From natxo.asenjo at gmail.com Wed Nov 20 19:13:58 2019 Content-Type: multipart/mixed; boundary="===============8091706734737942787==" MIME-Version: 1.0 From: Natxo Asenjo To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] yum update problem Date: Wed, 20 Nov 2019 20:13:18 +0100 Message-ID: --===============8091706734737942787== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable hi, after patching our centos 7 hosts to the latest version today, one of the two replicas is having trouble. [root(a)kdc2 ~]# ipactl status Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED ntpd Service: STOPPED pki-tomcatd Service: RUNNING smb Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED ipa-dnskeysyncd Service: STOPPED ipa: INFO: The ipactl command was successful and after digging in the logs I come across this in /var/log/ipaupgrade.log: 2019-11-20T18:18:29Z DEBUG stderr=3D 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration already up-to-date 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and validation] 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2019-11-20T18:18:31Z INFO PKIX already enabled 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in Dogtag database] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547472 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162547472 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160021648 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/rest/account/login 2019-11-20T18:18:31Z DEBUG request body '' 2019-11-20T18:18:31Z DEBUG response status 401 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET WWW-Authenticate: Basic realm=3D"Certificate Authority" Content-Type: text/html;charset=3Dutf-8 Content-Language: en Content-Length: 951 Date: Wed, 20 Nov 2019 18:18:31 GMT 2019-11-20T18:18:31Z DEBUG response body 'Apache Tomcat/7.0.76 - Error report

HTTP Status 401 -


type Status report

message

description This request requires HTTP authentication.


Apache Tomcat/7.0.76

' 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2019-11-20T18:18:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value =3D self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2146, in upgrade upgrade_configuration() File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 2018, in upgrade_configuration ca_enable_ldap_profile_subsystem(ca) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 406, in ca_enable_ldap_profile_subsystem cainstance.migrate_profiles_to_ldap() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2027, in migrate_profiles_to_ldap _create_dogtag_profile(profile_id, profile_data, overwrite=3DFalse) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 2033, in _create_dogtag_profile with api.Backend.ra_certprofile as profile_api: File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 1315, in __enter__ raise errors.RemoteRetrieveError(reason=3D_('Failed to authenticate to = CA REST API')) 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API In this kdc I see these errors in getcert list: Request ID '20190220182014': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditSignin= gCert cert-pki-ca',token=3D'NSS Certificate DB',pin set certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditSignin= gCert cert-pki-ca',token=3D'NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=3DCertificate Authority,O=3DL.DOMAIN.IT subject: CN=3DCA Audit,O=3DL.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182015': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSigning= Cert cert-pki-ca',token=3D'NSS Certificate DB',pin set certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSigning= Cert cert-pki-ca',token=3D'NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=3DCertificate Authority,O=3DL.DOMAIN.IT subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182016': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsystemCe= rt cert-pki-ca',token=3D'NSS Certificate DB',pin set certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsystemCe= rt cert-pki-ca',token=3D'NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=3DCertificate Authority,O=3DL.DOMAIN.IT subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT expires: 2019-12-05 13:58:24 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190220182018': status: MONITORING ca-error: Invalid cookie: u'' stuck: no key pair storage: type=3DFILE,location=3D'/var/lib/ipa/ra-agent.key' certificate: type=3DFILE,location=3D'/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=3DCertificate Authority,O=3DL.DOMAIN.IT subject: CN=3DIPA RA,O=3DL.DOMAIN.IT expires: 2019-12-05 13:58:44 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20190220182019': status: MONITORING ca-error: Server at " https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB',pin set certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=3DCertificate Authority,O=3DL.DOMAIN.IT subject: CN=3Dkdc2.l.domain.it,O=3DL.DOMAIN.IT expires: 2019-12-10 10:57:52 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes I still have a working replica, so I could just reinstall and have a working set in a couple of minutes, but I would like to find out what has gone wrong. The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 Any help welcome ;-) Thanks, -- Groeten, natxo --===============8091706734737942787== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdj48YnI+PC9kaXY+PGRpdj5oaSw8L2Rpdj48ZGl2Pjxicj48L2Rp dj48ZGl2PmFmdGVyIHBhdGNoaW5nIG91ciBjZW50b3MgNyBob3N0cyB0byB0aGUgbGF0ZXN0IHZl cnNpb24gdG9kYXksIG9uZSBvZiB0aGUgdHdvIHJlcGxpY2FzIGlzIGhhdmluZyB0cm91YmxlLjwv ZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+W3Jvb3RAa2RjMiB+XSMgaXBhY3RsIHN0YXR1czxicj5E aXJlY3RvcnkgU2VydmljZTogUlVOTklORzxicj5rcmI1a2RjIFNlcnZpY2U6IFNUT1BQRUQ8YnI+ a2FkbWluIFNlcnZpY2U6IFNUT1BQRUQ8YnI+bmFtZWQgU2VydmljZTogU1RPUFBFRDxicj5odHRw ZCBTZXJ2aWNlOiBSVU5OSU5HPGJyPmlwYS1jdXN0b2RpYSBTZXJ2aWNlOiBTVE9QUEVEPGJyPm50 cGQgU2VydmljZTogU1RPUFBFRDxicj5wa2ktdG9tY2F0ZCBTZXJ2aWNlOiBSVU5OSU5HPGJyPnNt YiBTZXJ2aWNlOiBTVE9QUEVEPGJyPndpbmJpbmQgU2VydmljZTogU1RPUFBFRDxicj5pcGEtb3Rw ZCBTZXJ2aWNlOiBTVE9QUEVEPGJyPmlwYS1kbnNrZXlzeW5jZCBTZXJ2aWNlOiBTVE9QUEVEPGJy PmlwYTogSU5GTzogVGhlIGlwYWN0bCBjb21tYW5kIHdhcyBzdWNjZXNzZnVsPC9kaXY+PGRpdj48 YnI+PC9kaXY+PGRpdj5hbmQgYWZ0ZXIgZGlnZ2luZyBpbiB0aGUgbG9ncyBJIGNvbWUgYWNyb3Nz IHRoaXMgaW4gL3Zhci9sb2cvaXBhdXBncmFkZS5sb2c6PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2 PjxkaXY+MjAxOS0xMS0yMFQxODoxODoyOVogREVCVUcgc3RkZXJyPTxicj4yMDE5LTExLTIwVDE4 OjE4OjMxWiBJTkZPIENlcnRtb25nZXIgY2VydGlmaWNhdGUgcmVuZXdhbCBjb25maWd1cmF0aW9u IGFscmVhZHkgdXAtdG8tZGF0ZTxicj4yMDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtFbmFibGUg UEtJWCBjZXJ0aWZpY2F0ZSBwYXRoIGRpc2NvdmVyeSBhbmQgdmFsaWRhdGlvbl08YnI+MjAxOS0x MS0yMFQxODoxODozMVogREVCVUcgTG9hZGluZyBTdGF0ZUZpbGUgZnJvbSAmIzM5Oy92YXIvbGli L2lwYS9zeXN1cGdyYWRlL3N5c3VwZ3JhZGUuc3RhdGUmIzM5Ozxicj4yMDE5LTExLTIwVDE4OjE4 OjMxWiBJTkZPIFBLSVggYWxyZWFkeSBlbmFibGVkPGJyPjIwMTktMTEtMjBUMTg6MTg6MzFaIElO Rk8gW0F1dGhvcml6aW5nIFJBIEFnZW50IHRvIG1vZGlmeSBwcm9maWxlc108YnI+MjAxOS0xMS0y MFQxODoxODozMVogSU5GTyBbQXV0aG9yaXppbmcgUkEgQWdlbnQgdG8gbWFuYWdlIGxpZ2h0d2Vp Z2h0IENBc108YnI+MjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBbRW5zdXJpbmcgTGlnaHR3ZWln aHQgQ0FzIGNvbnRhaW5lciBleGlzdHMgaW4gRG9ndGFnIGRhdGFiYXNlXTxicj4yMDE5LTExLTIw VDE4OjE4OjMxWiBERUJVRyBDcmVhdGVkIGNvbm5lY3Rpb24gY29udGV4dC5sZGFwMl8xMzk3NDAx NjI1NDc0NzI8YnI+MjAxOS0xMS0yMFQxODoxODozMVogREVCVUcgZmx1c2hpbmcgbGRhcGk6Ly8l MmZ2YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQgZnJvbSBTY2hlbWFDYWNoZTxi cj4yMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXRyaWV2aW5nIHNjaGVtYSBmb3IgU2NoZW1h Q2FjaGUgdXJsPWxkYXBpOi8vJTJmdmFyJTJmcnVuJTJmc2xhcGQtTC1ET01BSU4tSVQuc29ja2V0 IGNvbm49Jmx0O2xkYXAubGRhcG9iamVjdC5TaW1wbGVMREFQT2JqZWN0IGluc3RhbmNlIGF0IDB4 N2YxN2NjMjRiNjM4Jmd0Ozxicj4yMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBEZXN0cm95ZWQg Y29ubmVjdGlvbiBjb250ZXh0LmxkYXAyXzEzOTc0MDE2MjU0NzQ3Mjxicj4yMDE5LTExLTIwVDE4 OjE4OjMxWiBJTkZPIFtBZGRpbmcgZGVmYXVsdCBPQ1NQIFVSSSBjb25maWd1cmF0aW9uXTxicj4y MDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtFbnN1cmluZyBDQSBpcyB1c2luZyBMREFQUHJvZmls ZVN1YnN5c3RlbV08YnI+MjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBbTWlncmF0aW5nIGNlcnRp ZmljYXRlIHByb2ZpbGVzIHRvIExEQVBdPGJyPjIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIENy ZWF0ZWQgY29ubmVjdGlvbiBjb250ZXh0LmxkYXAyXzEzOTc0MDE2MDAyMTY0ODxicj4yMDE5LTEx LTIwVDE4OjE4OjMxWiBERUJVRyBmbHVzaGluZyBsZGFwaTovLyUyZnZhciUyZnJ1biUyZnNsYXBk LUwtRE9NQUlOLUlULnNvY2tldCBmcm9tIFNjaGVtYUNhY2hlPGJyPjIwMTktMTEtMjBUMTg6MTg6 MzFaIERFQlVHIHJldHJpZXZpbmcgc2NoZW1hIGZvciBTY2hlbWFDYWNoZSB1cmw9bGRhcGk6Ly8l MmZ2YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQgY29ubj0mbHQ7bGRhcC5sZGFw b2JqZWN0LlNpbXBsZUxEQVBPYmplY3QgaW5zdGFuY2UgYXQgMHg3ZjE3Y2MyODliMDAmZ3Q7PGJy PjIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIERlc3Ryb3llZCBjb25uZWN0aW9uIGNvbnRleHQu bGRhcDJfMTM5NzQwMTYwMDIxNjQ4PGJyPjIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIHJlcXVl c3QgR0VUIDxhIGhyZWY9Imh0dHBzOi8va2RjMi5sLmRvbWFpbi5pdDo4NDQzL2NhL3Jlc3QvYWNj b3VudC9sb2dpbiI+aHR0cHM6Ly9rZGMyLmwuZG9tYWluLml0Ojg0NDMvY2EvcmVzdC9hY2NvdW50 L2xvZ2luPC9hPjxicj4yMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXF1ZXN0IGJvZHkgJiMz OTsmIzM5Ozxicj4yMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXNwb25zZSBzdGF0dXMgNDAx PGJyPjIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIHJlc3BvbnNlIGhlYWRlcnMgU2VydmVyOiBB cGFjaGUtQ295b3RlLzEuMTxicj5DYWNoZS1Db250cm9sOiBwcml2YXRlPGJyPkV4cGlyZXM6IFRo dSwgMDEgSmFuIDE5NzAgMDE6MDA6MDAgQ0VUPGJyPldXVy1BdXRoZW50aWNhdGU6IEJhc2ljIHJl YWxtPSZxdW90O0NlcnRpZmljYXRlIEF1dGhvcml0eSZxdW90Ozxicj5Db250ZW50LVR5cGU6IHRl eHQvaHRtbDtjaGFyc2V0PXV0Zi04PGJyPkNvbnRlbnQtTGFuZ3VhZ2U6IGVuPGJyPkNvbnRlbnQt TGVuZ3RoOiA5NTE8YnI+RGF0ZTogV2VkLCAyMCBOb3YgMjAxOSAxODoxODozMSBHTVQ8YnI+PGJy PjIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIHJlc3BvbnNlIGJvZHkgJiMzOTsmbHQ7aHRtbCZn dDsmbHQ7aGVhZCZndDsmbHQ7dGl0bGUmZ3Q7QXBhY2hlIFRvbWNhdC83LjAuNzYgLSBFcnJvciBy ZXBvcnQmbHQ7L3RpdGxlJmd0OyZsdDtzdHlsZSZndDsmbHQ7IS0tSDEge2ZvbnQtZmFtaWx5OlRh aG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOndoaXRlO2JhY2tncm91bmQtY29sb3I6IzUyNUQ3 Njtmb250LXNpemU6MjJweDt9IEgyIHtmb250LWZhbWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJp Zjtjb2xvcjp3aGl0ZTtiYWNrZ3JvdW5kLWNvbG9yOiM1MjVENzY7Zm9udC1zaXplOjE2cHg7fSBI MyB7Zm9udC1mYW1pbHk6VGFob21hLEFyaWFsLHNhbnMtc2VyaWY7Y29sb3I6d2hpdGU7YmFja2dy b3VuZC1jb2xvcjojNTI1RDc2O2ZvbnQtc2l6ZToxNHB4O30gQk9EWSB7Zm9udC1mYW1pbHk6VGFo b21hLEFyaWFsLHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjp3aGl0ZTt9 IEIge2ZvbnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOndoaXRlO2JhY2tn cm91bmQtY29sb3I6IzUyNUQ3Njt9IFAge2ZvbnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNl cmlmO2JhY2tncm91bmQ6d2hpdGU7Y29sb3I6YmxhY2s7Zm9udC1zaXplOjEycHg7fUEge2NvbG9y IDogYmxhY2s7fUEubmFtZSB7Y29sb3IgOiBibGFjazt9SFIge2NvbG9yIDogIzUyNUQ3Njt9LS0m Z3Q7Jmx0Oy9zdHlsZSZndDsgJmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyZsdDtoMSZndDtIVFRQ IFN0YXR1cyA0MDEgLSAmbHQ7L2gxJmd0OyZsdDtIUiBzaXplPSZxdW90OzEmcXVvdDsgbm9zaGFk ZT0mcXVvdDtub3NoYWRlJnF1b3Q7Jmd0OyZsdDtwJmd0OyZsdDtiJmd0O3R5cGUmbHQ7L2ImZ3Q7 IFN0YXR1cyByZXBvcnQmbHQ7L3AmZ3Q7Jmx0O3AmZ3Q7Jmx0O2ImZ3Q7bWVzc2FnZSZsdDsvYiZn dDsgJmx0O3UmZ3Q7Jmx0Oy91Jmd0OyZsdDsvcCZndDsmbHQ7cCZndDsmbHQ7YiZndDtkZXNjcmlw dGlvbiZsdDsvYiZndDsgJmx0O3UmZ3Q7VGhpcyByZXF1ZXN0IHJlcXVpcmVzIEhUVFAgYXV0aGVu dGljYXRpb24uJmx0Oy91Jmd0OyZsdDsvcCZndDsmbHQ7SFIgc2l6ZT0mcXVvdDsxJnF1b3Q7IG5v c2hhZGU9JnF1b3Q7bm9zaGFkZSZxdW90OyZndDsmbHQ7aDMmZ3Q7QXBhY2hlIFRvbWNhdC83LjAu NzYmbHQ7L2gzJmd0OyZsdDsvYm9keSZndDsmbHQ7L2h0bWwmZ3Q7JiMzOTs8YnI+MjAxOS0xMS0y MFQxODoxODozMVogRVJST1IgSVBBIHNlcnZlciB1cGdyYWRlIGZhaWxlZDogSW5zcGVjdCAvdmFy L2xvZy9pcGF1cGdyYWRlLmxvZyBhbmQgcnVuIGNvbW1hbmQgaXBhLXNlcnZlci11cGdyYWRlIG1h bnVhbGx5Ljxicj4yMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyDCoCBGaWxlICZxdW90Oy91c3Iv bGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXB5dGhvbi9hZG1pbnRvb2wucHkmcXVvdDss IGxpbmUgMTc4LCBpbiBleGVjdXRlPGJyPsKgIMKgIHJldHVybl92YWx1ZSA9IHNlbGYucnVuKCk8 YnI+wqAgRmlsZSAmcXVvdDsvdXNyL2xpYi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2 ZXIvaW5zdGFsbC9pcGFfc2VydmVyX3VwZ3JhZGUucHkmcXVvdDssIGxpbmUgNTQsIGluIHJ1bjxi cj7CoCDCoCBzZXJ2ZXIudXBncmFkZSgpPGJyPsKgIEZpbGUgJnF1b3Q7L3Vzci9saWIvcHl0aG9u Mi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvc2VydmVyL3VwZ3JhZGUucHkmcXVv dDssIGxpbmUgMjE0NiwgaW4gdXBncmFkZTxicj7CoCDCoCB1cGdyYWRlX2NvbmZpZ3VyYXRpb24o KTxicj7CoCBGaWxlICZxdW90Oy91c3IvbGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXNl cnZlci9pbnN0YWxsL3NlcnZlci91cGdyYWRlLnB5JnF1b3Q7LCBsaW5lIDIwMTgsIGluIHVwZ3Jh ZGVfY29uZmlndXJhdGlvbjxicj7CoCDCoCBjYV9lbmFibGVfbGRhcF9wcm9maWxlX3N1YnN5c3Rl bShjYSk8YnI+wqAgRmlsZSAmcXVvdDsvdXNyL2xpYi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9p cGFzZXJ2ZXIvaW5zdGFsbC9zZXJ2ZXIvdXBncmFkZS5weSZxdW90OywgbGluZSA0MDYsIGluIGNh X2VuYWJsZV9sZGFwX3Byb2ZpbGVfc3Vic3lzdGVtPGJyPsKgIMKgIGNhaW5zdGFuY2UubWlncmF0 ZV9wcm9maWxlc190b19sZGFwKCk8YnI+wqAgRmlsZSAmcXVvdDsvdXNyL2xpYi9weXRob24yLjcv c2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9jYWluc3RhbmNlLnB5JnF1b3Q7LCBsaW5l IDIwMjcsIGluIG1pZ3JhdGVfcHJvZmlsZXNfdG9fbGRhcDxicj7CoCDCoCBfY3JlYXRlX2RvZ3Rh Z19wcm9maWxlKHByb2ZpbGVfaWQsIHByb2ZpbGVfZGF0YSwgb3ZlcndyaXRlPUZhbHNlKTxicj7C oCBGaWxlICZxdW90Oy91c3IvbGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXNlcnZlci9p bnN0YWxsL2NhaW5zdGFuY2UucHkmcXVvdDssIGxpbmUgMjAzMywgaW4gX2NyZWF0ZV9kb2d0YWdf cHJvZmlsZTxicj7CoCDCoCB3aXRoIGFwaS5CYWNrZW5kLnJhX2NlcnRwcm9maWxlIGFzIHByb2Zp bGVfYXBpOjxicj7CoCBGaWxlICZxdW90Oy91c3IvbGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2Vz L2lwYXNlcnZlci9wbHVnaW5zL2RvZ3RhZy5weSZxdW90OywgbGluZSAxMzE1LCBpbiBfX2VudGVy X188YnI+wqAgwqAgcmFpc2UgZXJyb3JzLlJlbW90ZVJldHJpZXZlRXJyb3IocmVhc29uPV8oJiMz OTtGYWlsZWQgdG8gYXV0aGVudGljYXRlIHRvIENBIFJFU1QgQVBJJiMzOTspKTxicj48YnI+MjAx OS0xMS0yMFQxODoxODozMVogREVCVUcgVGhlIGlwYS1zZXJ2ZXItdXBncmFkZSBjb21tYW5kIGZh aWxlZCwgZXhjZXB0aW9uOiBSZW1vdGVSZXRyaWV2ZUVycm9yOiBGYWlsZWQgdG8gYXV0aGVudGlj YXRlIHRvIENBIFJFU1QgQVBJPGJyPjIwMTktMTEtMjBUMTg6MTg6MzFaIEVSUk9SIFVuZXhwZWN0 ZWQgZXJyb3IgLSBzZWUgL3Zhci9sb2cvaXBhdXBncmFkZS5sb2cgZm9yIGRldGFpbHM6PGJyPlJl bW90ZVJldHJpZXZlRXJyb3I6IEZhaWxlZCB0byBhdXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEk8 L2Rpdj48ZGl2PjxkaXY+PGRpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pklu IHRoaXMga2RjIEkgc2VlIHRoZXNlIGVycm9ycyBpbiBnZXRjZXJ0IGxpc3Q6PC9kaXY+PGRpdj48 YnI+PC9kaXY+PGRpdj5SZXF1ZXN0IElEICYjMzk7MjAxOTAyMjAxODIwMTQmIzM5Ozo8YnI+wqAg wqAgwqAgwqAgc3RhdHVzOiBNT05JVE9SSU5HPGJyPsKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZh bGlkIGNvb2tpZTogdSYjMzk7JiMzOTs8YnI+wqAgwqAgwqAgwqAgc3R1Y2s6IG5vPGJyPsKgIMKg IMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6IHR5cGU9TlNTREIsbG9jYXRpb249JiMzOTsvZXRjL3Br aS9wa2ktdG9tY2F0L2FsaWFzJiMzOTssbmlja25hbWU9JiMzOTthdWRpdFNpZ25pbmdDZXJ0IGNl cnQtcGtpLWNhJiMzOTssdG9rZW49JiMzOTtOU1MgQ2VydGlmaWNhdGUgREImIzM5OyxwaW4gc2V0 PGJyPsKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOiB0eXBlPU5TU0RCLGxvY2F0aW9uPSYjMzk7L2V0 Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyYjMzk7LG5pY2tuYW1lPSYjMzk7YXVkaXRTaWduaW5nQ2Vy dCBjZXJ0LXBraS1jYSYjMzk7LHRva2VuPSYjMzk7TlNTIENlcnRpZmljYXRlIERCJiMzOTs8YnI+ wqAgwqAgwqAgwqAgQ0E6IGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQ8YnI+wqAgwqAgwqAgwqAg aXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz08YSBocmVmPSJodHRwOi8vTC5ET01B SU4uSVQiPkwuRE9NQUlOLklUPC9hPjxicj7CoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1DQSBBdWRp dCxPPTxhIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCI+TC5ET01BSU4uSVQ8L2E+PGJyPsKgIMKg IMKgIMKgIGV4cGlyZXM6IDIwMTktMTItMDUgMTM6NTg6MjQgVVRDPGJyPsKgIMKgIMKgIMKgIGtl eSB1c2FnZTogZGlnaXRhbFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbjxicj7CoCDCoCDCoCDCoCBw cmUtc2F2ZSBjb21tYW5kOiAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3RvcF9wa2ljYWQ8 YnI+wqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6IC91c3IvbGliZXhlYy9pcGEvY2VydG1v bmdlci9yZW5ld19jYV9jZXJ0ICZxdW90O2F1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EmcXVv dDs8YnI+wqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj7CoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5 ZXM8YnI+UmVxdWVzdCBJRCAmIzM5OzIwMTkwMjIwMTgyMDE1JiMzOTs6PGJyPsKgIMKgIMKgIMKg IHN0YXR1czogTU9OSVRPUklORzxicj7CoCDCoCDCoCDCoCBjYS1lcnJvcjogSW52YWxpZCBjb29r aWU6IHUmIzM5OyYjMzk7PGJyPsKgIMKgIMKgIMKgIHN0dWNrOiBubzxicj7CoCDCoCDCoCDCoCBr ZXkgcGFpciBzdG9yYWdlOiB0eXBlPU5TU0RCLGxvY2F0aW9uPSYjMzk7L2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcyYjMzk7LG5pY2tuYW1lPSYjMzk7b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh JiMzOTssdG9rZW49JiMzOTtOU1MgQ2VydGlmaWNhdGUgREImIzM5OyxwaW4gc2V0PGJyPsKgIMKg IMKgIMKgIGNlcnRpZmljYXRlOiB0eXBlPU5TU0RCLGxvY2F0aW9uPSYjMzk7L2V0Yy9wa2kvcGtp LXRvbWNhdC9hbGlhcyYjMzk7LG5pY2tuYW1lPSYjMzk7b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtp LWNhJiMzOTssdG9rZW49JiMzOTtOU1MgQ2VydGlmaWNhdGUgREImIzM5Ozxicj7CoCDCoCDCoCDC oCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxicj7CoCDCoCDCoCDCoCBpc3N1ZXI6IENO PUNlcnRpZmljYXRlIEF1dGhvcml0eSxPPTxhIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCI+TC5E T01BSU4uSVQ8L2E+PGJyPsKgIMKgIMKgIMKgIHN1YmplY3Q6IENOPU9DU1AgU3Vic3lzdGVtLE89 PGEgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIj5MLkRPTUFJTi5JVDwvYT48YnI+wqAgwqAgwqAg wqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1ODoyNCBVVEM8YnI+wqAgwqAgwqAgwqAga2V5IHVz YWdlOiBkaWdpdGFsU2lnbmF0dXJlLG5vblJlcHVkaWF0aW9uLGtleUNlcnRTaWduLGNSTFNpZ248 YnI+wqAgwqAgwqAgwqAgZWt1OiBpZC1rcC1PQ1NQU2lnbmluZzxicj7CoCDCoCDCoCDCoCBwcmUt c2F2ZSBjb21tYW5kOiAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3RvcF9wa2ljYWQ8YnI+ wqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6IC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdl ci9yZW5ld19jYV9jZXJ0ICZxdW90O29jc3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSZxdW90Ozxi cj7CoCDCoCDCoCDCoCB0cmFjazogeWVzPGJyPsKgIMKgIMKgIMKgIGF1dG8tcmVuZXc6IHllczxi cj5SZXF1ZXN0IElEICYjMzk7MjAxOTAyMjAxODIwMTYmIzM5Ozo8YnI+wqAgwqAgwqAgwqAgc3Rh dHVzOiBNT05JVE9SSU5HPGJyPsKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTog dSYjMzk7JiMzOTs8YnI+wqAgwqAgwqAgwqAgc3R1Y2s6IG5vPGJyPsKgIMKgIMKgIMKgIGtleSBw YWlyIHN0b3JhZ2U6IHR5cGU9TlNTREIsbG9jYXRpb249JiMzOTsvZXRjL3BraS9wa2ktdG9tY2F0 L2FsaWFzJiMzOTssbmlja25hbWU9JiMzOTtzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJiMzOTss dG9rZW49JiMzOTtOU1MgQ2VydGlmaWNhdGUgREImIzM5OyxwaW4gc2V0PGJyPsKgIMKgIMKgIMKg IGNlcnRpZmljYXRlOiB0eXBlPU5TU0RCLGxvY2F0aW9uPSYjMzk7L2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyYjMzk7LG5pY2tuYW1lPSYjMzk7c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSYjMzk7 LHRva2VuPSYjMzk7TlNTIENlcnRpZmljYXRlIERCJiMzOTs8YnI+wqAgwqAgwqAgwqAgQ0E6IGRv Z3RhZy1pcGEtY2EtcmVuZXctYWdlbnQ8YnI+wqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1DZXJ0aWZp Y2F0ZSBBdXRob3JpdHksTz08YSBocmVmPSJodHRwOi8vTC5ET01BSU4uSVQiPkwuRE9NQUlOLklU PC9hPjxicj7CoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1DQSBTdWJzeXN0ZW0sTz08YSBocmVmPSJo dHRwOi8vTC5ET01BSU4uSVQiPkwuRE9NQUlOLklUPC9hPjxicj7CoCDCoCDCoCDCoCBleHBpcmVz OiAyMDE5LTEyLTA1IDEzOjU4OjI0IFVUQzxicj7CoCDCoCDCoCDCoCBrZXkgdXNhZ2U6IGRpZ2l0 YWxTaWduYXR1cmUsbm9uUmVwdWRpYXRpb24sa2V5RW5jaXBoZXJtZW50LGRhdGFFbmNpcGhlcm1l bnQ8YnI+wqAgwqAgwqAgwqAgZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1dGg8 YnI+wqAgwqAgwqAgwqAgcHJlLXNhdmUgY29tbWFuZDogL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9u Z2VyL3N0b3BfcGtpY2FkPGJyPsKgIMKgIMKgIMKgIHBvc3Qtc2F2ZSBjb21tYW5kOiAvdXNyL2xp YmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydCAmcXVvdDtzdWJzeXN0ZW1DZXJ0IGNl cnQtcGtpLWNhJnF1b3Q7PGJyPsKgIMKgIMKgIMKgIHRyYWNrOiB5ZXM8YnI+wqAgwqAgwqAgwqAg YXV0by1yZW5ldzogeWVzPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5SZXF1ZXN0IElEICYjMzk7 MjAxOTAyMjAxODIwMTgmIzM5Ozo8YnI+wqAgwqAgwqAgwqAgc3RhdHVzOiBNT05JVE9SSU5HPGJy PsKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdSYjMzk7JiMzOTs8YnI+wqAg wqAgwqAgwqAgc3R1Y2s6IG5vPGJyPsKgIMKgIMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6IHR5cGU9 RklMRSxsb2NhdGlvbj0mIzM5Oy92YXIvbGliL2lwYS9yYS1hZ2VudC5rZXkmIzM5Ozxicj7CoCDC oCDCoCDCoCBjZXJ0aWZpY2F0ZTogdHlwZT1GSUxFLGxvY2F0aW9uPSYjMzk7L3Zhci9saWIvaXBh L3JhLWFnZW50LnBlbSYjMzk7PGJyPsKgIMKgIMKgIMKgIENBOiBkb2d0YWctaXBhLWNhLXJlbmV3 LWFnZW50PGJyPsKgIMKgIMKgIMKgIGlzc3VlcjogQ049Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89 PGEgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIj5MLkRPTUFJTi5JVDwvYT48YnI+wqAgwqAgwqAg wqAgc3ViamVjdDogQ049SVBBIFJBLE89PGEgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIj5MLkRP TUFJTi5JVDwvYT48YnI+wqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1ODo0NCBV VEM8YnI+wqAgwqAgwqAgwqAga2V5IHVzYWdlOiBkaWdpdGFsU2lnbmF0dXJlLG5vblJlcHVkaWF0 aW9uLGtleUVuY2lwaGVybWVudCxkYXRhRW5jaXBoZXJtZW50PGJyPsKgIMKgIMKgIMKgIGVrdTog aWQta3Atc2VydmVyQXV0aCxpZC1rcC1jbGllbnRBdXRoPGJyPsKgIMKgIMKgIMKgIHByZS1zYXZl IGNvbW1hbmQ6IC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19yYV9jZXJ0X3ByZTxi cj7CoCDCoCDCoCDCoCBwb3N0LXNhdmUgY29tbWFuZDogL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9u Z2VyL3JlbmV3X3JhX2NlcnQ8YnI+wqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj7CoCDCoCDCoCDC oCBhdXRvLXJlbmV3OiB5ZXM8YnI+UmVxdWVzdCBJRCAmIzM5OzIwMTkwMjIwMTgyMDE5JiMzOTs6 PGJyPsKgIMKgIMKgIMKgIHN0YXR1czogTU9OSVRPUklORzxicj7CoCDCoCDCoCDCoCBjYS1lcnJv cjogU2VydmVyIGF0ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8va2RjMi5sLmRvbWFpbi5pdDo4NDQz L2NhL2FnZW50L2NhL3Byb2ZpbGVQcm9jZXNzIj5odHRwczovL2tkYzIubC5kb21haW4uaXQ6ODQ0 My9jYS9hZ2VudC9jYS9wcm9maWxlUHJvY2VzczwvYT4mcXVvdDsgcmVwbGllZDogMTogSW52YWxp ZCBDcmVkZW50aWFsLjxicj7CoCDCoCDCoCDCoCBzdHVjazogbm88YnI+wqAgwqAgwqAgwqAga2V5 IHBhaXIgc3RvcmFnZTogdHlwZT1OU1NEQixsb2NhdGlvbj0mIzM5Oy9ldGMvcGtpL3BraS10b21j YXQvYWxpYXMmIzM5OyxuaWNrbmFtZT0mIzM5O1NlcnZlci1DZXJ0IGNlcnQtcGtpLWNhJiMzOTss dG9rZW49JiMzOTtOU1MgQ2VydGlmaWNhdGUgREImIzM5OyxwaW4gc2V0PGJyPsKgIMKgIMKgIMKg IGNlcnRpZmljYXRlOiB0eXBlPU5TU0RCLGxvY2F0aW9uPSYjMzk7L2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyYjMzk7LG5pY2tuYW1lPSYjMzk7U2VydmVyLUNlcnQgY2VydC1wa2ktY2EmIzM5Oyx0 b2tlbj0mIzM5O05TUyBDZXJ0aWZpY2F0ZSBEQiYjMzk7PGJyPsKgIMKgIMKgIMKgIENBOiBkb2d0 YWctaXBhLWNhLXJlbmV3LWFnZW50PGJyPsKgIMKgIMKgIMKgIGlzc3VlcjogQ049Q2VydGlmaWNh dGUgQXV0aG9yaXR5LE89PGEgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIj5MLkRPTUFJTi5JVDwv YT48YnI+wqAgwqAgwqAgwqAgc3ViamVjdDogQ049PGEgaHJlZj0iaHR0cDovL2tkYzIubC5kb21h aW4uaXQiPmtkYzIubC5kb21haW4uaXQ8L2E+LE89PGEgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklU Ij5MLkRPTUFJTi5JVDwvYT48YnI+wqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0xMCAxMDo1 Nzo1MiBVVEM8YnI+wqAgwqAgwqAgwqAga2V5IHVzYWdlOiBkaWdpdGFsU2lnbmF0dXJlLG5vblJl cHVkaWF0aW9uLGtleUVuY2lwaGVybWVudCxkYXRhRW5jaXBoZXJtZW50PGJyPsKgIMKgIMKgIMKg IGVrdTogaWQta3Atc2VydmVyQXV0aCxpZC1rcC1jbGllbnRBdXRoLGlkLWtwLWVtYWlsUHJvdGVj dGlvbjxicj7CoCDCoCDCoCDCoCBwcmUtc2F2ZSBjb21tYW5kOiAvdXNyL2xpYmV4ZWMvaXBhL2Nl cnRtb25nZXIvc3RvcF9wa2ljYWQ8YnI+wqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6IC91 c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0ICZxdW90O1NlcnZlci1DZXJ0 IGNlcnQtcGtpLWNhJnF1b3Q7PGJyPsKgIMKgIMKgIMKgIHRyYWNrOiB5ZXM8YnI+wqAgwqAgwqAg wqAgYXV0by1yZW5ldzogeWVzPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5JIHN0aWxsIGhhdmUg YSB3b3JraW5nIHJlcGxpY2EsIHNvIEkgY291bGQganVzdCByZWluc3RhbGwgYW5kIGhhdmUgYSB3 b3JraW5nIHNldCBpbiBhIGNvdXBsZSBvZiBtaW51dGVzLCBidXQgSSB3b3VsZCBsaWtlIHRvIGZp bmQgb3V0IHdoYXQgaGFzIGdvbmUgd3JvbmcuPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UaGUg c3lzdGVtcyBhcmUgcnVubmluZyBpcGEtc2VydmVyLTQuNi41LTExLmVsNy5jZW50b3MuMy54ODZf NjQ8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkFueSBoZWxwIHdlbGNvbWUgOy0pPC9kaXY+PGRp dj48YnI+PC9kaXY+PGRpdj5UaGFua3MsPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48ZGl2IGRp cj0ibHRyIiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIiBkYXRhLXNtYXJ0bWFpbD0iZ21haWxfc2ln bmF0dXJlIj4tLTxicj5Hcm9ldGVuLDxicj5uYXR4bzwvZGl2PjwvZGl2PjwvZGl2PjwvZGl2Pjwv ZGl2PjwvZGl2Pgo= --===============8091706734737942787==-- From flo at redhat.com Thu Nov 21 09:08:12 2019 Content-Type: multipart/mixed; boundary="===============1481507530352361911==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 21 Nov 2019 10:07:31 +0100 Message-ID: <3366276b-3852-a1d1-983c-0a401a70a0f4@redhat.com> In-Reply-To: CAHBEJzWGNKHEAODXjjnk6vTy2UsQRnX1ZpJFop+2Lp=fRH8xGw@mail.gmail.com --===============1481507530352361911== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/20/19 8:13 PM, Natxo Asenjo via FreeIPA-users wrote: > = > hi, > = > after patching our centos 7 hosts to the latest version today, one of = > the two replicas is having trouble. > = > [root(a)kdc2 ~]# ipactl status > Directory Service: RUNNING > krb5kdc Service: STOPPED > kadmin Service: STOPPED > named Service: STOPPED > httpd Service: RUNNING > ipa-custodia Service: STOPPED > ntpd Service: STOPPED > pki-tomcatd Service: RUNNING > smb Service: STOPPED > winbind Service: STOPPED > ipa-otpd Service: STOPPED > ipa-dnskeysyncd Service: STOPPED > ipa: INFO: The ipactl command was successful > = > and after digging in the logs I come across this in /var/log/ipaupgrade.l= og: > = > 2019-11-20T18:18:29Z DEBUG stderr=3D > 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration = > already up-to-date > 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and = > validation] > 2019-11-20T18:18:31Z DEBUG Loading StateFile from = > '/var/lib/ipa/sysupgrade/sysupgrade.state' > 2019-11-20T18:18:31Z INFO PKIX already enabled > 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] > 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] > 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in = > Dogtag database] > 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_1397401625474= 72 > 2019-11-20T18:18:31Z DEBUG flushing = > ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache > 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache = > url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket = > conn=3D > 2019-11-20T18:18:31Z DEBUG Destroyed connection = > context.ldap2_139740162547472 > 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] > 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] > 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] > 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_1397401600216= 48 > 2019-11-20T18:18:31Z DEBUG flushing = > ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache > 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache = > url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket = > conn=3D > 2019-11-20T18:18:31Z DEBUG Destroyed connection = > context.ldap2_139740160021648 > 2019-11-20T18:18:31Z DEBUG request GET = > https://kdc2.l.domain.it:8443/ca/rest/account/login > 2019-11-20T18:18:31Z DEBUG request body '' > 2019-11-20T18:18:31Z DEBUG response status 401 > 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 > Cache-Control: private > Expires: Thu, 01 Jan 1970 01:00:00 CET > WWW-Authenticate: Basic realm=3D"Certificate Authority" > Content-Type: text/html;charset=3Dutf-8 > Content-Language: en > Content-Length: 951 > Date: Wed, 20 Nov 2019 18:18:31 GMT > = > 2019-11-20T18:18:31Z DEBUG response body 'Apache = > Tomcat/7.0.76 - Error report = >

HTTP Status 401 -


noshade=3D"noshade">

type Status report

message = >

description This request requires HTTP = > authentication.


Apache = > Tomcat/7.0.76

' > 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect = > /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. > 2019-11-20T18:18:31Z DEBUG =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in = > execute > =C2=A0 =C2=A0 return_value =3D self.run() > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py= ", = > line 54, in run > =C2=A0 =C2=A0 server.upgrade() > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", = > line 2146, in upgrade > =C2=A0 =C2=A0 upgrade_configuration() > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", = > line 2018, in upgrade_configuration > =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", = > line 406, in ca_enable_ldap_profile_subsystem > =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line = > 2027, in migrate_profiles_to_ldap > =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwrite= =3DFalse) > =C2=A0 File = > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line = > 2033, in _create_dogtag_profile > =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.p= y", = > line 1315, in __enter__ > =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to aut= henticate = > to CA REST API')) > = > 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, = > exception: RemoteRetrieveError: Failed to authenticate to CA REST API > 2019-11-20T18:18:31Z ERROR Unexpected error - see = > /var/log/ipaupgrade.log for details: > RemoteRetrieveError: Failed to authenticate to CA REST API > = The authentication between IPA and dogtag is done using the ra-agent = cert located in /var/lib/ipa/ra-agent.pem. As its expiration date is = near, it's possible that the renewal process for this cert started but = did not complete successfully. You need to check the following: - note the serial ID of the cert, its subject and issuer: $ openssl x509 -noout -text -in /var/lib/ipa/ra-agent.pem You can also check if it has already been renewed (look at the date Not = Before / Not After). If it has been renewed, check the content of the entry = uid=3Dipara,ou=3Dpeople,o=3Dipaca: $ ldapsearch -D cn=3Ddirectory\ manager -W -b uid=3Dipara,ou=3Dpeople,o=3Di= paca There are 2 things to check: - The userCertificate attribute must contain the cert (same value as in = ra-agent.pem, in a single line and without the -----BEGIN = CERTIFICATE----- and -----END CERTIFICATE---- lines). - The description attribute must have the foollowing value: description: 2;;; If it's not the case, it's likely that the renewal failed to update the = entry and that may be causing your issue. You will need to manually fix = the entry using ldapmodify. After that, restart ipa with ipactl stop / ipactl start and check if = certmonger is able to renew the other certs that will expire soon. HTH, flo > = > In this kdc I see these errors in getcert list: > = > Request ID '20190220182014': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditSign= ingCert = > cert-pki-ca',token=3D'NSS Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditSign= ingCert = > cert-pki-ca',token=3D'NSS Certificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert = > "auditSigningCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182015': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSigni= ngCert cert-pki-ca',token=3D'NSS = > Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSigni= ngCert cert-pki-ca',token=3D'NSS = > Certificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.IT= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,k= eyCertSign,cRLSign > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert = > "ocspSigningCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182016': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsystem= Cert = > cert-pki-ca',token=3D'NSS Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsystem= Cert = > cert-pki-ca',token=3D'NSS Certificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT <= http://L.DOMAIN.IT> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: = > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert = > "subsystemCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > = > Request ID '20190220182018': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D'/v= ar/lib/ipa/ra-agent.key' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var/li= b/ipa/ra-agent.pem' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: = > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/renew_ra_cert_pre > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ra_cert > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182019': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at = > "https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: 1: = > Invalid Credential. > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server-Ce= rt = > cert-pki-ca',token=3D'NSS Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: = > type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server-Ce= rt = > cert-pki-ca',token=3D'NSS Certificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it = > ,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: = > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id-kp= -emailProtection > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert = > "Server-Cert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > = > I still have a working replica, so I could just reinstall and have a = > working set in a couple of minutes, but I would like to find out what = > has gone wrong. > = > The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 > = > Any help welcome ;-) > = > Thanks, > = > -- > Groeten, > natxo > = > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org >=20 --===============1481507530352361911==-- From natxo.asenjo at gmail.com Thu Nov 28 09:34:13 2019 Content-Type: multipart/mixed; boundary="===============8861744029831766857==" MIME-Version: 1.0 From: Natxo Asenjo To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 28 Nov 2019 10:33:41 +0100 Message-ID: In-Reply-To: 3366276b-3852-a1d1-983c-0a401a70a0f4@redhat.com --===============8861744029831766857== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable hi, sorry for the delay, priorities shifted a bit. Let's see, the serial # and validity of the cert in the kdc with problems: - note the serial ID of the cert, its subject and issuer: [root(a)kdc2 ~]# openssl x509 -noout -text -in /var/lib/ipa/ra-agent.pem Certificate: Data: Version: 3 (0x2) Serial Number: 7 (0x7) Signature Algorithm: sha256WithRSAEncryption Issuer: O=3DSUB.DOMAIN.TLD, CN=3DCertificate Authority Validity Not Before: Dec 15 13:58:44 2017 GMT Not After : Dec 5 13:58:44 2019 GMT Subject: O=3DSUB.DOMAIN.TLD, CN=3DIPA RA So it looks like this did not get renewed # ldapsearch -D cn=3Ddirectory\ manager -W -b uid=3Dipara,ou=3Dpeople,o=3D= ipaca Enter LDAP Password: dn: uid=3Dipara,ou=3Dpeople,o=3Dipaca description: 2;80;CN=3DCertificate Authority,O=3DSUB.DOMAIN.TLD;CN=3DIPA RA,O=3DSUB.DOMAIN.TLD IT cn: ipara objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: cmsuser userCertificate:: userCertificate:: userstate: 1 usertype: agentType sn: ipara uid: ipara So I have two userCertificates, the first one is the one in the file system on the broken kdc in /var/lib/ipa/ra-agent.pem. The second one is the one in the working kdc. The serial number is the one on the certificate on the working kdc, which was renewed on Nov 8th succesfully. So do I need to copy the ra-agent.pem and key from the working kdc to the broken kdc? -- Groeten, natxo --===============8861744029831766857== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBkaXI9Imx0ciI+PGRpdj5oaSw8L2Rpdj48ZGl2Pjxicj48L2Rp dj48ZGl2PnNvcnJ5IGZvciB0aGUgZGVsYXksIHByaW9yaXRpZXMgc2hpZnRlZCBhIGJpdC48L2Rp dj48ZGl2Pjxicj48L2Rpdj48ZGl2PkxldCYjMzk7cyBzZWUsIHRoZSBzZXJpYWwgIyBhbmQgdmFs aWRpdHkgb2YgdGhlIGNlcnQgaW4gdGhlIGtkYyB3aXRoIHByb2JsZW1zOjwvZGl2PjxkaXY+LSBu b3RlIHRoZSBzZXJpYWwgSUQgb2YgdGhlIGNlcnQsIGl0cyBzdWJqZWN0IGFuZCBpc3N1ZXI6PGJy Pjxicj5bcm9vdEBrZGMyIH5dIyBvcGVuc3NsIHg1MDkgLW5vb3V0IC10ZXh0IC1pbiAvdmFyL2xp Yi9pcGEvcmEtYWdlbnQucGVtPGJyPkNlcnRpZmljYXRlOjxicj7CoMKgwqAgRGF0YTo8YnI+wqDC oMKgwqDCoMKgwqAgVmVyc2lvbjogMyAoMHgyKTxicj7CoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVt YmVyOiA3ICgweDcpPGJyPsKgwqDCoCBTaWduYXR1cmUgQWxnb3JpdGhtOiBzaGEyNTZXaXRoUlNB RW5jcnlwdGlvbjxicj7CoMKgwqDCoMKgwqDCoCBJc3N1ZXI6IE89U1VCLkRPTUFJTi5UTEQsIENO PUNlcnRpZmljYXRlIEF1dGhvcml0eTxicj7CoMKgwqDCoMKgwqDCoCBWYWxpZGl0eTxicj7CoMKg wqDCoMKgwqDCoMKgwqDCoMKgIE5vdCBCZWZvcmU6IERlYyAxNSAxMzo1ODo0NCAyMDE3IEdNVDxi cj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgIE5vdCBBZnRlciA6IERlY8KgIDUgMTM6NTg6NDQgMjAx OSBHTVQ8YnI+wqDCoMKgIMKgwqDCoCBTdWJqZWN0OiBPPVNVQi5ET01BSU4uVExELCBDTj1JUEEg UkE8L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlNvIGl0IGxvb2tzIGxpa2UgdGhpcyBkaWQgbm90 IGdldCByZW5ld2VkPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48L2Rpdj48ZGl2PiPCoCBsZGFw c2VhcmNoIC1EIGNuPWRpcmVjdG9yeVwgbWFuYWdlciAtVyAtYiB1aWQ9aXBhcmEsb3U9cGVvcGxl LG89aXBhY2E8YnI+RW50ZXIgTERBUCBQYXNzd29yZDo8L2Rpdj48ZGl2PiZsdDtzbmlwJmd0Ozxi cj48L2Rpdj48ZGl2PmRuOiB1aWQ9aXBhcmEsb3U9cGVvcGxlLG89aXBhY2E8YnI+ZGVzY3JpcHRp b246IDI7ODA7Q049Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89U1VCLkRPTUFJTi5UTEQ7Q049SVBB IFJBLE89U1VCLkRPTUFJTi5UTEQ8YnI+wqBJVDxicj5jbjogaXBhcmE8YnI+b2JqZWN0Q2xhc3M6 IHRvcDxicj5vYmplY3RDbGFzczogcGVyc29uPGJyPm9iamVjdENsYXNzOiBvcmdhbml6YXRpb25h bFBlcnNvbjxicj5vYmplY3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj5vYmplY3RDbGFzczogY21z dXNlcjxicj51c2VyQ2VydGlmaWNhdGU6OiAmbHQ7c25pcCZndDs8YnI+dXNlckNlcnRpZmljYXRl OjogJmx0O3NuaXAmZ3Q7PGJyPnVzZXJzdGF0ZTogMTxicj51c2VydHlwZTogYWdlbnRUeXBlPGJy PnNuOiBpcGFyYTxicj51aWQ6IGlwYXJhPGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+U28g SSBoYXZlIHR3byB1c2VyQ2VydGlmaWNhdGVzLCB0aGUgZmlyc3Qgb25lIGlzIHRoZSBvbmUgaW4g dGhlIGZpbGUgc3lzdGVtIG9uIHRoZSBicm9rZW4ga2RjIGluIC92YXIvbGliL2lwYS9yYS1hZ2Vu dC5wZW0uPC9kaXY+PGRpdj5UaGUgc2Vjb25kIG9uZSBpcyB0aGUgb25lIGluIHRoZSB3b3JraW5n IGtkYy48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UaGUgc2VyaWFsIG51bWJlciBpcyB0 aGUgb25lIG9uIHRoZSBjZXJ0aWZpY2F0ZSBvbiB0aGUgd29ya2luZyBrZGMsIHdoaWNoIHdhcyBy ZW5ld2VkIG9uIE5vdiA4dGggc3VjY2VzZnVsbHkuPGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2Pjxk aXY+U28gZG8gSSBuZWVkIHRvIGNvcHkgdGhlIHJhLWFnZW50LnBlbSBhbmQga2V5IGZyb20gdGhl IHdvcmtpbmcga2RjIHRvIHRoZSBicm9rZW4ga2RjPyA8YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+ PC9kaXY+PGJyPjxkaXYgZGlyPSJsdHIiIGNsYXNzPSJnbWFpbF9zaWduYXR1cmUiPi0tPGJyPkdy b2V0ZW4sPGJyPm5hdHhvPC9kaXY+PC9kaXY+Cg== --===============8861744029831766857==-- From flo at redhat.com Thu Nov 28 09:58:30 2019 Content-Type: multipart/mixed; boundary="===============4612722872555118384==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 28 Nov 2019 10:57:56 +0100 Message-ID: <0f95aafd-7b20-382c-b4e0-bc751d73feb1@redhat.com> In-Reply-To: CAHBEJzW49ocSpsFN-7Do2Cc7hWV7Uaxsfgu3HJ8dZKhC8bdwFg@mail.gmail.com --===============4612722872555118384== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/28/19 10:33 AM, Natxo Asenjo via FreeIPA-users wrote: > hi, > = > sorry for the delay, priorities shifted a bit. > = > Let's see, the serial # and validity of the cert in the kdc with problems: > - note the serial ID of the cert, its subject and issuer: > = > [root(a)kdc2 ~]# openssl x509 -noout -text -in /var/lib/ipa/ra-agent.pem > Certificate: > =C2=A0=C2=A0=C2=A0 Data: > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Version: 3 (0x2) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Serial Number: 7 (0x7) > =C2=A0=C2=A0=C2=A0 Signature Algorithm: sha256WithRSAEncryption > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Issuer: O=3DSUB.DOMAIN.TLD, C= N=3DCertificate Authority > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Validity > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Not B= efore: Dec 15 13:58:44 2017 GMT > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Not A= fter : Dec=C2=A0 5 13:58:44 2019 GMT > =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 Subject: O=3DSUB.DOMAIN.TLD, CN=3D= IPA RA > = > So it looks like this did not get renewed > = > #=C2=A0 ldapsearch -D cn=3Ddirectory\ manager -W -b uid=3Dipara,ou=3Dpeop= le,o=3Dipaca > Enter LDAP Password: > > dn: uid=3Dipara,ou=3Dpeople,o=3Dipaca > description: 2;80;CN=3DCertificate Authority,O=3DSUB.DOMAIN.TLD;CN=3DIPA = > RA,O=3DSUB.DOMAIN.TLD > =C2=A0IT > cn: ipara > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: cmsuser > userCertificate:: > userCertificate:: > userstate: 1 > usertype: agentType > sn: ipara > uid: ipara > = > So I have two userCertificates, the first one is the one in the file = > system on the broken kdc in /var/lib/ipa/ra-agent.pem. > The second one is the one in the working kdc. > = > The serial number is the one on the certificate on the working kdc, = > which was renewed on Nov 8th succesfully. > = > So do I need to copy the ra-agent.pem and key from the working kdc to = > the broken kdc? > = Hi, please first make a backup of the files. Copy the ra-agent.pem from the = working kdc to the broken kdc, then restart ipa and check if certmonger = is able to renew the other certificates. The key file probably didn't change (the renewal uses the same key) so I = don't think you need to copy this file. HTH, flo > = > -- > Groeten, > natxo > = > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org >=20 --===============4612722872555118384==-- From natxo.asenjo at gmail.com Thu Nov 28 12:58:45 2019 Content-Type: multipart/mixed; boundary="===============7872546274576876896==" MIME-Version: 1.0 From: Natxo Asenjo To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 28 Nov 2019 13:58:05 +0100 Message-ID: In-Reply-To: 0f95aafd-7b20-382c-b4e0-bc751d73feb1@redhat.com --===============7872546274576876896== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Thu, Nov 28, 2019 at 10:58 AM Florence Blanc-Renaud wrote: > > please first make a backup of the files. Copy the ra-agent.pem from the > working kdc to the broken kdc, then restart ipa and check if certmonger > is able to renew the other certificates. > The key file probably didn't change (the renewal uses the same key) so I > don't think you need to copy this file. > > so, this worked ;-), en now ipactl status shows everything is running. After re-submitting a couple of certificate requests, everything is back to normal. Thanks Florence, for your assistance. I have learnt a lot too with this blog of your colleague Fraser Tweedale: https://frasertweedale.github.io/blog-redhat/posts/2018-11-20-ca-renewal-ma= ster.html Regards, Natxo -- Groeten, natxo --===============7872546274576876896== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBkaXI9Imx0ciI+PGJyPjwvZGl2Pjxicj48ZGl2IGNsYXNzPSJn bWFpbF9xdW90ZSI+PGRpdiBkaXI9Imx0ciIgY2xhc3M9ImdtYWlsX2F0dHIiPk9uIFRodSwgTm92 IDI4LCAyMDE5IGF0IDEwOjU4IEFNIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCAmbHQ7PGEgaHJlZj0i bWFpbHRvOmZsb0ByZWRoYXQuY29tIj5mbG9AcmVkaGF0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj48 L2Rpdj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBw eCAwcHggMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0LDIwNCk7cGFkZGlu Zy1sZWZ0OjFleCI+PGJyPgpwbGVhc2UgZmlyc3QgbWFrZSBhIGJhY2t1cCBvZiB0aGUgZmlsZXMu IENvcHkgdGhlIHJhLWFnZW50LnBlbSBmcm9tIHRoZSA8YnI+Cndvcmtpbmcga2RjIHRvIHRoZSBi cm9rZW4ga2RjLCB0aGVuIHJlc3RhcnQgaXBhIGFuZCBjaGVjayBpZiBjZXJ0bW9uZ2VyIDxicj4K aXMgYWJsZSB0byByZW5ldyB0aGUgb3RoZXIgY2VydGlmaWNhdGVzLjxicj4KVGhlIGtleSBmaWxl IHByb2JhYmx5IGRpZG4mIzM5O3QgY2hhbmdlICh0aGUgcmVuZXdhbCB1c2VzIHRoZSBzYW1lIGtl eSkgc28gSSA8YnI+CmRvbiYjMzk7dCB0aGluayB5b3UgbmVlZCB0byBjb3B5IHRoaXMgZmlsZS48 YnI+Cjxicj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+PGRpdj5zbywgdGhpcyB3b3JrZWQg Oy0pLCBlbiBub3cgaXBhY3RsIHN0YXR1cyBzaG93cyBldmVyeXRoaW5nIGlzIHJ1bm5pbmcuPC9k aXY+PGRpdj48YnI+PC9kaXY+QWZ0ZXIgcmUtc3VibWl0dGluZyBhIGNvdXBsZSBvZiBjZXJ0aWZp Y2F0ZSByZXF1ZXN0cywgZXZlcnl0aGluZyBpcyBiYWNrIHRvIG5vcm1hbC48L2Rpdj48ZGl2IGNs YXNzPSJnbWFpbF9xdW90ZSI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX3F1b3RlIj5UaGFu a3MgRmxvcmVuY2UsIGZvciB5b3VyIGFzc2lzdGFuY2UuIEkgaGF2ZSBsZWFybnQgYSBsb3QgdG9v IHdpdGggdGhpcyBibG9nIG9mIHlvdXIgY29sbGVhZ3VlIEZyYXNlciBUd2VlZGFsZTogPGEgaHJl Zj0iaHR0cHM6Ly9mcmFzZXJ0d2VlZGFsZS5naXRodWIuaW8vYmxvZy1yZWRoYXQvcG9zdHMvMjAx OC0xMS0yMC1jYS1yZW5ld2FsLW1hc3Rlci5odG1sIj5odHRwczovL2ZyYXNlcnR3ZWVkYWxlLmdp dGh1Yi5pby9ibG9nLXJlZGhhdC9wb3N0cy8yMDE4LTExLTIwLWNhLXJlbmV3YWwtbWFzdGVyLmh0 bWw8L2E+IDxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+PGJyPjwvZGl2PjxkaXYg Y2xhc3M9ImdtYWlsX3F1b3RlIj5SZWdhcmRzLDwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX3F1b3Rl Ij5OYXR4bzxicj48L2Rpdj48ZGl2IGRpcj0ibHRyIiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIj4t LTxicj5Hcm9ldGVuLDxicj5uYXR4bzwvZGl2PjwvZGl2Pgo= --===============7872546274576876896==-- From flo at redhat.com Thu Nov 28 13:26:51 2019 Content-Type: multipart/mixed; boundary="===============4561639744458529362==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 28 Nov 2019 14:26:18 +0100 Message-ID: In-Reply-To: CAHBEJzU9NcsDAcF7r-khaZC-rR1x_5zH6vxs_xBpmbvnj_9iaw@mail.gmail.com --===============4561639744458529362== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 11/28/19 1:58 PM, Natxo Asenjo via FreeIPA-users wrote: > = > = > On Thu, Nov 28, 2019 at 10:58 AM Florence Blanc-Renaud > wrote: > = > = > please first make a backup of the files. Copy the ra-agent.pem from t= he > working kdc to the broken kdc, then restart ipa and check if certmong= er > is able to renew the other certificates. > The key file probably didn't change (the renewal uses the same key) > so I > don't think you need to copy this file. > = > = > so, this worked ;-), en now ipactl status shows everything is running. > = > After re-submitting a couple of certificate requests, everything is back = > to normal. Great! Thanks for the update. flo > = > Thanks Florence, for your assistance. I have learnt a lot too with this = > blog of your colleague Fraser Tweedale: = > https://frasertweedale.github.io/blog-redhat/posts/2018-11-20-ca-renewal-= master.html = > = > = > Regards, > Natxo > -- > Groeten, > natxo > = > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org >=20 --===============4561639744458529362==-- From keesb at ghs.com Thu Oct 1 14:08:00 2020 Content-Type: multipart/mixed; boundary="===============2487156464546001081==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 16:07:37 +0200 Message-ID: <44800c46-b135-9e79-d223-b96b86b731dc@ghs.com> In-Reply-To: CAHBEJzWGNKHEAODXjjnk6vTy2UsQRnX1ZpJFop+2Lp=fRH8xGw@mail.gmail.com --===============2487156464546001081== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable This now happened to me too. The solution in this thread was to copy /var/lib/ipa/ra-agent.* to the fail= ing system. After that I was able to restart (ipactl restart). What remains a mystery is **why** this happened. In my case, we have three CA masters, one is the CA renewal master (of cour= se). Two days ago, linge, the renewal master, renewed a few certificates. Here i= s a summary of journalctl. [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file "/var/l= ib/ipa/ra-agent.pem" will not be valid after 20201026201548. sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named "auditSig= ningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" will not be valid after 20201026201532. sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named "ocspSign= ingCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pk= i-tomcat/alias" will not be valid after 20201026201531. sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named "subsyste= mCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-= tomcat/alias" will not be valid after 20201026201532. sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: dogta= g-ipa-renew-agent returned 0 sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named "subsyste= mCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-= tomcat/alias" issued by CA and saved. sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: dogta= g-ipa-renew-agent returned 0 sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named "auditSig= ningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" issued by CA and saved. sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: dogta= g-ipa-renew-agent returned 0 sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file "/var/l= ib/ipa/ra-agent.pem" issued by CA and saved. sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: dogta= g-ipa-renew-agent returned 5 sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: Forwa= rding request to dogtag-ipa-renew-agent sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: dogta= g-ipa-renew-agent returned 0 sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named "ocspSign= ingCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pk= i-tomcat/alias" issued by CA and saved. Today (two days later) I looked at the two other CA masters to see if these= same certificates were OK. I saw this: [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in file "/va= r/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named "audit= SigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" will not be valid after 20201026201532. sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named "ocspS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" will not be valid after 20201026201531. sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named "subsy= stemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" will not be valid after 20201026201532. sep 29 11:22:15 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214487]: Up= dated certificate not available sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214488]: Up= dated certificate not available sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214496]: Up= dated certificate not available sep 29 11:22:17 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214505]: Up= dated certificate not available sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 [428] I= nvalid cookie: u'' sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 [428] I= nvalid cookie: u'' sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 [428] I= nvalid cookie: u'' sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 [428] I= nvalid cookie: u'' [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file "/var/= lib/ipa/ra-agent.pem" will not be valid after 20201026201548. sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named "auditSi= gningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/= pki-tomcat/alias" will not be valid after 20201026201532. sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named "ocspSig= ningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" will not be valid after 20201026201531. sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named "subsyst= emCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki= -tomcat/alias" will not be valid after 20201026201532. sep 29 13:00:57 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166389]: Upda= ted certificate not available sep 29 13:00:58 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166392]: Upda= ted certificate not available sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166391]: Upda= ted certificate not available sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166390]: Upda= ted certificate not available sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 [97976]= Invalid cookie: u'' sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 [97976]= Invalid cookie: u'' sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 [97976]= Invalid cookie: u'' sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 [97976]= Invalid cookie: u'' So, both non-renewal masters started tried dogtag-ipa-ca-renew-agent-submit= , and both failed with "Updated certificate not available" Next, I did a "yum update", hoping to get rid of the invalid cookie. This u= pdated ipa from 4.6.5 to 4.6.6 The update failed because /var/lib/ipa/ra-agent.pem still had the old certi= ficate. After manually copying ra-agent.* to the failing system I was able to resta= rt ipa. However, I suspect that things are still not right. Too many certs on the non-renewal masters = still need to be renewed. I'm digging further ... -- Kees On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: > hi, > > after patching our centos 7 hosts to the latest version today, one of the= two replicas is having trouble. > > [root(a)kdc2 ~]# ipactl status > Directory Service: RUNNING > krb5kdc Service: STOPPED > kadmin Service: STOPPED > named Service: STOPPED > httpd Service: RUNNING > ipa-custodia Service: STOPPED > ntpd Service: STOPPED > pki-tomcatd Service: RUNNING > smb Service: STOPPED > winbind Service: STOPPED > ipa-otpd Service: STOPPED > ipa-dnskeysyncd Service: STOPPED > ipa: INFO: The ipactl command was successful > > and after digging in the logs I come across this in /var/log/ipaupgrade.l= og: > > 2019-11-20T18:18:29Z DEBUG stderr=3D > 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration al= ready up-to-date > 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and val= idation] > 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrad= e/sysupgrade.state' > 2019-11-20T18:18:31Z INFO PKIX already enabled > 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] > 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CAs] > 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in D= ogtag database] > 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_1397401625474= 72 > 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN= -IT.socket from SchemaCache > 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi:= //%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D > 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_13974016254= 7472 > 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] > 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] > 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] > 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_1397401600216= 48 > 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAIN= -IT.socket from SchemaCache > 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi:= //%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D > 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_13974016002= 1648 > 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/r= est/account/login > 2019-11-20T18:18:31Z DEBUG request body '' > 2019-11-20T18:18:31Z DEBUG response status 401 > 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 > Cache-Control: private > Expires: Thu, 01 Jan 1970 01:00:00 CET > WWW-Authenticate: Basic realm=3D"Certificate Authority" > Content-Type: text/html;charset=3Dutf-8 > Content-Language: en > Content-Length: 951 > Date: Wed, 20 Nov 2019 18:18:31 GMT > > 2019-11-20T18:18:31Z DEBUG response body 'Apache Tomca= t/7.0.76 - Error report

HTTP Status 401 - <= /h1>

type Status report

<= b>message

description This request requires HTT= P authentication.


Apache > Tomcat/7.0.76

' > 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/ip= aupgrade.log and run command ipa-server-upgrade manually. > 2019-11-20T18:18:31Z DEBUG =C2=A0 File "/usr/lib/python2.7/site-packages/= ipapython/admintool.py", line 178, in execute > =C2=A0 =C2=A0 return_value =3D self.run() > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_serve= r_upgrade.py", line 54, in run > =C2=A0 =C2=A0 server.upgrade() > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/up= grade.py", line 2146, in upgrade > =C2=A0 =C2=A0 upgrade_configuration() > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/up= grade.py", line 2018, in upgrade_configuration > =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/up= grade.py", line 406, in ca_enable_ldap_profile_subsystem > =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstanc= e.py", line 2027, in migrate_profiles_to_ldap > =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwrite= =3DFalse) > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstanc= e.py", line 2033, in _create_dogtag_profile > =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: > =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py= ", line 1315, in __enter__ > =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to auth= enticate to CA REST API')) > > 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, excepti= on: RemoteRetrieveError: Failed to authenticate to CA REST API > 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.log= for details: > RemoteRetrieveError: Failed to authenticate to CA REST API > > > In this kdc I see these errors in getcert list: > > Request ID '20190220182014': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/e= tc/pki/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token=3D= 'NSS Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/pk= i/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token=3D'NSS = Certificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOMA= IN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonger= /stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmonge= r/renew_ca_cert "auditSigningCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182015': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/e= tc/pki/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token=3D'= NSS Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/pk= i/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token=3D'NSS C= ertificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOMA= IN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.IT = > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,ke= yCertSign,cRLSign > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonger= /stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmonge= r/renew_ca_cert "ocspSigningCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182016': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/e= tc/pki/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'NS= S Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/pk= i/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'NSS Cer= tificate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOMA= IN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,ke= yEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonger= /stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmonge= r/renew_ca_cert "subsystemCert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > > Request ID '20190220182018': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D'/va= r/lib/ipa/ra-agent.key' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var/lib= /ipa/ra-agent.pem' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOMA= IN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,ke= yEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonger= /renew_ra_cert_pre > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmonge= r/renew_ra_cert > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > Request ID '20190220182019': > =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING > =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at "https://kdc2.l.domain.it= :8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. > =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/e= tc/pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS = Certificate DB',pin set > =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/pk= i/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certi= ficate DB' > =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent > =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOMA= IN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it ,O=3DL.DOMAIN.IT > =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC > =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,ke= yEncipherment,dataEncipherment > =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-= emailProtection > =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonger= /stop_pkicad > =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmonge= r/renew_ca_cert "Server-Cert cert-pki-ca" > =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes > =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes > > I still have a working replica, so I could just reinstall and have a work= ing set in a couple of minutes, but I would like to find out what has gone = wrong. > > The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 > > Any help welcome ;-) > > Thanks, > > -- > Groeten, > natxo > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org --===============2487156464546001081== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CiAgPC9oZWFkPgogIDxib2R5PgogICAgVGhp cyBub3cgaGFwcGVuZWQgdG8gbWUgdG9vLjxicj4KICAgIDxicj4KICAgIFRoZSBzb2x1dGlvbiBp biB0aGlzIHRocmVhZCB3YXMgdG8gY29weSAvdmFyL2xpYi9pcGEvcmEtYWdlbnQuKiB0bwogICAg dGhlIGZhaWxpbmcgc3lzdGVtLjxicj4KICAgIEFmdGVyIHRoYXQgSSB3YXMgYWJsZSB0byByZXN0 YXJ0IChpcGFjdGwgcmVzdGFydCkuPGJyPgogICAgPGJyPgogICAgV2hhdCByZW1haW5zIGEgbXlz dGVyeSBpcyAqKndoeSoqIHRoaXMgaGFwcGVuZWQuPGJyPgogICAgPGJyPgogICAgSW4gbXkgY2Fz ZSwgd2UgaGF2ZSB0aHJlZSBDQSBtYXN0ZXJzLCBvbmUgaXMgdGhlIENBIHJlbmV3YWwgbWFzdGVy CiAgICAob2YgY291cnNlKS48YnI+CiAgICBUd28gZGF5cyBhZ28sIGxpbmdlLCB0aGUgcmVuZXdh bCBtYXN0ZXIsIHJlbmV3ZWQgYSBmZXcgY2VydGlmaWNhdGVzLgogICAgSGVyZSBpcyBhIHN1bW1h cnk8YnI+CiAgICBvZiBqb3VybmFsY3RsLjxicj4KICAgIDxicj4KICAgIFtyb290QGxpbmdlIH5d IyBqb3VybmFsY3RsIHwgZ3JlcCAtRSAnY2VydG1vbmdlcnxkb2d0YWcnPGJyPgogICAgc2VwIDI5 IDEzOjM5OjAwIGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2Mjg4XTogQ2VydGlmaWNhdGUgaW4g ZmlsZQogICAgIi92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0iIHdpbGwgbm90IGJlIHZhbGlkIGFm dGVyIDIwMjAxMDI2MjAxNTQ4Ljxicj4KICAgIHNlcCAyOSAxMzozOTowMCBsaW5nZS5naHMubmwg Y2VydG1vbmdlclsxNjI4OV06IENlcnRpZmljYXRlIG5hbWVkCiAgICAiYXVkaXRTaWduaW5nQ2Vy dCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4KICAgIGRhdGFi YXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgog ICAgMjAyMDEwMjYyMDE1MzIuPGJyPgogICAgc2VwIDI5IDEzOjM5OjAwIGxpbmdlLmdocy5ubCBj ZXJ0bW9uZ2VyWzE2MjkwXTogQ2VydGlmaWNhdGUgbmFtZWQKICAgICJvY3NwU2lnbmluZ0NlcnQg Y2VydC1wa2ktY2EiIGluIHRva2VuICJOU1MgQ2VydGlmaWNhdGUgREIiIGluCiAgICBkYXRhYmFz ZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2lsbCBub3QgYmUgdmFsaWQgYWZ0ZXIKICAg IDIwMjAxMDI2MjAxNTMxLjxicj4KICAgIHNlcCAyOSAxMzozOTowMCBsaW5nZS5naHMubmwgY2Vy dG1vbmdlclsxNjI5MV06IENlcnRpZmljYXRlIG5hbWVkCiAgICAic3Vic3lzdGVtQ2VydCBjZXJ0 LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4KICAgIGRhdGFiYXNlICIv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAgMjAy MDEwMjYyMDE1MzIuPGJyPgogICAgc2VwIDI5IDEzOjM5OjAyIGxpbmdlLmdocy5ubAogICAgZG9n dGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYyOThdOiBGb3J3YXJkaW5nIHJlcXVlc3Qg dG8KICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAgICBzZXAgMjkgMTM6Mzk6MDMgbGlu Z2UuZ2hzLm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5OF06IGRv Z3RhZy1pcGEtcmVuZXctYWdlbnQKICAgIHJldHVybmVkIDU8YnI+CiAgICBzZXAgMjkgMTM6Mzk6 MDUgbGluZ2UuZ2hzLm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjMz OV06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4K ICAgIHNlcCAyOSAxMzozOTowNiBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXct YWdlbnQtc3VibWl0WzE2MzM5XTogZG9ndGFnLWlwYS1yZW5ldy1hZ2VudAogICAgcmV0dXJuZWQg NTxicj4KICAgIHNlcCAyOSAxMzozOTowOCBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2Et cmVuZXctYWdlbnQtc3VibWl0WzE2MzU0XTogRm9yd2FyZGluZyByZXF1ZXN0IHRvCiAgICBkb2d0 YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgc2VwIDI5IDEzOjM5OjA4IGxpbmdlLmdocy5ubAog ICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYzNTRdOiBkb2d0YWctaXBhLXJl bmV3LWFnZW50CiAgICByZXR1cm5lZCAwPGJyPgogICAgc2VwIDI5IDEzOjM5OjIwIGxpbmdlLmdo cy5ubCBjZXJ0bW9uZ2VyWzE2NzIwXTogQ2VydGlmaWNhdGUgbmFtZWQKICAgICJzdWJzeXN0ZW1D ZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERCIiBpbgogICAgZGF0 YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMiIGlzc3VlZCBieSBDQSBhbmQgc2F2ZWQu PGJyPgogICAgc2VwIDI5IDEzOjM5OjIyIGxpbmdlLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1y ZW5ldy1hZ2VudC1zdWJtaXRbMTYyOTddOiBGb3J3YXJkaW5nIHJlcXVlc3QgdG8KICAgIGRvZ3Rh Zy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAgICBzZXAgMjkgMTM6Mzk6MjMgbGluZ2UuZ2hzLm5sCiAg ICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5N106IGRvZ3RhZy1pcGEtcmVu ZXctYWdlbnQKICAgIHJldHVybmVkIDU8YnI+CiAgICBzZXAgMjkgMTM6Mzk6MjUgbGluZ2UuZ2hz Lm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjcyNl06IEZvcndhcmRp bmcgcmVxdWVzdCB0bwogICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4KICAgIHNlcCAyOSAx MzozOToyNSBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0 WzE2NzI2XTogZG9ndGFnLWlwYS1yZW5ldy1hZ2VudAogICAgcmV0dXJuZWQgNTxicj4KICAgIHNl cCAyOSAxMzozOToyNyBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQt c3VibWl0WzE2NzQxXTogRm9yd2FyZGluZyByZXF1ZXN0IHRvCiAgICBkb2d0YWctaXBhLXJlbmV3 LWFnZW50PGJyPgogICAgc2VwIDI5IDEzOjM5OjI3IGxpbmdlLmdocy5ubAogICAgZG9ndGFnLWlw YS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTY3NDFdOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAg ICByZXR1cm5lZCAwPGJyPgogICAgc2VwIDI5IDEzOjM5OjM5IGxpbmdlLmdocy5ubCBjZXJ0bW9u Z2VyWzE3MTA2XTogQ2VydGlmaWNhdGUgbmFtZWQKICAgICJhdWRpdFNpZ25pbmdDZXJ0IGNlcnQt cGtpLWNhIiBpbiB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERCIiBpbgogICAgZGF0YWJhc2UgIi9l dGMvcGtpL3BraS10b21jYXQvYWxpYXMiIGlzc3VlZCBieSBDQSBhbmQgc2F2ZWQuPGJyPgogICAg c2VwIDI5IDEzOjM5OjQyIGxpbmdlLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2Vu dC1zdWJtaXRbMTYyOTZdOiBGb3J3YXJkaW5nIHJlcXVlc3QgdG8KICAgIGRvZ3RhZy1pcGEtcmVu ZXctYWdlbnQ8YnI+CiAgICBzZXAgMjkgMTM6Mzk6NDMgbGluZ2UuZ2hzLm5sCiAgICBkb2d0YWct aXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5Nl06IGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQK ICAgIHJldHVybmVkIDU8YnI+CiAgICBzZXAgMjkgMTM6Mzk6NDQgbGluZ2UuZ2hzLm5sCiAgICBk b2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNzExMl06IEZvcndhcmRpbmcgcmVxdWVz dCB0bwogICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4KICAgIHNlcCAyOSAxMzozOTo0NSBs aW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTEyXTog ZG9ndGFnLWlwYS1yZW5ldy1hZ2VudAogICAgcmV0dXJuZWQgNTxicj4KICAgIHNlcCAyOSAxMzoz OTo0NyBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3 MTI2XTogRm9yd2FyZGluZyByZXF1ZXN0IHRvCiAgICBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJy PgogICAgc2VwIDI5IDEzOjM5OjQ3IGxpbmdlLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1yZW5l dy1hZ2VudC1zdWJtaXRbMTcxMjZdOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAgICByZXR1cm5l ZCAwPGJyPgogICAgc2VwIDI5IDEzOjM5OjQ5IGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE3MTU2 XTogQ2VydGlmaWNhdGUgaW4gZmlsZQogICAgIi92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0iIGlz c3VlZCBieSBDQSBhbmQgc2F2ZWQuPGJyPgogICAgc2VwIDI5IDEzOjM5OjUyIGxpbmdlLmdocy5u bAogICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYyOTldOiBGb3J3YXJkaW5n IHJlcXVlc3QgdG8KICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAgICBzZXAgMjkgMTM6 Mzk6NTMgbGluZ2UuZ2hzLm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsx NjI5OV06IGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQKICAgIHJldHVybmVkIDU8YnI+CiAgICBzZXAg MjkgMTM6Mzk6NTQgbGluZ2UuZ2hzLm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1 Ym1pdFsxNzE2Ml06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgZG9ndGFnLWlwYS1yZW5ldy1h Z2VudDxicj4KICAgIHNlcCAyOSAxMzozOTo1NSBsaW5nZS5naHMubmwKICAgIGRvZ3RhZy1pcGEt Y2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTYyXTogZG9ndGFnLWlwYS1yZW5ldy1hZ2VudAogICAg cmV0dXJuZWQgNTxicj4KICAgIHNlcCAyOSAxMzozOTo1NyBsaW5nZS5naHMubmwKICAgIGRvZ3Rh Zy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTc3XTogRm9yd2FyZGluZyByZXF1ZXN0IHRv CiAgICBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgc2VwIDI5IDEzOjM5OjU3IGxpbmdl Lmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTcxNzddOiBkb2d0 YWctaXBhLXJlbmV3LWFnZW50CiAgICByZXR1cm5lZCAwPGJyPgogICAgc2VwIDI5IDEzOjQwOjA1 IGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE3NTQwXTogQ2VydGlmaWNhdGUgbmFtZWQKICAgICJv Y3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1MgQ2VydGlmaWNhdGUgREIi IGluCiAgICBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgaXNzdWVkIGJ5IENB IGFuZCBzYXZlZC48YnI+CiAgICA8YnI+CiAgICBUb2RheSAodHdvIGRheXMgbGF0ZXIpIEkgbG9v a2VkIGF0IHRoZSB0d28gb3RoZXIgQ0EgbWFzdGVycyB0byBzZWUKICAgIGlmIHRoZXNlIHNhbWUg Y2VydGlmaWNhdGVzIHdlcmUgT0suPGJyPgogICAgSSBzYXcgdGhpczo8YnI+CiAgICA8YnI+CiAg ICBbcm9vdEBpcGFyZXAzIH5dIyBqb3VybmFsY3RsIHwgZ3JlcCAtRSAnY2VydG1vbmdlcnxkb2d0 YWcnPGJyPgogICAgc2VwIDI5IDExOjIyOjEzIGlwYXJlcDMuZ2hzLm5sIGNlcnRtb25nZXJbMjE0 NDc5XTogQ2VydGlmaWNhdGUgaW4KICAgIGZpbGUgIi92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0i IHdpbGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAyMDIwMTAyNjIwMTU0OC48YnI+CiAgICBzZXAg MjkgMTE6MjI6MTMgaXBhcmVwMy5naHMubmwgY2VydG1vbmdlclsyMTQ0ODBdOiBDZXJ0aWZpY2F0 ZSBuYW1lZAogICAgImF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1Mg Q2VydGlmaWNhdGUgREIiIGluCiAgICBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cyIgd2lsbCBub3QgYmUgdmFsaWQgYWZ0ZXIKICAgIDIwMjAxMDI2MjAxNTMyLjxicj4KICAgIHNl cCAyOSAxMToyMjoxMyBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzIxNDQ4MV06IENlcnRpZmlj YXRlIG5hbWVkCiAgICAib2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNT IENlcnRpZmljYXRlIERCIiBpbgogICAgZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxp YXMiIHdpbGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAyMDIwMTAyNjIwMTUzMS48YnI+CiAgICBz ZXAgMjkgMTE6MjI6MTMgaXBhcmVwMy5naHMubmwgY2VydG1vbmdlclsyMTQ0ODJdOiBDZXJ0aWZp Y2F0ZSBuYW1lZAogICAgInN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1Mg Q2VydGlmaWNhdGUgREIiIGluCiAgICBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cyIgd2lsbCBub3QgYmUgdmFsaWQgYWZ0ZXIKICAgIDIwMjAxMDI2MjAxNTMyLjxicj4KICAgIHNl cCAyOSAxMToyMjoxNSBpcGFyZXAzLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2Vu dC1zdWJtaXRbMjE0NDg3XTogVXBkYXRlZCBjZXJ0aWZpY2F0ZSBub3QKICAgIGF2YWlsYWJsZTxi cj4KICAgIHNlcCAyOSAxMToyMjoxNiBpcGFyZXAzLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1y ZW5ldy1hZ2VudC1zdWJtaXRbMjE0NDg4XTogVXBkYXRlZCBjZXJ0aWZpY2F0ZSBub3QKICAgIGF2 YWlsYWJsZTxicj4KICAgIHNlcCAyOSAxMToyMjoxNiBpcGFyZXAzLmdocy5ubAogICAgZG9ndGFn LWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMjE0NDk2XTogVXBkYXRlZCBjZXJ0aWZpY2F0ZSBu b3QKICAgIGF2YWlsYWJsZTxicj4KICAgIHNlcCAyOSAxMToyMjoxNyBpcGFyZXAzLmdocy5ubAog ICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMjE0NTA1XTogVXBkYXRlZCBjZXJ0 aWZpY2F0ZSBub3QKICAgIGF2YWlsYWJsZTxicj4KICAgIHNlcCAyOSAxOToyMjoxOCBpcGFyZXAz Lmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkgMTk6MjI6MTgKICAgIFs0MjhdIElu dmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICBzZXAgMjkgMTk6MjI6MTkgaXBhcmVwMy5naHMubmwg Y2VydG1vbmdlcls0MjhdOiAyMDIwLTA5LTI5IDE5OjIyOjE5CiAgICBbNDI4XSBJbnZhbGlkIGNv b2tpZTogdScnPGJyPgogICAgc2VwIDI5IDE5OjIyOjIwIGlwYXJlcDMuZ2hzLm5sIGNlcnRtb25n ZXJbNDI4XTogMjAyMC0wOS0yOSAxOToyMjoyMAogICAgWzQyOF0gSW52YWxpZCBjb29raWU6IHUn Jzxicj4KICAgIHNlcCAyOSAxOToyMjoyOSBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06 IDIwMjAtMDktMjkgMTk6MjI6MjkKICAgIFs0MjhdIEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAg ICA8YnI+CiAgICBbcm9vdEByb3R0ZSB+XSMgam91cm5hbGN0bCB8IGdyZXAgLUUgJ2NlcnRtb25n ZXJ8ZG9ndGFnJzxicj4KICAgIHNlcCAyOSAxMzowMDo1NSByb3R0ZS5naHMubmwgY2VydG1vbmdl clsxNjYzODFdOiBDZXJ0aWZpY2F0ZSBpbiBmaWxlCiAgICAiL3Zhci9saWIvaXBhL3JhLWFnZW50 LnBlbSIgd2lsbCBub3QgYmUgdmFsaWQgYWZ0ZXIgMjAyMDEwMjYyMDE1NDguPGJyPgogICAgc2Vw IDI5IDEzOjAwOjU1IHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NjM4Ml06IENlcnRpZmljYXRl IG5hbWVkCiAgICAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBD ZXJ0aWZpY2F0ZSBEQiIgaW4KICAgIGRhdGFiYXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz IiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAgMjAyMDEwMjYyMDE1MzIuPGJyPgogICAgc2Vw IDI5IDEzOjAwOjU1IHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NjM4M106IENlcnRpZmljYXRl IG5hbWVkCiAgICAib2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTIENl cnRpZmljYXRlIERCIiBpbgogICAgZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMi IHdpbGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAyMDIwMTAyNjIwMTUzMS48YnI+CiAgICBzZXAg MjkgMTM6MDA6NTUgcm90dGUuZ2hzLm5sIGNlcnRtb25nZXJbMTY2Mzg0XTogQ2VydGlmaWNhdGUg bmFtZWQKICAgICJzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTIENlcnRp ZmljYXRlIERCIiBpbgogICAgZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMiIHdp bGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAyMDIwMTAyNjIwMTUzMi48YnI+CiAgICBzZXAgMjkg MTM6MDA6NTcgcm90dGUuZ2hzLm5sCiAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1p dFsxNjYzODldOiBVcGRhdGVkIGNlcnRpZmljYXRlIG5vdAogICAgYXZhaWxhYmxlPGJyPgogICAg c2VwIDI5IDEzOjAwOjU4IHJvdHRlLmdocy5ubAogICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2Vu dC1zdWJtaXRbMTY2MzkyXTogVXBkYXRlZCBjZXJ0aWZpY2F0ZSBub3QKICAgIGF2YWlsYWJsZTxi cj4KICAgIHNlcCAyOSAxMzowMTowOCByb3R0ZS5naHMubmwKICAgIGRvZ3RhZy1pcGEtY2EtcmVu ZXctYWdlbnQtc3VibWl0WzE2NjM5MV06IFVwZGF0ZWQgY2VydGlmaWNhdGUgbm90CiAgICBhdmFp bGFibGU8YnI+CiAgICBzZXAgMjkgMTM6MDE6MDggcm90dGUuZ2hzLm5sCiAgICBkb2d0YWctaXBh LWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjYzOTBdOiBVcGRhdGVkIGNlcnRpZmljYXRlIG5vdAog ICAgYXZhaWxhYmxlPGJyPgogICAgc2VwIDI5IDIxOjAxOjAwIHJvdHRlLmdocy5ubCBjZXJ0bW9u Z2VyWzk3OTc2XTogMjAyMC0wOS0yOSAyMTowMTowMAogICAgWzk3OTc2XSBJbnZhbGlkIGNvb2tp ZTogdScnPGJyPgogICAgc2VwIDI5IDIxOjAxOjAxIHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzk3 OTc2XTogMjAyMC0wOS0yOSAyMTowMTowMQogICAgWzk3OTc2XSBJbnZhbGlkIGNvb2tpZTogdScn PGJyPgogICAgc2VwIDI5IDIxOjAxOjEwIHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzk3OTc2XTog MjAyMC0wOS0yOSAyMTowMToxMAogICAgWzk3OTc2XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgog ICAgc2VwIDI5IDIxOjAxOjExIHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzk3OTc2XTogMjAyMC0w OS0yOSAyMTowMToxMQogICAgWzk3OTc2XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgPGJy PgogICAgU28sIGJvdGggbm9uLXJlbmV3YWwgbWFzdGVycyBzdGFydGVkIHRyaWVkCiAgICBkb2d0 YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdCwgYW5kIGJvdGggZmFpbGVkIHdpdGg8YnI+CiAg ICAiVXBkYXRlZCBjZXJ0aWZpY2F0ZSBub3QgYXZhaWxhYmxlIjxicj4KICAgIDxicj4KICAgIE5l eHQsIEkgZGlkIGEgInl1bSB1cGRhdGUiLCBob3BpbmcgdG8gZ2V0IHJpZCBvZiB0aGUgaW52YWxp ZCBjb29raWUuCiAgICBUaGlzIHVwZGF0ZWQgaXBhIGZyb20gNC42LjUgdG8gNC42LjY8YnI+CiAg ICBUaGUgdXBkYXRlIGZhaWxlZCBiZWNhdXNlIC92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0gc3Rp bGwgaGFkIHRoZQogICAgb2xkIGNlcnRpZmljYXRlLjxicj4KICAgIDxicj4KICAgIEFmdGVyIG1h bnVhbGx5IGNvcHlpbmcgcmEtYWdlbnQuKiB0byB0aGUgZmFpbGluZyBzeXN0ZW0gSSB3YXMgYWJs ZQogICAgdG8gcmVzdGFydCBpcGEuIEhvd2V2ZXIsIEkgc3VzcGVjdDxicj4KICAgIHRoYXQgdGhp bmdzIGFyZSBzdGlsbCBub3QgcmlnaHQuIFRvbyBtYW55IGNlcnRzIG9uIHRoZSBub24tcmVuZXdh bAogICAgbWFzdGVycyBzdGlsbCBuZWVkIHRvIGJlIHJlbmV3ZWQuPGJyPgogICAgSSdtIGRpZ2dp bmcgZnVydGhlciAuLi48YnI+CiAgICAtLSBLZWVzPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAyMC0xMS0yMDE5IDIwOjEzLCBOYXR4byBBc2Vuam8gdmlh CiAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIgpjaXRlPSJtaWQ6Q0FIQkVKeldHTktIRUFPRFhqam5rNnZUeTJVc1FSblgx WnBKRm9wKzJMcD1mUkg4eEd3QG1haWwuZ21haWwuY29tIj4KICAgICAgPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPgogICAg ICA8ZGl2PgogICAgICAgIDxkaXYgZGlyPSJsdHIiPgogICAgICAgICAgPGRpdj5oaSw8L2Rpdj4K ICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8ZGl2PmFmdGVy IHBhdGNoaW5nIG91ciBjZW50b3MgNyBob3N0cyB0byB0aGUgbGF0ZXN0IHZlcnNpb24KICAgICAg ICAgICAgdG9kYXksIG9uZSBvZiB0aGUgdHdvIHJlcGxpY2FzIGlzIGhhdmluZyB0cm91YmxlLjwv ZGl2PgogICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxkaXY+ W3Jvb3RAa2RjMiB+XSMgaXBhY3RsIHN0YXR1czxicj4KICAgICAgICAgICAgRGlyZWN0b3J5IFNl cnZpY2U6IFJVTk5JTkc8YnI+CiAgICAgICAgICAgIGtyYjVrZGMgU2VydmljZTogU1RPUFBFRDxi cj4KICAgICAgICAgICAga2FkbWluIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgIG5h bWVkIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgIGh0dHBkIFNlcnZpY2U6IFJVTk5J Tkc8YnI+CiAgICAgICAgICAgIGlwYS1jdXN0b2RpYSBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAg ICAgICAgICBudHBkIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgIHBraS10b21jYXRk IFNlcnZpY2U6IFJVTk5JTkc8YnI+CiAgICAgICAgICAgIHNtYiBTZXJ2aWNlOiBTVE9QUEVEPGJy PgogICAgICAgICAgICB3aW5iaW5kIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgIGlw YS1vdHBkIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgIGlwYS1kbnNrZXlzeW5jZCBT ZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICBpcGE6IElORk86IFRoZSBpcGFjdGwgY29t bWFuZCB3YXMgc3VjY2Vzc2Z1bDwvZGl2PgogICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICA8 L2Rpdj4KICAgICAgICAgIDxkaXY+YW5kIGFmdGVyIGRpZ2dpbmcgaW4gdGhlIGxvZ3MgSSBjb21l IGFjcm9zcyB0aGlzIGluCiAgICAgICAgICAgIC92YXIvbG9nL2lwYXVwZ3JhZGUubG9nOjxicj4K ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICA8L2Rpdj4KICAg ICAgICAgIDxkaXY+MjAxOS0xMS0yMFQxODoxODoyOVogREVCVUcgc3RkZXJyPTxicj4KICAgICAg ICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBDZXJ0bW9uZ2VyIGNlcnRpZmljYXRlIHJl bmV3YWwKICAgICAgICAgICAgY29uZmlndXJhdGlvbiBhbHJlYWR5IHVwLXRvLWRhdGU8YnI+CiAg ICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gW0VuYWJsZSBQS0lYIGNlcnRpZmlj YXRlIHBhdGgKICAgICAgICAgICAgZGlzY292ZXJ5IGFuZCB2YWxpZGF0aW9uXTxicj4KICAgICAg ICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVCVUcgTG9hZGluZyBTdGF0ZUZpbGUgZnJvbQog ICAgICAgICAgICAnL3Zhci9saWIvaXBhL3N5c3VwZ3JhZGUvc3lzdXBncmFkZS5zdGF0ZSc8YnI+ CiAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gUEtJWCBhbHJlYWR5IGVuYWJs ZWQ8YnI+CiAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gW0F1dGhvcml6aW5n IFJBIEFnZW50IHRvIG1vZGlmeQogICAgICAgICAgICBwcm9maWxlc108YnI+CiAgICAgICAgICAg IDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gW0F1dGhvcml6aW5nIFJBIEFnZW50IHRvIG1hbmFn ZQogICAgICAgICAgICBsaWdodHdlaWdodCBDQXNdPGJyPgogICAgICAgICAgICAyMDE5LTExLTIw VDE4OjE4OjMxWiBJTkZPIFtFbnN1cmluZyBMaWdodHdlaWdodCBDQXMKICAgICAgICAgICAgY29u dGFpbmVyIGV4aXN0cyBpbiBEb2d0YWcgZGF0YWJhc2VdPGJyPgogICAgICAgICAgICAyMDE5LTEx LTIwVDE4OjE4OjMxWiBERUJVRyBDcmVhdGVkIGNvbm5lY3Rpb24KICAgICAgICAgICAgY29udGV4 dC5sZGFwMl8xMzk3NDAxNjI1NDc0NzI8YnI+CiAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6 MzFaIERFQlVHIGZsdXNoaW5nCiAgICAgICAgICAgIGxkYXBpOi8vJTJmdmFyJTJmcnVuJTJmc2xh cGQtTC1ET01BSU4tSVQuc29ja2V0IGZyb20KICAgICAgICAgICAgU2NoZW1hQ2FjaGU8YnI+CiAg ICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIHJldHJpZXZpbmcgc2NoZW1hIGZv ciBTY2hlbWFDYWNoZQogICAgICAgICAgICB1cmw9bGRhcGk6Ly8lMmZ2YXIlMmZydW4lMmZzbGFw ZC1MLURPTUFJTi1JVC5zb2NrZXQKICAgICAgICAgICAgY29ubj0mbHQ7bGRhcC5sZGFwb2JqZWN0 LlNpbXBsZUxEQVBPYmplY3QgaW5zdGFuY2UgYXQKICAgICAgICAgICAgMHg3ZjE3Y2MyNGI2Mzgm Z3Q7PGJyPgogICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBEZXN0cm95ZWQg Y29ubmVjdGlvbgogICAgICAgICAgICBjb250ZXh0LmxkYXAyXzEzOTc0MDE2MjU0NzQ3Mjxicj4K ICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBbQWRkaW5nIGRlZmF1bHQgT0NT UCBVUkkKICAgICAgICAgICAgY29uZmlndXJhdGlvbl08YnI+CiAgICAgICAgICAgIDIwMTktMTEt MjBUMTg6MTg6MzFaIElORk8gW0Vuc3VyaW5nIENBIGlzIHVzaW5nCiAgICAgICAgICAgIExEQVBQ cm9maWxlU3Vic3lzdGVtXTxicj4KICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogSU5G TyBbTWlncmF0aW5nIGNlcnRpZmljYXRlIHByb2ZpbGVzIHRvCiAgICAgICAgICAgIExEQVBdPGJy PgogICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBDcmVhdGVkIGNvbm5lY3Rp b24KICAgICAgICAgICAgY29udGV4dC5sZGFwMl8xMzk3NDAxNjAwMjE2NDg8YnI+CiAgICAgICAg ICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIGZsdXNoaW5nCiAgICAgICAgICAgIGxkYXBp Oi8vJTJmdmFyJTJmcnVuJTJmc2xhcGQtTC1ET01BSU4tSVQuc29ja2V0IGZyb20KICAgICAgICAg ICAgU2NoZW1hQ2FjaGU8YnI+CiAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVH IHJldHJpZXZpbmcgc2NoZW1hIGZvciBTY2hlbWFDYWNoZQogICAgICAgICAgICB1cmw9bGRhcGk6 Ly8lMmZ2YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQKICAgICAgICAgICAgY29u bj0mbHQ7bGRhcC5sZGFwb2JqZWN0LlNpbXBsZUxEQVBPYmplY3QgaW5zdGFuY2UgYXQKICAgICAg ICAgICAgMHg3ZjE3Y2MyODliMDAmZ3Q7PGJyPgogICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4 OjMxWiBERUJVRyBEZXN0cm95ZWQgY29ubmVjdGlvbgogICAgICAgICAgICBjb250ZXh0LmxkYXAy XzEzOTc0MDE2MDAyMTY0ODxicj4KICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVC VUcgcmVxdWVzdCBHRVQgPGEKICAgICAgICAgICAgICBocmVmPSJodHRwczovL2tkYzIubC5kb21h aW4uaXQ6ODQ0My9jYS9yZXN0L2FjY291bnQvbG9naW4iCiAgICAgICAgICAgICAgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIj4KICAgICAgICAgICAgICBodHRwczovL2tkYzIubC5kb21haW4uaXQ6ODQ0 My9jYS9yZXN0L2FjY291bnQvbG9naW48L2E+PGJyPgogICAgICAgICAgICAyMDE5LTExLTIwVDE4 OjE4OjMxWiBERUJVRyByZXF1ZXN0IGJvZHkgJyc8YnI+CiAgICAgICAgICAgIDIwMTktMTEtMjBU MTg6MTg6MzFaIERFQlVHIHJlc3BvbnNlIHN0YXR1cyA0MDE8YnI+CiAgICAgICAgICAgIDIwMTkt MTEtMjBUMTg6MTg6MzFaIERFQlVHIHJlc3BvbnNlIGhlYWRlcnMgU2VydmVyOgogICAgICAgICAg ICBBcGFjaGUtQ295b3RlLzEuMTxicj4KICAgICAgICAgICAgQ2FjaGUtQ29udHJvbDogcHJpdmF0 ZTxicj4KICAgICAgICAgICAgRXhwaXJlczogVGh1LCAwMSBKYW4gMTk3MCAwMTowMDowMCBDRVQ8 YnI+CiAgICAgICAgICAgIFdXVy1BdXRoZW50aWNhdGU6IEJhc2ljIHJlYWxtPSJDZXJ0aWZpY2F0 ZSBBdXRob3JpdHkiPGJyPgogICAgICAgICAgICBDb250ZW50LVR5cGU6IHRleHQvaHRtbDtjaGFy c2V0PXV0Zi04PGJyPgogICAgICAgICAgICBDb250ZW50LUxhbmd1YWdlOiBlbjxicj4KICAgICAg ICAgICAgQ29udGVudC1MZW5ndGg6IDk1MTxicj4KICAgICAgICAgICAgRGF0ZTogV2VkLCAyMCBO b3YgMjAxOSAxODoxODozMSBHTVQ8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogREVCVUcgcmVzcG9uc2UgYm9keQogICAgICAgICAgICAnJmx0O2h0 bWwmZ3Q7Jmx0O2hlYWQmZ3Q7Jmx0O3RpdGxlJmd0O0FwYWNoZSBUb21jYXQvNy4wLjc2IC0KICAg ICAgICAgICAgRXJyb3IgcmVwb3J0Jmx0Oy90aXRsZSZndDsmbHQ7c3R5bGUmZ3Q7Jmx0OyEtLUgx Cntmb250LWZhbWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0ZTtiYWNrZ3Jv dW5kLWNvbG9yOiM1MjVENzY7Zm9udC1zaXplOjIycHg7fQogICAgICAgICAgICBIMgp7Zm9udC1m YW1pbHk6VGFob21hLEFyaWFsLHNhbnMtc2VyaWY7Y29sb3I6d2hpdGU7YmFja2dyb3VuZC1jb2xv cjojNTI1RDc2O2ZvbnQtc2l6ZToxNnB4O30KICAgICAgICAgICAgSDMKe2ZvbnQtZmFtaWx5OlRh aG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOndoaXRlO2JhY2tncm91bmQtY29sb3I6IzUyNUQ3 Njtmb250LXNpemU6MTRweDt9CiAgICAgICAgICAgIEJPRFkKe2ZvbnQtZmFtaWx5OlRhaG9tYSxB cmlhbCxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrO2JhY2tncm91bmQtY29sb3I6d2hpdGU7fQogICAg ICAgICAgICBCCntmb250LWZhbWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0 ZTtiYWNrZ3JvdW5kLWNvbG9yOiM1MjVENzY7fQogICAgICAgICAgICBQCntmb250LWZhbWlseTpU YWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtiYWNrZ3JvdW5kOndoaXRlO2NvbG9yOmJsYWNrO2ZvbnQt c2l6ZToxMnB4O31BCiAgICAgICAgICAgIHtjb2xvciA6IGJsYWNrO31BLm5hbWUge2NvbG9yIDog YmxhY2s7fUhSIHtjb2xvciA6CiAgICAgICAgICAgICM1MjVENzY7fS0tJmd0OyZsdDsvc3R5bGUm Z3Q7CiAgICAgICAgICAgICZsdDsvaGVhZCZndDsmbHQ7Ym9keSZndDsmbHQ7aDEmZ3Q7SFRUUCBT dGF0dXMgNDAxIC0KICAgICAgICAgICAgJmx0Oy9oMSZndDsmbHQ7SFIgc2l6ZT0iMSIKICAgICAg ICAgICAgbm9zaGFkZT0ibm9zaGFkZSImZ3Q7Jmx0O3AmZ3Q7Jmx0O2ImZ3Q7dHlwZSZsdDsvYiZn dDsgU3RhdHVzCiAgICAgICAgICAgIHJlcG9ydCZsdDsvcCZndDsmbHQ7cCZndDsmbHQ7YiZndDtt ZXNzYWdlJmx0Oy9iJmd0OwogICAgICAgICAgICAmbHQ7dSZndDsmbHQ7L3UmZ3Q7Jmx0Oy9wJmd0 OyZsdDtwJmd0OyZsdDtiJmd0O2Rlc2NyaXB0aW9uJmx0Oy9iJmd0OwogICAgICAgICAgICAmbHQ7 dSZndDtUaGlzIHJlcXVlc3QgcmVxdWlyZXMgSFRUUAogICAgICAgICAgICBhdXRoZW50aWNhdGlv bi4mbHQ7L3UmZ3Q7Jmx0Oy9wJmd0OyZsdDtIUiBzaXplPSIxIgogICAgICAgICAgICBub3NoYWRl PSJub3NoYWRlIiZndDsmbHQ7aDMmZ3Q7QXBhY2hlCiAgICAgICAgICAgIFRvbWNhdC83LjAuNzYm bHQ7L2gzJmd0OyZsdDsvYm9keSZndDsmbHQ7L2h0bWwmZ3Q7Jzxicj4KICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogRVJST1IgSVBBIHNlcnZlciB1cGdyYWRlIGZhaWxlZDoKICAgICAg ICAgICAgSW5zcGVjdCAvdmFyL2xvZy9pcGF1cGdyYWRlLmxvZyBhbmQgcnVuIGNvbW1hbmQKICAg ICAgICAgICAgaXBhLXNlcnZlci11cGdyYWRlIG1hbnVhbGx5Ljxicj4KICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogREVCVUcgwqAgRmlsZQogICAgICAgICAgICAiL3Vzci9saWIvcHl0 aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhcHl0aG9uL2FkbWludG9vbC5weSIsCiAgICAgICAgICAg IGxpbmUgMTc4LCBpbiBleGVjdXRlPGJyPgogICAgICAgICAgICDCoCDCoCByZXR1cm5fdmFsdWUg PSBzZWxmLnJ1bigpPGJyPgogICAgICAgICAgICDCoCBGaWxlCiIvdXNyL2xpYi9weXRob24yLjcv c2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9pcGFfc2VydmVyX3VwZ3JhZGUucHkiLAog ICAgICAgICAgICBsaW5lIDU0LCBpbiBydW48YnI+CiAgICAgICAgICAgIMKgIMKgIHNlcnZlci51 cGdyYWRlKCk8YnI+CiAgICAgICAgICAgIMKgIEZpbGUKICAgICAgICAgICAgIi91c3IvbGliL3B5 dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXNlcnZlci9pbnN0YWxsL3NlcnZlci91cGdyYWRlLnB5 IiwKICAgICAgICAgICAgbGluZSAyMTQ2LCBpbiB1cGdyYWRlPGJyPgogICAgICAgICAgICDCoCDC oCB1cGdyYWRlX2NvbmZpZ3VyYXRpb24oKTxicj4KICAgICAgICAgICAgwqAgRmlsZQogICAgICAg ICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwv c2VydmVyL3VwZ3JhZGUucHkiLAogICAgICAgICAgICBsaW5lIDIwMTgsIGluIHVwZ3JhZGVfY29u ZmlndXJhdGlvbjxicj4KICAgICAgICAgICAgwqAgwqAgY2FfZW5hYmxlX2xkYXBfcHJvZmlsZV9z dWJzeXN0ZW0oY2EpPGJyPgogICAgICAgICAgICDCoCBGaWxlCiAgICAgICAgICAgICIvdXNyL2xp Yi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9zZXJ2ZXIvdXBncmFk ZS5weSIsCiAgICAgICAgICAgIGxpbmUgNDA2LCBpbiBjYV9lbmFibGVfbGRhcF9wcm9maWxlX3N1 YnN5c3RlbTxicj4KICAgICAgICAgICAgwqAgwqAgY2FpbnN0YW5jZS5taWdyYXRlX3Byb2ZpbGVz X3RvX2xkYXAoKTxicj4KICAgICAgICAgICAgwqAgRmlsZQogICAgICAgICAgICAiL3Vzci9saWIv cHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvY2FpbnN0YW5jZS5weSIs CiAgICAgICAgICAgIGxpbmUgMjAyNywgaW4gbWlncmF0ZV9wcm9maWxlc190b19sZGFwPGJyPgog ICAgICAgICAgICDCoCDCoCBfY3JlYXRlX2RvZ3RhZ19wcm9maWxlKHByb2ZpbGVfaWQsIHByb2Zp bGVfZGF0YSwKICAgICAgICAgICAgb3ZlcndyaXRlPUZhbHNlKTxicj4KICAgICAgICAgICAgwqAg RmlsZQogICAgICAgICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2Vy dmVyL2luc3RhbGwvY2FpbnN0YW5jZS5weSIsCiAgICAgICAgICAgIGxpbmUgMjAzMywgaW4gX2Ny ZWF0ZV9kb2d0YWdfcHJvZmlsZTxicj4KICAgICAgICAgICAgwqAgwqAgd2l0aCBhcGkuQmFja2Vu ZC5yYV9jZXJ0cHJvZmlsZSBhcyBwcm9maWxlX2FwaTo8YnI+CiAgICAgICAgICAgIMKgIEZpbGUK ICAgICAgICAgICAgIi91c3IvbGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXNlcnZlci9w bHVnaW5zL2RvZ3RhZy5weSIsCiAgICAgICAgICAgIGxpbmUgMTMxNSwgaW4gX19lbnRlcl9fPGJy PgogICAgICAgICAgICDCoCDCoCByYWlzZSBlcnJvcnMuUmVtb3RlUmV0cmlldmVFcnJvcihyZWFz b249XygnRmFpbGVkIHRvCiAgICAgICAgICAgIGF1dGhlbnRpY2F0ZSB0byBDQSBSRVNUIEFQSScp KTxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBE RUJVRyBUaGUgaXBhLXNlcnZlci11cGdyYWRlIGNvbW1hbmQKICAgICAgICAgICAgZmFpbGVkLCBl eGNlcHRpb246IFJlbW90ZVJldHJpZXZlRXJyb3I6IEZhaWxlZCB0bwogICAgICAgICAgICBhdXRo ZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEk8YnI+CiAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6 MzFaIEVSUk9SIFVuZXhwZWN0ZWQgZXJyb3IgLSBzZWUKICAgICAgICAgICAgL3Zhci9sb2cvaXBh dXBncmFkZS5sb2cgZm9yIGRldGFpbHM6PGJyPgogICAgICAgICAgICBSZW1vdGVSZXRyaWV2ZUVy cm9yOiBGYWlsZWQgdG8gYXV0aGVudGljYXRlIHRvIENBIFJFU1QgQVBJPC9kaXY+CiAgICAgICAg ICA8ZGl2PgogICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgIDxkaXY+CiAgICAgICAgICAg ICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRp dj48YnI+CiAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgIDxkaXY+SW4gdGhp cyBrZGMgSSBzZWUgdGhlc2UgZXJyb3JzIGluIGdldGNlcnQgbGlzdDo8L2Rpdj4KICAgICAgICAg ICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICA8 ZGl2PlJlcXVlc3QgSUQgJzIwMTkwMjIwMTgyMDE0Jzo8YnI+CiAgICAgICAgICAgICAgICAgIMKg IMKgIMKgIMKgIHN0YXR1czogTU9OSVRPUklORzxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAgY2EtZXJyb3I6IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAgICAgICAg IMKgIMKgIMKgIMKgIHN0dWNrOiBubzxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAg a2V5IHBhaXIgc3RvcmFnZToKdHlwZT1OU1NEQixsb2NhdGlvbj0nL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcycsbmlja25hbWU9J2F1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgY2Vy dC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREInLHBpbiBzZXQ8YnI+CiAgICAgICAg ICAgICAgICAgIMKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOgp0eXBlPU5TU0RCLGxvY2F0aW9uPScv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nYXVkaXRTaWduaW5nQ2VydAogICAg ICAgICAgICAgICAgICBjZXJ0LXBraS1jYScsdG9rZW49J05TUyBDZXJ0aWZpY2F0ZSBEQic8YnI+ CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIENBOiBkb2d0YWctaXBhLWNhLXJlbmV3LWFn ZW50PGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6IENOPUNlcnRpZmlj YXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9N QUlOLklUIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxicj4KICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3ViamVjdDogQ049Q0EgQXVkaXQsTz08YQogICAgICAg ICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIj5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGV4 cGlyZXM6IDIwMTktMTItMDUgMTM6NTg6MjQgVVRDPGJyPgogICAgICAgICAgICAgICAgICDCoCDC oCDCoCDCoCBrZXkgdXNhZ2U6IGRpZ2l0YWxTaWduYXR1cmUsbm9uUmVwdWRpYXRpb248YnI+CiAg ICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHByZS1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAg ICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZDxicj4KICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAg ICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAg ICAgICAgICJhdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIjxicj4KICAgICAgICAgICAgICAg ICAgwqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAgYXV0by1yZW5ldzogeWVzPGJyPgogICAgICAgICAgICAgICAgICBSZXF1ZXN0IElEICcyMDE5 MDIyMDE4MjAxNSc6PGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1P TklUT1JJTkc8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZh bGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdHVjazog bm88YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6CnR5 cGU9TlNTREIsbG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMnLG5pY2tuYW1lPSdv Y3NwU2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1Mg Q2VydGlmaWNhdGUgREInLHBpbiBzZXQ8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGNlcnRpZmljYXRlOgp0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2ktdG9tY2F0L2Fs aWFzJyxuaWNrbmFtZT0nb2NzcFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAgICAgIGNlcnQtcGtp LWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJzxicj4KICAgICAgICAgICAgICAgICAgwqAg wqAgwqAgwqAgQ0E6IGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgICAg ICAgIMKgIMKgIMKgIMKgIGlzc3VlcjogQ049Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89PGEKICAg ICAgICAgICAgICAgICAgICBocmVmPSJodHRwOi8vTC5ET01BSU4uSVQiIG1vei1kby1ub3Qtc2Vu ZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDC oCBzdWJqZWN0OiBDTj1PQ1NQIFN1YnN5c3RlbSxPPTxhCiAgICAgICAgICAgICAgICAgICAgaHJl Zj0iaHR0cDovL0wuRE9NQUlOLklUIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlOLklU PC9hPjxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0w NSAxMzo1ODoyNCBVVEM8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSB1c2Fn ZToKICAgICAgICAgICAgICAgICAgZGlnaXRhbFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbixrZXlD ZXJ0U2lnbixjUkxTaWduPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBla3U6IGlk LWtwLU9DU1BTaWduaW5nPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBwcmUtc2F2 ZSBjb21tYW5kOgogICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIv c3RvcF9wa2ljYWQ8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHBvc3Qtc2F2ZSBj b21tYW5kOgogICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVu ZXdfY2FfY2VydAogICAgICAgICAgICAgICAgICAib2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh Ijxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj4KICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgYXV0by1yZW5ldzogeWVzPGJyPgogICAgICAgICAgICAg ICAgICBSZXF1ZXN0IElEICcyMDE5MDIyMDE4MjAxNic6PGJyPgogICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBzdGF0dXM6IE1PTklUT1JJTkc8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKg IMKgIMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAg ICDCoCDCoCDCoCDCoCBzdHVjazogbm88YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGtleSBwYWlyIHN0b3JhZ2U6CiAgICAgICAgICAgICAgICAgIHR5cGU9TlNTREIsbG9jYXRpb249 Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMnLG5pY2tuYW1lPSdzdWJzeXN0ZW1DZXJ0CiAgICAg ICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJyxwaW4g c2V0PGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBjZXJ0aWZpY2F0ZToKICAgICAg ICAgICAgICAgICAgdHlwZT1OU1NEQixsb2NhdGlvbj0nL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cycsbmlja25hbWU9J3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2En LHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREInPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDC oCDCoCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxicj4KICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz08YQogICAgICAg ICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIj5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHN1 YmplY3Q6IENOPUNBIFN1YnN5c3RlbSxPPTxhCiAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0 cDovL0wuRE9NQUlOLklUIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxi cj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1 ODoyNCBVVEM8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSB1c2FnZToKICAg ICAgICAgICAgICAgICAgZGlnaXRhbFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbixrZXlFbmNpcGhl cm1lbnQsZGF0YUVuY2lwaGVybWVudDxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAg ZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1dGg8YnI+CiAgICAgICAgICAgICAg ICAgIMKgIMKgIMKgIMKgIHByZS1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgIC91c3Iv bGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZDxicj4KICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgIC91c3IvbGli ZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICJzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIjxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAg dHJhY2s6IHllczxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgYXV0by1yZW5ldzog eWVzPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2 PgogICAgICAgICAgICAgICAgPGRpdj5SZXF1ZXN0IElEICcyMDE5MDIyMDE4MjAxOCc6PGJyPgog ICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1PTklUT1JJTkc8YnI+CiAgICAg ICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJy PgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdHVjazogbm88YnI+CiAgICAgICAgICAg ICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6CiAgICAgICAgICAgICAgICAgIHR5 cGU9RklMRSxsb2NhdGlvbj0nL3Zhci9saWIvaXBhL3JhLWFnZW50LmtleSc8YnI+CiAgICAgICAg ICAgICAgICAgIMKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOgogICAgICAgICAgICAgICAgICB0eXBl PUZJTEUsbG9jYXRpb249Jy92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0nPGJyPgogICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxicj4KICAg ICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3Jp dHksTz08YQogICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96 LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAg IMKgIMKgIMKgIMKgIHN1YmplY3Q6IENOPUlQQSBSQSxPPTxhCiAgICAgICAgICAgICAgICAgICAg aHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlO LklUPC9hPjxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0x Mi0wNSAxMzo1ODo0NCBVVEM8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSB1 c2FnZToKICAgICAgICAgICAgICAgICAgZGlnaXRhbFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbixr ZXlFbmNpcGhlcm1lbnQsZGF0YUVuY2lwaGVybWVudDxicj4KICAgICAgICAgICAgICAgICAgwqAg wqAgwqAgwqAgZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1dGg8YnI+CiAgICAg ICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHByZS1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAg ICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19yYV9jZXJ0X3ByZTxicj4KICAg ICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAg ICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19yYV9jZXJ0PGJyPgogICAg ICAgICAgICAgICAgICDCoCDCoCDCoCDCoCB0cmFjazogeWVzPGJyPgogICAgICAgICAgICAgICAg ICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8YnI+CiAgICAgICAgICAgICAgICAgIFJlcXVl c3QgSUQgJzIwMTkwMjIwMTgyMDE5Jzo8YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IHN0YXR1czogTU9OSVRPUklORzxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2Et ZXJyb3I6IFNlcnZlciBhdCAiPGEKICAgICAgICAgICAgICAgICAgICBocmVmPSJodHRwczovL2tk YzIubC5kb21haW4uaXQ6ODQ0My9jYS9hZ2VudC9jYS9wcm9maWxlUHJvY2VzcyIKICAgICAgICAg ICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8va2RjMi5sLmRvbWFpbi5p dDo4NDQzL2NhL2FnZW50L2NhL3Byb2ZpbGVQcm9jZXNzPC9hPiIKICAgICAgICAgICAgICAgICAg cmVwbGllZDogMTogSW52YWxpZCBDcmVkZW50aWFsLjxicj4KICAgICAgICAgICAgICAgICAgwqAg wqAgwqAgwqAgc3R1Y2s6IG5vPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBrZXkg cGFpciBzdG9yYWdlOgogICAgICAgICAgICAgICAgICB0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nU2VydmVyLUNlcnQKICAgICAgICAgICAg ICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREInLHBpbiBzZXQ8YnI+ CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOgogICAgICAgICAgICAg ICAgICB0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNr bmFtZT0nU2VydmVyLUNlcnQKICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdO U1MgQ2VydGlmaWNhdGUgREInPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBDQTog ZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAgaXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz08YQogICAgICAgICAgICAgICAg ICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRP TUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHN1YmplY3Q6IENO PTxhIGhyZWY9Imh0dHA6Ly9rZGMyLmwuZG9tYWluLml0IgogICAgICAgICAgICAgICAgICAgIG1v ei1kby1ub3Qtc2VuZD0idHJ1ZSI+a2RjMi5sLmRvbWFpbi5pdDwvYT4sTz08YQogICAgICAgICAg ICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVl Ij5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGV4cGly ZXM6IDIwMTktMTItMTAgMTA6NTc6NTIgVVRDPGJyPgogICAgICAgICAgICAgICAgICDCoCDCoCDC oCDCoCBrZXkgdXNhZ2U6CiAgICAgICAgICAgICAgICAgIGRpZ2l0YWxTaWduYXR1cmUsbm9uUmVw dWRpYXRpb24sa2V5RW5jaXBoZXJtZW50LGRhdGFFbmNpcGhlcm1lbnQ8YnI+CiAgICAgICAgICAg ICAgICAgIMKgIMKgIMKgIMKgIGVrdToKICAgICAgICAgICAgICAgICAgaWQta3Atc2VydmVyQXV0 aCxpZC1rcC1jbGllbnRBdXRoLGlkLWtwLWVtYWlsUHJvdGVjdGlvbjxicj4KICAgICAgICAgICAg ICAgICAgwqAgwqAgwqAgwqAgcHJlLXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgL3Vz ci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkPGJyPgogICAgICAgICAgICAgICAg ICDCoCDCoCDCoCDCoCBwb3N0LXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgL3Vzci9s aWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2NlcnQgIlNlcnZlci1DZXJ0CiAgICAgICAg ICAgICAgICAgIGNlcnQtcGtpLWNhIjxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAg dHJhY2s6IHllczxicj4KICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgYXV0by1yZW5ldzog eWVzPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2 PgogICAgICAgICAgICAgICAgPGRpdj5JIHN0aWxsIGhhdmUgYSB3b3JraW5nIHJlcGxpY2EsIHNv IEkgY291bGQganVzdAogICAgICAgICAgICAgICAgICByZWluc3RhbGwgYW5kIGhhdmUgYSB3b3Jr aW5nIHNldCBpbiBhIGNvdXBsZSBvZgogICAgICAgICAgICAgICAgICBtaW51dGVzLCBidXQgSSB3 b3VsZCBsaWtlIHRvIGZpbmQgb3V0IHdoYXQgaGFzIGdvbmUKICAgICAgICAgICAgICAgICAgd3Jv bmcuPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2 PgogICAgICAgICAgICAgICAgPGRpdj5UaGUgc3lzdGVtcyBhcmUgcnVubmluZwogICAgICAgICAg ICAgICAgICBpcGEtc2VydmVyLTQuNi41LTExLmVsNy5jZW50b3MuMy54ODZfNjQ8L2Rpdj4KICAg ICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAg ICAgICA8ZGl2PkFueSBoZWxwIHdlbGNvbWUgOy0pPC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2 Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgPGRpdj5UaGFua3Ms PC9kaXY+CiAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgIDwvZGl2Pgog ICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgICAgPGRpdiBkaXI9Imx0ciIgY2xh c3M9ImdtYWlsX3NpZ25hdHVyZSIKICAgICAgICAgICAgICAgICAgICBkYXRhLXNtYXJ0bWFpbD0i Z21haWxfc2lnbmF0dXJlIj4tLTxicj4KICAgICAgICAgICAgICAgICAgICBHcm9ldGVuLDxicj4K ICAgICAgICAgICAgICAgICAgICBuYXR4bzwvZGl2PgogICAgICAgICAgICAgICAgPC9kaXY+CiAg ICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPC9kaXY+CiAg ICAgICAgPC9kaXY+CiAgICAgIDwvZGl2PgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFz cz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxwcmUgY2xhc3M9Im1v ei1xdW90ZS1wcmUiIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10 eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgpU byB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJi cmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4K RmVkb3JhIENvZGUgb2YgQ29uZHVjdDogPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0iaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3JnL2VuLVVTL3Byb2plY3QvY29kZS1v Zi1jb25kdWN0LyI+aHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3JnL2VuLVVTL3Byb2plY3Qv Y29kZS1vZi1jb25kdWN0LzwvYT4KTGlzdCBHdWlkZWxpbmVzOiA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGlu Z19saXN0X2d1aWRlbGluZXMiPmh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5n X2xpc3RfZ3VpZGVsaW5lczwvYT4KTGlzdCBBcmNoaXZlczogPGEgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FyY2hpdmVz L2xpc3QvZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5odHRwczovL2xpc3Rz LmZlZG9yYWhvc3RlZC5vcmcvYXJjaGl2ZXMvbGlzdC9mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9k eT4KPC9odG1sPgo= --===============2487156464546001081==-- From keesb at ghs.com Thu Oct 1 15:36:52 2020 Content-Type: multipart/mixed; boundary="===============2119800377077249232==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 17:36:36 +0200 Message-ID: In-Reply-To: 44800c46-b135-9e79-d223-b96b86b731dc@ghs.com --===============2119800377077249232== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On the non-renewal masters there are 4 certificates that show "ca-error: In= valid cookie: u''" Request ID '20181127141739': =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' =C2=A0=C2=A0=C2=A0 subject: CN=3DIPA RA,O=3DGHS.NL =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:48 UTC Request ID '20181127141749': =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Audit,O=3DGHS.NL =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC Request ID '20181127141750': =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' =C2=A0=C2=A0=C2=A0 subject: CN=3DOCSP Subsystem,O=3DGHS.NL =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:31 UTC Request ID '20181127141751': =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Subsystem,O=3DGHS.NL =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC All of them are "system certificates" that are already renewed on the CA Re= newal Master. How do I get these renewed? I don't like to run whatever command, because I'm too scared to break the system for good. -- Kees On 01-10-2020 16:07, Kees Bakker via FreeIPA-users wrote: > This now happened to me too. > > The solution in this thread was to copy /var/lib/ipa/ra-agent.* to the fa= iling system. > After that I was able to restart (ipactl restart). > > What remains a mystery is **why** this happened. > > In my case, we have three CA masters, one is the CA renewal master (of co= urse). > Two days ago, linge, the renewal master, renewed a few certificates. Here= is a summary > of journalctl. > > [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' > sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file "/var= /lib/ipa/ra-agent.pem" will not be valid after 20201026201548. > sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named "auditS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" will not be valid after 20201026201532. > sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named "ocspSi= gningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/= pki-tomcat/alias" will not be valid after 20201026201531. > sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named "subsys= temCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pk= i-tomcat/alias" will not be valid after 20201026201532. > sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: dog= tag-ipa-renew-agent returned 0 > sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named "subsys= temCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pk= i-tomcat/alias" issued by CA and saved. > sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: dog= tag-ipa-renew-agent returned 0 > sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named "auditS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" issued by CA and saved. > sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: dog= tag-ipa-renew-agent returned 0 > sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file "/var= /lib/ipa/ra-agent.pem" issued by CA and saved. > sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: dog= tag-ipa-renew-agent returned 5 > sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: For= warding request to dogtag-ipa-renew-agent > sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: dog= tag-ipa-renew-agent returned 0 > sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named "ocspSi= gningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/= pki-tomcat/alias" issued by CA and saved. > > Today (two days later) I looked at the two other CA masters to see if the= se same certificates were OK. > I saw this: > > [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' > sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in file "/= var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. > sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named "aud= itSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/= pki/pki-tomcat/alias" will not be valid after 20201026201532. > sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named "ocs= pSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/p= ki/pki-tomcat/alias" will not be valid after 20201026201531. > sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named "sub= systemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" will not be valid after 20201026201532. > sep 29 11:22:15 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214487]: = Updated certificate not available > sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214488]: = Updated certificate not available > sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214496]: = Updated certificate not available > sep 29 11:22:17 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214505]: = Updated certificate not available > sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 [428]= Invalid cookie: u'' > sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 [428]= Invalid cookie: u'' > sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 [428]= Invalid cookie: u'' > sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 [428]= Invalid cookie: u'' > > [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' > sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file "/va= r/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. > sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named "audit= SigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" will not be valid after 20201026201532. > sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named "ocspS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" will not be valid after 20201026201531. > sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named "subsy= stemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" will not be valid after 20201026201532. > sep 29 13:00:57 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166389]: Up= dated certificate not available > sep 29 13:00:58 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166392]: Up= dated certificate not available > sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166391]: Up= dated certificate not available > sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166390]: Up= dated certificate not available > sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 [9797= 6] Invalid cookie: u'' > sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 [9797= 6] Invalid cookie: u'' > sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 [9797= 6] Invalid cookie: u'' > sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 [9797= 6] Invalid cookie: u'' > > So, both non-renewal masters started tried dogtag-ipa-ca-renew-agent-subm= it, and both failed with > "Updated certificate not available" > > Next, I did a "yum update", hoping to get rid of the invalid cookie. This= updated ipa from 4.6.5 to 4.6.6 > The update failed because /var/lib/ipa/ra-agent.pem still had the old cer= tificate. > > After manually copying ra-agent.* to the failing system I was able to res= tart ipa. However, I suspect > that things are still not right. Too many certs on the non-renewal master= s still need to be renewed. > I'm digging further ... > -- Kees > > On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: >> hi, >> >> after patching our centos 7 hosts to the latest version today, one of th= e two replicas is having trouble. >> >> [root(a)kdc2 ~]# ipactl status >> Directory Service: RUNNING >> krb5kdc Service: STOPPED >> kadmin Service: STOPPED >> named Service: STOPPED >> httpd Service: RUNNING >> ipa-custodia Service: STOPPED >> ntpd Service: STOPPED >> pki-tomcatd Service: RUNNING >> smb Service: STOPPED >> winbind Service: STOPPED >> ipa-otpd Service: STOPPED >> ipa-dnskeysyncd Service: STOPPED >> ipa: INFO: The ipactl command was successful >> >> and after digging in the logs I come across this in /var/log/ipaupgrade.= log: >> >> 2019-11-20T18:18:29Z DEBUG stderr=3D >> 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration a= lready up-to-date >> 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and va= lidation] >> 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgra= de/sysupgrade.state' >> 2019-11-20T18:18:31Z INFO PKIX already enabled >> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] >> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight CA= s] >> 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in = Dogtag database] >> 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740162547= 472 >> 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAI= N-IT.socket from SchemaCache >> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi= ://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D >> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_1397401625= 47472 >> 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] >> 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] >> 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] >> 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_139740160021= 648 >> 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMAI= N-IT.socket from SchemaCache >> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldapi= ://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D >> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_1397401600= 21648 >> 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca/= rest/account/login >> 2019-11-20T18:18:31Z DEBUG request body '' >> 2019-11-20T18:18:31Z DEBUG response status 401 >> 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 >> Cache-Control: private >> Expires: Thu, 01 Jan 1970 01:00:00 CET >> WWW-Authenticate: Basic realm=3D"Certificate Authority" >> Content-Type: text/html;charset=3Dutf-8 >> Content-Language: en >> Content-Length: 951 >> Date: Wed, 20 Nov 2019 18:18:31 GMT >> >> 2019-11-20T18:18:31Z DEBUG response body 'Apache Tomc= at/7.0.76 - Error report

HTTP Status 401 - =


type Status report

= message

description This request requires HT= TP authentication.


Apache >> Tomcat/7.0.76

' >> 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/i= paupgrade.log and run command ipa-server-upgrade manually. >> 2019-11-20T18:18:31Z DEBUG =C2=A0 File "/usr/lib/python2.7/site-packages= /ipapython/admintool.py", line 178, in execute >> =C2=A0 =C2=A0 return_value =3D self.run() >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_serv= er_upgrade.py", line 54, in run >> =C2=A0 =C2=A0 server.upgrade() >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/u= pgrade.py", line 2146, in upgrade >> =C2=A0 =C2=A0 upgrade_configuration() >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/u= pgrade.py", line 2018, in upgrade_configuration >> =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/u= pgrade.py", line 406, in ca_enable_ldap_profile_subsystem >> =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstan= ce.py", line 2027, in migrate_profiles_to_ldap >> =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwrite= =3DFalse) >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstan= ce.py", line 2033, in _create_dogtag_profile >> =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: >> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.p= y", line 1315, in __enter__ >> =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to aut= henticate to CA REST API')) >> >> 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, except= ion: RemoteRetrieveError: Failed to authenticate to CA REST API >> 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.lo= g for details: >> RemoteRetrieveError: Failed to authenticate to CA REST API >> >> >> In this kdc I see these errors in getcert list: >> >> Request ID '20190220182014': >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/= etc/pki/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token= =3D'NSS Certificate DB',pin set >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/p= ki/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token=3D'NSS= Certificate DB' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert "auditSigningCert cert-pki-ca" >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >> Request ID '20190220182015': >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/= etc/pki/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token=3D= 'NSS Certificate DB',pin set >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/p= ki/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token=3D'NSS = Certificate DB' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.IT= >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,k= eyCertSign,cRLSign >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert "ocspSigningCert cert-pki-ca" >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >> Request ID '20190220182016': >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/= etc/pki/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'N= SS Certificate DB',pin set >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/p= ki/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'NSS Ce= rtificate DB' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT <= http://L.DOMAIN.IT> >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,k= eyEncipherment,dataEncipherment >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert "subsystemCert cert-pki-ca" >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >> >> Request ID '20190220182018': >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D'/v= ar/lib/ipa/ra-agent.key' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var/li= b/ipa/ra-agent.pem' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,k= eyEncipherment,dataEncipherment >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/renew_ra_cert_pre >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ra_cert >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >> Request ID '20190220182019': >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at "https://kdc2.l.domain.i= t:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'/= etc/pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS= Certificate DB',pin set >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/p= ki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Cert= ificate DB' >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DOM= AIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it ,O=3DL.DOMAIN.IT >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,k= eyEncipherment,dataEncipherment >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id-kp= -emailProtection >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmonge= r/stop_pkicad >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmong= er/renew_ca_cert "Server-Cert cert-pki-ca" >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >> >> I still have a working replica, so I could just reinstall and have a wor= king set in a couple of minutes, but I would like to find out what has gone= wrong. >> >> The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 >> >> Any help welcome ;-) >> >> Thanks, >> >> -- >> Groeten, >> natxo >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org --===============2119800377077249232== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CiAgPC9oZWFkPgogIDxib2R5PgogICAgT24g dGhlIG5vbi1yZW5ld2FsIG1hc3RlcnMgdGhlcmUgYXJlIDQgY2VydGlmaWNhdGVzIHRoYXQgc2hv dwogICAgImNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnIjxicj4KICAgIDxicj4KICAgIFJl cXVlc3QgSUQgJzIwMTgxMTI3MTQxNzM5Jzo8YnI+CiAgICDCoMKgwqAgY2EtZXJyb3I6IEludmFs aWQgY29va2llOiB1Jyc8YnI+CiAgICDCoMKgwqAgc3ViamVjdDogQ049SVBBIFJBLE89R0hTLk5M PGJyPgogICAgwqDCoMKgIGV4cGlyZXM6IDIwMjAtMTAtMjYgMjA6MTU6NDggVVRDPGJyPgogICAg UmVxdWVzdCBJRCAnMjAxODExMjcxNDE3NDknOjxicj4KICAgIMKgwqDCoCBjYS1lcnJvcjogSW52 YWxpZCBjb29raWU6IHUnJzxicj4KICAgIMKgwqDCoCBzdWJqZWN0OiBDTj1DQSBBdWRpdCxPPUdI Uy5OTDxicj4KICAgIMKgwqDCoCBleHBpcmVzOiAyMDIwLTEwLTI2IDIwOjE1OjMyIFVUQzxicj4K ICAgIFJlcXVlc3QgSUQgJzIwMTgxMTI3MTQxNzUwJzo8YnI+CiAgICDCoMKgwqAgY2EtZXJyb3I6 IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICDCoMKgwqAgc3ViamVjdDogQ049T0NTUCBTdWJz eXN0ZW0sTz1HSFMuTkw8YnI+CiAgICDCoMKgwqAgZXhwaXJlczogMjAyMC0xMC0yNiAyMDoxNToz MSBVVEM8YnI+CiAgICBSZXF1ZXN0IElEICcyMDE4MTEyNzE0MTc1MSc6PGJyPgogICAgwqDCoMKg IGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgwqDCoMKgIHN1YmplY3Q6IENO PUNBIFN1YnN5c3RlbSxPPUdIUy5OTDxicj4KICAgIMKgwqDCoCBleHBpcmVzOiAyMDIwLTEwLTI2 IDIwOjE1OjMyIFVUQzxicj4KICAgIDxicj4KICAgIEFsbCBvZiB0aGVtIGFyZSAic3lzdGVtIGNl cnRpZmljYXRlcyIgdGhhdCBhcmUgYWxyZWFkeSByZW5ld2VkIG9uCiAgICB0aGUgQ0EgUmVuZXdh bCBNYXN0ZXIuPGJyPgogICAgPGJyPgogICAgSG93IGRvIEkgZ2V0IHRoZXNlIHJlbmV3ZWQ/IEkg ZG9uJ3QgbGlrZSB0byBydW4gd2hhdGV2ZXIgY29tbWFuZCwKICAgIGJlY2F1c2U8YnI+CiAgICBJ J20gdG9vIHNjYXJlZCB0byBicmVhayB0aGUgc3lzdGVtIGZvciBnb29kLjxicj4KICAgIC0tIEtl ZXM8YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgi Pk9uIDAxLTEwLTIwMjAgMTY6MDcsIEtlZXMgQmFra2VyIHZpYQogICAgICBGcmVlSVBBLXVzZXJz IHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAg Y2l0ZT0ibWlkOjQ0ODAwYzQ2LWIxMzUtOWU3OS1kMjIzLWI5NmI4NmI3MzFkY0BnaHMuY29tIj4K ICAgICAgPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7 IGNoYXJzZXQ9VVRGLTgiPgogICAgICBUaGlzIG5vdyBoYXBwZW5lZCB0byBtZSB0b28uPGJyPgog ICAgICA8ZGl2PgogICAgICAgIDxicj4KICAgICAgICBUaGUgc29sdXRpb24gaW4gdGhpcyB0aHJl YWQgd2FzIHRvIGNvcHkgL3Zhci9saWIvaXBhL3JhLWFnZW50LioKICAgICAgICB0byB0aGUgZmFp bGluZyBzeXN0ZW0uPGJyPgogICAgICAgIEFmdGVyIHRoYXQgSSB3YXMgYWJsZSB0byByZXN0YXJ0 IChpcGFjdGwgcmVzdGFydCkuPGJyPgogICAgICAgIDxicj4KICAgICAgICBXaGF0IHJlbWFpbnMg YSBteXN0ZXJ5IGlzICoqd2h5KiogdGhpcyBoYXBwZW5lZC48YnI+CiAgICAgICAgPGJyPgogICAg ICAgIEluIG15IGNhc2UsIHdlIGhhdmUgdGhyZWUgQ0EgbWFzdGVycywgb25lIGlzIHRoZSBDQSBy ZW5ld2FsCiAgICAgICAgbWFzdGVyIChvZiBjb3Vyc2UpLjxicj4KICAgICAgICBUd28gZGF5cyBh Z28sIGxpbmdlLCB0aGUgcmVuZXdhbCBtYXN0ZXIsIHJlbmV3ZWQgYSBmZXcKICAgICAgICBjZXJ0 aWZpY2F0ZXMuIEhlcmUgaXMgYSBzdW1tYXJ5PGJyPgogICAgICAgIG9mIGpvdXJuYWxjdGwuPGJy PgogICAgICAgIDxicj4KICAgICAgICBbcm9vdEBsaW5nZSB+XSMgam91cm5hbGN0bCB8IGdyZXAg LUUgJ2NlcnRtb25nZXJ8ZG9ndGFnJzxicj4KICAgICAgICBzZXAgMjkgMTM6Mzk6MDAgbGluZ2Uu Z2hzLm5sIGNlcnRtb25nZXJbMTYyODhdOiBDZXJ0aWZpY2F0ZSBpbgogICAgICAgIGZpbGUgIi92 YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0iIHdpbGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAgICAg MjAyMDEwMjYyMDE1NDguPGJyPgogICAgICAgIHNlcCAyOSAxMzozOTowMCBsaW5nZS5naHMubmwg Y2VydG1vbmdlclsxNjI4OV06IENlcnRpZmljYXRlCiAgICAgICAgbmFtZWQgImF1ZGl0U2lnbmlu Z0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICBEQiIg aW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMiIHdpbGwgbm90IGJlIHZhbGlk CiAgICAgICAgYWZ0ZXIgMjAyMDEwMjYyMDE1MzIuPGJyPgogICAgICAgIHNlcCAyOSAxMzozOTow MCBsaW5nZS5naHMubmwgY2VydG1vbmdlclsxNjI5MF06IENlcnRpZmljYXRlCiAgICAgICAgbmFt ZWQgIm9jc3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0 ZQogICAgICAgIERCIiBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2ls bCBub3QgYmUgdmFsaWQKICAgICAgICBhZnRlciAyMDIwMTAyNjIwMTUzMS48YnI+CiAgICAgICAg c2VwIDI5IDEzOjM5OjAwIGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2MjkxXTogQ2VydGlmaWNh dGUKICAgICAgICBuYW1lZCAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5T UyBDZXJ0aWZpY2F0ZSBEQiIKICAgICAgICBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyIgd2lsbCBub3QgYmUgdmFsaWQgYWZ0ZXIKICAgICAgICAyMDIwMTAyNjIwMTUzMi48 YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjAyIGxpbmdlLmdocy5ubAogICAgICAgIGRvZ3RhZy1p cGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2Mjk4XTogRm9yd2FyZGluZyByZXF1ZXN0IHRvCiAg ICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4KICAgICAgICBzZXAgMjkgMTM6Mzk6MDMg bGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYy OThdOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAgICAgICAgcmV0dXJuZWQgNTxicj4KICAgICAg ICBzZXAgMjkgMTM6Mzk6MDUgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5l dy1hZ2VudC1zdWJtaXRbMTYzMzldOiBGb3J3YXJkaW5nIHJlcXVlc3QgdG8KICAgICAgICBkb2d0 YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAgIHNlcCAyOSAxMzozOTowNiBsaW5nZS5naHMu bmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjMzOV06IGRvZ3Rh Zy1pcGEtcmVuZXctYWdlbnQKICAgICAgICByZXR1cm5lZCA1PGJyPgogICAgICAgIHNlcCAyOSAx MzozOTowOCBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1 Ym1pdFsxNjM1NF06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgICAgIGRvZ3RhZy1pcGEtcmVu ZXctYWdlbnQ8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjA4IGxpbmdlLmdocy5ubAogICAgICAg IGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2MzU0XTogZG9ndGFnLWlwYS1yZW5l dy1hZ2VudAogICAgICAgIHJldHVybmVkIDA8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjIwIGxp bmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NzIwXTogQ2VydGlmaWNhdGUKICAgICAgICBuYW1lZCAi c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIK ICAgICAgICBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgaXNzdWVkIGJ5 IENBIGFuZCBzYXZlZC48YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjIyIGxpbmdlLmdocy5ubAog ICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2Mjk3XTogRm9yd2FyZGlu ZyByZXF1ZXN0IHRvCiAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4KICAgICAgICBz ZXAgMjkgMTM6Mzk6MjMgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1h Z2VudC1zdWJtaXRbMTYyOTddOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAgICAgICAgcmV0dXJu ZWQgNTxicj4KICAgICAgICBzZXAgMjkgMTM6Mzk6MjUgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9n dGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTY3MjZdOiBGb3J3YXJkaW5nIHJlcXVlc3Qg dG8KICAgICAgICBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAgIHNlcCAyOSAxMzoz OToyNSBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1p dFsxNjcyNl06IGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQKICAgICAgICByZXR1cm5lZCA1PGJyPgog ICAgICAgIHNlcCAyOSAxMzozOToyNyBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNh LXJlbmV3LWFnZW50LXN1Ym1pdFsxNjc0MV06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgICAg IGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjI3IGxpbmdl Lmdocy5ubAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2NzQxXTog ZG9ndGFnLWlwYS1yZW5ldy1hZ2VudAogICAgICAgIHJldHVybmVkIDA8YnI+CiAgICAgICAgc2Vw IDI5IDEzOjM5OjM5IGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE3MTA2XTogQ2VydGlmaWNhdGUK ICAgICAgICBuYW1lZCAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5T UyBDZXJ0aWZpY2F0ZQogICAgICAgIERCIiBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyIgaXNzdWVkIGJ5IENBIGFuZAogICAgICAgIHNhdmVkLjxicj4KICAgICAgICBzZXAg MjkgMTM6Mzk6NDIgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2Vu dC1zdWJtaXRbMTYyOTZdOiBGb3J3YXJkaW5nIHJlcXVlc3QgdG8KICAgICAgICBkb2d0YWctaXBh LXJlbmV3LWFnZW50PGJyPgogICAgICAgIHNlcCAyOSAxMzozOTo0MyBsaW5nZS5naHMubmwKICAg ICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5Nl06IGRvZ3RhZy1pcGEt cmVuZXctYWdlbnQKICAgICAgICByZXR1cm5lZCA1PGJyPgogICAgICAgIHNlcCAyOSAxMzozOTo0 NCBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsx NzExMl06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdl bnQ8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjQ1IGxpbmdlLmdocy5ubAogICAgICAgIGRvZ3Rh Zy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTEyXTogZG9ndGFnLWlwYS1yZW5ldy1hZ2Vu dAogICAgICAgIHJldHVybmVkIDU8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjQ3IGxpbmdlLmdo cy5ubAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTI2XTogRm9y d2FyZGluZyByZXF1ZXN0IHRvCiAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxicj4KICAg ICAgICBzZXAgMjkgMTM6Mzk6NDcgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlwYS1jYS1y ZW5ldy1hZ2VudC1zdWJtaXRbMTcxMjZdOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAgICAgICAg cmV0dXJuZWQgMDxicj4KICAgICAgICBzZXAgMjkgMTM6Mzk6NDkgbGluZ2UuZ2hzLm5sIGNlcnRt b25nZXJbMTcxNTZdOiBDZXJ0aWZpY2F0ZSBpbgogICAgICAgIGZpbGUgIi92YXIvbGliL2lwYS9y YS1hZ2VudC5wZW0iIGlzc3VlZCBieSBDQSBhbmQgc2F2ZWQuPGJyPgogICAgICAgIHNlcCAyOSAx MzozOTo1MiBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1 Ym1pdFsxNjI5OV06IEZvcndhcmRpbmcgcmVxdWVzdCB0bwogICAgICAgIGRvZ3RhZy1pcGEtcmVu ZXctYWdlbnQ8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjUzIGxpbmdlLmdocy5ubAogICAgICAg IGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2Mjk5XTogZG9ndGFnLWlwYS1yZW5l dy1hZ2VudAogICAgICAgIHJldHVybmVkIDU8YnI+CiAgICAgICAgc2VwIDI5IDEzOjM5OjU0IGxp bmdlLmdocy5ubAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTYy XTogRm9yd2FyZGluZyByZXF1ZXN0IHRvCiAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxi cj4KICAgICAgICBzZXAgMjkgMTM6Mzk6NTUgbGluZ2UuZ2hzLm5sCiAgICAgICAgZG9ndGFnLWlw YS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTcxNjJdOiBkb2d0YWctaXBhLXJlbmV3LWFnZW50CiAg ICAgICAgcmV0dXJuZWQgNTxicj4KICAgICAgICBzZXAgMjkgMTM6Mzk6NTcgbGluZ2UuZ2hzLm5s CiAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTcxNzddOiBGb3J3YXJk aW5nIHJlcXVlc3QgdG8KICAgICAgICBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAg IHNlcCAyOSAxMzozOTo1NyBsaW5nZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3 LWFnZW50LXN1Ym1pdFsxNzE3N106IGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQKICAgICAgICByZXR1 cm5lZCAwPGJyPgogICAgICAgIHNlcCAyOSAxMzo0MDowNSBsaW5nZS5naHMubmwgY2VydG1vbmdl clsxNzU0MF06IENlcnRpZmljYXRlCiAgICAgICAgbmFtZWQgIm9jc3BTaWduaW5nQ2VydCBjZXJ0 LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgIERCIiBpbiBkYXRhYmFz ZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgaXNzdWVkIGJ5IENBIGFuZAogICAgICAgIHNh dmVkLjxicj4KICAgICAgICA8YnI+CiAgICAgICAgVG9kYXkgKHR3byBkYXlzIGxhdGVyKSBJIGxv b2tlZCBhdCB0aGUgdHdvIG90aGVyIENBIG1hc3RlcnMgdG8KICAgICAgICBzZWUgaWYgdGhlc2Ug c2FtZSBjZXJ0aWZpY2F0ZXMgd2VyZSBPSy48YnI+CiAgICAgICAgSSBzYXcgdGhpczo8YnI+CiAg ICAgICAgPGJyPgogICAgICAgIFtyb290QGlwYXJlcDMgfl0jIGpvdXJuYWxjdGwgfCBncmVwIC1F ICdjZXJ0bW9uZ2VyfGRvZ3RhZyc8YnI+CiAgICAgICAgc2VwIDI5IDExOjIyOjEzIGlwYXJlcDMu Z2hzLm5sIGNlcnRtb25nZXJbMjE0NDc5XTogQ2VydGlmaWNhdGUKICAgICAgICBpbiBmaWxlICIv dmFyL2xpYi9pcGEvcmEtYWdlbnQucGVtIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAgICAg IDIwMjAxMDI2MjAxNTQ4Ljxicj4KICAgICAgICBzZXAgMjkgMTE6MjI6MTMgaXBhcmVwMy5naHMu bmwgY2VydG1vbmdlclsyMTQ0ODBdOiBDZXJ0aWZpY2F0ZQogICAgICAgIG5hbWVkICJhdWRpdFNp Z25pbmdDZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTIENlcnRpZmljYXRlCiAgICAgICAg REIiIGluIGRhdGFiYXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIiB3aWxsIG5vdCBiZSB2 YWxpZAogICAgICAgIGFmdGVyIDIwMjAxMDI2MjAxNTMyLjxicj4KICAgICAgICBzZXAgMjkgMTE6 MjI6MTMgaXBhcmVwMy5naHMubmwgY2VydG1vbmdlclsyMTQ0ODFdOiBDZXJ0aWZpY2F0ZQogICAg ICAgIG5hbWVkICJvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1MgQ2Vy dGlmaWNhdGUKICAgICAgICBEQiIgaW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxp YXMiIHdpbGwgbm90IGJlIHZhbGlkCiAgICAgICAgYWZ0ZXIgMjAyMDEwMjYyMDE1MzEuPGJyPgog ICAgICAgIHNlcCAyOSAxMToyMjoxMyBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzIxNDQ4Ml06 IENlcnRpZmljYXRlCiAgICAgICAgbmFtZWQgInN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIGlu IHRva2VuICJOU1MgQ2VydGlmaWNhdGUgREIiCiAgICAgICAgaW4gZGF0YWJhc2UgIi9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMiIHdpbGwgbm90IGJlIHZhbGlkIGFmdGVyCiAgICAgICAgMjAyMDEw MjYyMDE1MzIuPGJyPgogICAgICAgIHNlcCAyOSAxMToyMjoxNSBpcGFyZXAzLmdocy5ubAogICAg ICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzIxNDQ4N106IFVwZGF0ZWQgY2Vy dGlmaWNhdGUKICAgICAgICBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgIHNlcCAyOSAxMToyMjox NiBpcGFyZXAzLmdocy5ubAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0 WzIxNDQ4OF06IFVwZGF0ZWQgY2VydGlmaWNhdGUKICAgICAgICBub3QgYXZhaWxhYmxlPGJyPgog ICAgICAgIHNlcCAyOSAxMToyMjoxNiBpcGFyZXAzLmdocy5ubAogICAgICAgIGRvZ3RhZy1pcGEt Y2EtcmVuZXctYWdlbnQtc3VibWl0WzIxNDQ5Nl06IFVwZGF0ZWQgY2VydGlmaWNhdGUKICAgICAg ICBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgIHNlcCAyOSAxMToyMjoxNyBpcGFyZXAzLmdocy5u bAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzIxNDUwNV06IFVwZGF0 ZWQgY2VydGlmaWNhdGUKICAgICAgICBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgIHNlcCAyOSAx OToyMjoxOCBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkKICAgICAg ICAxOToyMjoxOCBbNDI4XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgIHNlcCAyOSAx OToyMjoxOSBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkKICAgICAg ICAxOToyMjoxOSBbNDI4XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgIHNlcCAyOSAx OToyMjoyMCBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkKICAgICAg ICAxOToyMjoyMCBbNDI4XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgIHNlcCAyOSAx OToyMjoyOSBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkKICAgICAg ICAxOToyMjoyOSBbNDI4XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgIDxicj4KICAg ICAgICBbcm9vdEByb3R0ZSB+XSMgam91cm5hbGN0bCB8IGdyZXAgLUUgJ2NlcnRtb25nZXJ8ZG9n dGFnJzxicj4KICAgICAgICBzZXAgMjkgMTM6MDA6NTUgcm90dGUuZ2hzLm5sIGNlcnRtb25nZXJb MTY2MzgxXTogQ2VydGlmaWNhdGUgaW4KICAgICAgICBmaWxlICIvdmFyL2xpYi9pcGEvcmEtYWdl bnQucGVtIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAgICAgIDIwMjAxMDI2MjAxNTQ4Ljxi cj4KICAgICAgICBzZXAgMjkgMTM6MDA6NTUgcm90dGUuZ2hzLm5sIGNlcnRtb25nZXJbMTY2Mzgy XTogQ2VydGlmaWNhdGUKICAgICAgICBuYW1lZCAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1j YSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgIERCIiBpbiBkYXRhYmFzZSAiL2V0 Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2lsbCBub3QgYmUgdmFsaWQKICAgICAgICBhZnRlciAy MDIwMTAyNjIwMTUzMi48YnI+CiAgICAgICAgc2VwIDI5IDEzOjAwOjU1IHJvdHRlLmdocy5ubCBj ZXJ0bW9uZ2VyWzE2NjM4M106IENlcnRpZmljYXRlCiAgICAgICAgbmFtZWQgIm9jc3BTaWduaW5n Q2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgIERCIiBp biBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2lsbCBub3QgYmUgdmFsaWQK ICAgICAgICBhZnRlciAyMDIwMTAyNjIwMTUzMS48YnI+CiAgICAgICAgc2VwIDI5IDEzOjAwOjU1 IHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NjM4NF06IENlcnRpZmljYXRlCiAgICAgICAgbmFt ZWQgInN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuICJOU1MgQ2VydGlmaWNhdGUg REIiCiAgICAgICAgaW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMiIHdpbGwg bm90IGJlIHZhbGlkIGFmdGVyCiAgICAgICAgMjAyMDEwMjYyMDE1MzIuPGJyPgogICAgICAgIHNl cCAyOSAxMzowMDo1NyByb3R0ZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFn ZW50LXN1Ym1pdFsxNjYzODldOiBVcGRhdGVkIGNlcnRpZmljYXRlCiAgICAgICAgbm90IGF2YWls YWJsZTxicj4KICAgICAgICBzZXAgMjkgMTM6MDA6NTggcm90dGUuZ2hzLm5sCiAgICAgICAgZG9n dGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTY2MzkyXTogVXBkYXRlZCBjZXJ0aWZpY2F0 ZQogICAgICAgIG5vdCBhdmFpbGFibGU8YnI+CiAgICAgICAgc2VwIDI5IDEzOjAxOjA4IHJvdHRl Lmdocy5ubAogICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2NjM5MV06 IFVwZGF0ZWQgY2VydGlmaWNhdGUKICAgICAgICBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgIHNl cCAyOSAxMzowMTowOCByb3R0ZS5naHMubmwKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFn ZW50LXN1Ym1pdFsxNjYzOTBdOiBVcGRhdGVkIGNlcnRpZmljYXRlCiAgICAgICAgbm90IGF2YWls YWJsZTxicj4KICAgICAgICBzZXAgMjkgMjE6MDE6MDAgcm90dGUuZ2hzLm5sIGNlcnRtb25nZXJb OTc5NzZdOiAyMDIwLTA5LTI5CiAgICAgICAgMjE6MDE6MDAgWzk3OTc2XSBJbnZhbGlkIGNvb2tp ZTogdScnPGJyPgogICAgICAgIHNlcCAyOSAyMTowMTowMSByb3R0ZS5naHMubmwgY2VydG1vbmdl cls5Nzk3Nl06IDIwMjAtMDktMjkKICAgICAgICAyMTowMTowMSBbOTc5NzZdIEludmFsaWQgY29v a2llOiB1Jyc8YnI+CiAgICAgICAgc2VwIDI5IDIxOjAxOjEwIHJvdHRlLmdocy5ubCBjZXJ0bW9u Z2VyWzk3OTc2XTogMjAyMC0wOS0yOQogICAgICAgIDIxOjAxOjEwIFs5Nzk3Nl0gSW52YWxpZCBj b29raWU6IHUnJzxicj4KICAgICAgICBzZXAgMjkgMjE6MDE6MTEgcm90dGUuZ2hzLm5sIGNlcnRt b25nZXJbOTc5NzZdOiAyMDIwLTA5LTI5CiAgICAgICAgMjE6MDE6MTEgWzk3OTc2XSBJbnZhbGlk IGNvb2tpZTogdScnPGJyPgogICAgICAgIDxicj4KICAgICAgICBTbywgYm90aCBub24tcmVuZXdh bCBtYXN0ZXJzIHN0YXJ0ZWQgdHJpZWQKICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50 LXN1Ym1pdCwgYW5kIGJvdGggZmFpbGVkIHdpdGg8YnI+CiAgICAgICAgIlVwZGF0ZWQgY2VydGlm aWNhdGUgbm90IGF2YWlsYWJsZSI8YnI+CiAgICAgICAgPGJyPgogICAgICAgIE5leHQsIEkgZGlk IGEgInl1bSB1cGRhdGUiLCBob3BpbmcgdG8gZ2V0IHJpZCBvZiB0aGUgaW52YWxpZAogICAgICAg IGNvb2tpZS4gVGhpcyB1cGRhdGVkIGlwYSBmcm9tIDQuNi41IHRvIDQuNi42PGJyPgogICAgICAg IFRoZSB1cGRhdGUgZmFpbGVkIGJlY2F1c2UgL3Zhci9saWIvaXBhL3JhLWFnZW50LnBlbSBzdGls bCBoYWQKICAgICAgICB0aGUgb2xkIGNlcnRpZmljYXRlLjxicj4KICAgICAgICA8YnI+CiAgICAg ICAgQWZ0ZXIgbWFudWFsbHkgY29weWluZyByYS1hZ2VudC4qIHRvIHRoZSBmYWlsaW5nIHN5c3Rl bSBJIHdhcwogICAgICAgIGFibGUgdG8gcmVzdGFydCBpcGEuIEhvd2V2ZXIsIEkgc3VzcGVjdDxi cj4KICAgICAgICB0aGF0IHRoaW5ncyBhcmUgc3RpbGwgbm90IHJpZ2h0LiBUb28gbWFueSBjZXJ0 cyBvbiB0aGUKICAgICAgICBub24tcmVuZXdhbCBtYXN0ZXJzIHN0aWxsIG5lZWQgdG8gYmUgcmVu ZXdlZC48YnI+CiAgICAgICAgSSdtIGRpZ2dpbmcgZnVydGhlciAuLi48YnI+CiAgICAgICAgLS0g S2Vlczxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAyMC0xMS0yMDE5IDIwOjEzLCBOYXR4byBBc2Vuam8KICAgICAgICAgIHZpYSBGcmVlSVBB LXVzZXJzIHdyb3RlOjxicj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIgpjaXRlPSJtaWQ6Q0FIQkVKeldHTktIRUFPRFhqam5rNnZUeTJVc1FSblgxWnBKRm9w KzJMcD1mUkg4eEd3QG1haWwuZ21haWwuY29tIj4KICAgICAgICAgIDxkaXY+CiAgICAgICAgICAg IDxkaXYgZGlyPSJsdHIiPgogICAgICAgICAgICAgIDxkaXY+aGksPC9kaXY+CiAgICAgICAgICAg ICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGRpdj5hZnRl ciBwYXRjaGluZyBvdXIgY2VudG9zIDcgaG9zdHMgdG8gdGhlIGxhdGVzdAogICAgICAgICAgICAg ICAgdmVyc2lvbiB0b2RheSwgb25lIG9mIHRoZSB0d28gcmVwbGljYXMgaXMgaGF2aW5nCiAgICAg ICAgICAgICAgICB0cm91YmxlLjwvZGl2PgogICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAg ICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDxkaXY+W3Jvb3RAa2RjMiB+XSMgaXBhY3RsIHN0 YXR1czxicj4KICAgICAgICAgICAgICAgIERpcmVjdG9yeSBTZXJ2aWNlOiBSVU5OSU5HPGJyPgog ICAgICAgICAgICAgICAga3JiNWtkYyBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAg ICAga2FkbWluIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgICAgICBuYW1lZCBTZXJ2 aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAgICAgaHR0cGQgU2VydmljZTogUlVOTklORzxi cj4KICAgICAgICAgICAgICAgIGlwYS1jdXN0b2RpYSBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAg ICAgICAgICAgICAgbnRwZCBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAgICAgcGtp LXRvbWNhdGQgU2VydmljZTogUlVOTklORzxicj4KICAgICAgICAgICAgICAgIHNtYiBTZXJ2aWNl OiBTVE9QUEVEPGJyPgogICAgICAgICAgICAgICAgd2luYmluZCBTZXJ2aWNlOiBTVE9QUEVEPGJy PgogICAgICAgICAgICAgICAgaXBhLW90cGQgU2VydmljZTogU1RPUFBFRDxicj4KICAgICAgICAg ICAgICAgIGlwYS1kbnNrZXlzeW5jZCBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAg ICAgaXBhOiBJTkZPOiBUaGUgaXBhY3RsIGNvbW1hbmQgd2FzIHN1Y2Nlc3NmdWw8L2Rpdj4KICAg ICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICA8 ZGl2PmFuZCBhZnRlciBkaWdnaW5nIGluIHRoZSBsb2dzIEkgY29tZSBhY3Jvc3MgdGhpcyBpbgog ICAgICAgICAgICAgICAgL3Zhci9sb2cvaXBhdXBncmFkZS5sb2c6PGJyPgogICAgICAgICAgICAg IDwvZGl2PgogICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgIDwvZGl2PgogICAg ICAgICAgICAgIDxkaXY+MjAxOS0xMS0yMFQxODoxODoyOVogREVCVUcgc3RkZXJyPTxicj4KICAg ICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gQ2VydG1vbmdlciBjZXJ0aWZp Y2F0ZSByZW5ld2FsCiAgICAgICAgICAgICAgICBjb25maWd1cmF0aW9uIGFscmVhZHkgdXAtdG8t ZGF0ZTxicj4KICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIElORk8gW0VuYWJs ZSBQS0lYIGNlcnRpZmljYXRlIHBhdGgKICAgICAgICAgICAgICAgIGRpc2NvdmVyeSBhbmQgdmFs aWRhdGlvbl08YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBM b2FkaW5nIFN0YXRlRmlsZSBmcm9tCiAgICAgICAgICAgICAgICAnL3Zhci9saWIvaXBhL3N5c3Vw Z3JhZGUvc3lzdXBncmFkZS5zdGF0ZSc8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4 OjE4OjMxWiBJTkZPIFBLSVggYWxyZWFkeSBlbmFibGVkPGJyPgogICAgICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogSU5GTyBbQXV0aG9yaXppbmcgUkEgQWdlbnQgdG8KICAgICAgICAg ICAgICAgIG1vZGlmeSBwcm9maWxlc108YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4 OjE4OjMxWiBJTkZPIFtBdXRob3JpemluZyBSQSBBZ2VudCB0bwogICAgICAgICAgICAgICAgbWFu YWdlIGxpZ2h0d2VpZ2h0IENBc108YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4 OjMxWiBJTkZPIFtFbnN1cmluZyBMaWdodHdlaWdodCBDQXMKICAgICAgICAgICAgICAgIGNvbnRh aW5lciBleGlzdHMgaW4gRG9ndGFnIGRhdGFiYXNlXTxicj4KICAgICAgICAgICAgICAgIDIwMTkt MTEtMjBUMTg6MTg6MzFaIERFQlVHIENyZWF0ZWQgY29ubmVjdGlvbgogICAgICAgICAgICAgICAg Y29udGV4dC5sZGFwMl8xMzk3NDAxNjI1NDc0NzI8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTEx LTIwVDE4OjE4OjMxWiBERUJVRyBmbHVzaGluZwogICAgICAgICAgICAgICAgbGRhcGk6Ly8lMmZ2 YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQgZnJvbQogICAgICAgICAgICAgICAg U2NoZW1hQ2FjaGU8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJV RyByZXRyaWV2aW5nIHNjaGVtYSBmb3IKICAgICAgICAgICAgICAgIFNjaGVtYUNhY2hlCiAgICAg ICAgICAgICAgICB1cmw9bGRhcGk6Ly8lMmZ2YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5z b2NrZXQKICAgICAgICAgICAgICAgIGNvbm49Jmx0O2xkYXAubGRhcG9iamVjdC5TaW1wbGVMREFQ T2JqZWN0IGluc3RhbmNlIGF0CiAgICAgICAgICAgICAgICAweDdmMTdjYzI0YjYzOCZndDs8YnI+ CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBEZXN0cm95ZWQgY29u bmVjdGlvbgogICAgICAgICAgICAgICAgY29udGV4dC5sZGFwMl8xMzk3NDAxNjI1NDc0NzI8YnI+ CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtBZGRpbmcgZGVmYXVs dCBPQ1NQIFVSSQogICAgICAgICAgICAgICAgY29uZmlndXJhdGlvbl08YnI+CiAgICAgICAgICAg ICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtFbnN1cmluZyBDQSBpcyB1c2luZwogICAg ICAgICAgICAgICAgTERBUFByb2ZpbGVTdWJzeXN0ZW1dPGJyPgogICAgICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogSU5GTyBbTWlncmF0aW5nIGNlcnRpZmljYXRlCiAgICAgICAgICAg ICAgICBwcm9maWxlcyB0byBMREFQXTxicj4KICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6 MTg6MzFaIERFQlVHIENyZWF0ZWQgY29ubmVjdGlvbgogICAgICAgICAgICAgICAgY29udGV4dC5s ZGFwMl8xMzk3NDAxNjAwMjE2NDg8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4 OjMxWiBERUJVRyBmbHVzaGluZwogICAgICAgICAgICAgICAgbGRhcGk6Ly8lMmZ2YXIlMmZydW4l MmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQgZnJvbQogICAgICAgICAgICAgICAgU2NoZW1hQ2Fj aGU8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXRyaWV2 aW5nIHNjaGVtYSBmb3IKICAgICAgICAgICAgICAgIFNjaGVtYUNhY2hlCiAgICAgICAgICAgICAg ICB1cmw9bGRhcGk6Ly8lMmZ2YXIlMmZydW4lMmZzbGFwZC1MLURPTUFJTi1JVC5zb2NrZXQKICAg ICAgICAgICAgICAgIGNvbm49Jmx0O2xkYXAubGRhcG9iamVjdC5TaW1wbGVMREFQT2JqZWN0IGlu c3RhbmNlIGF0CiAgICAgICAgICAgICAgICAweDdmMTdjYzI4OWIwMCZndDs8YnI+CiAgICAgICAg ICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBEZXN0cm95ZWQgY29ubmVjdGlvbgog ICAgICAgICAgICAgICAgY29udGV4dC5sZGFwMl8xMzk3NDAxNjAwMjE2NDg8YnI+CiAgICAgICAg ICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXF1ZXN0IEdFVCA8YQogICAgICAg ICAgICAgICAgICBocmVmPSJodHRwczovL2tkYzIubC5kb21haW4uaXQ6ODQ0My9jYS9yZXN0L2Fj Y291bnQvbG9naW4iCiAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+CiAg ICAgICAgICAgICAgICAgIGh0dHBzOi8va2RjMi5sLmRvbWFpbi5pdDo4NDQzL2NhL3Jlc3QvYWNj b3VudC9sb2dpbjwvYT48YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBE RUJVRyByZXF1ZXN0IGJvZHkgJyc8YnI+CiAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4 OjMxWiBERUJVRyByZXNwb25zZSBzdGF0dXMgNDAxPGJyPgogICAgICAgICAgICAgICAgMjAxOS0x MS0yMFQxODoxODozMVogREVCVUcgcmVzcG9uc2UgaGVhZGVycyBTZXJ2ZXI6CiAgICAgICAgICAg ICAgICBBcGFjaGUtQ295b3RlLzEuMTxicj4KICAgICAgICAgICAgICAgIENhY2hlLUNvbnRyb2w6 IHByaXZhdGU8YnI+CiAgICAgICAgICAgICAgICBFeHBpcmVzOiBUaHUsIDAxIEphbiAxOTcwIDAx OjAwOjAwIENFVDxicj4KICAgICAgICAgICAgICAgIFdXVy1BdXRoZW50aWNhdGU6IEJhc2ljIHJl YWxtPSJDZXJ0aWZpY2F0ZSBBdXRob3JpdHkiPGJyPgogICAgICAgICAgICAgICAgQ29udGVudC1U eXBlOiB0ZXh0L2h0bWw7Y2hhcnNldD11dGYtODxicj4KICAgICAgICAgICAgICAgIENvbnRlbnQt TGFuZ3VhZ2U6IGVuPGJyPgogICAgICAgICAgICAgICAgQ29udGVudC1MZW5ndGg6IDk1MTxicj4K ICAgICAgICAgICAgICAgIERhdGU6IFdlZCwgMjAgTm92IDIwMTkgMTg6MTg6MzEgR01UPGJyPgog ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVog REVCVUcgcmVzcG9uc2UgYm9keQogICAgICAgICAgICAgICAgJyZsdDtodG1sJmd0OyZsdDtoZWFk Jmd0OyZsdDt0aXRsZSZndDtBcGFjaGUKICAgICAgICAgICAgICAgIFRvbWNhdC83LjAuNzYgLSBF cnJvcgogICAgICAgICAgICAgICAgcmVwb3J0Jmx0Oy90aXRsZSZndDsmbHQ7c3R5bGUmZ3Q7Jmx0 OyEtLUgxCntmb250LWZhbWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0ZTti YWNrZ3JvdW5kLWNvbG9yOiM1MjVENzY7Zm9udC1zaXplOjIycHg7fQogICAgICAgICAgICAgICAg SDIKe2ZvbnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOndoaXRlO2JhY2tn cm91bmQtY29sb3I6IzUyNUQ3Njtmb250LXNpemU6MTZweDt9CiAgICAgICAgICAgICAgICBIMwp7 Zm9udC1mYW1pbHk6VGFob21hLEFyaWFsLHNhbnMtc2VyaWY7Y29sb3I6d2hpdGU7YmFja2dyb3Vu ZC1jb2xvcjojNTI1RDc2O2ZvbnQtc2l6ZToxNHB4O30KICAgICAgICAgICAgICAgIEJPRFkKe2Zv bnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrO2JhY2tncm91bmQt Y29sb3I6d2hpdGU7fQogICAgICAgICAgICAgICAgQgp7Zm9udC1mYW1pbHk6VGFob21hLEFyaWFs LHNhbnMtc2VyaWY7Y29sb3I6d2hpdGU7YmFja2dyb3VuZC1jb2xvcjojNTI1RDc2O30KICAgICAg ICAgICAgICAgIFAKe2ZvbnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmO2JhY2tncm91 bmQ6d2hpdGU7Y29sb3I6YmxhY2s7Zm9udC1zaXplOjEycHg7fUEKICAgICAgICAgICAgICAgIHtj b2xvciA6IGJsYWNrO31BLm5hbWUge2NvbG9yIDogYmxhY2s7fUhSIHtjb2xvciA6CiAgICAgICAg ICAgICAgICAjNTI1RDc2O30tLSZndDsmbHQ7L3N0eWxlJmd0OwogICAgICAgICAgICAgICAgJmx0 Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyZsdDtoMSZndDtIVFRQIFN0YXR1cyA0MDEgLQogICAgICAg ICAgICAgICAgJmx0Oy9oMSZndDsmbHQ7SFIgc2l6ZT0iMSIKICAgICAgICAgICAgICAgIG5vc2hh ZGU9Im5vc2hhZGUiJmd0OyZsdDtwJmd0OyZsdDtiJmd0O3R5cGUmbHQ7L2ImZ3Q7CiAgICAgICAg ICAgICAgICBTdGF0dXMKICAgICAgICAgICAgICAgIHJlcG9ydCZsdDsvcCZndDsmbHQ7cCZndDsm bHQ7YiZndDttZXNzYWdlJmx0Oy9iJmd0OwogICAgICAgICAgICAgICAgJmx0O3UmZ3Q7Jmx0Oy91 Jmd0OyZsdDsvcCZndDsmbHQ7cCZndDsmbHQ7YiZndDtkZXNjcmlwdGlvbiZsdDsvYiZndDsKICAg ICAgICAgICAgICAgICZsdDt1Jmd0O1RoaXMgcmVxdWVzdCByZXF1aXJlcyBIVFRQCiAgICAgICAg ICAgICAgICBhdXRoZW50aWNhdGlvbi4mbHQ7L3UmZ3Q7Jmx0Oy9wJmd0OyZsdDtIUiBzaXplPSIx IgogICAgICAgICAgICAgICAgbm9zaGFkZT0ibm9zaGFkZSImZ3Q7Jmx0O2gzJmd0O0FwYWNoZQog ICAgICAgICAgICAgICAgVG9tY2F0LzcuMC43NiZsdDsvaDMmZ3Q7Jmx0Oy9ib2R5Jmd0OyZsdDsv aHRtbCZndDsnPGJyPgogICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogRVJST1Ig SVBBIHNlcnZlciB1cGdyYWRlIGZhaWxlZDoKICAgICAgICAgICAgICAgIEluc3BlY3QgL3Zhci9s b2cvaXBhdXBncmFkZS5sb2cgYW5kIHJ1biBjb21tYW5kCiAgICAgICAgICAgICAgICBpcGEtc2Vy dmVyLXVwZ3JhZGUgbWFudWFsbHkuPGJyPgogICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODox ODozMVogREVCVUcgwqAgRmlsZQogICAgICAgICAgICAgICAgIi91c3IvbGliL3B5dGhvbjIuNy9z aXRlLXBhY2thZ2VzL2lwYXB5dGhvbi9hZG1pbnRvb2wucHkiLAogICAgICAgICAgICAgICAgbGlu ZSAxNzgsIGluIGV4ZWN1dGU8YnI+CiAgICAgICAgICAgICAgICDCoCDCoCByZXR1cm5fdmFsdWUg PSBzZWxmLnJ1bigpPGJyPgogICAgICAgICAgICAgICAgwqAgRmlsZQoiL3Vzci9saWIvcHl0aG9u Mi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvaXBhX3NlcnZlcl91cGdyYWRlLnB5 IiwKICAgICAgICAgICAgICAgIGxpbmUgNTQsIGluIHJ1bjxicj4KICAgICAgICAgICAgICAgIMKg IMKgIHNlcnZlci51cGdyYWRlKCk8YnI+CiAgICAgICAgICAgICAgICDCoCBGaWxlCiAgICAgICAg ICAgICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3Rh bGwvc2VydmVyL3VwZ3JhZGUucHkiLAogICAgICAgICAgICAgICAgbGluZSAyMTQ2LCBpbiB1cGdy YWRlPGJyPgogICAgICAgICAgICAgICAgwqAgwqAgdXBncmFkZV9jb25maWd1cmF0aW9uKCk8YnI+ CiAgICAgICAgICAgICAgICDCoCBGaWxlCiAgICAgICAgICAgICAgICAiL3Vzci9saWIvcHl0aG9u Mi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvc2VydmVyL3VwZ3JhZGUucHkiLAog ICAgICAgICAgICAgICAgbGluZSAyMDE4LCBpbiB1cGdyYWRlX2NvbmZpZ3VyYXRpb248YnI+CiAg ICAgICAgICAgICAgICDCoCDCoCBjYV9lbmFibGVfbGRhcF9wcm9maWxlX3N1YnN5c3RlbShjYSk8 YnI+CiAgICAgICAgICAgICAgICDCoCBGaWxlCiAgICAgICAgICAgICAgICAiL3Vzci9saWIvcHl0 aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvc2VydmVyL3VwZ3JhZGUucHki LAogICAgICAgICAgICAgICAgbGluZSA0MDYsIGluIGNhX2VuYWJsZV9sZGFwX3Byb2ZpbGVfc3Vi c3lzdGVtPGJyPgogICAgICAgICAgICAgICAgwqAgwqAgY2FpbnN0YW5jZS5taWdyYXRlX3Byb2Zp bGVzX3RvX2xkYXAoKTxicj4KICAgICAgICAgICAgICAgIMKgIEZpbGUKICAgICAgICAgICAgICAg ICIvdXNyL2xpYi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9jYWlu c3RhbmNlLnB5IiwKICAgICAgICAgICAgICAgIGxpbmUgMjAyNywgaW4gbWlncmF0ZV9wcm9maWxl c190b19sZGFwPGJyPgogICAgICAgICAgICAgICAgwqAgwqAgX2NyZWF0ZV9kb2d0YWdfcHJvZmls ZShwcm9maWxlX2lkLCBwcm9maWxlX2RhdGEsCiAgICAgICAgICAgICAgICBvdmVyd3JpdGU9RmFs c2UpPGJyPgogICAgICAgICAgICAgICAgwqAgRmlsZQogICAgICAgICAgICAgICAgIi91c3IvbGli L3B5dGhvbjIuNy9zaXRlLXBhY2thZ2VzL2lwYXNlcnZlci9pbnN0YWxsL2NhaW5zdGFuY2UucHki LAogICAgICAgICAgICAgICAgbGluZSAyMDMzLCBpbiBfY3JlYXRlX2RvZ3RhZ19wcm9maWxlPGJy PgogICAgICAgICAgICAgICAgwqAgwqAgd2l0aCBhcGkuQmFja2VuZC5yYV9jZXJ0cHJvZmlsZSBh cyBwcm9maWxlX2FwaTo8YnI+CiAgICAgICAgICAgICAgICDCoCBGaWxlCiAgICAgICAgICAgICAg ICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL3BsdWdpbnMvZG9n dGFnLnB5IiwKICAgICAgICAgICAgICAgIGxpbmUgMTMxNSwgaW4gX19lbnRlcl9fPGJyPgogICAg ICAgICAgICAgICAgwqAgwqAgcmFpc2UgZXJyb3JzLlJlbW90ZVJldHJpZXZlRXJyb3IocmVhc29u PV8oJ0ZhaWxlZCB0bwogICAgICAgICAgICAgICAgYXV0aGVudGljYXRlIHRvIENBIFJFU1QgQVBJ JykpPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQx ODoxODozMVogREVCVUcgVGhlIGlwYS1zZXJ2ZXItdXBncmFkZQogICAgICAgICAgICAgICAgY29t bWFuZCBmYWlsZWQsIGV4Y2VwdGlvbjogUmVtb3RlUmV0cmlldmVFcnJvcjogRmFpbGVkCiAgICAg ICAgICAgICAgICB0byBhdXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEk8YnI+CiAgICAgICAgICAg ICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBFUlJPUiBVbmV4cGVjdGVkIGVycm9yIC0gc2VlCiAg ICAgICAgICAgICAgICAvdmFyL2xvZy9pcGF1cGdyYWRlLmxvZyBmb3IgZGV0YWlsczo8YnI+CiAg ICAgICAgICAgICAgICBSZW1vdGVSZXRyaWV2ZUVycm9yOiBGYWlsZWQgdG8gYXV0aGVudGljYXRl IHRvIENBIFJFU1QKICAgICAgICAgICAgICAgIEFQSTwvZGl2PgogICAgICAgICAgICAgIDxkaXY+ CiAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAg ICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgICAgICAgIDxkaXY+SW4gdGhpcyBrZGMgSSBzZWUgdGhlc2UgZXJyb3JzIGluIGdldGNlcnQg bGlzdDo8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAg ICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2PlJlcXVlc3QgSUQgJzIwMTkwMjIw MTgyMDE0Jzo8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1P TklUT1JJTkc8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBjYS1lcnJvcjog SW52YWxpZCBjb29raWU6IHUnJzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IHN0dWNrOiBubzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWly IHN0b3JhZ2U6CnR5cGU9TlNTREIsbG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMn LG5pY2tuYW1lPSdhdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBr aS1jYScsdG9rZW49J05TUyBDZXJ0aWZpY2F0ZSBEQicscGluIHNldDxicj4KICAgICAgICAgICAg ICAgICAgICAgIMKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOgp0eXBlPU5TU0RCLGxvY2F0aW9uPScv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nYXVkaXRTaWduaW5nQ2VydAogICAg ICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREIn PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgQ0E6IGRvZ3RhZy1pcGEtY2Et cmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6 IENOPUNlcnRpZmljYXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgIGhy ZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5J VDwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1D QSBBdWRpdCxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJ Ti5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAg ICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBleHBpcmVzOiAyMDE5LTEyLTA1IDEzOjU4OjI0IFVU Qzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSB1c2FnZTogZGlnaXRh bFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKg IMKgIMKgIHByZS1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4 ZWMvaXBhL2NlcnRtb25nZXIvc3RvcF9wa2ljYWQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBwb3N0LXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgICAgIC91c3Iv bGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAg ICAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSI8YnI+CiAgICAgICAgICAgICAgICAgICAg ICDCoCDCoCDCoCDCoCB0cmFjazogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAgYXV0by1yZW5ldzogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgUmVxdWVzdCBJ RCAnMjAxOTAyMjAxODIwMTUnOjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IHN0YXR1czogTU9OSVRPUklORzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgc3R1Y2s6IG5vPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAga2V5IHBhaXIgc3RvcmFnZToKdHlwZT1OU1NEQixsb2NhdGlvbj0nL2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcycsbmlja25hbWU9J29jc3BTaWduaW5nQ2VydAogICAgICAgICAgICAgICAgICAg ICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREInLHBpbiBzZXQ8YnI+CiAg ICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBjZXJ0aWZpY2F0ZToKdHlwZT1OU1NEQixs b2NhdGlvbj0nL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcycsbmlja25hbWU9J29jc3BTaWduaW5n Q2VydAogICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlm aWNhdGUgREInPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgQ0E6IGRvZ3Rh Zy1pcGEtY2EtcmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDC oCBpc3N1ZXI6IENOPUNlcnRpZmljYXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAg ICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5M LkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdWJq ZWN0OiBDTj1PQ1NQIFN1YnN5c3RlbSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9 Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwv YT48YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBleHBpcmVzOiAyMDE5LTEy LTA1IDEzOjU4OjI0IFVUQzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtl eSB1c2FnZToKICAgICAgICAgICAgICAgICAgICAgIGRpZ2l0YWxTaWduYXR1cmUsbm9uUmVwdWRp YXRpb24sa2V5Q2VydFNpZ24sY1JMU2lnbjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKg IMKgIMKgIGVrdTogaWQta3AtT0NTUFNpZ25pbmc8YnI+CiAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBwcmUtc2F2ZSBjb21tYW5kOgogICAgICAgICAgICAgICAgICAgICAgL3Vzci9s aWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkPGJyPgogICAgICAgICAgICAgICAgICAg ICAgwqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAv dXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAg ICAgICAgIm9jc3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSI8YnI+CiAgICAgICAgICAgICAgICAg ICAgICDCoCDCoCDCoCDCoCB0cmFjazogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAg wqAgwqAgwqAgYXV0by1yZW5ldzogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgUmVxdWVz dCBJRCAnMjAxOTAyMjAxODIwMTYnOjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKg IMKgIHN0YXR1czogTU9OSVRPUklORzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKg IMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAgICAg ICAgwqAgwqAgwqAgwqAgc3R1Y2s6IG5vPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAga2V5IHBhaXIgc3RvcmFnZToKICAgICAgICAgICAgICAgICAgICAgIHR5cGU9TlNTREIs bG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMnLG5pY2tuYW1lPSdzdWJzeXN0ZW1D ZXJ0CiAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScsdG9rZW49J05TUyBDZXJ0aWZp Y2F0ZSBEQicscGluIHNldDxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNl cnRpZmljYXRlOgogICAgICAgICAgICAgICAgICAgICAgdHlwZT1OU1NEQixsb2NhdGlvbj0nL2V0 Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcycsbmlja25hbWU9J3N1YnN5c3RlbUNlcnQKICAgICAgICAg ICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJzxicj4K ICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIENBOiBkb2d0YWctaXBhLWNhLXJlbmV3 LWFnZW50PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1D ZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz08YQogICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJo dHRwOi8vTC5ET01BSU4uSVQiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+ PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3ViamVjdDogQ049Q0EgU3Vi c3lzdGVtLE89PGEKICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9NQUlO LklUIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxicj4KICAgICAgICAg ICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGV4cGlyZXM6IDIwMTktMTItMDUgMTM6NTg6MjQgVVRD PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAga2V5IHVzYWdlOgogICAgICAg ICAgICAgICAgICAgICAgZGlnaXRhbFNpZ25hdHVyZSxub25SZXB1ZGlhdGlvbixrZXlFbmNpcGhl cm1lbnQsZGF0YUVuY2lwaGVybWVudDxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKg IMKgIGVrdTogaWQta3Atc2VydmVyQXV0aCxpZC1rcC1jbGllbnRBdXRoPGJyPgogICAgICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgcHJlLXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAg ICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZDxicj4KICAgICAg ICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHBvc3Qtc2F2ZSBjb21tYW5kOgogICAgICAgICAg ICAgICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2NlcnQKICAg ICAgICAgICAgICAgICAgICAgICJzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIjxicj4KICAgICAg ICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHRyYWNrOiB5ZXM8YnI+CiAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICA8ZGl2PlJlcXVlc3QgSUQgJzIwMTkwMjIwMTgyMDE4Jzo8YnI+CiAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1PTklUT1JJTkc8YnI+CiAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBjYS1lcnJvcjogSW52YWxpZCBjb29raWU6IHUnJzxicj4KICAg ICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHN0dWNrOiBubzxicj4KICAgICAgICAgICAg ICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6CiAgICAgICAgICAgICAgICAg ICAgICB0eXBlPUZJTEUsbG9jYXRpb249Jy92YXIvbGliL2lwYS9yYS1hZ2VudC5rZXknPGJyPgog ICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2VydGlmaWNhdGU6CiAgICAgICAgICAg ICAgICAgICAgICB0eXBlPUZJTEUsbG9jYXRpb249Jy92YXIvbGliL2lwYS9yYS1hZ2VudC5wZW0n PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgQ0E6IGRvZ3RhZy1pcGEtY2Et cmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6 IENOPUNlcnRpZmljYXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgIGhy ZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5J VDwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1J UEEgUkEsTz08YQogICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJodHRwOi8vTC5ET01BSU4u SVQiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJyPgogICAgICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1ODo0NCBVVEM8 YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBrZXkgdXNhZ2U6CiAgICAgICAg ICAgICAgICAgICAgICBkaWdpdGFsU2lnbmF0dXJlLG5vblJlcHVkaWF0aW9uLGtleUVuY2lwaGVy bWVudCxkYXRhRW5jaXBoZXJtZW50PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAgZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1dGg8YnI+CiAgICAgICAgICAg ICAgICAgICAgICDCoCDCoCDCoCDCoCBwcmUtc2F2ZSBjb21tYW5kOgogICAgICAgICAgICAgICAg ICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X3JhX2NlcnRfcHJlPGJyPgog ICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAg ICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfcmFfY2Vy dDxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHRyYWNrOiB5ZXM8YnI+CiAg ICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8YnI+CiAgICAg ICAgICAgICAgICAgICAgICBSZXF1ZXN0IElEICcyMDE5MDIyMDE4MjAxOSc6PGJyPgogICAgICAg ICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3RhdHVzOiBNT05JVE9SSU5HPGJyPgogICAgICAg ICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2EtZXJyb3I6IFNlcnZlciBhdCAiPGEKICAgICAg ICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cHM6Ly9rZGMyLmwuZG9tYWluLml0Ojg0NDMvY2Ev YWdlbnQvY2EvcHJvZmlsZVByb2Nlc3MiCiAgICAgICAgICAgICAgICAgICAgICAgIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSI+aHR0cHM6Ly9rZGMyLmwuZG9tYWluLml0Ojg0NDMvY2EvYWdlbnQvY2Ev cHJvZmlsZVByb2Nlc3M8L2E+IgogICAgICAgICAgICAgICAgICAgICAgcmVwbGllZDogMTogSW52 YWxpZCBDcmVkZW50aWFsLjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHN0 dWNrOiBubzxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWlyIHN0 b3JhZ2U6CiAgICAgICAgICAgICAgICAgICAgICB0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3Br aS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nU2VydmVyLUNlcnQKICAgICAgICAgICAgICAg ICAgICAgIGNlcnQtcGtpLWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJyxwaW4gc2V0PGJy PgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2VydGlmaWNhdGU6CiAgICAgICAg ICAgICAgICAgICAgICB0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2ktdG9tY2F0L2Fs aWFzJyxuaWNrbmFtZT0nU2VydmVyLUNlcnQKICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtp LWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJzxicj4KICAgICAgICAgICAgICAgICAgICAg IMKgIMKgIMKgIMKgIENBOiBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50PGJyPgogICAgICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHks Tz08YQogICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJodHRwOi8vTC5ET01BSU4uSVQiIG1v ei1kby1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJyPgogICAgICAgICAgICAgICAg ICAgICAgwqAgwqAgwqAgwqAgc3ViamVjdDogQ049PGEKICAgICAgICAgICAgICAgICAgICAgICAg aHJlZj0iaHR0cDovL2tkYzIubC5kb21haW4uaXQiCiAgICAgICAgICAgICAgICAgICAgICAgIG1v ei1kby1ub3Qtc2VuZD0idHJ1ZSI+a2RjMi5sLmRvbWFpbi5pdDwvYT4sTz08YQogICAgICAgICAg ICAgICAgICAgICAgICBocmVmPSJodHRwOi8vTC5ET01BSU4uSVQiIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAgZXhwaXJlczogMjAxOS0xMi0xMCAxMDo1Nzo1MiBVVEM8YnI+CiAgICAgICAgICAgICAgICAg ICAgICDCoCDCoCDCoCDCoCBrZXkgdXNhZ2U6CiAgICAgICAgICAgICAgICAgICAgICBkaWdpdGFs U2lnbmF0dXJlLG5vblJlcHVkaWF0aW9uLGtleUVuY2lwaGVybWVudCxkYXRhRW5jaXBoZXJtZW50 PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZWt1OgogICAgICAgICAgICAg ICAgICAgICAgaWQta3Atc2VydmVyQXV0aCxpZC1rcC1jbGllbnRBdXRoLGlkLWtwLWVtYWlsUHJv dGVjdGlvbjxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHByZS1zYXZlIGNv bW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIv c3RvcF9wa2ljYWQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBwb3N0LXNh dmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1v bmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAgICAiU2VydmVyLUNlcnQgY2Vy dC1wa2ktY2EiPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgdHJhY2s6IHll czxicj4KICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGF1dG8tcmVuZXc6IHllczwv ZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgIDwv ZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+SSBzdGlsbCBoYXZlIGEgd29ya2luZyByZXBs aWNhLCBzbyBJIGNvdWxkIGp1c3QKICAgICAgICAgICAgICAgICAgICAgIHJlaW5zdGFsbCBhbmQg aGF2ZSBhIHdvcmtpbmcgc2V0IGluIGEgY291cGxlIG9mCiAgICAgICAgICAgICAgICAgICAgICBt aW51dGVzLCBidXQgSSB3b3VsZCBsaWtlIHRvIGZpbmQgb3V0IHdoYXQgaGFzCiAgICAgICAgICAg ICAgICAgICAgICBnb25lIHdyb25nLjwvZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+PGJy PgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+VGhl IHN5c3RlbXMgYXJlIHJ1bm5pbmcKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC42 LjUtMTEuZWw3LmNlbnRvcy4zLng4Nl82NDwvZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+ PGJyPgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgIDxkaXY+ QW55IGhlbHAgd2VsY29tZSA7LSk8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4K ICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2PlRoYW5r cyw8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAgICAgICAg ICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICAgICAg PGRpdiBkaXI9Imx0ciIgY2xhc3M9ImdtYWlsX3NpZ25hdHVyZSIKICAgICAgICAgICAgICAgICAg ICAgICAgZGF0YS1zbWFydG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+LS08YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgIEdyb2V0ZW4sPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBuYXR4bzwv ZGl2PgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICA8L2Rpdj4K ICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8 L2Rpdj4KICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPGJyPgogICAgICAgICAgPGZpZWxkc2V0 IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgICAgIDxwcmUg Y2xhc3M9Im1vei1xdW90ZS1wcmUiIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xh c3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVz ZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1h aWwgdG8gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZy ZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CkZl ZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhy ZWY9Imh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2Yt Y29uZHVjdC8iIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0cHM6Ly9kb2NzLmZlZG9yYXByb2pl Y3Qub3JnL2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LzwvYT4KTGlzdCBHdWlkZWxpbmVz OiA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2ZlZG9yYXBy b2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMiIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSI+aHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL01haWxpbmdfbGlzdF9ndWlkZWxp bmVzPC9hPgpMaXN0IEFyY2hpdmVzOiA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBo cmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYXJjaGl2ZXMvbGlzdC9mcmVlaXBh LXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0 cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL2FyY2hpdmVzL2xpc3QvZnJlZWlwYS11c2Vyc0Bs aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgPGJyPgogICAgICA8L2Rpdj4KICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9 Im1pbWVBdHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0PgogICAgICA8cHJlIGNsYXNzPSJtb3ot cXVvdGUtcHJlIiB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fCkZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0 LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8g dW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJl dmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0 ZWQub3JnIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CkZl ZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhy ZWY9Imh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2Yt Y29uZHVjdC8iPmh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2Nv ZGUtb2YtY29uZHVjdC88L2E+Ckxpc3QgR3VpZGVsaW5lczogPGEgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL01haWxpbmdf bGlzdF9ndWlkZWxpbmVzIj5odHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19s aXN0X2d1aWRlbGluZXM8L2E+Ckxpc3QgQXJjaGl2ZXM6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hcmNoaXZlcy9s aXN0L2ZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+aHR0cHM6Ly9saXN0cy5m ZWRvcmFob3N0ZWQub3JnL2FyY2hpdmVzL2xpc3QvZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFo b3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2JvZHk+ CjwvaHRtbD4K --===============2119800377077249232==-- From keesb at ghs.com Thu Oct 1 17:49:53 2020 Content-Type: multipart/mixed; boundary="===============5543263153100526964==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 19:49:38 +0200 Message-ID: <58c69c22-467a-1904-4656-11fc65333e8d@ghs.com> In-Reply-To: ac345a75-35f2-8f8e-6fce-87cba924f6d7@ghs.com --===============5543263153100526964== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Can I safely do the following? ipa-getcert resubmit -i 20181127141739 ipa-getcert resubmit -i 20181127141749 ipa-getcert resubmit -i 20181127141750 ipa-getcert resubmit -i 20181127141751 On 01-10-2020 17:36, Kees Bakker via FreeIPA-users wrote: > **** EXTERNAL E-MAIL **** > > On the non-renewal masters there are 4 certificates that show "ca-error: = Invalid cookie: u''" > > Request ID '20181127141739': > =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' > =C2=A0=C2=A0=C2=A0 subject: CN=3DIPA RA,O=3DGHS.NL > =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:48 UTC > Request ID '20181127141749': > =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' > =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Audit,O=3DGHS.NL > =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC > Request ID '20181127141750': > =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' > =C2=A0=C2=A0=C2=A0 subject: CN=3DOCSP Subsystem,O=3DGHS.NL > =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:31 UTC > Request ID '20181127141751': > =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' > =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Subsystem,O=3DGHS.NL > =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC > > All of them are "system certificates" that are already renewed on the CA = Renewal Master. > > How do I get these renewed? I don't like to run whatever command, because > I'm too scared to break the system for good. > -- Kees > > > On 01-10-2020 16:07, Kees Bakker via FreeIPA-users wrote: >> This now happened to me too. >> >> The solution in this thread was to copy /var/lib/ipa/ra-agent.* to the f= ailing system. >> After that I was able to restart (ipactl restart). >> >> What remains a mystery is **why** this happened. >> >> In my case, we have three CA masters, one is the CA renewal master (of c= ourse). >> Two days ago, linge, the renewal master, renewed a few certificates. Her= e is a summary >> of journalctl. >> >> [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' >> sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file "/va= r/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >> sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named "audit= SigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named "ocspS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" will not be valid after 20201026201531. >> sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named "subsy= stemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: do= gtag-ipa-renew-agent returned 0 >> sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named "subsy= stemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" issued by CA and saved. >> sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: do= gtag-ipa-renew-agent returned 0 >> sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named "audit= SigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" issued by CA and saved. >> sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: do= gtag-ipa-renew-agent returned 0 >> sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file "/va= r/lib/ipa/ra-agent.pem" issued by CA and saved. >> sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: do= gtag-ipa-renew-agent returned 5 >> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: Fo= rwarding request to dogtag-ipa-renew-agent >> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: do= gtag-ipa-renew-agent returned 0 >> sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named "ocspS= igningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki= /pki-tomcat/alias" issued by CA and saved. >> >> Today (two days later) I looked at the two other CA masters to see if th= ese same certificates were OK. >> I saw this: >> >> [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' >> sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in file "= /var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >> sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named "au= ditSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc= /pki/pki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named "oc= spSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/= pki/pki-tomcat/alias" will not be valid after 20201026201531. >> sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named "su= bsystemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 11:22:15 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214487]:= Updated certificate not available >> sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214488]:= Updated certificate not available >> sep 29 11:22:16 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214496]:= Updated certificate not available >> sep 29 11:22:17 iparep3.ghs.nl dogtag-ipa-ca-renew-agent-submit[214505]:= Updated certificate not available >> sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 [428= ] Invalid cookie: u'' >> sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 [428= ] Invalid cookie: u'' >> sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 [428= ] Invalid cookie: u'' >> sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 [428= ] Invalid cookie: u'' >> >> [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' >> sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file "/v= ar/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >> sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named "audi= tSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/p= ki/pki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named "ocsp= SigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pk= i/pki-tomcat/alias" will not be valid after 20201026201531. >> sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named "subs= ystemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/= pki-tomcat/alias" will not be valid after 20201026201532. >> sep 29 13:00:57 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166389]: U= pdated certificate not available >> sep 29 13:00:58 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166392]: U= pdated certificate not available >> sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166391]: U= pdated certificate not available >> sep 29 13:01:08 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[166390]: U= pdated certificate not available >> sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 [979= 76] Invalid cookie: u'' >> sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 [979= 76] Invalid cookie: u'' >> sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 [979= 76] Invalid cookie: u'' >> sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 [979= 76] Invalid cookie: u'' >> >> So, both non-renewal masters started tried dogtag-ipa-ca-renew-agent-sub= mit, and both failed with >> "Updated certificate not available" >> >> Next, I did a "yum update", hoping to get rid of the invalid cookie. Thi= s updated ipa from 4.6.5 to 4.6.6 >> The update failed because /var/lib/ipa/ra-agent.pem still had the old ce= rtificate. >> >> After manually copying ra-agent.* to the failing system I was able to re= start ipa. However, I suspect >> that things are still not right. Too many certs on the non-renewal maste= rs still need to be renewed. >> I'm digging further ... >> -- Kees >> >> On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: >>> hi, >>> >>> after patching our centos 7 hosts to the latest version today, one of t= he two replicas is having trouble. >>> >>> [root(a)kdc2 ~]# ipactl status >>> Directory Service: RUNNING >>> krb5kdc Service: STOPPED >>> kadmin Service: STOPPED >>> named Service: STOPPED >>> httpd Service: RUNNING >>> ipa-custodia Service: STOPPED >>> ntpd Service: STOPPED >>> pki-tomcatd Service: RUNNING >>> smb Service: STOPPED >>> winbind Service: STOPPED >>> ipa-otpd Service: STOPPED >>> ipa-dnskeysyncd Service: STOPPED >>> ipa: INFO: The ipactl command was successful >>> >>> and after digging in the logs I come across this in /var/log/ipaupgrade= .log: >>> >>> 2019-11-20T18:18:29Z DEBUG stderr=3D >>> 2019-11-20T18:18:31Z INFO Certmonger certificate renewal configuration = already up-to-date >>> 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery and v= alidation] >>> 2019-11-20T18:18:31Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgr= ade/sysupgrade.state' >>> 2019-11-20T18:18:31Z INFO PKIX already enabled >>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] >>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage lightweight C= As] >>> 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists in= Dogtag database] >>> 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_13974016254= 7472 >>> 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMA= IN-IT.socket from SchemaCache >>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldap= i://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D >>> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740162= 547472 >>> 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] >>> 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] >>> 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] >>> 2019-11-20T18:18:31Z DEBUG Created connection context.ldap2_13974016002= 1648 >>> 2019-11-20T18:18:31Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-L-DOMA= IN-IT.socket from SchemaCache >>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache url=3Dldap= i://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket conn=3D >>> 2019-11-20T18:18:31Z DEBUG Destroyed connection context.ldap2_139740160= 021648 >>> 2019-11-20T18:18:31Z DEBUG request GET https://kdc2.l.domain.it:8443/ca= /rest/account/login >>> 2019-11-20T18:18:31Z DEBUG request body '' >>> 2019-11-20T18:18:31Z DEBUG response status 401 >>> 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 >>> Cache-Control: private >>> Expires: Thu, 01 Jan 1970 01:00:00 CET >>> WWW-Authenticate: Basic realm=3D"Certificate Authority" >>> Content-Type: text/html;charset=3Dutf-8 >>> Content-Language: en >>> Content-Length: 951 >>> Date: Wed, 20 Nov 2019 18:18:31 GMT >>> >>> 2019-11-20T18:18:31Z DEBUG response body 'Apache Tom= cat/7.0.76 - Error report

HTTP Status 401 -=


type Status report

message

description This request requires H= TTP authentication.


Apache >>> Tomcat/7.0.76

' >>> 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect /var/log/= ipaupgrade.log and run command ipa-server-upgrade manually. >>> 2019-11-20T18:18:31Z DEBUG =C2=A0 File "/usr/lib/python2.7/site-package= s/ipapython/admintool.py", line 178, in execute >>> =C2=A0 =C2=A0 return_value =3D self.run() >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_ser= ver_upgrade.py", line 54, in run >>> =C2=A0 =C2=A0 server.upgrade() >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/= upgrade.py", line 2146, in upgrade >>> =C2=A0 =C2=A0 upgrade_configuration() >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/= upgrade.py", line 2018, in upgrade_configuration >>> =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/server/= upgrade.py", line 406, in ca_enable_ldap_profile_subsystem >>> =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainsta= nce.py", line 2027, in migrate_profiles_to_ldap >>> =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwrit= e=3DFalse) >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/install/cainsta= nce.py", line 2033, in _create_dogtag_profile >>> =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: >>> =C2=A0 File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.= py", line 1315, in __enter__ >>> =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to au= thenticate to CA REST API')) >>> >>> 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, excep= tion: RemoteRetrieveError: Failed to authenticate to CA REST API >>> 2019-11-20T18:18:31Z ERROR Unexpected error - see /var/log/ipaupgrade.l= og for details: >>> RemoteRetrieveError: Failed to authenticate to CA REST API >>> >>> >>> In this kdc I see these errors in getcert list: >>> >>> Request ID '20190220182014': >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'= /etc/pki/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token= =3D'NSS Certificate DB',pin set >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/= pki/pki-tomcat/alias',nickname=3D'auditSigningCert cert-pki-ca',token=3D'NS= S Certificate DB' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DO= MAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmong= er/stop_pkicad >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmon= ger/renew_ca_cert "auditSigningCert cert-pki-ca" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>> Request ID '20190220182015': >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'= /etc/pki/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token= =3D'NSS Certificate DB',pin set >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/= pki/pki-tomcat/alias',nickname=3D'ocspSigningCert cert-pki-ca',token=3D'NSS= Certificate DB' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DO= MAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.I= T >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,= keyCertSign,cRLSign >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmong= er/stop_pkicad >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmon= ger/renew_ca_cert "ocspSigningCert cert-pki-ca" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>> Request ID '20190220182016': >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'= /etc/pki/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'= NSS Certificate DB',pin set >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/= pki/pki-tomcat/alias',nickname=3D'subsystemCert cert-pki-ca',token=3D'NSS C= ertificate DB' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DO= MAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT = >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,= keyEncipherment,dataEncipherment >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmong= er/stop_pkicad >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmon= ger/renew_ca_cert "subsystemCert cert-pki-ca" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>> >>> Request ID '20190220182018': >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D'/= var/lib/ipa/ra-agent.key' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var/l= ib/ipa/ra-agent.pem' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DO= MAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,= keyEncipherment,dataEncipherment >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmong= er/renew_ra_cert_pre >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmon= ger/renew_ra_cert >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>> Request ID '20190220182019': >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at "https://kdc2.l.domain.= it:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DNSSDB,location=3D'= /etc/pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NS= S Certificate DB',pin set >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DNSSDB,location=3D'/etc/= pki/pki-tomcat/alias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Cer= tificate DB' >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.DO= MAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it ,O=3DL.DOMAIN.IT >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation,= keyEncipherment,dataEncipherment >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id-k= p-emailProtection >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmong= er/stop_pkicad >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmon= ger/renew_ca_cert "Server-Cert cert-pki-ca" >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>> >>> I still have a working replica, so I could just reinstall and have a wo= rking set in a couple of minutes, but I would like to find out what has gon= e wrong. >>> >>> The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 >>> >>> Any help welcome ;-) >>> >>> Thanks, >>> >>> -- >>> Groeten, >>> natxo >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahoste= d.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/co= de-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-use= rs(a)lists.fedorahosted.org >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org --===============5543263153100526964== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CiAgPC9oZWFkPgogIDxib2R5PgogICAgQ2Fu IEkgc2FmZWx5IGRvIHRoZSBmb2xsb3dpbmc/PGJyPgogICAgPGJyPgogICAgaXBhLWdldGNlcnQg cmVzdWJtaXQgLWkgMjAxODExMjcxNDE3Mzk8YnI+CiAgICBpcGEtZ2V0Y2VydCByZXN1Ym1pdCAt aSAyMDE4MTEyNzE0MTc0OTxicj4KICAgIGlwYS1nZXRjZXJ0IHJlc3VibWl0IC1pIDIwMTgxMTI3 MTQxNzUwPGJyPgogICAgaXBhLWdldGNlcnQgcmVzdWJtaXQgLWkgMjAxODExMjcxNDE3NTE8YnI+ CiAgICA8YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVm aXgiPk9uIDAxLTEwLTIwMjAgMTc6MzYsIEtlZXMgQmFra2VyIHZpYQogICAgICBGcmVlSVBBLXVz ZXJzIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAg ICAgY2l0ZT0ibWlkOmFjMzQ1YTc1LTM1ZjItOGY4ZS02ZmNlLTg3Y2JhOTI0ZjZkN0BnaHMuY29t Ij4KICAgICAgPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0 bWw7IGNoYXJzZXQ9VVRGLTgiPgogICAgICA8ZGl2IHN0eWxlPSJ3aWR0aDoxMDAlOyBmb250LXNp emU6MTJwdDsgbGluZS1oZWlnaHQ6MTRwdDsKICAgICAgICBmb250LWZhbWlseTonQ2FsaWJyaSc7 IGNvbG9yOkJsYWNrOyB0ZXh0LWFsaWduOiBsZWZ0OyI+CiAgICAgICAgPHNwYW4gc3R5bGU9ImNv bG9yOnJlZCIgOz0iIiBmb250LXdlaWdodDpib2xkOz0iIj48Yj4qKioKICAgICAgICAgICAgRVhU RVJOQUwgRS1NQUlMICoqKjwvYj48L3NwYW4+PC9kaXY+CiAgICAgIDxicj4KICAgICAgPGRpdj5P biB0aGUgbm9uLXJlbmV3YWwgbWFzdGVycyB0aGVyZSBhcmUgNCBjZXJ0aWZpY2F0ZXMgdGhhdCBz aG93CiAgICAgICAgImNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnIjxicj4KICAgICAgICA8 YnI+CiAgICAgICAgUmVxdWVzdCBJRCAnMjAxODExMjcxNDE3MzknOjxicj4KICAgICAgICDCoMKg wqAgY2EtZXJyb3I6IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgwqDCoMKgIHN1Ympl Y3Q6IENOPUlQQSBSQSxPPUdIUy5OTDxicj4KICAgICAgICDCoMKgwqAgZXhwaXJlczogMjAyMC0x MC0yNiAyMDoxNTo0OCBVVEM8YnI+CiAgICAgICAgUmVxdWVzdCBJRCAnMjAxODExMjcxNDE3NDkn Ojxicj4KICAgICAgICDCoMKgwqAgY2EtZXJyb3I6IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAg ICAgICAgwqDCoMKgIHN1YmplY3Q6IENOPUNBIEF1ZGl0LE89R0hTLk5MPGJyPgogICAgICAgIMKg wqDCoCBleHBpcmVzOiAyMDIwLTEwLTI2IDIwOjE1OjMyIFVUQzxicj4KICAgICAgICBSZXF1ZXN0 IElEICcyMDE4MTEyNzE0MTc1MCc6PGJyPgogICAgICAgIMKgwqDCoCBjYS1lcnJvcjogSW52YWxp ZCBjb29raWU6IHUnJzxicj4KICAgICAgICDCoMKgwqAgc3ViamVjdDogQ049T0NTUCBTdWJzeXN0 ZW0sTz1HSFMuTkw8YnI+CiAgICAgICAgwqDCoMKgIGV4cGlyZXM6IDIwMjAtMTAtMjYgMjA6MTU6 MzEgVVRDPGJyPgogICAgICAgIFJlcXVlc3QgSUQgJzIwMTgxMTI3MTQxNzUxJzo8YnI+CiAgICAg ICAgwqDCoMKgIGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgIMKgwqDC oCBzdWJqZWN0OiBDTj1DQSBTdWJzeXN0ZW0sTz1HSFMuTkw8YnI+CiAgICAgICAgwqDCoMKgIGV4 cGlyZXM6IDIwMjAtMTAtMjYgMjA6MTU6MzIgVVRDPGJyPgogICAgICAgIDxicj4KICAgICAgICBB bGwgb2YgdGhlbSBhcmUgInN5c3RlbSBjZXJ0aWZpY2F0ZXMiIHRoYXQgYXJlIGFscmVhZHkgcmVu ZXdlZAogICAgICAgIG9uIHRoZSBDQSBSZW5ld2FsIE1hc3Rlci48YnI+CiAgICAgICAgPGJyPgog ICAgICAgIEhvdyBkbyBJIGdldCB0aGVzZSByZW5ld2VkPyBJIGRvbid0IGxpa2UgdG8gcnVuIHdo YXRldmVyCiAgICAgICAgY29tbWFuZCwgYmVjYXVzZTxicj4KICAgICAgICBJJ20gdG9vIHNjYXJl ZCB0byBicmVhayB0aGUgc3lzdGVtIGZvciBnb29kLjxicj4KICAgICAgICAtLSBLZWVzPGJyPgog ICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJl Zml4Ij5PbiAwMS0xMC0yMDIwIDE2OjA3LCBLZWVzIEJha2tlcgogICAgICAgICAgdmlhIEZyZWVJ UEEtdXNlcnMgd3JvdGU6PGJyPgogICAgICAgIDwvZGl2PgogICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiCiAgICAgICAgICBjaXRlPSJtaWQ6NDQ4MDBjNDYtYjEzNS05ZTc5LWQyMjMtYjk2 Yjg2YjczMWRjQGdocy5jb20iPlRoaXMKICAgICAgICAgIG5vdyBoYXBwZW5lZCB0byBtZSB0b28u PGJyPgogICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgIFRoZSBzb2x1dGlvbiBpbiB0aGlz IHRocmVhZCB3YXMgdG8gY29weQogICAgICAgICAgICAvdmFyL2xpYi9pcGEvcmEtYWdlbnQuKiB0 byB0aGUgZmFpbGluZyBzeXN0ZW0uPGJyPgogICAgICAgICAgICBBZnRlciB0aGF0IEkgd2FzIGFi bGUgdG8gcmVzdGFydCAoaXBhY3RsIHJlc3RhcnQpLjxicj4KICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICBXaGF0IHJlbWFpbnMgYSBteXN0ZXJ5IGlzICoqd2h5KiogdGhpcyBoYXBwZW5lZC48 YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgSW4gbXkgY2FzZSwgd2UgaGF2ZSB0aHJl ZSBDQSBtYXN0ZXJzLCBvbmUgaXMgdGhlIENBIHJlbmV3YWwKICAgICAgICAgICAgbWFzdGVyIChv ZiBjb3Vyc2UpLjxicj4KICAgICAgICAgICAgVHdvIGRheXMgYWdvLCBsaW5nZSwgdGhlIHJlbmV3 YWwgbWFzdGVyLCByZW5ld2VkIGEgZmV3CiAgICAgICAgICAgIGNlcnRpZmljYXRlcy4gSGVyZSBp cyBhIHN1bW1hcnk8YnI+CiAgICAgICAgICAgIG9mIGpvdXJuYWxjdGwuPGJyPgogICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgIFtyb290QGxpbmdlIH5dIyBqb3VybmFsY3RsIHwgZ3JlcCAtRSAn Y2VydG1vbmdlcnxkb2d0YWcnPGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6MDAgbGluZ2Uu Z2hzLm5sIGNlcnRtb25nZXJbMTYyODhdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAgICBpbiBmaWxl ICIvdmFyL2xpYi9pcGEvcmEtYWdlbnQucGVtIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAg ICAgICAgICAyMDIwMTAyNjIwMTU0OC48YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTowMCBs aW5nZS5naHMubmwgY2VydG1vbmdlclsxNjI4OV06IENlcnRpZmljYXRlCiAgICAgICAgICAgIG5h bWVkICJhdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTCiAgICAgICAg ICAgIENlcnRpZmljYXRlIERCIiBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cyIgd2lsbAogICAgICAgICAgICBub3QgYmUgdmFsaWQgYWZ0ZXIgMjAyMDEwMjYyMDE1MzIuPGJy PgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6MDAgbGluZ2UuZ2hzLm5sIGNlcnRtb25nZXJbMTYy OTBdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAgICBuYW1lZCAib2NzcFNpZ25pbmdDZXJ0IGNlcnQt cGtpLWNhIiBpbiB0b2tlbiAiTlNTCiAgICAgICAgICAgIENlcnRpZmljYXRlIERCIiBpbiBkYXRh YmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2lsbAogICAgICAgICAgICBub3QgYmUg dmFsaWQgYWZ0ZXIgMjAyMDEwMjYyMDE1MzEuPGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6 MDAgbGluZ2UuZ2hzLm5sIGNlcnRtb25nZXJbMTYyOTFdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAg ICBuYW1lZCAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZp Y2F0ZQogICAgICAgICAgICBEQiIgaW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxp YXMiIHdpbGwgbm90IGJlCiAgICAgICAgICAgIHZhbGlkIGFmdGVyIDIwMjAxMDI2MjAxNTMyLjxi cj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjAyIGxpbmdlLmdocy5ubAogICAgICAgICAgICBk b2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5OF06IEZvcndhcmRpbmcgcmVxdWVz dAogICAgICAgICAgICB0byBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAgICAgICBz ZXAgMjkgMTM6Mzk6MDMgbGluZ2UuZ2hzLm5sCiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVu ZXctYWdlbnQtc3VibWl0WzE2Mjk4XToKICAgICAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2Vu dCByZXR1cm5lZCA1PGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6MDUgbGluZ2UuZ2hzLm5s CiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2MzM5XTogRm9y d2FyZGluZyByZXF1ZXN0CiAgICAgICAgICAgIHRvIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+ CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTowNiBsaW5nZS5naHMubmwKICAgICAgICAgICAgZG9n dGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYzMzldOgogICAgICAgICAgICBkb2d0YWct aXBhLXJlbmV3LWFnZW50IHJldHVybmVkIDU8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTow OCBsaW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJt aXRbMTYzNTRdOiBGb3J3YXJkaW5nIHJlcXVlc3QKICAgICAgICAgICAgdG8gZG9ndGFnLWlwYS1y ZW5ldy1hZ2VudDxicj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjA4IGxpbmdlLmdocy5ubAog ICAgICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjM1NF06CiAgICAg ICAgICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQgcmV0dXJuZWQgMDxicj4KICAgICAgICAgICAg c2VwIDI5IDEzOjM5OjIwIGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NzIwXTogQ2VydGlmaWNh dGUKICAgICAgICAgICAgbmFtZWQgInN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIGluIHRva2Vu ICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICAgICAgREIiIGluIGRhdGFiYXNlICIvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzIiBpc3N1ZWQgYnkgQ0EgYW5kCiAgICAgICAgICAgIHNhdmVkLjxicj4K ICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjIyIGxpbmdlLmdocy5ubAogICAgICAgICAgICBkb2d0 YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5N106IEZvcndhcmRpbmcgcmVxdWVzdAog ICAgICAgICAgICB0byBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAgICAgICBzZXAg MjkgMTM6Mzk6MjMgbGluZ2UuZ2hzLm5sCiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXct YWdlbnQtc3VibWl0WzE2Mjk3XToKICAgICAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudCBy ZXR1cm5lZCA1PGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6MjUgbGluZ2UuZ2hzLm5sCiAg ICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2NzI2XTogRm9yd2Fy ZGluZyByZXF1ZXN0CiAgICAgICAgICAgIHRvIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAg ICAgICAgICAgIHNlcCAyOSAxMzozOToyNSBsaW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFn LWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTY3MjZdOgogICAgICAgICAgICBkb2d0YWctaXBh LXJlbmV3LWFnZW50IHJldHVybmVkIDU8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOToyNyBs aW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRb MTY3NDFdOiBGb3J3YXJkaW5nIHJlcXVlc3QKICAgICAgICAgICAgdG8gZG9ndGFnLWlwYS1yZW5l dy1hZ2VudDxicj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjI3IGxpbmdlLmdocy5ubAogICAg ICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjc0MV06CiAgICAgICAg ICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQgcmV0dXJuZWQgMDxicj4KICAgICAgICAgICAgc2Vw IDI5IDEzOjM5OjM5IGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE3MTA2XTogQ2VydGlmaWNhdGUK ICAgICAgICAgICAgbmFtZWQgImF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2Vu ICJOU1MKICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIGRhdGFiYXNlICIvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzIgogICAgICAgICAgICBpc3N1ZWQgYnkgQ0EgYW5kIHNhdmVkLjxicj4K ICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjQyIGxpbmdlLmdocy5ubAogICAgICAgICAgICBkb2d0 YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5Nl06IEZvcndhcmRpbmcgcmVxdWVzdAog ICAgICAgICAgICB0byBkb2d0YWctaXBhLXJlbmV3LWFnZW50PGJyPgogICAgICAgICAgICBzZXAg MjkgMTM6Mzk6NDMgbGluZ2UuZ2hzLm5sCiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXct YWdlbnQtc3VibWl0WzE2Mjk2XToKICAgICAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudCBy ZXR1cm5lZCA1PGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6NDQgbGluZ2UuZ2hzLm5sCiAg ICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTEyXTogRm9yd2Fy ZGluZyByZXF1ZXN0CiAgICAgICAgICAgIHRvIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAg ICAgICAgICAgIHNlcCAyOSAxMzozOTo0NSBsaW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFn LWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTcxMTJdOgogICAgICAgICAgICBkb2d0YWctaXBh LXJlbmV3LWFnZW50IHJldHVybmVkIDU8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTo0NyBs aW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRb MTcxMjZdOiBGb3J3YXJkaW5nIHJlcXVlc3QKICAgICAgICAgICAgdG8gZG9ndGFnLWlwYS1yZW5l dy1hZ2VudDxicj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjQ3IGxpbmdlLmdocy5ubAogICAg ICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNzEyNl06CiAgICAgICAg ICAgIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQgcmV0dXJuZWQgMDxicj4KICAgICAgICAgICAgc2Vw IDI5IDEzOjM5OjQ5IGxpbmdlLmdocy5ubCBjZXJ0bW9uZ2VyWzE3MTU2XTogQ2VydGlmaWNhdGUK ICAgICAgICAgICAgaW4gZmlsZSAiL3Zhci9saWIvaXBhL3JhLWFnZW50LnBlbSIgaXNzdWVkIGJ5 IENBIGFuZCBzYXZlZC48YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTo1MiBsaW5nZS5naHMu bmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMTYyOTldOiBG b3J3YXJkaW5nIHJlcXVlc3QKICAgICAgICAgICAgdG8gZG9ndGFnLWlwYS1yZW5ldy1hZ2VudDxi cj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5OjUzIGxpbmdlLmdocy5ubAogICAgICAgICAgICBk b2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjI5OV06CiAgICAgICAgICAgIGRvZ3Rh Zy1pcGEtcmVuZXctYWdlbnQgcmV0dXJuZWQgNTxicj4KICAgICAgICAgICAgc2VwIDI5IDEzOjM5 OjU0IGxpbmdlLmdocy5ubAogICAgICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1 Ym1pdFsxNzE2Ml06IEZvcndhcmRpbmcgcmVxdWVzdAogICAgICAgICAgICB0byBkb2d0YWctaXBh LXJlbmV3LWFnZW50PGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6Mzk6NTUgbGluZ2UuZ2hzLm5s CiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE3MTYyXToKICAg ICAgICAgICAgZG9ndGFnLWlwYS1yZW5ldy1hZ2VudCByZXR1cm5lZCA1PGJyPgogICAgICAgICAg ICBzZXAgMjkgMTM6Mzk6NTcgbGluZ2UuZ2hzLm5sCiAgICAgICAgICAgIGRvZ3RhZy1pcGEtY2Et cmVuZXctYWdlbnQtc3VibWl0WzE3MTc3XTogRm9yd2FyZGluZyByZXF1ZXN0CiAgICAgICAgICAg IHRvIGRvZ3RhZy1pcGEtcmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzozOTo1 NyBsaW5nZS5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJt aXRbMTcxNzddOgogICAgICAgICAgICBkb2d0YWctaXBhLXJlbmV3LWFnZW50IHJldHVybmVkIDA8 YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzo0MDowNSBsaW5nZS5naHMubmwgY2VydG1vbmdlclsx NzU0MF06IENlcnRpZmljYXRlCiAgICAgICAgICAgIG5hbWVkICJvY3NwU2lnbmluZ0NlcnQgY2Vy dC1wa2ktY2EiIGluIHRva2VuICJOU1MKICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIGRh dGFiYXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIgogICAgICAgICAgICBpc3N1ZWQgYnkg Q0EgYW5kIHNhdmVkLjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUb2RheSAodHdv IGRheXMgbGF0ZXIpIEkgbG9va2VkIGF0IHRoZSB0d28gb3RoZXIgQ0EgbWFzdGVycwogICAgICAg ICAgICB0byBzZWUgaWYgdGhlc2Ugc2FtZSBjZXJ0aWZpY2F0ZXMgd2VyZSBPSy48YnI+CiAgICAg ICAgICAgIEkgc2F3IHRoaXM6PGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFtyb290 QGlwYXJlcDMgfl0jIGpvdXJuYWxjdGwgfCBncmVwIC1FICdjZXJ0bW9uZ2VyfGRvZ3RhZyc8YnI+ CiAgICAgICAgICAgIHNlcCAyOSAxMToyMjoxMyBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzIx NDQ3OV06CiAgICAgICAgICAgIENlcnRpZmljYXRlIGluIGZpbGUgIi92YXIvbGliL2lwYS9yYS1h Z2VudC5wZW0iIHdpbGwgbm90IGJlCiAgICAgICAgICAgIHZhbGlkIGFmdGVyIDIwMjAxMDI2MjAx NTQ4Ljxicj4KICAgICAgICAgICAgc2VwIDI5IDExOjIyOjEzIGlwYXJlcDMuZ2hzLm5sIGNlcnRt b25nZXJbMjE0NDgwXToKICAgICAgICAgICAgQ2VydGlmaWNhdGUgbmFtZWQgImF1ZGl0U2lnbmlu Z0NlcnQgY2VydC1wa2ktY2EiIGluIHRva2VuCiAgICAgICAgICAgICJOU1MgQ2VydGlmaWNhdGUg REIiIGluIGRhdGFiYXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIgogICAgICAgICAgICB3 aWxsIG5vdCBiZSB2YWxpZCBhZnRlciAyMDIwMTAyNjIwMTUzMi48YnI+CiAgICAgICAgICAgIHNl cCAyOSAxMToyMjoxMyBpcGFyZXAzLmdocy5ubCBjZXJ0bW9uZ2VyWzIxNDQ4MV06CiAgICAgICAg ICAgIENlcnRpZmljYXRlIG5hbWVkICJvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiIGluIHRv a2VuCiAgICAgICAgICAgICJOU1MgQ2VydGlmaWNhdGUgREIiIGluIGRhdGFiYXNlICIvZXRjL3Br aS9wa2ktdG9tY2F0L2FsaWFzIgogICAgICAgICAgICB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlciAy MDIwMTAyNjIwMTUzMS48YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMToyMjoxMyBpcGFyZXAzLmdo cy5ubCBjZXJ0bW9uZ2VyWzIxNDQ4Ml06CiAgICAgICAgICAgIENlcnRpZmljYXRlIG5hbWVkICJz dWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiBpbiB0b2tlbiAiTlNTCiAgICAgICAgICAgIENlcnRp ZmljYXRlIERCIiBpbiBkYXRhYmFzZSAiL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyIgd2lsbAog ICAgICAgICAgICBub3QgYmUgdmFsaWQgYWZ0ZXIgMjAyMDEwMjYyMDE1MzIuPGJyPgogICAgICAg ICAgICBzZXAgMjkgMTE6MjI6MTUgaXBhcmVwMy5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlw YS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMjE0NDg3XTogVXBkYXRlZAogICAgICAgICAgICBjZXJ0 aWZpY2F0ZSBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgICAgICBzZXAgMjkgMTE6MjI6MTYgaXBh cmVwMy5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRb MjE0NDg4XTogVXBkYXRlZAogICAgICAgICAgICBjZXJ0aWZpY2F0ZSBub3QgYXZhaWxhYmxlPGJy PgogICAgICAgICAgICBzZXAgMjkgMTE6MjI6MTYgaXBhcmVwMy5naHMubmwKICAgICAgICAgICAg ZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1zdWJtaXRbMjE0NDk2XTogVXBkYXRlZAogICAgICAg ICAgICBjZXJ0aWZpY2F0ZSBub3QgYXZhaWxhYmxlPGJyPgogICAgICAgICAgICBzZXAgMjkgMTE6 MjI6MTcgaXBhcmVwMy5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2Vu dC1zdWJtaXRbMjE0NTA1XTogVXBkYXRlZAogICAgICAgICAgICBjZXJ0aWZpY2F0ZSBub3QgYXZh aWxhYmxlPGJyPgogICAgICAgICAgICBzZXAgMjkgMTk6MjI6MTggaXBhcmVwMy5naHMubmwgY2Vy dG1vbmdlcls0MjhdOiAyMDIwLTA5LTI5CiAgICAgICAgICAgIDE5OjIyOjE4IFs0MjhdIEludmFs aWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxOToyMjoxOSBpcGFyZXAzLmdo cy5ubCBjZXJ0bW9uZ2VyWzQyOF06IDIwMjAtMDktMjkKICAgICAgICAgICAgMTk6MjI6MTkgWzQy OF0gSW52YWxpZCBjb29raWU6IHUnJzxicj4KICAgICAgICAgICAgc2VwIDI5IDE5OjIyOjIwIGlw YXJlcDMuZ2hzLm5sIGNlcnRtb25nZXJbNDI4XTogMjAyMC0wOS0yOQogICAgICAgICAgICAxOToy MjoyMCBbNDI4XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICBzZXAgMjkgMTk6 MjI6MjkgaXBhcmVwMy5naHMubmwgY2VydG1vbmdlcls0MjhdOiAyMDIwLTA5LTI5CiAgICAgICAg ICAgIDE5OjIyOjI5IFs0MjhdIEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgW3Jvb3RAcm90dGUgfl0jIGpvdXJuYWxjdGwgfCBncmVwIC1FICdjZXJ0 bW9uZ2VyfGRvZ3RhZyc8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzowMDo1NSByb3R0ZS5naHMu bmwgY2VydG1vbmdlclsxNjYzODFdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAgICBpbiBmaWxlICIv dmFyL2xpYi9pcGEvcmEtYWdlbnQucGVtIiB3aWxsIG5vdCBiZSB2YWxpZCBhZnRlcgogICAgICAg ICAgICAyMDIwMTAyNjIwMTU0OC48YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzowMDo1NSByb3R0 ZS5naHMubmwgY2VydG1vbmdlclsxNjYzODJdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAgICBuYW1l ZCAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUwogICAgICAgICAg ICBDZXJ0aWZpY2F0ZSBEQiIgaW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMi IHdpbGwKICAgICAgICAgICAgbm90IGJlIHZhbGlkIGFmdGVyIDIwMjAxMDI2MjAxNTMyLjxicj4K ICAgICAgICAgICAgc2VwIDI5IDEzOjAwOjU1IHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzE2NjM4 M106IENlcnRpZmljYXRlCiAgICAgICAgICAgIG5hbWVkICJvY3NwU2lnbmluZ0NlcnQgY2VydC1w a2ktY2EiIGluIHRva2VuICJOU1MKICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIGRhdGFi YXNlICIvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIiB3aWxsCiAgICAgICAgICAgIG5vdCBiZSB2 YWxpZCBhZnRlciAyMDIwMTAyNjIwMTUzMS48YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzowMDo1 NSByb3R0ZS5naHMubmwgY2VydG1vbmdlclsxNjYzODRdOiBDZXJ0aWZpY2F0ZQogICAgICAgICAg ICBuYW1lZCAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIgaW4gdG9rZW4gIk5TUyBDZXJ0aWZp Y2F0ZQogICAgICAgICAgICBEQiIgaW4gZGF0YWJhc2UgIi9ldGMvcGtpL3BraS10b21jYXQvYWxp YXMiIHdpbGwgbm90IGJlCiAgICAgICAgICAgIHZhbGlkIGFmdGVyIDIwMjAxMDI2MjAxNTMyLjxi cj4KICAgICAgICAgICAgc2VwIDI5IDEzOjAwOjU3IHJvdHRlLmdocy5ubAogICAgICAgICAgICBk b2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdFsxNjYzODldOiBVcGRhdGVkCiAgICAgICAg ICAgIGNlcnRpZmljYXRlIG5vdCBhdmFpbGFibGU8YnI+CiAgICAgICAgICAgIHNlcCAyOSAxMzow MDo1OCByb3R0ZS5naHMubmwKICAgICAgICAgICAgZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudC1z dWJtaXRbMTY2MzkyXTogVXBkYXRlZAogICAgICAgICAgICBjZXJ0aWZpY2F0ZSBub3QgYXZhaWxh YmxlPGJyPgogICAgICAgICAgICBzZXAgMjkgMTM6MDE6MDggcm90dGUuZ2hzLm5sCiAgICAgICAg ICAgIGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQtc3VibWl0WzE2NjM5MV06IFVwZGF0ZWQKICAg ICAgICAgICAgY2VydGlmaWNhdGUgbm90IGF2YWlsYWJsZTxicj4KICAgICAgICAgICAgc2VwIDI5 IDEzOjAxOjA4IHJvdHRlLmdocy5ubAogICAgICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFn ZW50LXN1Ym1pdFsxNjYzOTBdOiBVcGRhdGVkCiAgICAgICAgICAgIGNlcnRpZmljYXRlIG5vdCBh dmFpbGFibGU8YnI+CiAgICAgICAgICAgIHNlcCAyOSAyMTowMTowMCByb3R0ZS5naHMubmwgY2Vy dG1vbmdlcls5Nzk3Nl06IDIwMjAtMDktMjkKICAgICAgICAgICAgMjE6MDE6MDAgWzk3OTc2XSBJ bnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICBzZXAgMjkgMjE6MDE6MDEgcm90dGUu Z2hzLm5sIGNlcnRtb25nZXJbOTc5NzZdOiAyMDIwLTA5LTI5CiAgICAgICAgICAgIDIxOjAxOjAx IFs5Nzk3Nl0gSW52YWxpZCBjb29raWU6IHUnJzxicj4KICAgICAgICAgICAgc2VwIDI5IDIxOjAx OjEwIHJvdHRlLmdocy5ubCBjZXJ0bW9uZ2VyWzk3OTc2XTogMjAyMC0wOS0yOQogICAgICAgICAg ICAyMTowMToxMCBbOTc5NzZdIEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAgIHNl cCAyOSAyMTowMToxMSByb3R0ZS5naHMubmwgY2VydG1vbmdlcls5Nzk3Nl06IDIwMjAtMDktMjkK ICAgICAgICAgICAgMjE6MDE6MTEgWzk3OTc2XSBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgIFNvLCBib3RoIG5vbi1yZW5ld2FsIG1hc3RlcnMgc3Rh cnRlZCB0cmllZAogICAgICAgICAgICBkb2d0YWctaXBhLWNhLXJlbmV3LWFnZW50LXN1Ym1pdCwg YW5kIGJvdGggZmFpbGVkIHdpdGg8YnI+CiAgICAgICAgICAgICJVcGRhdGVkIGNlcnRpZmljYXRl IG5vdCBhdmFpbGFibGUiPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIE5leHQsIEkg ZGlkIGEgInl1bSB1cGRhdGUiLCBob3BpbmcgdG8gZ2V0IHJpZCBvZiB0aGUgaW52YWxpZAogICAg ICAgICAgICBjb29raWUuIFRoaXMgdXBkYXRlZCBpcGEgZnJvbSA0LjYuNSB0byA0LjYuNjxicj4K ICAgICAgICAgICAgVGhlIHVwZGF0ZSBmYWlsZWQgYmVjYXVzZSAvdmFyL2xpYi9pcGEvcmEtYWdl bnQucGVtIHN0aWxsCiAgICAgICAgICAgIGhhZCB0aGUgb2xkIGNlcnRpZmljYXRlLjxicj4KICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICBBZnRlciBtYW51YWxseSBjb3B5aW5nIHJhLWFnZW50 LiogdG8gdGhlIGZhaWxpbmcgc3lzdGVtIEkKICAgICAgICAgICAgd2FzIGFibGUgdG8gcmVzdGFy dCBpcGEuIEhvd2V2ZXIsIEkgc3VzcGVjdDxicj4KICAgICAgICAgICAgdGhhdCB0aGluZ3MgYXJl IHN0aWxsIG5vdCByaWdodC4gVG9vIG1hbnkgY2VydHMgb24gdGhlCiAgICAgICAgICAgIG5vbi1y ZW5ld2FsIG1hc3RlcnMgc3RpbGwgbmVlZCB0byBiZSByZW5ld2VkLjxicj4KICAgICAgICAgICAg SSdtIGRpZ2dpbmcgZnVydGhlciAuLi48YnI+CiAgICAgICAgICAgIC0tIEtlZXM8YnI+CiAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4Ij5PbiAy MC0xMS0yMDE5IDIwOjEzLCBOYXR4bwogICAgICAgICAgICAgIEFzZW5qbyB2aWEgRnJlZUlQQS11 c2VycyB3cm90ZTo8YnI+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICA8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIgpjaXRlPSJtaWQ6Q0FIQkVKeldHTktIRUFPRFhqam5rNnZUeTJVc1FSblgx WnBKRm9wKzJMcD1mUkg4eEd3QG1haWwuZ21haWwuY29tIj4KICAgICAgICAgICAgICA8ZGl2Pgog ICAgICAgICAgICAgICAgPGRpdiBkaXI9Imx0ciI+CiAgICAgICAgICAgICAgICAgIDxkaXY+aGks PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICA8L2Rp dj4KICAgICAgICAgICAgICAgICAgPGRpdj5hZnRlciBwYXRjaGluZyBvdXIgY2VudG9zIDcgaG9z dHMgdG8gdGhlIGxhdGVzdAogICAgICAgICAgICAgICAgICAgIHZlcnNpb24gdG9kYXksIG9uZSBv ZiB0aGUgdHdvIHJlcGxpY2FzIGlzIGhhdmluZwogICAgICAgICAgICAgICAgICAgIHRyb3VibGUu PC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICA8L2Rp dj4KICAgICAgICAgICAgICAgICAgPGRpdj5bcm9vdEBrZGMyIH5dIyBpcGFjdGwgc3RhdHVzPGJy PgogICAgICAgICAgICAgICAgICAgIERpcmVjdG9yeSBTZXJ2aWNlOiBSVU5OSU5HPGJyPgogICAg ICAgICAgICAgICAgICAgIGtyYjVrZGMgU2VydmljZTogU1RPUFBFRDxicj4KICAgICAgICAgICAg ICAgICAgICBrYWRtaW4gU2VydmljZTogU1RPUFBFRDxicj4KICAgICAgICAgICAgICAgICAgICBu YW1lZCBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAgICAgICAgIGh0dHBkIFNlcnZp Y2U6IFJVTk5JTkc8YnI+CiAgICAgICAgICAgICAgICAgICAgaXBhLWN1c3RvZGlhIFNlcnZpY2U6 IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgICAgICAgICAgbnRwZCBTZXJ2aWNlOiBTVE9QUEVEPGJy PgogICAgICAgICAgICAgICAgICAgIHBraS10b21jYXRkIFNlcnZpY2U6IFJVTk5JTkc8YnI+CiAg ICAgICAgICAgICAgICAgICAgc21iIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgICAg ICAgICAgd2luYmluZCBTZXJ2aWNlOiBTVE9QUEVEPGJyPgogICAgICAgICAgICAgICAgICAgIGlw YS1vdHBkIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgICAgICAgICAgaXBhLWRuc2tl eXN5bmNkIFNlcnZpY2U6IFNUT1BQRUQ8YnI+CiAgICAgICAgICAgICAgICAgICAgaXBhOiBJTkZP OiBUaGUgaXBhY3RsIGNvbW1hbmQgd2FzIHN1Y2Nlc3NmdWw8L2Rpdj4KICAgICAgICAgICAgICAg ICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICA8 ZGl2PmFuZCBhZnRlciBkaWdnaW5nIGluIHRoZSBsb2dzIEkgY29tZSBhY3Jvc3MgdGhpcwogICAg ICAgICAgICAgICAgICAgIGluIC92YXIvbG9nL2lwYXVwZ3JhZGUubG9nOjxicj4KICAgICAgICAg ICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAg ICAgICA8L2Rpdj4KICAgICAgICAgICAgICAgICAgPGRpdj4yMDE5LTExLTIwVDE4OjE4OjI5WiBE RUJVRyBzdGRlcnI9PGJyPgogICAgICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFa IElORk8gQ2VydG1vbmdlciBjZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgIHJlbmV3YWwg Y29uZmlndXJhdGlvbiBhbHJlYWR5IHVwLXRvLWRhdGU8YnI+CiAgICAgICAgICAgICAgICAgICAg MjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBbRW5hYmxlIFBLSVggY2VydGlmaWNhdGUKICAgICAg ICAgICAgICAgICAgICBwYXRoIGRpc2NvdmVyeSBhbmQgdmFsaWRhdGlvbl08YnI+CiAgICAgICAg ICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVCVUcgTG9hZGluZyBTdGF0ZUZpbGUg ZnJvbQogICAgICAgICAgICAgICAgICAgICcvdmFyL2xpYi9pcGEvc3lzdXBncmFkZS9zeXN1cGdy YWRlLnN0YXRlJzxicj4KICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBJ TkZPIFBLSVggYWxyZWFkeSBlbmFibGVkPGJyPgogICAgICAgICAgICAgICAgICAgIDIwMTktMTEt MjBUMTg6MTg6MzFaIElORk8gW0F1dGhvcml6aW5nIFJBIEFnZW50IHRvCiAgICAgICAgICAgICAg ICAgICAgbW9kaWZ5IHByb2ZpbGVzXTxicj4KICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIw VDE4OjE4OjMxWiBJTkZPIFtBdXRob3JpemluZyBSQSBBZ2VudCB0bwogICAgICAgICAgICAgICAg ICAgIG1hbmFnZSBsaWdodHdlaWdodCBDQXNdPGJyPgogICAgICAgICAgICAgICAgICAgIDIwMTkt MTEtMjBUMTg6MTg6MzFaIElORk8gW0Vuc3VyaW5nIExpZ2h0d2VpZ2h0IENBcwogICAgICAgICAg ICAgICAgICAgIGNvbnRhaW5lciBleGlzdHMgaW4gRG9ndGFnIGRhdGFiYXNlXTxicj4KICAgICAg ICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBDcmVhdGVkIGNvbm5lY3Rp b24KICAgICAgICAgICAgICAgICAgICBjb250ZXh0LmxkYXAyXzEzOTc0MDE2MjU0NzQ3Mjxicj4K ICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBmbHVzaGluZwog ICAgICAgICAgICAgICAgICAgIGxkYXBpOi8vJTJmdmFyJTJmcnVuJTJmc2xhcGQtTC1ET01BSU4t SVQuc29ja2V0IGZyb20KICAgICAgICAgICAgICAgICAgICBTY2hlbWFDYWNoZTxicj4KICAgICAg ICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXRyaWV2aW5nIHNjaGVt YSBmb3IKICAgICAgICAgICAgICAgICAgICBTY2hlbWFDYWNoZQogICAgICAgICAgICAgICAgICAg IHVybD1sZGFwaTovLyUyZnZhciUyZnJ1biUyZnNsYXBkLUwtRE9NQUlOLUlULnNvY2tldAogICAg ICAgICAgICAgICAgICAgIGNvbm49Jmx0O2xkYXAubGRhcG9iamVjdC5TaW1wbGVMREFQT2JqZWN0 IGluc3RhbmNlCiAgICAgICAgICAgICAgICAgICAgYXQgMHg3ZjE3Y2MyNGI2MzgmZ3Q7PGJyPgog ICAgICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIERlc3Ryb3llZCBj b25uZWN0aW9uCiAgICAgICAgICAgICAgICAgICAgY29udGV4dC5sZGFwMl8xMzk3NDAxNjI1NDc0 NzI8YnI+CiAgICAgICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogSU5GTyBbQWRk aW5nIGRlZmF1bHQgT0NTUCBVUkkKICAgICAgICAgICAgICAgICAgICBjb25maWd1cmF0aW9uXTxi cj4KICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtFbnN1cmlu ZyBDQSBpcyB1c2luZwogICAgICAgICAgICAgICAgICAgIExEQVBQcm9maWxlU3Vic3lzdGVtXTxi cj4KICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBJTkZPIFtNaWdyYXRp bmcgY2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICBwcm9maWxlcyB0byBMREFQXTxicj4K ICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBDcmVhdGVkIGNv bm5lY3Rpb24KICAgICAgICAgICAgICAgICAgICBjb250ZXh0LmxkYXAyXzEzOTc0MDE2MDAyMTY0 ODxicj4KICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyBmbHVz aGluZwogICAgICAgICAgICAgICAgICAgIGxkYXBpOi8vJTJmdmFyJTJmcnVuJTJmc2xhcGQtTC1E T01BSU4tSVQuc29ja2V0IGZyb20KICAgICAgICAgICAgICAgICAgICBTY2hlbWFDYWNoZTxicj4K ICAgICAgICAgICAgICAgICAgICAyMDE5LTExLTIwVDE4OjE4OjMxWiBERUJVRyByZXRyaWV2aW5n IHNjaGVtYSBmb3IKICAgICAgICAgICAgICAgICAgICBTY2hlbWFDYWNoZQogICAgICAgICAgICAg ICAgICAgIHVybD1sZGFwaTovLyUyZnZhciUyZnJ1biUyZnNsYXBkLUwtRE9NQUlOLUlULnNvY2tl dAogICAgICAgICAgICAgICAgICAgIGNvbm49Jmx0O2xkYXAubGRhcG9iamVjdC5TaW1wbGVMREFQ T2JqZWN0IGluc3RhbmNlCiAgICAgICAgICAgICAgICAgICAgYXQgMHg3ZjE3Y2MyODliMDAmZ3Q7 PGJyPgogICAgICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIERlc3Ry b3llZCBjb25uZWN0aW9uCiAgICAgICAgICAgICAgICAgICAgY29udGV4dC5sZGFwMl8xMzk3NDAx NjAwMjE2NDg8YnI+CiAgICAgICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVC VUcgcmVxdWVzdCBHRVQgPGEKICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHBzOi8va2Rj Mi5sLmRvbWFpbi5pdDo4NDQzL2NhL3Jlc3QvYWNjb3VudC9sb2dpbiIKICAgICAgICAgICAgICAg ICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+Cmh0dHBzOi8va2RjMi5sLmRvbWFpbi5pdDo4 NDQzL2NhL3Jlc3QvYWNjb3VudC9sb2dpbjwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgMjAx OS0xMS0yMFQxODoxODozMVogREVCVUcgcmVxdWVzdCBib2R5ICcnPGJyPgogICAgICAgICAgICAg ICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIHJlc3BvbnNlIHN0YXR1cyA0MDE8YnI+ CiAgICAgICAgICAgICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVCVUcgcmVzcG9uc2Ug aGVhZGVycyBTZXJ2ZXI6CiAgICAgICAgICAgICAgICAgICAgQXBhY2hlLUNveW90ZS8xLjE8YnI+ CiAgICAgICAgICAgICAgICAgICAgQ2FjaGUtQ29udHJvbDogcHJpdmF0ZTxicj4KICAgICAgICAg ICAgICAgICAgICBFeHBpcmVzOiBUaHUsIDAxIEphbiAxOTcwIDAxOjAwOjAwIENFVDxicj4KICAg ICAgICAgICAgICAgICAgICBXV1ctQXV0aGVudGljYXRlOiBCYXNpYyByZWFsbT0iQ2VydGlmaWNh dGUKICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHkiPGJyPgogICAgICAgICAgICAgICAgICAg IENvbnRlbnQtVHlwZTogdGV4dC9odG1sO2NoYXJzZXQ9dXRmLTg8YnI+CiAgICAgICAgICAgICAg ICAgICAgQ29udGVudC1MYW5ndWFnZTogZW48YnI+CiAgICAgICAgICAgICAgICAgICAgQ29udGVu dC1MZW5ndGg6IDk1MTxicj4KICAgICAgICAgICAgICAgICAgICBEYXRlOiBXZWQsIDIwIE5vdiAy MDE5IDE4OjE4OjMxIEdNVDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgMjAxOS0xMS0yMFQxODoxODozMVogREVCVUcgcmVzcG9uc2UgYm9keQogICAgICAg ICAgICAgICAgICAgICcmbHQ7aHRtbCZndDsmbHQ7aGVhZCZndDsmbHQ7dGl0bGUmZ3Q7QXBhY2hl CiAgICAgICAgICAgICAgICAgICAgVG9tY2F0LzcuMC43NiAtIEVycm9yCiAgICAgICAgICAgICAg ICAgICAgcmVwb3J0Jmx0Oy90aXRsZSZndDsmbHQ7c3R5bGUmZ3Q7Jmx0OyEtLUgxCntmb250LWZh bWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0ZTtiYWNrZ3JvdW5kLWNvbG9y OiM1MjVENzY7Zm9udC1zaXplOjIycHg7fQogICAgICAgICAgICAgICAgICAgIEgyCntmb250LWZh bWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0ZTtiYWNrZ3JvdW5kLWNvbG9y OiM1MjVENzY7Zm9udC1zaXplOjE2cHg7fQogICAgICAgICAgICAgICAgICAgIEgzCntmb250LWZh bWlseTpUYWhvbWEsQXJpYWwsc2Fucy1zZXJpZjtjb2xvcjp3aGl0ZTtiYWNrZ3JvdW5kLWNvbG9y OiM1MjVENzY7Zm9udC1zaXplOjE0cHg7fQogICAgICAgICAgICAgICAgICAgIEJPRFkKe2ZvbnQt ZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrO2JhY2tncm91bmQtY29s b3I6d2hpdGU7fQogICAgICAgICAgICAgICAgICAgIEIKe2ZvbnQtZmFtaWx5OlRhaG9tYSxBcmlh bCxzYW5zLXNlcmlmO2NvbG9yOndoaXRlO2JhY2tncm91bmQtY29sb3I6IzUyNUQ3Njt9CiAgICAg ICAgICAgICAgICAgICAgUAp7Zm9udC1mYW1pbHk6VGFob21hLEFyaWFsLHNhbnMtc2VyaWY7YmFj a2dyb3VuZDp3aGl0ZTtjb2xvcjpibGFjaztmb250LXNpemU6MTJweDt9QQogICAgICAgICAgICAg ICAgICAgIHtjb2xvciA6IGJsYWNrO31BLm5hbWUge2NvbG9yIDogYmxhY2s7fUhSIHtjb2xvciA6 CiAgICAgICAgICAgICAgICAgICAgIzUyNUQ3Njt9LS0mZ3Q7Jmx0Oy9zdHlsZSZndDsKICAgICAg ICAgICAgICAgICAgICAmbHQ7L2hlYWQmZ3Q7Jmx0O2JvZHkmZ3Q7Jmx0O2gxJmd0O0hUVFAgU3Rh dHVzIDQwMSAtCiAgICAgICAgICAgICAgICAgICAgJmx0Oy9oMSZndDsmbHQ7SFIgc2l6ZT0iMSIK ICAgICAgICAgICAgICAgICAgICBub3NoYWRlPSJub3NoYWRlIiZndDsmbHQ7cCZndDsmbHQ7YiZn dDt0eXBlJmx0Oy9iJmd0OwogICAgICAgICAgICAgICAgICAgIFN0YXR1cwogICAgICAgICAgICAg ICAgICAgIHJlcG9ydCZsdDsvcCZndDsmbHQ7cCZndDsmbHQ7YiZndDttZXNzYWdlJmx0Oy9iJmd0 OwombHQ7dSZndDsmbHQ7L3UmZ3Q7Jmx0Oy9wJmd0OyZsdDtwJmd0OyZsdDtiJmd0O2Rlc2NyaXB0 aW9uJmx0Oy9iJmd0OwogICAgICAgICAgICAgICAgICAgICZsdDt1Jmd0O1RoaXMgcmVxdWVzdCBy ZXF1aXJlcyBIVFRQCiAgICAgICAgICAgICAgICAgICAgYXV0aGVudGljYXRpb24uJmx0Oy91Jmd0 OyZsdDsvcCZndDsmbHQ7SFIgc2l6ZT0iMSIKICAgICAgICAgICAgICAgICAgICBub3NoYWRlPSJu b3NoYWRlIiZndDsmbHQ7aDMmZ3Q7QXBhY2hlCiAgICAgICAgICAgICAgICAgICAgVG9tY2F0Lzcu MC43NiZsdDsvaDMmZ3Q7Jmx0Oy9ib2R5Jmd0OyZsdDsvaHRtbCZndDsnPGJyPgogICAgICAgICAg ICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIEVSUk9SIElQQSBzZXJ2ZXIgdXBncmFkZQog ICAgICAgICAgICAgICAgICAgIGZhaWxlZDogSW5zcGVjdCAvdmFyL2xvZy9pcGF1cGdyYWRlLmxv ZyBhbmQgcnVuCiAgICAgICAgICAgICAgICAgICAgY29tbWFuZCBpcGEtc2VydmVyLXVwZ3JhZGUg bWFudWFsbHkuPGJyPgogICAgICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERF QlVHIMKgIEZpbGUKICAgICAgICAgICAgICAgICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUt cGFja2FnZXMvaXBhcHl0aG9uL2FkbWludG9vbC5weSIsCiAgICAgICAgICAgICAgICAgICAgbGlu ZSAxNzgsIGluIGV4ZWN1dGU8YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgwqAgcmV0dXJuX3Zh bHVlID0gc2VsZi5ydW4oKTxicj4KICAgICAgICAgICAgICAgICAgICDCoCBGaWxlCiIvdXNyL2xp Yi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9pcGFfc2VydmVyX3Vw Z3JhZGUucHkiLAogICAgICAgICAgICAgICAgICAgIGxpbmUgNTQsIGluIHJ1bjxicj4KICAgICAg ICAgICAgICAgICAgICDCoCDCoCBzZXJ2ZXIudXBncmFkZSgpPGJyPgogICAgICAgICAgICAgICAg ICAgIMKgIEZpbGUKICAgICAgICAgICAgICAgICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUt cGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvc2VydmVyL3VwZ3JhZGUucHkiLAogICAgICAgICAg ICAgICAgICAgIGxpbmUgMjE0NiwgaW4gdXBncmFkZTxicj4KICAgICAgICAgICAgICAgICAgICDC oCDCoCB1cGdyYWRlX2NvbmZpZ3VyYXRpb24oKTxicj4KICAgICAgICAgICAgICAgICAgICDCoCBG aWxlCiAgICAgICAgICAgICAgICAgICAgIi91c3IvbGliL3B5dGhvbjIuNy9zaXRlLXBhY2thZ2Vz L2lwYXNlcnZlci9pbnN0YWxsL3NlcnZlci91cGdyYWRlLnB5IiwKICAgICAgICAgICAgICAgICAg ICBsaW5lIDIwMTgsIGluIHVwZ3JhZGVfY29uZmlndXJhdGlvbjxicj4KICAgICAgICAgICAgICAg ICAgICDCoCDCoCBjYV9lbmFibGVfbGRhcF9wcm9maWxlX3N1YnN5c3RlbShjYSk8YnI+CiAgICAg ICAgICAgICAgICAgICAgwqAgRmlsZQogICAgICAgICAgICAgICAgICAgICIvdXNyL2xpYi9weXRo b24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9zZXJ2ZXIvdXBncmFkZS5weSIs CiAgICAgICAgICAgICAgICAgICAgbGluZSA0MDYsIGluIGNhX2VuYWJsZV9sZGFwX3Byb2ZpbGVf c3Vic3lzdGVtPGJyPgogICAgICAgICAgICAgICAgICAgIMKgIMKgIGNhaW5zdGFuY2UubWlncmF0 ZV9wcm9maWxlc190b19sZGFwKCk8YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgRmlsZQogICAg ICAgICAgICAgICAgICAgICIvdXNyL2xpYi9weXRob24yLjcvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2 ZXIvaW5zdGFsbC9jYWluc3RhbmNlLnB5IiwKICAgICAgICAgICAgICAgICAgICBsaW5lIDIwMjcs IGluIG1pZ3JhdGVfcHJvZmlsZXNfdG9fbGRhcDxicj4KICAgICAgICAgICAgICAgICAgICDCoCDC oCBfY3JlYXRlX2RvZ3RhZ19wcm9maWxlKHByb2ZpbGVfaWQsIHByb2ZpbGVfZGF0YSwKICAgICAg ICAgICAgICAgICAgICBvdmVyd3JpdGU9RmFsc2UpPGJyPgogICAgICAgICAgICAgICAgICAgIMKg IEZpbGUKICAgICAgICAgICAgICAgICAgICAiL3Vzci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2Fn ZXMvaXBhc2VydmVyL2luc3RhbGwvY2FpbnN0YW5jZS5weSIsCiAgICAgICAgICAgICAgICAgICAg bGluZSAyMDMzLCBpbiBfY3JlYXRlX2RvZ3RhZ19wcm9maWxlPGJyPgogICAgICAgICAgICAgICAg ICAgIMKgIMKgIHdpdGggYXBpLkJhY2tlbmQucmFfY2VydHByb2ZpbGUgYXMgcHJvZmlsZV9hcGk6 PGJyPgogICAgICAgICAgICAgICAgICAgIMKgIEZpbGUKICAgICAgICAgICAgICAgICAgICAiL3Vz ci9saWIvcHl0aG9uMi43L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL3BsdWdpbnMvZG9ndGFnLnB5 IiwKICAgICAgICAgICAgICAgICAgICBsaW5lIDEzMTUsIGluIF9fZW50ZXJfXzxicj4KICAgICAg ICAgICAgICAgICAgICDCoCDCoCByYWlzZQogICAgICAgICAgICAgICAgICAgIGVycm9ycy5SZW1v dGVSZXRyaWV2ZUVycm9yKHJlYXNvbj1fKCdGYWlsZWQgdG8KICAgICAgICAgICAgICAgICAgICBh dXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEknKSk8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgIDIwMTktMTEtMjBUMTg6MTg6MzFaIERFQlVHIFRoZSBpcGEt c2VydmVyLXVwZ3JhZGUKICAgICAgICAgICAgICAgICAgICBjb21tYW5kIGZhaWxlZCwgZXhjZXB0 aW9uOiBSZW1vdGVSZXRyaWV2ZUVycm9yOgogICAgICAgICAgICAgICAgICAgIEZhaWxlZCB0byBh dXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEk8YnI+CiAgICAgICAgICAgICAgICAgICAgMjAxOS0x MS0yMFQxODoxODozMVogRVJST1IgVW5leHBlY3RlZCBlcnJvciAtIHNlZQogICAgICAgICAgICAg ICAgICAgIC92YXIvbG9nL2lwYXVwZ3JhZGUubG9nIGZvciBkZXRhaWxzOjxicj4KICAgICAgICAg ICAgICAgICAgICBSZW1vdGVSZXRyaWV2ZUVycm9yOiBGYWlsZWQgdG8gYXV0aGVudGljYXRlIHRv IENBCiAgICAgICAgICAgICAgICAgICAgUkVTVCBBUEk8L2Rpdj4KICAgICAgICAgICAgICAgICAg PGRpdj4KICAgICAgICAgICAgICAgICAgICA8ZGl2PgogICAgICAgICAgICAgICAgICAgICAgPGRp dj4KICAgICAgICAgICAgICAgICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+SW4gdGhpcyBr ZGMgSSBzZWUgdGhlc2UgZXJyb3JzIGluIGdldGNlcnQKICAgICAgICAgICAgICAgICAgICAgICAg ICBsaXN0OjwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+UmVxdWVz dCBJRCAnMjAxOTAyMjAxODIwMTQnOjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDC oCDCoCDCoCBzdGF0dXM6IE1PTklUT1JJTkc8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgY2EtZXJyb3I6IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3R1Y2s6IG5vPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgIMKgIMKgIMKgIMKgIGtleSBwYWlyIHN0b3JhZ2U6CnR5cGU9TlNTREIsbG9jYXRp b249Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMnLG5pY2tuYW1lPSdhdWRpdFNpZ25pbmdDZXJ0 CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlm aWNhdGUgREInLHBpbgogICAgICAgICAgICAgICAgICAgICAgICAgIHNldDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBjZXJ0aWZpY2F0ZToKdHlwZT1OU1NEQixsb2Nh dGlvbj0nL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcycsbmlja25hbWU9J2F1ZGl0U2lnbmluZ0Nl cnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScsdG9rZW49J05TUyBDZXJ0 aWZpY2F0ZSBEQic8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgQ0E6 IGRvZ3RhZy1pcGEtY2EtcmVuZXctYWdlbnQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgaXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz08YQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwvYT48 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3ViamVjdDogQ049Q0Eg QXVkaXQsTz08YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9N QUlOLklUIgogICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVl Ij5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1ODoyNCBVVEM8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgwqAgwqAgwqAgwqAga2V5IHVzYWdlOgogICAgICAgICAgICAgICAgICAgICAgICAg IGRpZ2l0YWxTaWduYXR1cmUsbm9uUmVwdWRpYXRpb248YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgwqAgwqAgwqAgwqAgcHJlLXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgICAg ICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3RvcF9wa2ljYWQ8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2Nl cnQKICAgICAgICAgICAgICAgICAgICAgICAgICAiYXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1j YSI8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgdHJhY2s6IHllczxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgUmVxdWVzdCBJRCAnMjAxOTAyMjAxODIwMTUn Ojxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1PTklU T1JJTkc8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2EtZXJyb3I6 IEludmFsaWQgY29va2llOiB1Jyc8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAgc3R1Y2s6IG5vPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGtleSBwYWlyIHN0b3JhZ2U6CnR5cGU9TlNTREIsbG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21j YXQvYWxpYXMnLG5pY2tuYW1lPSdvY3NwU2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAg ICAgICBjZXJ0LXBraS1jYScsdG9rZW49J05TUyBDZXJ0aWZpY2F0ZSBEQicscGluCiAgICAgICAg ICAgICAgICAgICAgICAgICAgc2V0PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKg IMKgIMKgIGNlcnRpZmljYXRlOgp0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2ktdG9t Y2F0L2FsaWFzJyxuaWNrbmFtZT0nb2NzcFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAgICAgICAg ICAgICAgY2VydC1wa2ktY2EnLHRva2VuPSdOU1MgQ2VydGlmaWNhdGUgREInPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIENBOiBkb2d0YWctaXBhLWNhLXJlbmV3LWFn ZW50PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGlzc3VlcjogQ049 Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89PGEKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhy ZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgIMKgIMKgIMKgIMKgIHN1YmplY3Q6IENOPU9DU1AgU3Vic3lzdGVtLE89PGEKICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+ PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGV4cGlyZXM6IDIwMTkt MTItMDUgMTM6NTg6MjQgVVRDPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKg IMKgIGtleSB1c2FnZToKICAgICAgICAgICAgICAgICAgICAgICAgICBkaWdpdGFsU2lnbmF0dXJl LG5vblJlcHVkaWF0aW9uLGtleUNlcnRTaWduLGNSTFNpZ248YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgwqAgwqAgwqAgwqAgZWt1OiBpZC1rcC1PQ1NQU2lnbmluZzxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBwcmUtc2F2ZSBjb21tYW5kOgogICAgICAgICAg ICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBwb3N0LXNhdmUgY29tbWFu ZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIv cmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICJvY3NwU2lnbmluZ0NlcnQg Y2VydC1wa2ktY2EiPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHRy YWNrOiB5ZXM8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgYXV0by1y ZW5ldzogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFJlcXVlc3QgSUQgJzIwMTkw MjIwMTgyMDE2Jzo8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3Rh dHVzOiBNT05JVE9SSU5HPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGNhLWVycm9yOiBJbnZhbGlkIGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIMKgIMKgIMKgIMKgIHN0dWNrOiBubzxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBrZXkgcGFpciBzdG9yYWdlOgogICAgICAgICAgICAgICAgICAgICAgICAgIHR5 cGU9TlNTREIsbG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMnLG5pY2tuYW1lPSdz dWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnLHRva2Vu PSdOU1MgQ2VydGlmaWNhdGUgREInLHBpbgogICAgICAgICAgICAgICAgICAgICAgICAgIHNldDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBjZXJ0aWZpY2F0ZToKICAg ICAgICAgICAgICAgICAgICAgICAgICB0eXBlPU5TU0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2kt dG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAg ICAgICAgIGNlcnQtcGtpLWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJzxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1h Z2VudDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6IENO PUNlcnRpZmljYXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBo cmVmPSJodHRwOi8vTC5ET01BSU4uSVQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtb3ot ZG8tbm90LXNlbmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1DQSBTdWJzeXN0ZW0sTz08YQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwvYT48 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0x Mi0wNSAxMzo1ODoyNCBVVEM8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAg wqAga2V5IHVzYWdlOgogICAgICAgICAgICAgICAgICAgICAgICAgIGRpZ2l0YWxTaWduYXR1cmUs bm9uUmVwdWRpYXRpb24sa2V5RW5jaXBoZXJtZW50LGRhdGFFbmNpcGhlcm1lbnQ8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlk LWtwLWNsaWVudEF1dGg8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAg cHJlLXNhdmUgY29tbWFuZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMv aXBhL2NlcnRtb25nZXIvc3RvcF9wa2ljYWQ8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAg L3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2NlcnQKICAgICAgICAgICAgICAg ICAgICAgICAgICAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSI8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8L2Rpdj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAg ICAgICAgICAgICAgICAgICA8ZGl2PlJlcXVlc3QgSUQgJzIwMTkwMjIwMTgyMDE4Jzo8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgc3RhdHVzOiBNT05JVE9SSU5HPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNhLWVycm9yOiBJbnZhbGlk IGNvb2tpZTogdScnPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHN0 dWNrOiBubzxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBrZXkgcGFp ciBzdG9yYWdlOgogICAgICAgICAgICAgICAgICAgICAgICAgIHR5cGU9RklMRSxsb2NhdGlvbj0n L3Zhci9saWIvaXBhL3JhLWFnZW50LmtleSc8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg wqAgwqAgwqAgwqAgY2VydGlmaWNhdGU6CiAgICAgICAgICAgICAgICAgICAgICAgICAgdHlwZT1G SUxFLGxvY2F0aW9uPScvdmFyL2xpYi9pcGEvcmEtYWdlbnQucGVtJzxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6IENOPUNlcnRp ZmljYXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJo dHRwOi8vTC5ET01BSU4uSVQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90 LXNlbmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICDCoCDCoCDCoCDCoCBzdWJqZWN0OiBDTj1JUEEgUkEsTz08YQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgaHJlZj0iaHR0cDovL0wuRE9NQUlOLklUIgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5MLkRPTUFJTi5JVDwvYT48YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgZXhwaXJlczogMjAxOS0xMi0wNSAxMzo1ODo0 NCBVVEM8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAga2V5IHVzYWdl OgogICAgICAgICAgICAgICAgICAgICAgICAgIGRpZ2l0YWxTaWduYXR1cmUsbm9uUmVwdWRpYXRp b24sa2V5RW5jaXBoZXJtZW50LGRhdGFFbmNpcGhlcm1lbnQ8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgwqAgwqAgwqAgwqAgZWt1OiBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1 dGg8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAgwqAgwqAgcHJlLXNhdmUgY29t bWFuZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25n ZXIvcmVuZXdfcmFfY2VydF9wcmU8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAgcG9zdC1zYXZlIGNvbW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgL3Vzci9s aWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X3JhX2NlcnQ8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgwqAgwqAgwqAgwqAgdHJhY2s6IHllczxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICDCoCDCoCDCoCDCoCBhdXRvLXJlbmV3OiB5ZXM8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgUmVxdWVzdCBJRCAnMjAxOTAyMjAxODIwMTknOjxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICDCoCDCoCDCoCDCoCBzdGF0dXM6IE1PTklUT1JJTkc8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgwqAgwqAgwqAgwqAgY2EtZXJyb3I6IFNlcnZlciBhdCAiPGEKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHBzOi8va2RjMi5sLmRvbWFpbi5pdDo4NDQzL2Nh L2FnZW50L2NhL3Byb2ZpbGVQcm9jZXNzIgogICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96 LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRwczovL2tkYzIubC5kb21haW4uaXQ6ODQ0My9jYS9hZ2Vu dC9jYS9wcm9maWxlUHJvY2VzczwvYT4iCiAgICAgICAgICAgICAgICAgICAgICAgICAgcmVwbGll ZDogMTogSW52YWxpZCBDcmVkZW50aWFsLjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBzdHVjazogbm88YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgwqAgwqAg wqAgwqAga2V5IHBhaXIgc3RvcmFnZToKICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPU5T U0RCLGxvY2F0aW9uPScvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzJyxuaWNrbmFtZT0nU2VydmVy LUNlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScsdG9rZW49J05TUyBD ZXJ0aWZpY2F0ZSBEQicscGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgc2V0PGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGNlcnRpZmljYXRlOgogICAgICAgICAg ICAgICAgICAgICAgICAgIHR5cGU9TlNTREIsbG9jYXRpb249Jy9ldGMvcGtpL3BraS10b21jYXQv YWxpYXMnLG5pY2tuYW1lPSdTZXJ2ZXItQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgIGNl cnQtcGtpLWNhJyx0b2tlbj0nTlNTIENlcnRpZmljYXRlIERCJzxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICDCoCDCoCDCoCDCoCBDQTogZG9ndGFnLWlwYS1jYS1yZW5ldy1hZ2VudDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICDCoCDCoCDCoCDCoCBpc3N1ZXI6IENOPUNlcnRpZmlj YXRlIEF1dGhvcml0eSxPPTxhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJodHRw Oi8vTC5ET01BSU4uSVQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNl bmQ9InRydWUiPkwuRE9NQUlOLklUPC9hPjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCBzdWJqZWN0OiBDTj08YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgaHJl Zj0iaHR0cDovL2tkYzIubC5kb21haW4uaXQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBt b3otZG8tbm90LXNlbmQ9InRydWUiPmtkYzIubC5kb21haW4uaXQ8L2E+LE89PGEKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGhyZWY9Imh0dHA6Ly9MLkRPTUFJTi5JVCIKICAgICAgICAgICAg ICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+TC5ET01BSU4uSVQ8L2E+PGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGV4cGlyZXM6IDIwMTktMTIt MTAgMTA6NTc6NTIgVVRDPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IGtleSB1c2FnZToKICAgICAgICAgICAgICAgICAgICAgICAgICBkaWdpdGFsU2lnbmF0dXJlLG5v blJlcHVkaWF0aW9uLGtleUVuY2lwaGVybWVudCxkYXRhRW5jaXBoZXJtZW50PGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIGVrdToKICAgICAgICAgICAgICAgICAgICAg ICAgICBpZC1rcC1zZXJ2ZXJBdXRoLGlkLWtwLWNsaWVudEF1dGgsaWQta3AtZW1haWxQcm90ZWN0 aW9uPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKgIHByZS1zYXZlIGNv bW1hbmQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9u Z2VyL3N0b3BfcGtpY2FkPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKgIMKgIMKg IHBvc3Qtc2F2ZSBjb21tYW5kOgogICAgICAgICAgICAgICAgICAgICAgICAgIC91c3IvbGliZXhl Yy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAg IlNlcnZlci1DZXJ0IGNlcnQtcGtpLWNhIjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICDC oCDCoCDCoCDCoCB0cmFjazogeWVzPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgIMKg IMKgIMKgIGF1dG8tcmVuZXc6IHllczwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2 Pjxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAg ICAgIDxkaXY+SSBzdGlsbCBoYXZlIGEgd29ya2luZyByZXBsaWNhLCBzbyBJIGNvdWxkCiAgICAg ICAgICAgICAgICAgICAgICAgICAganVzdCByZWluc3RhbGwgYW5kIGhhdmUgYSB3b3JraW5nIHNl dCBpbiBhCiAgICAgICAgICAgICAgICAgICAgICAgICAgY291cGxlIG9mIG1pbnV0ZXMsIGJ1dCBJ IHdvdWxkIGxpa2UgdG8gZmluZAogICAgICAgICAgICAgICAgICAgICAgICAgIG91dCB3aGF0IGhh cyBnb25lIHdyb25nLjwvZGl2PgogICAgICAgICAgICAgICAgICAgICAgICA8ZGl2Pjxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDxkaXY+ VGhlIHN5c3RlbXMgYXJlIHJ1bm5pbmcKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2Vy dmVyLTQuNi41LTExLmVsNy5jZW50b3MuMy54ODZfNjQ8L2Rpdj4KICAgICAgICAgICAgICAgICAg ICAgICAgPGRpdj48YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAg ICAgICAgICAgICAgICA8ZGl2PkFueSBoZWxwIHdlbGNvbWUgOy0pPC9kaXY+CiAgICAgICAgICAg ICAgICAgICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAg ICAgICAgICAgICAgICAgICAgICAgPGRpdj5UaGFua3MsPC9kaXY+CiAgICAgICAgICAgICAgICAg ICAgICAgIDxkaXY+PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Rpdj4KICAgICAgICAg ICAgICAgICAgICAgICAgPGRpdj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8ZGl2IGRpcj0i bHRyIiBjbGFzcz0iZ21haWxfc2lnbmF0dXJlIgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ZGF0YS1zbWFydG1haWw9ImdtYWlsX3NpZ25hdHVyZSI+LS08YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBHcm9ldGVuLDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5hdHhv PC9kaXY+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAg ICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgICAgIDwv ZGl2PgogICAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRI ZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgICAgICAgICAgPHByZSBjbGFzcz0ibW96LXF1b3RlLXBy ZSIgd3JhcD0iIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFi YnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9z dGVkLm9yZzwvYT4KVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNl cnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KRmVkb3JhIENvZGUgb2YgQ29uZHVj dDogPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9kb2NzLmZl ZG9yYXByb2plY3Qub3JnL2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LyIgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIj5odHRwczovL2RvY3MuZmVkb3JhcHJvamVjdC5vcmcvZW4tVVMvcHJvamVj dC9jb2RlLW9mLWNvbmR1Y3QvPC9hPgpMaXN0IEd1aWRlbGluZXM6IDxhIGNsYXNzPSJtb3otdHh0 LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWls aW5nX2xpc3RfZ3VpZGVsaW5lcyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRwczovL2ZlZG9y YXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXM8L2E+Ckxpc3QgQXJjaGl2 ZXM6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZy9hcmNoaXZlcy9saXN0L2ZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRwczovL2xpc3RzLmZlZG9yYWhv c3RlZC5vcmcvYXJjaGl2ZXMvbGlzdC9mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmc8L2E+CjwvcHJlPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4K ICAgICAgICAgIDwvZGl2PgogICAgICAgICAgPGJyPgogICAgICAgICAgPGZpZWxkc2V0IGNsYXNz PSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgICAgIDxwcmUgY2xhc3M9 Im1vei1xdW90ZS1wcmUiIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1v ei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxp c3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8g PGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEt dXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVl Ij5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CkZlZG9yYSBD b2RlIG9mIENvbmR1Y3Q6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0 dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVj dC8iIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LzwvYT4KTGlzdCBHdWlkZWxpbmVzOiA8YSBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2ZlZG9yYXByb2plY3Qu b3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMiIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ aHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL01haWxpbmdfbGlzdF9ndWlkZWxpbmVzPC9h PgpMaXN0IEFyY2hpdmVzOiA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJo dHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvYXJjaGl2ZXMvbGlzdC9mcmVlaXBhLXVzZXJz QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+aHR0cHM6Ly9s aXN0cy5mZWRvcmFob3N0ZWQub3JnL2FyY2hpdmVzL2xpc3QvZnJlZWlwYS11c2Vyc0BsaXN0cy5m ZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg PGJyPgogICAgICA8L2Rpdj4KICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVB dHRhY2htZW50SGVhZGVyIj48L2ZpZWxkc2V0PgogICAgICA8cHJlIGNsYXNzPSJtb3otcXVvdGUt cHJlIiB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCkZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3Rl ZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJz Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn Ij5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CkZlZG9yYSBD b2RlIG9mIENvbmR1Y3Q6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0 dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVj dC8iPmh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2Yt Y29uZHVjdC88L2E+Ckxpc3QgR3VpZGVsaW5lczogPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIgaHJlZj0iaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL01haWxpbmdfbGlzdF9n dWlkZWxpbmVzIj5odHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1 aWRlbGluZXM8L2E+Ckxpc3QgQXJjaGl2ZXM6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hcmNoaXZlcy9saXN0L2Zy ZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+aHR0cHM6Ly9saXN0cy5mZWRvcmFo b3N0ZWQub3JnL2FyY2hpdmVzL2xpc3QvZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu b3JnPC9hPgo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRt bD4K --===============5543263153100526964==-- From rcritten at redhat.com Thu Oct 1 18:33:57 2020 Content-Type: multipart/mixed; boundary="===============7501458982138868808==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 14:33:23 -0400 Message-ID: In-Reply-To: 58c69c22-467a-1904-4656-11fc65333e8d@ghs.com --===============7501458982138868808== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Kees Bakker via FreeIPA-users wrote: > Can I safely do the following? > = > ipa-getcert resubmit -i 20181127141739 > ipa-getcert resubmit -i 20181127141749 > ipa-getcert resubmit -i 20181127141750 > ipa-getcert resubmit -i 20181127141751 No. Only the renewal master should attempt renewing the certificates. The cookie error was fixed in https://bugzilla.redhat.com/show_bug.cgi?id=3D1788907 A description of what is happening is at https://github.com/freeipa/freeipa/commit/b5b9efeb57c010443c33c6f14f831abdb= d804e78 Try restarting certmonger. rob > = > = > = > On 01-10-2020 17:36, Kees Bakker via FreeIPA-users wrote: >> **** EXTERNAL E-MAIL **** >> >> On the non-renewal masters there are 4 certificates that show >> "ca-error: Invalid cookie: u''" >> >> Request ID '20181127141739': >> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0=C2=A0=C2=A0 subject: CN=3DIPA RA,O=3DGHS.NL >> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:48 UTC >> Request ID '20181127141749': >> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Audit,O=3DGHS.NL >> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >> Request ID '20181127141750': >> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0=C2=A0=C2=A0 subject: CN=3DOCSP Subsystem,O=3DGHS.NL >> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:31 UTC >> Request ID '20181127141751': >> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Subsystem,O=3DGHS.NL >> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >> >> All of them are "system certificates" that are already renewed on the >> CA Renewal Master. >> >> How do I get these renewed? I don't like to run whatever command, because >> I'm too scared to break the system for good. >> -- Kees >> >> >> On 01-10-2020 16:07, Kees Bakker via FreeIPA-users wrote: >>> This now happened to me too. >>> >>> The solution in this thread was to copy /var/lib/ipa/ra-agent.* to >>> the failing system. >>> After that I was able to restart (ipactl restart). >>> >>> What remains a mystery is **why** this happened. >>> >>> In my case, we have three CA masters, one is the CA renewal master >>> (of course). >>> Two days ago, linge, the renewal master, renewed a few certificates. >>> Here is a summary >>> of journalctl. >>> >>> [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' >>> sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file >>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>> sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named >>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201532. >>> sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named >>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201531. >>> sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named >>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>> sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>> dogtag-ipa-renew-agent returned 0 >>> sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named >>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>> "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>> sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>> dogtag-ipa-renew-agent returned 0 >>> sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named >>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>> sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>> dogtag-ipa-renew-agent returned 0 >>> sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file >>> "/var/lib/ipa/ra-agent.pem" issued by CA and saved. >>> sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>> dogtag-ipa-renew-agent returned 5 >>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>> Forwarding request to dogtag-ipa-renew-agent >>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>> dogtag-ipa-renew-agent returned 0 >>> sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named >>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>> >>> Today (two days later) I looked at the two other CA masters to see if >>> these same certificates were OK. >>> I saw this: >>> >>> [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' >>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in >>> file "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named >>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201532. >>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named >>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201531. >>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named >>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>> sep 29 11:22:15 iparep3.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[214487]: Updated certificate not >>> available >>> sep 29 11:22:16 iparep3.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[214488]: Updated certificate not >>> available >>> sep 29 11:22:16 iparep3.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[214496]: Updated certificate not >>> available >>> sep 29 11:22:17 iparep3.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[214505]: Updated certificate not >>> available >>> sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 >>> [428] Invalid cookie: u'' >>> sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 >>> [428] Invalid cookie: u'' >>> sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 >>> [428] Invalid cookie: u'' >>> sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 >>> [428] Invalid cookie: u'' >>> >>> [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' >>> sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file >>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>> sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named >>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201532. >>> sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named >>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>> 20201026201531. >>> sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named >>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>> sep 29 13:00:57 rotte.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[166389]: Updated certificate not >>> available >>> sep 29 13:00:58 rotte.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[166392]: Updated certificate not >>> available >>> sep 29 13:01:08 rotte.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[166391]: Updated certificate not >>> available >>> sep 29 13:01:08 rotte.ghs.nl >>> dogtag-ipa-ca-renew-agent-submit[166390]: Updated certificate not >>> available >>> sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 >>> [97976] Invalid cookie: u'' >>> sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 >>> [97976] Invalid cookie: u'' >>> sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 >>> [97976] Invalid cookie: u'' >>> sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 >>> [97976] Invalid cookie: u'' >>> >>> So, both non-renewal masters started tried >>> dogtag-ipa-ca-renew-agent-submit, and both failed with >>> "Updated certificate not available" >>> >>> Next, I did a "yum update", hoping to get rid of the invalid cookie. >>> This updated ipa from 4.6.5 to 4.6.6 >>> The update failed because /var/lib/ipa/ra-agent.pem still had the old >>> certificate. >>> >>> After manually copying ra-agent.* to the failing system I was able to >>> restart ipa. However, I suspect >>> that things are still not right. Too many certs on the non-renewal >>> masters still need to be renewed. >>> I'm digging further ... >>> -- Kees >>> >>> On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: >>>> hi, >>>> >>>> after patching our centos 7 hosts to the latest version today, one >>>> of the two replicas is having trouble. >>>> >>>> [root(a)kdc2 ~]# ipactl status >>>> Directory Service: RUNNING >>>> krb5kdc Service: STOPPED >>>> kadmin Service: STOPPED >>>> named Service: STOPPED >>>> httpd Service: RUNNING >>>> ipa-custodia Service: STOPPED >>>> ntpd Service: STOPPED >>>> pki-tomcatd Service: RUNNING >>>> smb Service: STOPPED >>>> winbind Service: STOPPED >>>> ipa-otpd Service: STOPPED >>>> ipa-dnskeysyncd Service: STOPPED >>>> ipa: INFO: The ipactl command was successful >>>> >>>> and after digging in the logs I come across this in >>>> /var/log/ipaupgrade.log: >>>> >>>> 2019-11-20T18:18:29Z DEBUG stderr=3D >>>> 2019-11-20T18:18:31Z INFO Certmonger certificate renewal >>>> configuration already up-to-date >>>> 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery >>>> and validation] >>>> 2019-11-20T18:18:31Z DEBUG Loading StateFile from >>>> '/var/lib/ipa/sysupgrade/sysupgrade.state' >>>> 2019-11-20T18:18:31Z INFO PKIX already enabled >>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] >>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage >>>> lightweight CAs] >>>> 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists >>>> in Dogtag database] >>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>> context.ldap2_139740162547472 >>>> 2019-11-20T18:18:31Z DEBUG flushing >>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>> conn=3D >>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>> context.ldap2_139740162547472 >>>> 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] >>>> 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] >>>> 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] >>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>> context.ldap2_139740160021648 >>>> 2019-11-20T18:18:31Z DEBUG flushing >>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>> conn=3D >>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>> context.ldap2_139740160021648 >>>> 2019-11-20T18:18:31Z DEBUG request GET >>>> https://kdc2.l.domain.it:8443/ca/rest/account/login >>>> 2019-11-20T18:18:31Z DEBUG request body '' >>>> 2019-11-20T18:18:31Z DEBUG response status 401 >>>> 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 >>>> Cache-Control: private >>>> Expires: Thu, 01 Jan 1970 01:00:00 CET >>>> WWW-Authenticate: Basic realm=3D"Certificate Authority" >>>> Content-Type: text/html;charset=3Dutf-8 >>>> Content-Language: en >>>> Content-Length: 951 >>>> Date: Wed, 20 Nov 2019 18:18:31 GMT >>>> >>>> 2019-11-20T18:18:31Z DEBUG response body 'Apache >>>> Tomcat/7.0.76 - Error report

HTTP Status 401 -


>>> size=3D"1" noshade=3D"noshade">

type Status >>>> report

message

description This >>>> request requires HTTP authentication.


>>> noshade=3D"noshade">

Apache Tomcat/7.0.76

' >>>> 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect >>>> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>>> 2019-11-20T18:18:31Z DEBUG =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, >>>> in execute >>>> =C2=A0 =C2=A0 return_value =3D self.run() >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade= .py", >>>> line 54, in run >>>> =C2=A0 =C2=A0 server.upgrade() >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>>> line 2146, in upgrade >>>> =C2=A0 =C2=A0 upgrade_configuration() >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>>> line 2018, in upgrade_configuration >>>> =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >>>> line 406, in ca_enable_ldap_profile_subsystem >>>> =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>> line 2027, in migrate_profiles_to_ldap >>>> =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwri= te=3DFalse) >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>> line 2033, in _create_dogtag_profile >>>> =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: >>>> =C2=A0 File >>>> "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line >>>> 1315, in __enter__ >>>> =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to >>>> authenticate to CA REST API')) >>>> >>>> 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, >>>> exception: RemoteRetrieveError: Failed to authenticate to CA REST API >>>> 2019-11-20T18:18:31Z ERROR Unexpected error - see >>>> /var/log/ipaupgrade.log for details: >>>> RemoteRetrieveError: Failed to authenticate to CA REST API >>>> >>>> >>>> In this kdc I see these errors in getcert list: >>>> >>>> Request ID '20190220182014': >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditS= igningCert >>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'auditS= igningCert >>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.D= OMAIN.IT >>>> >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmon= ger/stop_pkicad >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmo= nger/renew_ca_cert >>>> "auditSigningCert cert-pki-ca" >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>> Request ID '20190220182015': >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSi= gningCert >>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspSi= gningCert >>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.D= OMAIN.IT >>>> >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN.= IT >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation= ,keyCertSign,cRLSign >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmon= ger/stop_pkicad >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmo= nger/renew_ca_cert >>>> "ocspSigningCert cert-pki-ca" >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>> Request ID '20190220182016': >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsys= temCert >>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsys= temCert >>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.D= OMAIN.IT >>>> >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.IT= >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmon= ger/stop_pkicad >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmo= nger/renew_ca_cert >>>> "subsystemCert cert-pki-ca" >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>> >>>> Request ID '20190220182018': >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D'= /var/lib/ipa/ra-agent.key' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var/= lib/ipa/ra-agent.pem' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.D= OMAIN.IT >>>> >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmon= ger/renew_ra_cert_pre >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmo= nger/renew_ra_cert >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>> Request ID '20190220182019': >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at >>>> "https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: >>>> 1: Invalid Credential. >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server= -Cert cert-pki-ca',token=3D'NSS >>>> Certificate DB',pin set >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Server= -Cert cert-pki-ca',token=3D'NSS >>>> Certificate DB' >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.D= OMAIN.IT >>>> >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it >>>> ,O=3DL.DOMAIN.IT >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id-= kp-emailProtection >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmon= ger/stop_pkicad >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certmo= nger/renew_ca_cert >>>> "Server-Cert cert-pki-ca" >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>> >>>> I still have a working replica, so I could just reinstall and have a >>>> working set in a couple of minutes, but I would like to find out >>>> what has gone wrong. >>>> >>>> The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 >>>> >>>> Any help welcome ;-) >>>> >>>> Thanks, >>>> >>>> -- >>>> Groeten, >>>> natxo >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahost= ed.org >>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/c= ode-of-conduct/ >>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-us= ers(a)lists.fedorahosted.org >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahoste= d.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/co= de-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-use= rs(a)lists.fedorahosted.org >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org > = > = > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org >=20 --===============7501458982138868808==-- From keesb at ghs.com Thu Oct 1 19:10:13 2020 Content-Type: multipart/mixed; boundary="===============5352768449195638812==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 21:09:55 +0200 Message-ID: <40940800-88bf-555d-c0ee-43d28a87a3ed@ghs.com> In-Reply-To: f39fa70e-aac0-4b86-6008-5990f238a11a@redhat.com --===============5352768449195638812== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 01-10-2020 20:33, Rob Crittenden wrote: > Kees Bakker via FreeIPA-users wrote: >> Can I safely do the following? >> >> ipa-getcert resubmit -i 20181127141739 >> ipa-getcert resubmit -i 20181127141749 >> ipa-getcert resubmit -i 20181127141750 >> ipa-getcert resubmit -i 20181127141751 > No. Only the renewal master should attempt renewing the certificates. OK. I'm glad I asked > The cookie error was fixed in > https://bugzilla.redhat.com/show_bug.cgi?id=3D1788907 > > A description of what is happening is at > https://github.com/freeipa/freeipa/commit/b5b9efeb57c010443c33c6f14f831ab= dbd804e78 > > Try restarting certmonger. > > rob Restarting certmonger did nothing. This is a Centos 7 system with these versions of FreeIPA and certmonger. # rpm -qa ipa\* certmonger ipa-server-trust-ad-4.6.6-11.el7.centos.x86_64 ipa-server-common-4.6.6-11.el7.centos.noarch ipa-common-4.6.6-11.el7.centos.noarch ipa-client-4.6.6-11.el7.centos.x86_64 ipa-server-4.6.6-11.el7.centos.x86_64 ipa-client-common-4.6.6-11.el7.centos.noarch ipa-server-dns-4.6.6-11.el7.centos.noarch certmonger-0.78.4-12.el7.x86_64 Snif. And I need 4.6.8 :-( -- Kees > >> >> >> On 01-10-2020 17:36, Kees Bakker via FreeIPA-users wrote: >>> **** EXTERNAL E-MAIL **** >>> >>> On the non-renewal masters there are 4 certificates that show >>> "ca-error: Invalid cookie: u''" >>> >>> Request ID '20181127141739': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DIPA RA,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:48 UTC >>> Request ID '20181127141749': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Audit,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >>> Request ID '20181127141750': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DOCSP Subsystem,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:31 UTC >>> Request ID '20181127141751': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Subsystem,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >>> >>> All of them are "system certificates" that are already renewed on the >>> CA Renewal Master. >>> >>> How do I get these renewed? I don't like to run whatever command, becau= se >>> I'm too scared to break the system for good. >>> -- Kees >>> >>> >>> On 01-10-2020 16:07, Kees Bakker via FreeIPA-users wrote: >>>> This now happened to me too. >>>> >>>> The solution in this thread was to copy /var/lib/ipa/ra-agent.* to >>>> the failing system. >>>> After that I was able to restart (ipactl restart). >>>> >>>> What remains a mystery is **why** this happened. >>>> >>>> In my case, we have three CA masters, one is the CA renewal master >>>> (of course). >>>> Two days ago, linge, the renewal master, renewed a few certificates. >>>> Here is a summary >>>> of journalctl. >>>> >>>> [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" issued by CA and saved. >>>> sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> >>>> Today (two days later) I looked at the two other CA masters to see if >>>> these same certificates were OK. >>>> I saw this: >>>> >>>> [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in >>>> file "/var/lib/ipa/ra-agent.pem" will not be valid after 2020102620154= 8. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 11:22:15 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214487]: Updated certificate not >>>> available >>>> sep 29 11:22:16 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214488]: Updated certificate not >>>> available >>>> sep 29 11:22:16 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214496]: Updated certificate not >>>> available >>>> sep 29 11:22:17 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214505]: Updated certificate not >>>> available >>>> sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 >>>> [428] Invalid cookie: u'' >>>> >>>> [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 13:00:57 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166389]: Updated certificate not >>>> available >>>> sep 29 13:00:58 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166392]: Updated certificate not >>>> available >>>> sep 29 13:01:08 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166391]: Updated certificate not >>>> available >>>> sep 29 13:01:08 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166390]: Updated certificate not >>>> available >>>> sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 >>>> [97976] Invalid cookie: u'' >>>> >>>> So, both non-renewal masters started tried >>>> dogtag-ipa-ca-renew-agent-submit, and both failed with >>>> "Updated certificate not available" >>>> >>>> Next, I did a "yum update", hoping to get rid of the invalid cookie. >>>> This updated ipa from 4.6.5 to 4.6.6 >>>> The update failed because /var/lib/ipa/ra-agent.pem still had the old >>>> certificate. >>>> >>>> After manually copying ra-agent.* to the failing system I was able to >>>> restart ipa. However, I suspect >>>> that things are still not right. Too many certs on the non-renewal >>>> masters still need to be renewed. >>>> I'm digging further ... >>>> -- Kees >>>> >>>> On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: >>>>> hi, >>>>> >>>>> after patching our centos 7 hosts to the latest version today, one >>>>> of the two replicas is having trouble. >>>>> >>>>> [root(a)kdc2 ~]# ipactl status >>>>> Directory Service: RUNNING >>>>> krb5kdc Service: STOPPED >>>>> kadmin Service: STOPPED >>>>> named Service: STOPPED >>>>> httpd Service: RUNNING >>>>> ipa-custodia Service: STOPPED >>>>> ntpd Service: STOPPED >>>>> pki-tomcatd Service: RUNNING >>>>> smb Service: STOPPED >>>>> winbind Service: STOPPED >>>>> ipa-otpd Service: STOPPED >>>>> ipa-dnskeysyncd Service: STOPPED >>>>> ipa: INFO: The ipactl command was successful >>>>> >>>>> and after digging in the logs I come across this in >>>>> /var/log/ipaupgrade.log: >>>>> >>>>> 2019-11-20T18:18:29Z DEBUG stderr=3D >>>>> 2019-11-20T18:18:31Z INFO Certmonger certificate renewal >>>>> configuration already up-to-date >>>>> 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery >>>>> and validation] >>>>> 2019-11-20T18:18:31Z DEBUG Loading StateFile from >>>>> '/var/lib/ipa/sysupgrade/sysupgrade.state' >>>>> 2019-11-20T18:18:31Z INFO PKIX already enabled >>>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] >>>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage >>>>> lightweight CAs] >>>>> 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists >>>>> in Dogtag database] >>>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>>> context.ldap2_139740162547472 >>>>> 2019-11-20T18:18:31Z DEBUG flushing >>>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>>> conn=3D >>>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>>> context.ldap2_139740162547472 >>>>> 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] >>>>> 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] >>>>> 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] >>>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>>> context.ldap2_139740160021648 >>>>> 2019-11-20T18:18:31Z DEBUG flushing >>>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>>> conn=3D >>>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>>> context.ldap2_139740160021648 >>>>> 2019-11-20T18:18:31Z DEBUG request GET >>>>> https://kdc2.l.domain.it:8443/ca/rest/account/login >>>>> 2019-11-20T18:18:31Z DEBUG request body '' >>>>> 2019-11-20T18:18:31Z DEBUG response status 401 >>>>> 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 >>>>> Cache-Control: private >>>>> Expires: Thu, 01 Jan 1970 01:00:00 CET >>>>> WWW-Authenticate: Basic realm=3D"Certificate Authority" >>>>> Content-Type: text/html;charset=3Dutf-8 >>>>> Content-Language: en >>>>> Content-Length: 951 >>>>> Date: Wed, 20 Nov 2019 18:18:31 GMT >>>>> >>>>> 2019-11-20T18:18:31Z DEBUG response body 'Apache >>>>> Tomcat/7.0.76 - Error report

HTTP Status 401 -


>>>> size=3D"1" noshade=3D"noshade">

type Status >>>>> report

message

description This >>>>> request requires HTTP authentication.


>>>> noshade=3D"noshade">

Apache Tomcat/7.0.76

' >>>>> 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect >>>>> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>>>> 2019-11-20T18:18:31Z DEBUG =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, >>>>> in execute >>>>> =C2=A0 =C2=A0 return_value =3D self.run() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrad= e.py", >>>>> line 54, in run >>>>> =C2=A0 =C2=A0 server.upgrade() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 2146, in upgrade >>>>> =C2=A0 =C2=A0 upgrade_configuration() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 2018, in upgrade_configuration >>>>> =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 406, in ca_enable_ldap_profile_subsystem >>>>> =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>>> line 2027, in migrate_profiles_to_ldap >>>>> =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwr= ite=3DFalse) >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>>> line 2033, in _create_dogtag_profile >>>>> =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line >>>>> 1315, in __enter__ >>>>> =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to >>>>> authenticate to CA REST API')) >>>>> >>>>> 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, >>>>> exception: RemoteRetrieveError: Failed to authenticate to CA REST API >>>>> 2019-11-20T18:18:31Z ERROR Unexpected error - see >>>>> /var/log/ipaupgrade.log for details: >>>>> RemoteRetrieveError: Failed to authenticate to CA REST API >>>>> >>>>> >>>>> In this kdc I see these errors in getcert list: >>>>> >>>>> Request ID '20190220182014': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'audit= SigningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'audit= SigningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "auditSigningCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182015': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspS= igningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspS= igningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN= .IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiatio= n,keyCertSign,cRLSign >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "ocspSigningCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182016': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsy= stemCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsy= stemCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.I= T >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "subsystemCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> >>>>> Request ID '20190220182018': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D= '/var/lib/ipa/ra-agent.key' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var= /lib/ipa/ra-agent.pem' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/renew_ra_cert_pre >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ra_cert >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182019': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at >>>>> "https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: >>>>> 1: Invalid Credential. >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Serve= r-Cert cert-pki-ca',token=3D'NSS >>>>> Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Serve= r-Cert cert-pki-ca',token=3D'NSS >>>>> Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it >>>>> ,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id= -kp-emailProtection >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "Server-Cert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> >>>>> I still have a working replica, so I could just reinstall and have a >>>>> working set in a couple of minutes, but I would like to find out >>>>> what has gone wrong. >>>>> >>>>> The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 >>>>> >>>>> Any help welcome ;-) >>>>> >>>>> Thanks, >>>>> >>>>> -- >>>>> Groeten, >>>>> natxo >>>>> >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahos= ted.org >>>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/= code-of-conduct/ >>>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelin= es >>>>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-u= sers(a)lists.fedorahosted.org >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahost= ed.org >>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/c= ode-of-conduct/ >>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-us= ers(a)lists.fedorahosted.org >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahoste= d.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/co= de-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-use= rs(a)lists.fedorahosted.org >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org >> --===============5352768449195638812==-- From keesb at ghs.com Thu Oct 1 20:05:48 2020 Content-Type: multipart/mixed; boundary="===============1129369251681593260==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Thu, 01 Oct 2020 22:05:11 +0200 Message-ID: In-Reply-To: f39fa70e-aac0-4b86-6008-5990f238a11a@redhat.com --===============1129369251681593260== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 01-10-2020 20:33, Rob Crittenden wrote: > Kees Bakker via FreeIPA-users wrote: >> Can I safely do the following? >> >> ipa-getcert resubmit -i 20181127141739 >> ipa-getcert resubmit -i 20181127141749 >> ipa-getcert resubmit -i 20181127141750 >> ipa-getcert resubmit -i 20181127141751 > No. Only the renewal master should attempt renewing the certificates. That conflicts with a remark from Florence in a thread with the subject "Replica not renewing IPA certificates" in January this year on this mailin= g list. "Since you are hitting the issue 8164, you can manually force the renewal on the replica (once the CA renewal master has actually renewed the cert) with getcert resubmit." and the feedback from Roderick was "Thank you very much! The getcert resubmit has successfully renewed all the certificates in need of renewal." I'm puzzled, which is it? Can I use "getcert resubmit" or can I not use it? And, if not, how is the renewal re-triggered (assuming I have manually patc= hed /usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit to avoid the cookie problem). Restarting certmonger did not help. Restarting all of IPA did not= help. -- Kees > > The cookie error was fixed in > https://bugzilla.redhat.com/show_bug.cgi?id=3D1788907 > > A description of what is happening is at > https://github.com/freeipa/freeipa/commit/b5b9efeb57c010443c33c6f14f831ab= dbd804e78 > > Try restarting certmonger. > > rob > >> >> >> On 01-10-2020 17:36, Kees Bakker via FreeIPA-users wrote: >>> **** EXTERNAL E-MAIL **** >>> >>> On the non-renewal masters there are 4 certificates that show >>> "ca-error: Invalid cookie: u''" >>> >>> Request ID '20181127141739': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DIPA RA,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:48 UTC >>> Request ID '20181127141749': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Audit,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >>> Request ID '20181127141750': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DOCSP Subsystem,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:31 UTC >>> Request ID '20181127141751': >>> =C2=A0=C2=A0=C2=A0 ca-error: Invalid cookie: u'' >>> =C2=A0=C2=A0=C2=A0 subject: CN=3DCA Subsystem,O=3DGHS.NL >>> =C2=A0=C2=A0=C2=A0 expires: 2020-10-26 20:15:32 UTC >>> >>> All of them are "system certificates" that are already renewed on the >>> CA Renewal Master. >>> >>> How do I get these renewed? I don't like to run whatever command, becau= se >>> I'm too scared to break the system for good. >>> -- Kees >>> >>> >>> On 01-10-2020 16:07, Kees Bakker via FreeIPA-users wrote: >>>> This now happened to me too. >>>> >>>> The solution in this thread was to copy /var/lib/ipa/ra-agent.* to >>>> the failing system. >>>> After that I was able to restart (ipactl restart). >>>> >>>> What remains a mystery is **why** this happened. >>>> >>>> In my case, we have three CA masters, one is the CA renewal master >>>> (of course). >>>> Two days ago, linge, the renewal master, renewed a few certificates. >>>> Here is a summary >>>> of journalctl. >>>> >>>> [root(a)linge ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16288]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16289]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16290]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 13:39:00 linge.ghs.nl certmonger[16291]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 13:39:02 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:03 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16298]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:05 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:06 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16339]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:08 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16354]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:20 linge.ghs.nl certmonger[16720]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> sep 29 13:39:22 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:23 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16297]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:25 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16726]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:27 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16741]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:39 linge.ghs.nl certmonger[17106]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> sep 29 13:39:42 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:43 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16296]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:44 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:45 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17112]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:47 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17126]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:39:49 linge.ghs.nl certmonger[17156]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" issued by CA and saved. >>>> sep 29 13:39:52 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:53 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[16299]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:54 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:55 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17162]: >>>> dogtag-ipa-renew-agent returned 5 >>>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>>> Forwarding request to dogtag-ipa-renew-agent >>>> sep 29 13:39:57 linge.ghs.nl dogtag-ipa-ca-renew-agent-submit[17177]: >>>> dogtag-ipa-renew-agent returned 0 >>>> sep 29 13:40:05 linge.ghs.nl certmonger[17540]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" issued by CA and saved. >>>> >>>> Today (two days later) I looked at the two other CA masters to see if >>>> these same certificates were OK. >>>> I saw this: >>>> >>>> [root(a)iparep3 ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214479]: Certificate in >>>> file "/var/lib/ipa/ra-agent.pem" will not be valid after 2020102620154= 8. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214480]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214481]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 11:22:13 iparep3.ghs.nl certmonger[214482]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 11:22:15 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214487]: Updated certificate not >>>> available >>>> sep 29 11:22:16 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214488]: Updated certificate not >>>> available >>>> sep 29 11:22:16 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214496]: Updated certificate not >>>> available >>>> sep 29 11:22:17 iparep3.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[214505]: Updated certificate not >>>> available >>>> sep 29 19:22:18 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:18 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:19 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:19 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:20 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:20 >>>> [428] Invalid cookie: u'' >>>> sep 29 19:22:29 iparep3.ghs.nl certmonger[428]: 2020-09-29 19:22:29 >>>> [428] Invalid cookie: u'' >>>> >>>> [root(a)rotte ~]# journalctl | grep -E 'certmonger|dogtag' >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166381]: Certificate in file >>>> "/var/lib/ipa/ra-agent.pem" will not be valid after 20201026201548. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166382]: Certificate named >>>> "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201532. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166383]: Certificate named >>>> "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in >>>> database "/etc/pki/pki-tomcat/alias" will not be valid after >>>> 20201026201531. >>>> sep 29 13:00:55 rotte.ghs.nl certmonger[166384]: Certificate named >>>> "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database >>>> "/etc/pki/pki-tomcat/alias" will not be valid after 20201026201532. >>>> sep 29 13:00:57 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166389]: Updated certificate not >>>> available >>>> sep 29 13:00:58 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166392]: Updated certificate not >>>> available >>>> sep 29 13:01:08 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166391]: Updated certificate not >>>> available >>>> sep 29 13:01:08 rotte.ghs.nl >>>> dogtag-ipa-ca-renew-agent-submit[166390]: Updated certificate not >>>> available >>>> sep 29 21:01:00 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:00 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:01 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:01 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:10 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:10 >>>> [97976] Invalid cookie: u'' >>>> sep 29 21:01:11 rotte.ghs.nl certmonger[97976]: 2020-09-29 21:01:11 >>>> [97976] Invalid cookie: u'' >>>> >>>> So, both non-renewal masters started tried >>>> dogtag-ipa-ca-renew-agent-submit, and both failed with >>>> "Updated certificate not available" >>>> >>>> Next, I did a "yum update", hoping to get rid of the invalid cookie. >>>> This updated ipa from 4.6.5 to 4.6.6 >>>> The update failed because /var/lib/ipa/ra-agent.pem still had the old >>>> certificate. >>>> >>>> After manually copying ra-agent.* to the failing system I was able to >>>> restart ipa. However, I suspect >>>> that things are still not right. Too many certs on the non-renewal >>>> masters still need to be renewed. >>>> I'm digging further ... >>>> -- Kees >>>> >>>> On 20-11-2019 20:13, Natxo Asenjo via FreeIPA-users wrote: >>>>> hi, >>>>> >>>>> after patching our centos 7 hosts to the latest version today, one >>>>> of the two replicas is having trouble. >>>>> >>>>> [root(a)kdc2 ~]# ipactl status >>>>> Directory Service: RUNNING >>>>> krb5kdc Service: STOPPED >>>>> kadmin Service: STOPPED >>>>> named Service: STOPPED >>>>> httpd Service: RUNNING >>>>> ipa-custodia Service: STOPPED >>>>> ntpd Service: STOPPED >>>>> pki-tomcatd Service: RUNNING >>>>> smb Service: STOPPED >>>>> winbind Service: STOPPED >>>>> ipa-otpd Service: STOPPED >>>>> ipa-dnskeysyncd Service: STOPPED >>>>> ipa: INFO: The ipactl command was successful >>>>> >>>>> and after digging in the logs I come across this in >>>>> /var/log/ipaupgrade.log: >>>>> >>>>> 2019-11-20T18:18:29Z DEBUG stderr=3D >>>>> 2019-11-20T18:18:31Z INFO Certmonger certificate renewal >>>>> configuration already up-to-date >>>>> 2019-11-20T18:18:31Z INFO [Enable PKIX certificate path discovery >>>>> and validation] >>>>> 2019-11-20T18:18:31Z DEBUG Loading StateFile from >>>>> '/var/lib/ipa/sysupgrade/sysupgrade.state' >>>>> 2019-11-20T18:18:31Z INFO PKIX already enabled >>>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to modify profiles] >>>>> 2019-11-20T18:18:31Z INFO [Authorizing RA Agent to manage >>>>> lightweight CAs] >>>>> 2019-11-20T18:18:31Z INFO [Ensuring Lightweight CAs container exists >>>>> in Dogtag database] >>>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>>> context.ldap2_139740162547472 >>>>> 2019-11-20T18:18:31Z DEBUG flushing >>>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>>> conn=3D >>>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>>> context.ldap2_139740162547472 >>>>> 2019-11-20T18:18:31Z INFO [Adding default OCSP URI configuration] >>>>> 2019-11-20T18:18:31Z INFO [Ensuring CA is using LDAPProfileSubsystem] >>>>> 2019-11-20T18:18:31Z INFO [Migrating certificate profiles to LDAP] >>>>> 2019-11-20T18:18:31Z DEBUG Created connection >>>>> context.ldap2_139740160021648 >>>>> 2019-11-20T18:18:31Z DEBUG flushing >>>>> ldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket from SchemaCache >>>>> 2019-11-20T18:18:31Z DEBUG retrieving schema for SchemaCache >>>>> url=3Dldapi://%2fvar%2frun%2fslapd-L-DOMAIN-IT.socket >>>>> conn=3D >>>>> 2019-11-20T18:18:31Z DEBUG Destroyed connection >>>>> context.ldap2_139740160021648 >>>>> 2019-11-20T18:18:31Z DEBUG request GET >>>>> https://kdc2.l.domain.it:8443/ca/rest/account/login >>>>> 2019-11-20T18:18:31Z DEBUG request body '' >>>>> 2019-11-20T18:18:31Z DEBUG response status 401 >>>>> 2019-11-20T18:18:31Z DEBUG response headers Server: Apache-Coyote/1.1 >>>>> Cache-Control: private >>>>> Expires: Thu, 01 Jan 1970 01:00:00 CET >>>>> WWW-Authenticate: Basic realm=3D"Certificate Authority" >>>>> Content-Type: text/html;charset=3Dutf-8 >>>>> Content-Language: en >>>>> Content-Length: 951 >>>>> Date: Wed, 20 Nov 2019 18:18:31 GMT >>>>> >>>>> 2019-11-20T18:18:31Z DEBUG response body 'Apache >>>>> Tomcat/7.0.76 - Error report

HTTP Status 401 -


>>>> size=3D"1" noshade=3D"noshade">

type Status >>>>> report

message

description This >>>>> request requires HTTP authentication.


>>>> noshade=3D"noshade">

Apache Tomcat/7.0.76

' >>>>> 2019-11-20T18:18:31Z ERROR IPA server upgrade failed: Inspect >>>>> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>>>> 2019-11-20T18:18:31Z DEBUG =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, >>>>> in execute >>>>> =C2=A0 =C2=A0 return_value =3D self.run() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrad= e.py", >>>>> line 54, in run >>>>> =C2=A0 =C2=A0 server.upgrade() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 2146, in upgrade >>>>> =C2=A0 =C2=A0 upgrade_configuration() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 2018, in upgrade_configuration >>>>> =C2=A0 =C2=A0 ca_enable_ldap_profile_subsystem(ca) >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py= ", >>>>> line 406, in ca_enable_ldap_profile_subsystem >>>>> =C2=A0 =C2=A0 cainstance.migrate_profiles_to_ldap() >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>>> line 2027, in migrate_profiles_to_ldap >>>>> =C2=A0 =C2=A0 _create_dogtag_profile(profile_id, profile_data, overwr= ite=3DFalse) >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >>>>> line 2033, in _create_dogtag_profile >>>>> =C2=A0 =C2=A0 with api.Backend.ra_certprofile as profile_api: >>>>> =C2=A0 File >>>>> "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line >>>>> 1315, in __enter__ >>>>> =C2=A0 =C2=A0 raise errors.RemoteRetrieveError(reason=3D_('Failed to >>>>> authenticate to CA REST API')) >>>>> >>>>> 2019-11-20T18:18:31Z DEBUG The ipa-server-upgrade command failed, >>>>> exception: RemoteRetrieveError: Failed to authenticate to CA REST API >>>>> 2019-11-20T18:18:31Z ERROR Unexpected error - see >>>>> /var/log/ipaupgrade.log for details: >>>>> RemoteRetrieveError: Failed to authenticate to CA REST API >>>>> >>>>> >>>>> In this kdc I see these errors in getcert list: >>>>> >>>>> Request ID '20190220182014': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'audit= SigningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'audit= SigningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Audit,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiation >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "auditSigningCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182015': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspS= igningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'ocspS= igningCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DOCSP Subsystem,O=3DL.DOMAIN= .IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: digitalSignature,nonRepudiatio= n,keyCertSign,cRLSign >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-OCSPSigning >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "ocspSigningCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182016': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsy= stemCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'subsy= stemCert >>>>> cert-pki-ca',token=3D'NSS Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DCA Subsystem,O=3DL.DOMAIN.I= T >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:24 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "subsystemCert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> >>>>> Request ID '20190220182018': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Invalid cookie: u'' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: type=3DFILE,location=3D= '/var/lib/ipa/ra-agent.key' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: type=3DFILE,location=3D'/var= /lib/ipa/ra-agent.pem' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3DIPA RA,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-05 13:58:44 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/renew_ra_cert_pre >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ra_cert >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> Request ID '20190220182019': >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 status: MONITORING >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 ca-error: Server at >>>>> "https://kdc2.l.domain.it:8443/ca/agent/ca/profileProcess" replied: >>>>> 1: Invalid Credential. >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 stuck: no >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key pair storage: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Serve= r-Cert cert-pki-ca',token=3D'NSS >>>>> Certificate DB',pin set >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 certificate: >>>>> type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',nickname=3D'Serve= r-Cert cert-pki-ca',token=3D'NSS >>>>> Certificate DB' >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 CA: dogtag-ipa-ca-renew-agent >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 issuer: CN=3DCertificate Authority,O=3DL.= DOMAIN.IT >>>>> >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 subject: CN=3Dkdc2.l.domain.it >>>>> ,O=3DL.DOMAIN.IT >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 expires: 2019-12-10 10:57:52 UTC >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 eku: id-kp-serverAuth,id-kp-clientAuth,id= -kp-emailProtection >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 pre-save command: /usr/libexec/ipa/certmo= nger/stop_pkicad >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 post-save command: /usr/libexec/ipa/certm= onger/renew_ca_cert >>>>> "Server-Cert cert-pki-ca" >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 track: yes >>>>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 auto-renew: yes >>>>> >>>>> I still have a working replica, so I could just reinstall and have a >>>>> working set in a couple of minutes, but I would like to find out >>>>> what has gone wrong. >>>>> >>>>> The systems are running ipa-server-4.6.5-11.el7.centos.3.x86_64 >>>>> >>>>> Any help welcome ;-) >>>>> >>>>> Thanks, >>>>> >>>>> -- >>>>> Groeten, >>>>> natxo >>>>> >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahos= ted.org >>>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/= code-of-conduct/ >>>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelin= es >>>>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-u= sers(a)lists.fedorahosted.org >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahost= ed.org >>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/c= ode-of-conduct/ >>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-us= ers(a)lists.fedorahosted.org >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahoste= d.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/co= de-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-use= rs(a)lists.fedorahosted.org >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org >> --===============1129369251681593260==-- From keesb at ghs.com Fri Oct 2 19:37:02 2020 Content-Type: multipart/mixed; boundary="===============6063345841246145380==" MIME-Version: 1.0 From: Kees Bakker To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: yum update problem Date: Fri, 02 Oct 2020 21:36:50 +0200 Message-ID: <746f2527-9737-0136-6f24-a2e0d0a1d350@ghs.com> In-Reply-To: c4faaa92-abe5-338f-4882-b97ed6d11f6a@ghs.com --===============6063345841246145380== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 01-10-2020 22:05, Kees Bakker via FreeIPA-users wrote: > On 01-10-2020 20:33, Rob Crittenden wrote: >> Kees Bakker via FreeIPA-users wrote: >>> Can I safely do the following? >>> >>> ipa-getcert resubmit -i 20181127141739 >>> ipa-getcert resubmit -i 20181127141749 >>> ipa-getcert resubmit -i 20181127141750 >>> ipa-getcert resubmit -i 20181127141751 >> No. Only the renewal master should attempt renewing the certificates. > That conflicts with a remark from Florence in a thread with the subject > "Replica not renewing IPA certificates" in January this year on this mail= ing list. > > "Since you are hitting the issue 8164, you can manually force the renewal > on the replica (once the CA renewal master has actually renewed the > cert) with getcert resubmit." > > and the feedback from Roderick was > > "Thank you very much! The getcert resubmit has successfully renewed all > the certificates in need of renewal." > > I'm puzzled, which is it? Can I use "getcert resubmit" or can I not use i= t? > > And, if not, how is the renewal re-triggered (assuming I have manually pa= tched > /usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit to avoid the coo= kie > problem). Restarting certmonger did not help. Restarting all of IPA did n= ot help. > -- Kees > Anyway, I decided to take a chance and just do it. Not with the ipa-getcert command but with getcert. getcert resubmit -i 20181127141751 getcert resubmit -i 20181127141750 getcert resubmit -i 20181127141749 getcert resubmit -i 20181127141739 That worked. okt 02 21:15:15 rotte.ghs.nl certmonger[184791]: Certificate named "subsyst= emCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki= -tomcat/alias" issued by CA and saved. okt 02 21:16:34 rotte.ghs.nl certmonger[185194]: Certificate named "ocspSig= ningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/p= ki-tomcat/alias" issued by CA and saved. okt 02 21:17:46 rotte.ghs.nl certmonger[185599]: Certificate named "auditSi= gningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/= pki-tomcat/alias" issued by CA and saved. okt 02 21:18:46 rotte.ghs.nl dogtag-ipa-ca-renew-agent-submit[185607]: Upda= ted certificate not available That last line is the result of resubmitting IPA RA. I have manually copied /var/lib/ipa/ra-agent.* from the renewal master to t= his machine. I think all is well now. -- = Kees --===============6063345841246145380==--