%s\".\n", email, mailbox);
+    ret = 1;
+  }
+
+  fclose (fpout);
+  fclose (fperr);
+
+  return ret;
+}
+
+
+/* Add a certificate and update index file. */
+
+static void smime_add_certificate (char *certificate, char *mailbox, short public)
+{
+  FILE *fpin = NULL, *fpout = NULL, *fperr = NULL;
+  char tmpfname[_POSIX_PATH_MAX], dest[_POSIX_PATH_MAX];
+  char buf[LONG_STRING], hashval[STRING], *tmpKey;
+  struct stat info;
+  int i = 0;
+  pid_t thepid;
+
+
+  if (smime_check_cert_email (certificate, mailbox))
+  {
+    printf ("Certificate *NOT* added.\n");
+    return;
+  }
+
+  mutt_mktemp (tmpfname);
+  if ((fperr = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    mutt_perror (tmpfname);
+    return;
+  }
+  mutt_unlink (tmpfname);
+
+  mutt_mktemp (tmpfname);
+  if ((fpout = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    fclose (fperr);
+    mutt_perror (tmpfname);
+    return;
+  }
+  mutt_unlink (tmpfname);
+
+  /* 
+     OpenSSl can create a hash value of the certificate's subject.
+     This and a concatenated integer make up the certificat's
+     'unique id' and also its filename.
+  */
+
+  if ((thepid =  smime_invoke (NULL, NULL, NULL,
+                              -1, fileno (fpout), fileno (fperr),
+                              certificate, NULL, NULL, NULL, NULL, NULL,
+                              SmimeHashCertCommand))== -1)
+  {
+    mutt_message (_("Error: unable to create OpenSSL subprocess!"));
+    fclose (fperr);
+    fclose (fpout);
+    return;
+  }
+
+  mutt_wait_filter (thepid);
+
+  fflush (fpout);
+  rewind (fpout);
+  rewind (fperr);
+  fflush (fperr);
+
+  if (!(fgets (hashval, sizeof (hashval), fpout)))
+  {
+    mutt_copy_stream (fperr, stdout);
+    fclose (fpout);
+    fclose (fperr);
+    return;
+  }
+  fclose (fpout);
+  fclose (fperr);
+
+  *(hashval+mutt_strlen(hashval)-1) = '\0';
+
+  while (1)
+  {
+    snprintf (dest, sizeof (dest), _("%s/%s.%d"), NONULL(SmimeCertificates),
+             hashval, i);
+
+    if (stat (dest, &info))
+      break;
+    else
+      i++;
+  }
+    
+  if ((fpout = safe_fopen (dest, "w+")) == NULL)
+  {
+    mutt_perror (dest);
+    return;
+  }
+
+  if ((fpin = safe_fopen (certificate, "r")) == NULL)
+  {
+    mutt_perror (certificate);
+    fclose (fpout);
+    mutt_unlink (dest);
+    return;
+  }
+    
+  mutt_copy_stream (fpin, fpout);
+  fclose (fpout);
+  fclose (fpin);
+
+
+  /*
+    Now check if the mailbox is already found with the certificate's
+    hash value.
+
+    openssl uses md5 fingerprints to check wether two keys are identical.
+    I have to add that.
+    
+  */
+  
+  tmpKey = smime_get_field_from_db (mailbox, NULL, public);
+
+  /* check if hash values are identical => same certificate ? */
+  /* perhaps we should ask for permission to overwrite ? */
+  /* what about revoked certificates anyway ? */
+
+  /* reminder: openssl checks md5 - fingerprint for equality. add this. */
+
+  if (tmpKey && !mutt_strncmp (tmpKey, hashval, mutt_strlen (hashval)))
+  {
+    mutt_endwin(NULL);
+    printf ("Certificate \"%s\" exists for \"%s\".\n", hashval, mailbox);
+    mutt_unlink (dest);
+    return;
+  }
+    
+  /* append to index. */
+  snprintf (tmpfname, sizeof (tmpfname), _("%s/.index"),
+           (public ? NONULL(SmimeCertificates) : NONULL(SmimeKeys)));
+  
+  if (!stat (tmpfname, &info))
+  {
+    if ((fpout = safe_fopen (tmpfname, "a")) == NULL)
+    {
+      mutt_perror (tmpfname);
+      mutt_unlink (dest);
+      return;
+    }
+    /*
+       ? = unknown issuer, - = unassigned label,
+       u = undefined trust settings.
+    */
+    snprintf (buf, sizeof (buf), _("%s %s.%d - ? u\n"), mailbox, hashval, i);
+    fputs (buf, fpout);
+       
+    snprintf (buf, sizeof (buf), "Successfully added certificate"
+             " \"%s\" for \"%s\". ", hashval, mailbox);
+    mutt_message (buf);
+
+    fclose (fpout);
+  }
+
+  return;
+}
+
+
+
+
+static char *smime_extract_certificate (char *infile, int split)
+{
+  FILE *fpout = NULL, *fperr = NULL;
+  char pk7out[_POSIX_PATH_MAX], certfile[_POSIX_PATH_MAX];
+  char tmpfname[_POSIX_PATH_MAX];
+  pid_t thepid;
+  int empty;
+
+
+  mutt_mktemp (tmpfname);
+  if ((fperr = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    mutt_perror (tmpfname);
+    return NULL;
+  }
+  mutt_unlink (tmpfname);
+
+  mutt_mktemp (pk7out);
+  if ((fpout = safe_fopen (pk7out, "w+")) == NULL)
+  {
+    fclose (fperr);
+    mutt_perror (pk7out);
+    return NULL;
+  }
+
+  /* Step 1: Convert the signature to a PKCS#7 structure, as we can't
+     extract the full set of certificates directly.
+  */
+  if ((thepid =  smime_invoke (NULL, NULL, NULL,
+                              -1, fileno (fpout), fileno (fperr),
+                              infile, NULL, NULL, NULL, NULL, NULL,
+                              SmimePk7outCommand))== -1)
+  {
+    mutt_any_key_to_continue (_("Error: unable to create OpenSSL subprocess!"));
+    fclose (fperr);
+    fclose (fpout);
+    mutt_unlink (pk7out);
+    return NULL;
+  }
+
+  mutt_wait_filter (thepid);
+
+
+  fflush (fpout);
+  rewind (fpout);
+  rewind (fperr);
+  fflush (fperr);
+  empty = (fgetc (fpout) == EOF);
+  if (empty)
+  {
+    mutt_perror (pk7out);
+    mutt_copy_stream (fperr, stdout);
+    fclose (fpout);
+    fclose (fperr);
+    mutt_unlink (pk7out);
+    return NULL;
+    
+  }
+
+
+  fclose (fpout);
+  mutt_mktemp (certfile);
+  if ((fpout = safe_fopen (certfile, "w+")) == NULL)
+  {
+    fclose (fperr);
+    mutt_unlink (pk7out);
+    mutt_perror (certfile);
+    return NULL;
+  }
+  
+  /* Step 2: Extract the certificates from a PKCS#7 structure.
+   */
+  if ((thepid =  smime_invoke (NULL, NULL, NULL,
+                              -1, fileno (fpout), fileno (fperr),
+                              pk7out, NULL, NULL, NULL, NULL, NULL,
+                              SmimeGetCertCommand))== -1)
+  {
+    mutt_any_key_to_continue (_("Error: unable to create OpenSSL subprocess!"));
+    fclose (fperr);
+    fclose (fpout);
+    mutt_unlink (pk7out);
+    mutt_unlink (certfile);
+    return NULL;
+  }
+
+  mutt_wait_filter (thepid);
+
+  mutt_unlink (pk7out);
+
+  fflush (fpout);
+  rewind (fpout);
+  rewind (fperr);
+  fflush (fperr);
+  empty =  (fgetc (fpout) == EOF);
+  if (empty)
+  {
+    mutt_copy_stream (fperr, stdout);
+    fclose (fpout);
+    fclose (fperr);
+    mutt_unlink (certfile);
+    return NULL;
+  }
+
+  fclose (fpout);
+  fclose (fperr);
+
+  return safe_strdup (certfile);
+}
+
+
+
+
+static char *smime_extract_signer_certificate (char *infile, int split)
+{
+  FILE *fpout = NULL, *fperr = NULL;
+  char pk7out[_POSIX_PATH_MAX], certfile[_POSIX_PATH_MAX];
+  char tmpfname[_POSIX_PATH_MAX];
+  pid_t thepid;
+  int empty;
+
+
+  mutt_mktemp (tmpfname);
+  if ((fperr = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    mutt_perror (tmpfname);
+    return NULL;
+  }
+  mutt_unlink (tmpfname);
+
+
+  mutt_mktemp (certfile);
+  if ((fpout = safe_fopen (certfile, "w+")) == NULL)
+  {
+    fclose (fperr);
+    mutt_perror (certfile);
+    return NULL;
+  }
+  
+  /* Extract signer's certificate
+   */
+  if ((thepid =  smime_invoke (NULL, NULL, NULL,
+                              -1, -1, fileno (fperr),
+                              infile, NULL, NULL, NULL, certfile, NULL,
+                              SmimeGetSignerCertCommand))== -1)
+  {
+    mutt_any_key_to_continue (_("Error: unable to create OpenSSL subprocess!"));
+    fclose (fperr);
+    fclose (fpout);
+    mutt_unlink (pk7out);
+    mutt_unlink (certfile);
+    return NULL;
+  }
+
+  mutt_wait_filter (thepid);
+
+  fflush (fpout);
+  rewind (fpout);
+  rewind (fperr);
+  fflush (fperr);
+  empty =  (fgetc (fpout) == EOF);
+  if (empty)
+  {
+    mutt_copy_stream (fperr, stdout);
+    fclose (fpout);
+    fclose (fperr);
+    mutt_unlink (certfile);
+    return NULL;
+    
+  }
+
+  fclose (fpout);
+  fclose (fperr);
+
+  return safe_strdup (certfile);
+}
+
+
+
+
+void smime_invoke_import (char *infile, char *mailbox)
+{
+  char *certfile = NULL;
+
+  if ((certfile = smime_extract_certificate(infile, FALSE)))
+  {
+    smime_add_certificate (certfile, mailbox, 1);
+    mutt_unlink (certfile);
+    safe_free((void **)&certfile);
+  }
+  
+  return;
+}
+
+
+
+int smime_verify_sender(HEADER *h)
+{
+  char *mbox = NULL, *certfile, tempfname[_POSIX_PATH_MAX];
+  FILE *fpout;
+  int retval=1;
+
+  mutt_mktemp (tempfname);
+  if (!(fpout = safe_fopen (tempfname, "w")))
+  {
+    mutt_perror (tempfname);
+    return 1;
+  }
+
+  if(h->security & ENCRYPT)
+    mutt_copy_message (fpout, Context, h,
+                      M_CM_DECODE_CRYPT & M_CM_DECODE_SMIME,
+                      CH_WEED|CH_NONEWLINE);
+  else
+    mutt_copy_message (fpout, Context, h, 0, 0);
+
+  fflush(fpout);
+  fclose (fpout);
+
+  if (h->env->from)
+  {
+    h->env->from = mutt_expand_aliases (h->env->from); 
+    mbox = h->env->from->mailbox; 
+  }
+  else if (h->env->sender)
+  {
+    h->env->sender = mutt_expand_aliases (h->env->sender); 
+    mbox = h->env->sender->mailbox; 
+  }
+
+  if (mbox)
+  {
+    if ((certfile = smime_extract_signer_certificate(tempfname,TRUE)))
+    {
+      mutt_unlink(tempfname);
+      if (smime_check_cert_email (certfile, mbox))
+       mutt_any_key_to_continue(NULL);
+      else
+       retval = 0;
+      mutt_unlink(certfile);
+      safe_free((void **)&certfile);
+    }
+  else 
+       mutt_any_key_to_continue("no certfile");
+  }
+  else 
+       mutt_any_key_to_continue("no mbox");
+
+  mutt_unlink(tempfname);
+  return retval;
+}
+
+
+
+
+
+
+
+
+
+/*
+ *    Creating S/MIME - bodies.
+ */
+
+
+
+
+static
+pid_t smime_invoke_encrypt (FILE **smimein, FILE **smimeout, FILE **smimeerr,
+                           int smimeinfd, int smimeoutfd, int smimeerrfd,
+                           const char *fname, const char *uids)
+{
+  return smime_invoke (smimein, smimeout, smimeerr,
+                      smimeinfd, smimeoutfd, smimeerrfd,
+                      fname, NULL, SmimeCryptAlg, NULL, uids, NULL,
+                      SmimeEncryptCommand);
+}
+
+
+static
+pid_t smime_invoke_sign (FILE **smimein, FILE **smimeout, FILE **smimeerr,
+                        int smimeinfd, int smimeoutfd, int smimeerrfd, 
+                        const char *fname)
+{
+  return smime_invoke (smimein, smimeout, smimeerr, smimeinfd, smimeoutfd,
+                      smimeerrfd, fname, NULL, NULL, SmimeKeyToUse,
+                      SmimeCertToUse, SmimeIntermediateToUse,
+                      SmimeSignCommand);
+}
+
+
+
+
+BODY *smime_build_smime_entity (BODY *a, char *certlist)
+{
+  char buf[LONG_STRING], certfile[LONG_STRING];
+  char tempfile[_POSIX_PATH_MAX], smimeerrfile[_POSIX_PATH_MAX];
+  char smimeinfile[_POSIX_PATH_MAX];
+  char *cert_start = certlist, *cert_end = certlist;
+  FILE *smimein = NULL, *smimeerr = NULL, *fpout = NULL, *fptmp = NULL;
+  BODY *t;
+  int err = 0, empty;
+  pid_t thepid;
+  
+  mutt_mktemp (tempfile);
+  if ((fpout = safe_fopen (tempfile, "w+")) == NULL)
+  {
+    mutt_perror (tempfile);
+    return (NULL);
+  }
+
+  mutt_mktemp (smimeerrfile);
+  if ((smimeerr = safe_fopen (smimeerrfile, "w+")) == NULL)
+  {
+    mutt_perror (smimeerrfile);
+    fclose (fpout);
+    mutt_unlink (tempfile);
+    return NULL;
+  }
+  mutt_unlink (smimeerrfile);
+  
+  mutt_mktemp (smimeinfile);
+  if ((fptmp = safe_fopen (smimeinfile, "w+")) == NULL)
+  {
+    mutt_perror (smimeinfile);
+    mutt_unlink (tempfile);
+    fclose (fpout);
+    fclose (smimeerr);
+    return NULL;
+  }
+
+  *certfile = '\0';
+  while (1)
+  {
+    int off = mutt_strlen (certfile);
+    while (*++cert_end && *cert_end != '\n');
+    if (!*cert_end) break;
+    *cert_end = '\0';
+    snprintf (certfile+off, sizeof (certfile)-off, " %s/%s",
+             NONULL(SmimeCertificates), cert_start);
+    *cert_end = '\n';
+    cert_start = cert_end;
+    cert_start++;
+  }
+
+  /* write a MIME entity */
+  mutt_write_mime_header (a, fptmp);
+  fputc ('\n', fptmp);
+  mutt_write_mime_body (a, fptmp);
+  fclose (fptmp);
+
+  if ((thepid =
+       smime_invoke_encrypt (&smimein, NULL, NULL, -1,
+                            fileno (fpout), fileno (smimeerr),
+                            smimeinfile, certfile)) == -1)
+  {
+    fclose (smimeerr);
+    mutt_unlink (smimeinfile);
+    mutt_unlink (certfile);
+    return (NULL);
+  }
+
+  fclose (smimein);
+  
+  mutt_wait_filter (thepid);
+  mutt_unlink (smimeinfile);
+  mutt_unlink (certfile);
+  
+  fflush (fpout);
+  rewind (fpout);
+  empty = (fgetc (fpout) == EOF);
+  fclose (fpout);
+
+  fflush (smimeerr);
+  rewind (smimeerr);
+  while (fgets (buf, sizeof (buf) - 1, smimeerr) != NULL)
+  {
+    err = 1;
+    fputs (buf, stdout);
+  }
+  fclose (smimeerr);
+
+  /* pause if there is any error output from SMIME */
+  if (err)
+    mutt_any_key_to_continue (NULL);
+
+  if (empty)
+  {
+    /* fatal error while trying to encrypt message */
+    if (!err) mutt_any_key_to_continue _("No outbut from OpenSSL..");
+    mutt_unlink (tempfile);
+    return (NULL);
+  }
+
+  t = mutt_new_body ();
+  t->type = TYPEAPPLICATION;
+  t->subtype = safe_strdup ("x-pkcs7-mime");
+  mutt_set_parameter ("name", "smime.p7m", &t->parameter);
+  mutt_set_parameter ("smime-type", "enveloped-data", &t->parameter);
+  t->encoding = ENCBASE64;  /* The output of OpenSSL SHOULD be binary */
+  t->use_disp = 1;
+  t->disposition = DISPATTACH;
+  t->d_filename = safe_strdup ("smime.p7m");
+  t->filename = safe_strdup (tempfile);
+  t->unlink = 1; /*delete after sending the message */
+  t->parts=0;
+  t->next=0;
+  
+  return (t);
+}
+
+
+
+
+BODY *smime_sign_message (BODY *a )
+{
+  BODY *t;
+  char buffer[LONG_STRING];
+  char signedfile[_POSIX_PATH_MAX], filetosign[_POSIX_PATH_MAX];
+  FILE *smimein = NULL, *smimeout = NULL, *smimeerr = NULL, *sfp = NULL;
+  int err = 0;
+  int empty = 0;
+  pid_t thepid;
+  char *intermediates = smime_get_field_from_db(NULL, SmimeSignAs, 1);
+
+  if (!intermediates)
+  {
+    mutt_message(_("Warning: Intermediate certificate not found."));
+    intermediates = SmimeSignAs; /* so openssl won't complain in any case */
+  }
+  else
+      intermediates[mutt_strlen (intermediates)-1] = '\0';
+
+  convert_to_7bit (a); /* Signed data _must_ be in 7-bit format. */
+
+  mutt_mktemp (filetosign);
+  if ((sfp = safe_fopen (filetosign, "w+")) == NULL)
+  {
+    mutt_perror (filetosign);
+    return NULL;
+  }
+
+  mutt_mktemp (signedfile);
+  if ((smimeout = safe_fopen (signedfile, "w+")) == NULL)
+  {
+    mutt_perror (signedfile);
+    fclose (sfp);
+    mutt_unlink (filetosign);
+    return NULL;
+  }
+  
+  mutt_write_mime_header (a, sfp);
+  fputc ('\n', sfp);
+  mutt_write_mime_body (a, sfp);
+  fclose (sfp);
+
+  
+
+  snprintf (SmimeKeyToUse, sizeof (SmimeKeyToUse), "%s/%s", 
+          NONULL(SmimeKeys), SmimeSignAs);
+
+  snprintf (SmimeCertToUse, sizeof (SmimeCertToUse), "%s/%s",
+          NONULL(SmimeCertificates), SmimeSignAs);
+  
+  snprintf (SmimeIntermediateToUse, sizeof (SmimeIntermediateToUse), "%s/%s",
+          NONULL(SmimeCertificates), intermediates);
+  
+
+
+  if ((thepid = smime_invoke_sign (&smimein, NULL, &smimeerr,
+                                -1, fileno (smimeout), -1, filetosign)) == -1)
+  {
+    mutt_perror _("Can't open OpenSSL subprocess!");
+    fclose (smimeout);
+    mutt_unlink (signedfile);
+    mutt_unlink (filetosign);
+    return NULL;
+  }
+  fputs (SmimePass, smimein);
+  fputc ('\n', smimein);
+  fclose (smimein);
+  
+
+  mutt_wait_filter (thepid);
+
+  /* check for errors from OpenSSL */
+  err = 0;
+  fflush (smimeerr);
+  rewind (smimeerr);
+  while (fgets (buffer, sizeof (buffer) - 1, smimeerr) != NULL)
+  {
+    err = 1;
+    fputs (buffer, stdout);
+  }
+  fclose (smimeerr);
+
+
+  fflush (smimeout);
+  rewind (smimeout);
+  empty = (fgetc (smimeout) == EOF);
+  fclose (smimeout);
+
+  mutt_unlink (filetosign);
+  
+
+  if (err)
+    mutt_any_key_to_continue (NULL);
+
+  if (empty)
+  {
+    mutt_any_key_to_continue _("No output from OpenSSL...");
+    mutt_unlink (signedfile);
+    return (NULL); /* fatal error while signing */
+  }
+
+  t = mutt_new_body ();
+  t->type = TYPEMULTIPART;
+  t->subtype = safe_strdup ("signed");
+  t->encoding = ENC7BIT;
+  t->use_disp = 0;
+  t->disposition = DISPINLINE;
+
+  mutt_generate_boundary (&t->parameter);
+  /* check if this can be extracted from private key somehow.... */
+  mutt_set_parameter ("micalg", "sha1", &t->parameter);
+  mutt_set_parameter ("protocol", "application/x-pkcs7-signature",
+                    &t->parameter);
+
+  t->parts = a;
+  a = t;
+
+  t->parts->next = mutt_new_body ();
+  t = t->parts->next;
+  t->type = TYPEAPPLICATION;
+  t->subtype = safe_strdup ("x-pkcs7-signature");
+  t->filename = safe_strdup (signedfile);
+  t->d_filename = safe_strdup ("smime.p7s");
+  t->use_disp = 1;
+  t->disposition = DISPATTACH;
+  t->encoding = ENCBASE64;
+  t->unlink = 1; /* ok to remove this file after sending. */
+
+  return (a);
+
+}
+
+
+
+
+
+
+/*
+ *    Handling S/MIME - bodies.
+ */
+
+
+
+
+
+
+static
+pid_t smime_invoke_verify (FILE **smimein, FILE **smimeout, FILE **smimeerr,
+                          int smimeinfd, int smimeoutfd, int smimeerrfd, 
+                          const char *fname, const char *sig_fname, int opaque)
+{
+  return smime_invoke (smimein, smimeout, smimeerr, smimeinfd, smimeoutfd,
+                      smimeerrfd, fname, sig_fname, NULL, NULL, NULL, NULL,
+                      (opaque ? SmimeVerifyOpaqueCommand : SmimeVerifyCommand));
+}
+
+
+static
+pid_t smime_invoke_decrypt (FILE **smimein, FILE **smimeout, FILE **smimeerr,
+                           int smimeinfd, int smimeoutfd, int smimeerrfd, 
+                           const char *fname)
+{
+  return smime_invoke (smimein, smimeout, smimeerr, smimeinfd, smimeoutfd,
+                      smimeerrfd, fname, NULL, NULL, SmimeKeyToUse,
+                      SmimeCertToUse, NULL, SmimeDecryptCommand);
+}
+
+
+
+int smime_verify_one (BODY *sigbdy, STATE *s, const char *tempfile)
+{
+  char signedfile[_POSIX_PATH_MAX], smimeerrfile[_POSIX_PATH_MAX];
+  FILE *fp=NULL, *smimeout=NULL, *smimeerr=NULL;
+  pid_t thepid;
+  int badsig = -1;
+
+  long tmpoffset = 0;
+  size_t tmplength = 0;
+  int origType = sigbdy->type;
+  char *savePrefix = NULL;
+
+
+  snprintf (signedfile, sizeof (signedfile), "%s.sig", tempfile);
+  
+  /* decode to a tempfile, saving the original destination */
+  fp = s->fpout;
+  if ((s->fpout = safe_fopen (signedfile, "w")) == NULL)
+  {
+    mutt_perror (signedfile);
+    return -1;
+  }
+  /* decoding the attachment changes the size and offset, so save a copy
+   * of the "real" values now, and restore them after processing
+   */
+  tmplength = sigbdy->length;
+  tmpoffset = sigbdy->offset;
+
+  /* if we are decoding binary bodies, we don't want to prefix each
+   * line with the prefix or else the data will get corrupted.
+   */
+  savePrefix = s->prefix;
+  s->prefix = NULL;
+
+  mutt_decode_attachment (sigbdy, s);
+
+  sigbdy->length = ftell (s->fpout);
+  sigbdy->offset = 0;
+  fclose (s->fpout);
+
+  /* restore final destination and substitute the tempfile for input */
+  s->fpout = fp;
+  fp = s->fpin;
+  s->fpin = fopen (signedfile, "r");
+
+  /* restore the prefix */
+  s->prefix = savePrefix;
+  
+  sigbdy->type = origType;
+
+  
+  mutt_mktemp (smimeerrfile);
+  if (!(smimeerr = safe_fopen (smimeerrfile, "w+")))
+  {
+    mutt_perror (smimeerrfile);
+    mutt_unlink (signedfile);
+    return -1;
+  }
+  
+  crypt_current_time (s, "OpenSSL");
+  
+  if ((thepid = smime_invoke_verify (NULL, &smimeout, NULL, 
+                                  -1, -1, fileno (smimeerr),
+                                  tempfile, signedfile, 0)) != -1)
+  {
+    fflush (smimeout);
+    fclose (smimeout);
+      
+    if (mutt_wait_filter (thepid))
+      badsig = -1;
+    else
+    {
+      char *line = NULL;
+      int lineno = 0;
+      size_t linelen;
+      
+      fflush (smimeerr);
+      rewind (smimeerr);
+      
+      line = mutt_read_line (line, &linelen, smimeerr, &lineno);
+      if (linelen && !mutt_strcasecmp (line, "verification successful"))
+       badsig = 0;
+
+      safe_free ((void **) &line);
+    }
+  }
+  
+  fflush (smimeerr);
+  rewind (smimeerr);
+  mutt_copy_stream (smimeerr, s->fpout);
+  fclose (smimeerr);
+    
+  state_attach_puts (_("[-- End of OpenSSL output --]\n\n"), s);
+  
+  mutt_unlink (signedfile);
+  mutt_unlink (smimeerrfile);
+
+  sigbdy->length = tmplength;
+  sigbdy->offset = tmpoffset;
+  
+  /* restore the original source stream */
+  fclose (s->fpin);
+  s->fpin = fp;
+  
+
+  return badsig;
+}
+
+
+
+
+
+/*
+  This handles application/pkcs7-mime which can either be a signed
+  or an encrypted message.
+*/
+
+static BODY *smime_handle_entity (BODY *m, STATE *s, FILE *outFile)
+{
+  int len=0;
+  long last_pos;
+  char buf[HUGE_STRING];
+  char outfile[_POSIX_PATH_MAX], errfile[_POSIX_PATH_MAX];
+  char tmpfname[_POSIX_PATH_MAX];
+  char tmptmpfname[_POSIX_PATH_MAX];
+  FILE *smimeout = NULL, *smimein=NULL, *smimeerr=NULL;
+  FILE *tmpfp=NULL, *tmpfp_buffer=NULL, *fpout=NULL;
+  struct stat info;
+  BODY *p=NULL;
+  pid_t thepid=-1;
+  unsigned int type = mutt_is_application_smime (m);
+
+  if (!(type & APPLICATION_SMIME)) return NULL;
+
+  mutt_mktemp (outfile);
+  if ((smimeout = safe_fopen (outfile, "w+")) == NULL)
+  {
+    mutt_perror (outfile);
+    return NULL;
+  }
+  
+  mutt_mktemp (errfile);
+  if ((smimeerr = safe_fopen (errfile, "w+")) == NULL)
+  {
+    mutt_perror (errfile);
+    fclose (smimeout); smimeout = NULL;
+    return NULL;
+  }
+  mutt_unlink (errfile);
+
+  
+  mutt_mktemp (tmpfname);
+  if ((tmpfp = safe_fopen (tmpfname, "w+")) == NULL)
+  {
+    mutt_perror (tmpfname);
+    fclose (smimeout); smimeout = NULL;
+    fclose (smimeerr); smimeerr = NULL;
+    return NULL;
+  }
+
+  fseek (s->fpin, m->offset, 0);
+  last_pos = m->offset;
+
+  mutt_copy_bytes (s->fpin, tmpfp,  m->length);
+
+  fflush (tmpfp);
+  fclose (tmpfp);
+
+  if ((type & ENCRYPT) &&
+      (thepid = smime_invoke_decrypt (&smimein, NULL, NULL, -1,
+                                     fileno (smimeout),  fileno (smimeerr), tmpfname)) == -1)
+  {
+    fclose (smimeout); smimeout = NULL;
+    mutt_unlink (tmpfname);
+    state_attach_puts (_("[-- Error: unable to create OpenSSL subprocess! --]\n"), s);
+    return NULL;
+  }
+  else if ((type & SIGNOPAQUE) &&
+          (thepid = smime_invoke_verify (&smimein, NULL, NULL, -1,
+                                         fileno (smimeout), fileno (smimeerr), NULL,
+                                         tmpfname, SIGNOPAQUE)) == -1)
+  {
+    fclose (smimeout); smimeout = NULL;
+    mutt_unlink (tmpfname);
+    state_attach_puts (_("[-- Error: unable to create OpenSSL subprocess! --]\n"), s);
+    return NULL;
+  }
+
+  
+  if (type & ENCRYPT)
+  {
+    if (!smime_valid_passphrase ())
+      smime_void_passphrase ();
+    fputs (SmimePass, smimein);
+    fputc ('\n', smimein);
+  }
+
+  fclose (smimein);
+       
+  if (s->flags & M_DISPLAY) crypt_current_time (s, "OpenSSL");
+       
+  mutt_wait_filter (thepid);
+
+  mutt_unlink (tmpfname);
+  
+  if (s->flags & M_DISPLAY)
+    mutt_copy_stream (smimeerr, s->fpout);
+  
+  if (s->flags & M_DISPLAY)
+    state_attach_puts (_("\n[-- End of OpenSSL output --]\n\n"), s);
+  
+  if (s->flags & M_DISPLAY)
+  {
+    if (type & ENCRYPT)
+      state_attach_puts (_("\n[-- The following data is S/MIME"
+                   " encrypted --]\n"), s);
+    else
+      state_attach_puts (_("\n[-- The following data is S/MIME signed --]\n"), s);
+  }  
+  if (smimeout)
+  {
+    fflush (smimeout);
+    rewind (smimeout);
+    
+    if (outFile) fpout = outFile;
+    else
+    {
+      mutt_mktemp (tmptmpfname);
+      if ((fpout = safe_fopen (tmptmpfname, "w+")) == NULL)
+      {
+       mutt_perror(tmptmpfname);
+       fclose (smimeout); smimeout = NULL;
+       return NULL;
+      }
+    }
+    while (fgets (buf, sizeof (buf) - 1, smimeout) != NULL)
+    {
+      len = mutt_strlen (buf);
+      if (len > 1 && buf[len - 2] == '\r')
+       strcpy (buf + len - 2, "\n");
+      fputs (buf, fpout);
+    }
+    fflush (fpout);
+    rewind (fpout); 
+
+
+    if ((p = mutt_read_mime_header (fpout, 0)) != NULL)
+    {
+      fstat (fileno (fpout), &info);
+      p->length = info.st_size - p->offset;
+         
+      mutt_parse_part (fpout, p);
+      if (s->fpout)
+      {
+       rewind (fpout);
+       tmpfp_buffer = s->fpin;
+       s->fpin = fpout;
+       mutt_body_handler (p, s);
+       s->fpin = tmpfp_buffer;
+      }
+      
+    }
+    fclose (smimeout);
+    smimeout = NULL;
+    mutt_unlink (outfile);
+
+    if (!outFile)
+    {
+      fclose (fpout);
+      mutt_unlink (tmptmpfname);
+    }
+    fpout = NULL;
+  }
+
+  if (s->flags & M_DISPLAY)
+  {
+    if (type & ENCRYPT)
+      state_attach_puts (_("\n[-- End of S/MIME encrypted data. --]\n"), s);
+    else
+      state_attach_puts (_("\n[-- End of S/MIME signed data. --]\n"), s);
+  }
+
+  if (type & SIGNOPAQUE)
+  {
+    char *line = NULL;
+    int lineno = 0;
+    size_t linelen;
+    
+    rewind (smimeerr);
+    
+    line = mutt_read_line (line, &linelen, smimeerr, &lineno);
+    if (linelen && !mutt_strcasecmp (line, "verification successful"))
+      m->goodsig = 1;
+    safe_free ((void **) &line);
+  }
+  else {
+    m->goodsig = p->goodsig;
+    m->badsig = p->badsig;
+  }
+  fclose (smimeerr);
+
+  return (p);
+}
+
+
+
+
+
+int smime_decrypt_mime (FILE *fpin, FILE **fpout, BODY *b, BODY **cur)
+{
+
+
+  char tempfile[_POSIX_PATH_MAX];
+  STATE s;
+  long tmpoffset = b->offset;
+  size_t tmplength = b->length;
+  int origType = b->type;
+  FILE *tmpfp=NULL;
+
+  if (!mutt_is_application_smime (b))
+    return -1;
+
+  if (b->parts)
+    return -1;
+  
+  memset (&s, 0, sizeof (s));
+  s.fpin = fpin;
+  fseek (s.fpin, b->offset, 0);
+
+  mutt_mktemp (tempfile);
+  if ((tmpfp = safe_fopen (tempfile, "w+")) == NULL)
+  {
+    mutt_perror (tempfile);
+    return (-1);
+  }
+
+  mutt_unlink (tempfile);
+  s.fpout = tmpfp;
+  mutt_decode_attachment (b, &s);
+  fflush (tmpfp);
+  b->length = ftell (s.fpout);
+  b->offset = 0;
+  rewind (tmpfp);
+  s.fpin = tmpfp;
+  s.fpout = 0;
+
+  mutt_mktemp (tempfile);
+  if ((*fpout = safe_fopen (tempfile, "w+")) == NULL)
+  {
+    mutt_perror (tempfile);
+    return (-1);
+  }
+  mutt_unlink (tempfile);
+
+  *cur = smime_handle_entity (b, &s, *fpout);
+  (*cur)->goodsig = b->goodsig;
+  (*cur)->badsig = b->badsig;
+  b->type = origType;
+  b->length = tmplength;
+  b->offset = tmpoffset;
+  fclose (tmpfp);
+
+  rewind (*fpout);
+  return (0);
+
+}
+
+
+void smime_application_smime_handler (BODY *m, STATE *s)
+{
+    
+    smime_handle_entity (m, s, NULL);
+
+}
+#endif /* HAVE_SMIME */
+
+
+
+
+
+

diff --git a/smime.h b/smime.h
new file mode 100644 (file)
index 0000000..a20c1e5
--- /dev/null
+++ b/smime.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2001 Oliver Ehli <elmy@acm.org>
+ *
+ *     This program is free software; you can redistribute it and/or modify
+ *     it under the terms of the GNU General Public License as published by
+ *     the Free Software Foundation; either version 2 of the License, or
+ *     (at your option) any later version.
+ * 
+ *     This program is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ * 
+ *     You should have received a copy of the GNU General Public License
+ *     along with this program; if not, write to the Free Software
+ *     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+ */
+
+
+#ifdef HAVE_SMIME
+
+#include "crypt.h"
+
+WHERE char *SmimeSignAs;
+WHERE char *SmimeCryptAlg;
+WHERE short SmimeTimeout;
+WHERE char *SmimeCertificates;
+WHERE char *SmimeKeys;
+WHERE char *SmimeCryptAlg;
+
+/* The command formats */
+
+WHERE char *SmimeVerifyCommand;
+WHERE char *SmimeVerifyOpaqueCommand;
+WHERE char *SmimeDecryptCommand;
+
+WHERE char *SmimeSignCommand;
+WHERE char *SmimeSignOpaqueCommand;
+WHERE char *SmimeEncryptCommand;
+
+WHERE char *SmimeGetSignerCertCommand;
+WHERE char *SmimePk7outCommand;
+WHERE char *SmimeGetCertCommand;
+WHERE char *SmimeHashCertCommand;
+WHERE char *SmimeGetCertEmailCommand;
+
+#define APPLICATION_SMIME  (1 << 6)
+
+#define SIGNOPAQUE    (1 << 4)
+
+#define SMIMEENCRYPT  (APPLICATION_SMIME | ENCRYPT)
+#define SMIMESIGN     (APPLICATION_SMIME | SIGN)
+#define SMIMEGOODSIGN (APPLICATION_SMIME | GOODSIGN)
+#define SMIMEBADSIGN  (APPLICATION_SMIME | BADSIGN)
+#define SMIMEOPAQUE   (APPLICATION_SMIME | SIGNOPAQUE)
+
+
+
+#define smime_valid_passphrase() crypt_valid_passphrase(APPLICATION_SMIME)
+
+void smime_void_passphrase (void);
+
+int mutt_is_application_smime (BODY *);
+
+
+
+
+int smime_decrypt_mime (FILE *, FILE **, BODY *, BODY **);
+
+void smime_application_smime_handler (BODY *, STATE *);
+
+int smime_verify_sender(HEADER *);
+
+
+
+
+char *smime_get_field_from_db (char *, char *, short);
+
+char* smime_ask_for_key (char *, char *, short);
+
+void smime_getkeys (char *);
+
+
+/* private ? */
+
+void smime_invoke_import (char *, char *);
+
+int smime_verify_one(BODY *, STATE *, const char *);
+
+BODY *smime_sign_message (BODY *);
+
+BODY *smime_build_smime_entity (BODY *, char *);
+#endif

diff --git a/smime_keys.pl b/smime_keys.pl
new file mode 100755 (executable)
index 0000000..39cec7b
--- /dev/null
+++ b/smime_keys.pl
@@ -0,0 +1,887 @@
+#!/usr/bin/perl -w
+
+# Settings:
+
+my $SmimeMuttrc="$ENV{HOME}/.mutt/muttrc";
+
+# Copyright (C) 2001 Oliver Ehli <elmy@acm.org>
+# Copyright (C) 2001 Mike Schiraldi <raldi@research.netsol.com>
+#
+#     This program is free software; you can redistribute it and/or modify
+#     it under the terms of the GNU General Public License as published by
+#     the Free Software Foundation; either version 2 of the License, or
+#     (at your option) any later version.
+# 
+#     This program is distributed in the hope that it will be useful,
+#     but WITHOUT ANY WARRANTY; without even the implied warranty of
+#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#     GNU General Public License for more details.
+# 
+#     You should have received a copy of the GNU General Public License
+#     along with this program; if not, write to the Free Software
+#     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111, USA.
+
+use strict;
+
+require "timelocal.pl";
+
+# Global variables:
+
+my $private_keys_path;
+my $certificates_path;
+my $root_certs_switch;
+my $root_certs_path;
+
+
+sub usage ();
+sub get_paths ($ );
+sub myglob ($ );
+
+#  directory setup routines
+sub mkdir_recursive ($;$ );
+sub init_paths ();
+
+# key/certificate management methods
+sub list_certs ();
+sub query_label ();
+sub add_entry ($$$$;$ );
+sub add_certificate ($$$$;$ );
+sub add_key ($$$$);
+sub add_root_cert ($);
+sub parse_pem (@ );
+sub handle_pem (@ );
+sub modify_entry ($$$;$ );
+sub remove_pair ($ );
+sub change_label ($ );
+sub verify_cert($;$ );
+sub do_verify($$;$);
+
+
+
+
+# Get the directories mutt uses for certificate/key storage.
+
+($private_keys_path, $certificates_path,
+ $root_certs_switch, $root_certs_path) = get_paths($SmimeMuttrc);
+
+$certificates_path and $private_keys_path
+  and $root_certs_switch and $root_certs_path or
+  die("Couldn't get paths to certificates/keys from $SmimeMuttrc");
+
+#
+# OPS
+#
+
+if(@ARGV == 1 and $ARGV[0] eq "init") {
+    init_paths;
+}
+elsif(@ARGV == 1 and $ARGV[0] eq "list") {
+    list_certs;
+}
+elsif(@ARGV == 2 and $ARGV[0] eq "label") {
+    change_label($ARGV[1]);
+}
+elsif(@ARGV == 2 and $ARGV[0] eq "add_cert") {
+    my $cmd = "openssl x509 -noout -hash -in $ARGV[1]";
+    my $cert_hash = `$cmd`;
+    $? and die "'$cmd' returned $?";
+    chomp($cert_hash); 
+    my $label = query_label;
+    &add_certificate($ARGV[1], \$cert_hash, 1, $label, '-');
+}
+elsif(@ARGV == 2 and $ARGV[0] eq "add_pem") {
+    -e $ARGV[1] and -s $ARGV[1] or die("$ARGV[1] is nonexistent or empty.");
+    open(PEM_FILE, "<$ARGV[1]") or die("Can't open $ARGV[1]: $!");
+    my @pem = <PEM_FILE>;
+    close(PEM_FILE);
+    handle_pem(@pem);
+}
+elsif( @ARGV == 2 and $ARGV[0] eq "add_p12") {
+    -e $ARGV[1] and -s $ARGV[1] or die("$ARGV[1] is nonexistent or empty.");
+
+    print "\nNOTE: This will ask you for two passphrases:\n";
+    print "       1. The passphrase you used for exporting\n";
+    print "       2. The passphrase you wish to secure your private key with.\n\n";
+
+    my $pem_file = "$ARGV[1].pem";
+    
+    my $cmd = "openssl pkcs12 -in $ARGV[1] -out $pem_file";
+    system $cmd and die "'$cmd' returned $?";
+    
+    -e $pem_file and -s $pem_file or die("Conversion of $ARGV[1] failed.");
+    open(PEM_FILE, $pem_file) or die("Can't open $pem_file: $!");
+    my @pem = <PEM_FILE>;
+    close(PEM_FILE);
+    handle_pem(@pem);
+}
+elsif(@ARGV == 4 and $ARGV[0] eq "add_chain") {
+    my $cmd = "openssl x509 -noout -hash -in $ARGV[2]";
+    my $cert_hash = `$cmd`;
+    $? and die "'$cmd' returned $?";
+    
+    $cmd = "openssl x509 -noout -hash -in $ARGV[3]";
+    my $issuer_hash = `$cmd`;
+    $? and die "'$cmd' returned $?";
+    
+    chomp($cert_hash); 
+    chomp($issuer_hash);
+
+    my $label = query_label;
+    
+    add_certificate($ARGV[3], \$issuer_hash, 0, $label); 
+    my $mailbox = &add_certificate($ARGV[2], \$cert_hash, 1, $label, $issuer_hash);
+    
+    add_key($ARGV[1], $cert_hash, $mailbox, $label);
+}
+elsif((@ARGV == 2 or @ARGV == 3) and $ARGV[0] eq "verify") {
+    verify_cert($ARGV[1], $ARGV[2]);
+}
+elsif(@ARGV == 2 and $ARGV[0] eq "remove") {
+    remove_pair($ARGV[1]);
+}
+elsif(@ARGV == 2 and $ARGV[0] eq "add_root") {
+    add_root_cert($ARGV[1]);
+}
+else {    
+    usage;
+    exit(1);
+}
+
+exit(0);
+
+
+
+
+
+##############  sub-routines  ########################
+
+sub usage () {
+    print <<EOF;
+
+Usage: smime_keys <operation>  [file(s) | keyID [file(s)]]
+
+        with operation being one of:
+
+        init      : no files needed, inits directory structure.
+
+        list      : lists the certificates stored in database.
+        label     : keyID required. changes/removes/adds label.
+        remove    : keyID required.
+        verify    : 1=keyID and optionally 2=CRL
+                    Verifies the certificate chain, and optionally wether
+                    this certificate is included in supplied CRL (PEM format).
+                    Note: to verify all certificates at the same time,
+                    replace keyID with "all"
+
+        add_cert  : certificate required.
+        add_chain : three files reqd: 1=Key, 2=certificate
+                    plus 3=intermediate certificate(s).
+        add_p12   : one file reqd. Adds keypair to database.
+                    file is PKCS12 (e.g. export from netscape).
+        add_pem   : one file reqd. Adds keypair to database.
+                    (file was converted from e.g. PKCS12).
+
+        add_root  : one file reqd. Adds PEM root certificate to the location
+                    specified within muttrc (smime_verify_* command)
+
+EOF
+}
+
+sub get_paths ($) {
+    my @files = (shift);
+    my $certs;
+    my $keys;
+    my $roots;
+    my $switch;
+    
+    while (@files) {        
+        my $file = myglob shift @files;
+        
+        if (open(FILE, $file)) {
+        
+            while(<FILE>) {
+               chomp;
+               s/\#.*//;
+            
+               /^\s*source\s*\"?([^\"]*)\"?/
+                       and push @files, $1;
+            
+               /^\s*set\s*smime_keys\s*=\s*\"?([^\"]*)\"?/
+                       and $keys = myglob $1;
+            
+               /^\s*set\s*smime_certificates\s*=\s*\"?([^\"]*)\"?/
+                       and $certs = myglob $1;        
+
+               /^\s*set\s*smime_verify[^CA]*(-CA[^\s]*)\s*([^\s]*)./
+                       and $switch = myglob $1 and $roots = myglob $2;
+           }
+           close(FILE);
+       }
+    }
+    return ($keys, $certs, $switch, $roots);
+}
+
+sub myglob ($) {
+    my $file = shift;
+    
+    $file =~ s{
+                ^ ~             # find a leading tilde
+                (               # save this in $1
+                    [^/]        # a non-slash character
+                          *     # repeated 0 or more times (0 means me)
+                )
+              }{
+                $1
+                ? (getpwnam($1))[7]
+                : ( $ENV{HOME} || $ENV{LOGDIR} || (getpwuid($<))[7] )
+               }ex;
+
+    return $file;
+}
+
+#
+#  directory setup routines
+#
+
+
+sub mkdir_recursive ($;$) {
+    my $path = shift;
+    my $mode = 0700;
+
+    (@_ == 2) and $mode = shift;
+
+    my $tmp_path;
+    
+    for my $dir (split /\//, $path) {
+        $tmp_path .= "$dir/";
+
+        -d $tmp_path 
+            or mkdir $tmp_path, $mode 
+                or die "Can't mkdir $tmp_path: $!";
+    }
+}
+
+sub init_paths () {
+    mkdir_recursive($certificates_path);
+    mkdir_recursive($private_keys_path);
+
+    my $file;
+
+    $file = $certificates_path . "/.index";
+    -f $file or open(TMP_FILE, ">$file") and close(TMP_FILE)
+        or die "Can't touch $file: $!";
+
+    $file = $private_keys_path . "/.index";
+    -f $file or open(TMP_FILE, ">$file") and close(TMP_FILE)
+        or die "Can't touch $file: $!";
+}
+
+
+
+#
+# certificate management methods
+#
+
+sub list_certs () {
+  my %keyflags = ( 'i', '(Invalid)',  'r', '(Revoked)', 'e', '(Expired)',
+                  'u', '(Unverified)', 'v', '(Valid)', 't', '(Trusted)');
+
+  open(INDEX, "<$certificates_path/.index") or 
+    die "Couldn't open $certificates_path/.index: $!";
+  
+  print "\n";
+  while(<INDEX>) {
+    my $tmp;
+    my @tmp;
+    my $tab = "            ";
+    my @fields = split;
+
+    if($fields[2] eq '-') {
+      print "$fields[1]: Issued for: $fields[0] $keyflags{$fields[4]}\n";
+    } else {
+      print "$fields[1]: Issued for: $fields[0] \"$fields[2]\" $keyflags{$fields[4]}\n";
+    }
+
+    (my $subject_in, my $email_in, my $issuer_in, my $date1_in, my $date2_in) =
+      `openssl x509 -subject -email -issuer -dates -noout -in $certificates_path/$fields[1]`;
+
+    my @subject = split(/\//, $subject_in);
+    while(@subject) {
+      $tmp = shift @subject;
+      ($tmp =~ /^CN\=/) and last;
+      undef $tmp;
+    }
+    defined $tmp and @tmp = split (/\=/, $tmp) and
+      print $tab."Subject: $tmp[1]\n";
+
+    my @issuer = split(/\//, $issuer_in);
+    while(@issuer) {
+      $tmp = shift @issuer;
+      ($tmp =~ /^CN\=/) and last;
+      undef $tmp;
+    }
+    defined $tmp and @tmp = split (/\=/, $tmp) and
+      print $tab."Issued by: $tmp[1]";
+
+    if ( defined $date1_in and defined $date2_in ) {
+      @tmp = split (/\=/, $date1_in);
+      $tmp = $tmp[1];
+      @tmp = split (/\=/, $date2_in);
+      print $tab."Certificate is not valid before $tmp".
+       $tab."                      or after  ".$tmp[1];
+    }
+
+    -e "$private_keys_path/$fields[1]" and
+      print "$tab - Matching private key installed -\n";
+
+    my $purpose_in =
+      `openssl x509 -purpose -noout -in $certificates_path/$fields[1]`;
+    my @purpose = split (/\n/, $purpose_in);
+    print "$tab$purpose[0] (displays S/MIME options only)\n";
+    while(@purpose) {
+      $tmp = shift @purpose;
+      ($tmp =~ /^S\/MIME/ and $tmp =~ /Yes/) or next;
+      my @tmptmp = split (/:/, $tmp);
+      print "$tab  $tmptmp[0]\n";
+    }
+
+    print "\n";
+  }
+  
+  close(INDEX);
+}
+
+
+
+sub query_label () {
+    my @words;
+    my $input;
+
+    print "\nYou may assign a label to this key, so you don't have to remember\n";
+    print "the key ID. This has to be _one_ word (no whitespaces).\n\n";
+
+    print "Enter label: ";
+    chomp($input = <STDIN>);
+
+    my ($label, $junk) = split(/\s/, $input, 2);     
+    
+    defined $junk 
+        and print "\nUsing '$label' as label; ignoring '$junk'\n";
+
+    defined $label || ($label =  "-");
+
+    return $label;
+}
+
+
+
+sub add_entry ($$$$;$) {
+    my $mailbox = shift;
+    my $hashvalue = shift;
+    my $use_cert = shift;
+    my $label = shift;
+    my $issuer_hash = shift;
+
+    my @fields;
+
+    if ($use_cert) {
+        open(INDEX, "+<$certificates_path/.index") or 
+            die "Couldn't open $certificates_path/.index: $!";
+    }
+    else {
+        open(INDEX, "+<$private_keys_path/.index") or 
+            die "Couldn't open $private_keys_path/.index: $!";
+    }
+
+    while(<INDEX>) {
+        @fields = split;
+        return if ($fields[0] eq $mailbox && $fields[1] eq $hashvalue);
+    }
+
+    if ($use_cert) {
+        print INDEX "$mailbox $hashvalue $label $issuer_hash u\n";
+    }
+    else {
+        print INDEX "$mailbox $hashvalue $label \n";
+    }
+
+    close(INDEX);
+}
+
+
+sub add_certificate ($$$$;$) {
+    my $filename = shift;
+    my $hashvalue = shift;
+    my $add_to_index = shift;
+    my $label = shift;
+    my $issuer_hash = shift;
+
+    my $iter = 0;
+    my $mailbox;
+
+    while(-e "$certificates_path/$$hashvalue.$iter") {
+        my ($t1, $t2);
+
+        my $cmd = "openssl x509 -in $filename -fingerprint -noout";
+        $t1 = `$cmd`;
+        $? and die "'$cmd' returned $?";
+
+        $cmd = "openssl x509 -in $certificates_path/$$hashvalue.$iter -fingerprint -noout";
+        $t2 = `$cmd`;
+        $? and die "'$cmd' returned $?";
+        
+        $t1 eq $t2 and last;
+
+        $iter++;
+    }
+    $$hashvalue .= ".$iter";
+    
+    unless (-e "$certificates_path/$$hashvalue") {
+        my $cmd = "cp $filename $certificates_path/$$hashvalue";
+        system $cmd and die "'$cmd' returned $?";
+
+        if ($add_to_index) {
+           my $cmd = "openssl x509 -in $filename -email -noout";
+           $mailbox = `$cmd`;
+           $? and die "'$cmd' returned $?";
+
+           chomp($mailbox);
+           add_entry($mailbox, $$hashvalue, 1, $label, $issuer_hash);
+
+            print "added certificate: $certificates_path/$$hashvalue for $mailbox.\n";
+        }
+        else {
+            print "added certificate: $certificates_path/$$hashvalue.\n";
+        }
+    }
+
+    return $mailbox;
+}
+
+
+sub add_key ($$$$) {
+    my $file = shift;
+    my $hashvalue = shift;
+    my $mailbox = shift;
+    my $label = shift;
+
+    unless (-e "$private_keys_path/$hashvalue") {
+        my $cmd = "cp $file $private_keys_path/$hashvalue";
+       system $cmd and die "$cmd returned $!";
+       print "added private key: " .
+             "$private_keys_path/$hashvalue for $mailbox\n";
+       add_entry($mailbox, $hashvalue, 0, $label, "");
+    }    
+} 
+
+
+
+
+
+
+sub parse_pem (@) {
+    my $state = 0;
+    my $cert_iter = 0;
+    my @bag_attribs;
+    my $numBags = 0;
+
+    open(CERT_FILE, ">cert_tmp.$cert_iter") 
+        or die "Couldn't open cert_tmp.$cert_iter: $!";
+
+    while($_ = shift(@_)) {
+        if(/^Bag Attributes/) {
+            $numBags++;
+            $state == 0 or  die("PEM-parse error at: $.");
+           $state = 1;
+            $bag_attribs[$cert_iter*4+1] = "";
+            $bag_attribs[$cert_iter*4+2] = "";
+            $bag_attribs[$cert_iter*4+3] = "";
+        }
+
+        ($state == 1) and /localKeyID:\s*(.*)/ 
+            and ($bag_attribs[$cert_iter*4+1] = $1);
+
+        ($state == 1) and /subject=\s*(.*)/    
+            and ($bag_attribs[$cert_iter*4+2] = $1);
+
+        ($state == 1) and /issuer=\s*(.*)/     
+            and ($bag_attribs[$cert_iter*4+3] = $1);
+        
+        if(/^-----/) {
+            if(/BEGIN/) {
+                print CERT_FILE;
+                $state = 2;
+
+                if(/PRIVATE/) {
+                    $bag_attribs[$cert_iter*4] = "K";
+                    next;
+                }
+                if(/CERTIFICATE/) {
+                    $bag_attribs[$cert_iter*4] = "C";
+                    next;
+                }
+                die("What's this: $_");
+            }
+            if(/END/) {
+                $state = 0;
+                print CERT_FILE;
+                close(CERT_FILE);
+                $cert_iter++;
+                open(CERT_FILE, ">cert_tmp.$cert_iter")
+                    or die "Couldn't open cert_tmp.$cert_iter: $!";
+                next;
+            }
+        }
+        print CERT_FILE;
+    }
+    close(CERT_FILE);
+
+    # I'll add support for unbagged cetificates, in case this is needed.
+    $numBags == $cert_iter or 
+        die("Not all contents were bagged. can't continue.");
+
+    @bag_attribs;
+}
+
+
+# This requires the Bag Attributes to be set
+sub handle_pem (@) {
+
+    my @pem_contents;
+    my $iter=0;
+    my $root_cert;
+    my $key;
+    my $certificate;
+    my $mailbox;
+
+    @pem_contents = &parse_pem(@_);
+
+    # private key and certificate use the same 'localKeyID'
+    while($iter <= $#pem_contents>>2) {
+        if($pem_contents[$iter<<2] eq "K") {
+            $key = $iter;
+            last;
+        }
+        $iter++;
+    }
+    ($key > $#pem_contents>>2) and die("Couldn't find private key!");
+
+    $pem_contents[($key<<2)+1] or die("Attribute 'localKeyID' wasn't set.");
+
+    $iter = 0;
+    while($iter <= $#pem_contents>>2) {
+        $iter == $key and ($iter++) and next;
+        if($pem_contents[($iter<<2)+1] eq $pem_contents[($key<<2)+1]) {
+            $certificate = $iter;
+            last;
+        }
+        $iter++;
+    }
+    ($certificate > $#pem_contents>>2) and die("Couldn't find matching certificate!");
+
+    my $cmd = "cp cert_tmp.$key tmp_key";
+    system $cmd and die "'$cmd' returned $?";
+
+    $cmd = "cp cert_tmp.$certificate tmp_certificate";
+    system $cmd and die "'$cmd' returned $?";    
+
+    # root certificate is self signed
+    $iter = 0;
+
+    while($iter <= $#pem_contents>>2) {
+        if ($iter == $key or $iter == $certificate) {
+            $iter++; 
+            next;
+        }
+
+        if($pem_contents[($iter<<2)+2] eq $pem_contents[($iter<<2)+3]) {
+            $root_cert = $iter;
+            last;
+        }
+        $iter++;
+    }
+    ($root_cert > $#pem_contents>>2) and die("Couldn't identify root certificate!");
+
+    # what's left are intermediate certificates.
+    $iter = 0;
+
+    $cmd = "rm -f tmp_issuer_cert";
+    system $cmd and die "'$cmd' returned $?";
+
+    while($iter <= $#pem_contents>>2) {
+        if ($iter == $key or $iter == $certificate or $iter == $root_cert) {
+            $iter++; 
+            next;
+        }
+
+        my $cmd = "cat cert_tmp.$iter >> tmp_issuer_cert";
+        system $cmd and die "'$cmd' returned $?";
+
+        $iter++;
+    }
+
+    my $label = query_label;
+
+    $cmd = "openssl x509 -noout -hash -in tmp_certificate";
+    my $cert_hash = `$cmd`;
+    $? and die "'$cmd' returned $?";
+
+    $cmd = "openssl x509 -noout -hash -in tmp_issuer_cert";
+    my $issuer_hash = `$cmd`;
+    $? and die "'$cmd' returned $?";
+
+    chomp($cert_hash); chomp($issuer_hash);
+
+    # Note: $cert_hash will be changed to reflect the correct filename
+    #       within add_cert() ONLY, so these _have_ to get called first..
+    add_certificate("tmp_issuer_cert", \$issuer_hash, 0, $label);
+    $mailbox = &add_certificate("tmp_certificate", \$cert_hash, 1, $label, $issuer_hash); 
+    add_key("tmp_key", $cert_hash, $mailbox, $label);
+    
+    $cmd = "rm -f cert_tmp.* tmp_*";
+    system $cmd and die "'$cmd' returned $?";
+}
+
+
+
+
+
+
+sub modify_entry ($$$;$ ) {
+    my $op = shift;
+    my $hashvalue = shift;
+    my $use_cert = shift;
+    my $crl;
+    my $label;
+    my $path;
+    my @fields;
+
+    $op eq 'L' and ($label = shift);
+    $op eq 'V' and ($crl = shift);
+
+
+    if ($use_cert) {
+        $path = $certificates_path;
+    }
+    else {
+        $path = $private_keys_path;
+    }
+
+    open(INDEX, "<$path/.index") or  
+      die "Couldn't open $path/.index: $!";
+    open(NEW_INDEX, ">$path/.index.tmp") or 
+      die "Couldn't create $path/.index.tmp: $!";
+
+    while(<INDEX>) {
+        @fields = split;
+        if($fields[1] eq $hashvalue or $hashvalue eq 'all') {
+         $op eq 'R' and next;
+         print NEW_INDEX "$fields[0] $fields[1]";
+         if($op eq 'L') {
+           if($use_cert) {
+             print NEW_INDEX " $label $fields[3] $fields[4]";
+           }
+           else {
+             print NEW_INDEX " $label";
+           }
+         }
+         if ($op eq 'V') {
+           print "\n==> about to verify certificate of $fields[0]\n";
+           my $flag = &do_verify($fields[1], $fields[3], $crl);
+           print NEW_INDEX " $fields[2] $fields[3] $flag";
+         }
+         print NEW_INDEX "\n";
+         next;
+       }
+       print NEW_INDEX;
+    }
+    close(INDEX);
+    close(NEW_INDEX);
+
+    my $cmd = "mv -f $path/.index.tmp $path/.index";
+    system $cmd and die "'$cmd' returned $?";
+
+    print "\n";
+}
+
+
+
+
+sub remove_pair ($ ) {
+  my $keyid = shift;
+
+  if (-e "$certificates_path/$keyid") {
+    my $cmd = "rm -f $certificates_path/$keyid";
+    system $cmd and die "'$cmd' returned $?";
+    modify_entry('R', $keyid, 1);
+    print "Removed certificate $keyid.\n";
+  }
+  else {
+    die "No such certificate: $keyid";
+  }
+
+  if (-e "$private_keys_path/$keyid") {
+    my $cmd = "rm -f $private_keys_path/$keyid";
+    system $cmd and die "'$cmd' returned $?";
+    modify_entry('R', $keyid, 0);
+    print "Removed private key $keyid.\n";
+  }
+}
+
+
+
+sub change_label ($ ) {
+  my $keyid = shift;
+  
+  my $label = query_label;
+
+  if (-e "$certificates_path/$keyid") {
+    modify_entry('L', $keyid, 1, $label);
+    print "Changed label for certificate $keyid.\n";
+  }
+  else {
+    die "No such certificate: $keyid";
+  }
+
+  if (-e "$private_keys_path/$keyid") {
+    modify_entry('L', $keyid, 0, $label);
+    print "Changed label for private key $keyid.\n";
+  }
+
+}
+
+
+
+
+sub verify_cert ($;$ ) {
+  my $keyid = shift;
+  my $crl = shift;
+
+  -e "$certificates_path/$keyid" or $keyid eq 'all'
+    or die "No such certificate: $keyid";
+  modify_entry('V', $keyid, 1, $crl);
+}
+
+
+
+
+sub do_verify($$;$) {
+
+  my $cert = shift;
+  my $issuerid = shift;
+  my $crl = shift;
+
+  my $result = 'i';
+  my $trust_q;
+  my $issuer_path;
+  my $cert_path = "$certificates_path/$cert";
+
+  if($issuerid eq '?') {
+    $issuer_path = "$certificates_path/$cert";
+  } else {
+    $issuer_path = "$certificates_path/$issuerid";
+  }
+
+  my $output = `openssl verify $root_certs_switch $root_certs_path -purpose smimesign -purpose smimeencrypt -untrusted $issuer_path  $cert_path`;
+  chop $output;
+  print "\n$output\n";
+
+  ($output =~ /OK/) and ($result = 'v');
+
+  $result eq 'i' and return $result;
+
+
+  (my $date1_in, my $date2_in, my $serial_in) =
+    `openssl x509 -dates -serial -noout -in $cert_path`;
+
+  if ( defined $date1_in and defined $date2_in ) {
+    my @tmp = split (/\=/, $date1_in);
+    my $tmp = $tmp[1];
+    @tmp = split (/\=/, $date2_in);
+    my %months = ('Jan', '00', 'Feb', '01', 'Mar', '02', 'Apr', '03',
+                 'May', '04', 'Jun', '05', 'Jul', '06', 'Aug', '07',
+                 'Sep', '08', 'Oct', '09', 'Nov', '10', 'Dec', '11');
+
+    my @fields =
+      $tmp =~ /(\w+)\s*(\d+)\s*(\d+):(\d+):(\d+)\s*(\d+)\s*GMT/;
+
+    $#fields != 5 and print "Expiration Date: Parse Error :  $tmp\n\n" or
+      timegm($fields[4], $fields[3], $fields[2], $fields[1],
+            $months{$fields[0]}, $fields[5]) > time and $result = 'e';
+    $result eq 'e' and print "Certificate is not yet valid.\n" and return $result;
+
+    @fields =
+      $tmp[1] =~ /(\w+)\s*(\d+)\s*(\d+):(\d+):(\d+)\s*(\d+)\s*GMT/;
+
+    $#fields != 5 and print "Expiration Date: Parse Error :  $tmp[1]\n\n" or
+      timegm($fields[4], $fields[3], $fields[2], $fields[1],
+            $months{$fields[0]}, $fields[5]) < time and $result = 'e';
+    $result eq 'e' and print "Certificate has expired.\n" and return $result;
+
+  }
+    
+  if ( defined $crl ) {
+    my @serial = split (/\=/, $serial_in);
+    (my $l1, my $l2) =
+      `openssl crl -text -noout -in $crl |grep -A1 $serial[1]`;
+    
+    if ( defined $l2 ) {
+      my @revoke_date = split (/:\s/, $l2);
+      print "FAILURE: Certificate $cert has been revoked on $revoke_date[1]\n";
+      $result = 'r';
+    }
+  }    
+  print "\n";
+
+  if ($result eq 'v') {
+    print "Certificate was successfully verified.\nDo you choose to trust this certificate ? (yes/no) ";
+    chomp($trust_q = <STDIN>);
+    $trust_q eq 'yes' and $result = 't';
+  }
+
+  return $result;
+}
+
+
+
+sub add_root_cert ($) {
+  my $root_cert = shift;
+
+  my $cmd = "openssl x509 -noout -hash -in $root_cert";
+  my $root_hash = `$cmd`;
+  $? and die "'$cmd' returned $?";
+
+  if (-d $root_certs_path) {
+    $cmd = "cp $root_cert $root_certs_path/$root_hash";
+    -e "$root_certs_path/$root_hash" or
+      system $cmd and die "'$cmd' returned $?";
+  }
+  else {
+    open(ROOT_CERTS, ">>$root_certs_path") or 
+      die ("Couldn't open $root_certs_path for writing");
+
+    $cmd = "openssl x509 -in $root_cert -fingerprint -noout";
+    $? and die "'$cmd' returned $?";
+    chomp(my $md5fp = `$cmd`);
+
+    $cmd = "openssl x509 -in $root_cert -text -noout";
+    $? and die "'$cmd' returned $?";
+    my @cert_text = `$cmd`;
+
+    print "Enter a label, name or description for this certificate: ";
+    my $input = <STDIN>;
+
+    my $line = "=======================================\n";
+    print ROOT_CERTS "\n$input$line$md5fp\nPEM-Data:\n";
+
+    open(IN_CERT, "<$root_cert");
+    while (<IN_CERT>) {
+      print ROOT_CERTS;
+    }
+    close (IN_CERT);
+    print ROOT_CERTS @cert_text;
+    close (ROOT_CERTS);
+  }
+  
+}
+