From 76dd069fa653ad9ed8f100f71124fc5027b159df Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 19 Jun 2024 08:56:07 +0200 Subject: [PATCH] Let's Encrypt changed their intermediate certificates https://letsencrypt.org/2024/03/19/new-intermediate-certificates https://letsencrypt.org/certificates/ But let's keep the old ones around for now, as some sites are still using the old intermediate. --- INITIAL-COMMANDS.md | 10 +- README.d/01-download-certs.avif | Bin 4420 -> 4578 bytes README.d/03-check-certs.avif | Bin 12089 -> 12118 bytes README.md | 14 +- certs/E5.pem | 119 ++++++++++++++++ certs/R10.pem | 231 ++++++++++++++++++++++++++++++++ global-config.rsc | 6 +- global-functions.rsc | 2 +- 8 files changed, 366 insertions(+), 16 deletions(-) create mode 100644 certs/E5.pem create mode 100644 certs/R10.pem diff --git a/INITIAL-COMMANDS.md b/INITIAL-COMMANDS.md index 4a12197..889192d 100644 --- a/INITIAL-COMMANDS.md +++ b/INITIAL-COMMANDS.md @@ -17,13 +17,13 @@ Initial commands Run the complete base installation: { - /tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/E1.pem" dst-path="letsencrypt-E1.pem" as-value; + /tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/E5.pem" dst-path="letsencrypt-E5.pem" as-value; :delay 1s; - /certificate/import file-name=letsencrypt-E1.pem passphrase=""; - :if ([ :len [ /certificate/find where fingerprint="46494e30379059df18be52124305e606fc59070e5b21076ce113954b60517cda" or fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470" ] ] != 2) do={ + /certificate/import file-name=letsencrypt-E5.pem passphrase=""; + :if ([ :len [ /certificate/find where fingerprint="e788d14b0436b5120bbee3f15c15badf08c1407fe72568a4f16f9151c380e1e3" or fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470" ] ] != 2) do={ :error "Something is wrong with your certificates!"; }; - /file/remove [ find where name="letsencrypt-E1.pem" ]; + /file/remove [ find where name="letsencrypt-E5.pem" ]; :delay 1s; /system/script/set name=("global-config-overlay-" . [ /system/clock/get date ] . "-" . [ /system/clock/get time ]) [ find where name="global-config-overlay" ]; :foreach Script in={ "global-config"; "global-config-overlay"; "global-functions" } do={ @@ -34,7 +34,7 @@ Run the complete base installation: /system/scheduler/remove [ find where name="global-scripts" ]; /system/scheduler/add name="global-scripts" start-time=startup on-event="/system/script { run global-config; run global-functions; }"; :global CertificateNameByCN; - $CertificateNameByCN "E1"; + $CertificateNameByCN "E5"; $CertificateNameByCN "ISRG Root X2"; }; diff --git a/README.d/01-download-certs.avif b/README.d/01-download-certs.avif index b27b23b8ca7990d261be1e4b23349de6d493f767..b543aff2848235791b59fc0805e850a748f17a23 100644 GIT binary patch delta 3558 zcmb7^XEfUlpvDuFnpLBAYOkV3YS-Sei4}XR(V$kTzfr9ff}+%_t;AM>ic;H)8Z~N^ z*u;2C?Yi&h`{AB*&v|~Ip7T4;x91!88V@?0o&^LV9Rd-7Kp^mcL4ZKyU1=$i;1?Ox zU>zdb)C^0oESNU~4b}!jGv>ezVBV%gq7g9gaQ`&N*B!#1KiHgTyv;NsjINeYFeLY_ znS1_Wlb9pPmw=hv2Kodlb=d=+OT5o3D2aKAj}Z^utk3>t(}NiBYk$4Q+&`ldO6)i4 zamoY!nZ6yF1k*$*6jHAvR655jh;s+4_oM@m*HE+Q07rT~br$KU4C(pRg(93iAHM z=0SIwuhK{^jXv=0=5QrSHa!%nb^-h*4a3NuB3qz8Xb0F)H*W*om4fJ&+>Gf;!C81t z^sCUS6Al}C$swTHh@pO%JF0fZ9F=Y`er6=c`N|3sZi~C3zR5eX3+;!cyGusw27e}% z47d~^Dmk1x+a3?+fRF!>h1021-+X#bVv zxHVhg{jRu4?uOy>qMi>m-w9&y+qJ9e!5f4 z)I>T?(1lCl{lP=vb$7R%%UIyWbg<3aw+|Lyb!Y|`V&8a>C#Uo^<+%nOS}_=t8Msx4 zhKX>?-mU=)5QESZ0qtoRjVtO-fc4*i-qbQlqv7mk@T|k#Iz4suUf_mkV-(9JK zxa#cUDEXOLMKK7Aa=k+Ytl2f@?$EBh#MfO_fmFRZ{_52_KrFOqVu{XJ#{=EOLwbP> zaiuPc-pXj5BFp{HwV3IYZWZC0&|7HcVpgm<#Env;Ly*#_PRD=4{mpvUs7WUmbVQqF zkKC*uz~Zw!@WC4+!Tn=o$mN!y?s_}Xw;+d?t}-^} z$ewX$d;j!vmsUAhW`QZjY)y}S7jL_p{jJMRUvJ!(T+RHzx=Poco38PKO){CNAa#EWS!7|1%--$NCvc5}w29S-bzW2aWkW_?`S z8;`~kE#Ty+Hs7-NLBdy(mnU_~-fS(NGZ+tQ?rKhnym}|Jb|p_5jH6|bwm}`K>sut; zDloM-c)eT0KH^;v-}G!Yi%_YQRBQm*43v5(_0Q->9TE>tDVkSIbwls#GC{@~>7W{y^zP1QSOR0S(>6EaS&COMCLsAB?>lE-szg>py!E#4Nlb z+Gg}e+Wz~YWJi~Z-xx3+dOr*}O5M@kT_xNV)uGQgXcfDwRKqY29x>w zelOgybz^`tFqmk9{=WdX^K>8za#_AcB_B?%qDe_CwZ1FS5>(xJdATcA!Atpwnl38M1H=9p<{8Hfd$2cvDX_Vr6zvr?VQ6`%7y!_R|T}iJLsO|o)T4Q zy8Ghi!n3sQ0=$1{FI(TvWbkQ&lGu9CLkRJI`QTDO_8*|}wm{S2mxV(9075)v))E3Y z^s*{>?drG`10L)}U$+a&N!~eSjKdiP^WEiJr)NJ|I#`i;!{TrR-|j6-_^5ThA|7%L zZw@C{P`zBjJzCah`0!{rzfo*r(21UWJZFYER_)ryE*8obh1+5^aM9e5 zX8x+S?L;H)xz zl2RZ#X+9J=dQ#Y0;YkwJ5Z;8@2$__=DqX#oZE=eu%SO);i5jPP9MmK}*Dl?3l$s$a z?AAXyp?zw)(Rf<3m3*EGxAOC0A9@{xOz)34eWGK3x2UjlM5S4;|CLmv$Jt$mN=d@x zEz?WXKb4zl9vE2hymeXOQ4{nUz=W*Z2ic!S$U$!6)#)xKqH7v#?9K}iRhJsNH%0~7 z3bry=4rB$IM_e6o*Hu3@ZUhGLg6%4Nk;c(CA?;6*teG@-aqF-4Yo}9(B1n+#=>j!cz89^jjwuD zr>xd5+Kl)q_0$e2V~bxp8;(S9@EIoIp76m}$lA}&#d5VDr-lK>gRZMye5{aoAA~u{ zxWd)d^VE2Y)5dX!H|oKFEX?pSL*?{4v_q7fIKM-r9~K!g?_xvKvlqwwih(~)#;IgZ zCfK8qdytg~OukO(wuPErNLMu@9fNs`+?7*iOE4(4TLjNpEPW+Wj#c-2a{w`&<)MoekXi!K0(Lqw;3(ATAdx)u3m ziJ9(met6rB==6?;!i&Ae`%UooNr>G`y0t1|>J56$E+e&Qb}xE*9}mOf0shx=n-QhSc7s4m}OJNw@>j0PE*O!igcQ&ulbGWqPfoaO}&F4k!?I8@B)^Uw(KZ*Qvh|7nm+BwBS~ zY(r+@8TzeI_2HO1+@%P#3ja=DzJS-qj=hh5g~nqrZ2Jr6IcdkyYOr=1)Z$FiHILbIlR ztn>*~wOmlqug$mCyG_XAD*YxKR@G-TZ5Tvlev23Ki1#^eur(!7rbkBH?r~J{6V7n? zS4EUNkVk^2e!@8RHeYReEp@!-#4tQ^qI;~Hma|P?~MVfx4; delta 3399 zcmb8ehdUGw0|4N=!`;s~WMp&MBU#~a_B<*hIh^%#vLbsXheR&>%FdNsAxFrF$mZ-7 zWy{V!r>ywCKjHhH=Y4;QbPA_GV#fmjbX5Ql0002~7a9OyfM=ve1LN^fpb3cO0FMH~ zfztSNpfRul{~cHbl&-;n`hi%x>pSn8?6NzuZ?VBw|4vJ$xgd`baEl#relfFG-neMKrOAKTy>{RgK+Mz|SwFgCwUwEb?@2BIyOEC_Mnb@FR+bI?8=LI4*!TDr5=dDB|uA#5AyI#OB`WV%5<%G*}({sFUX8nnm zoB6!acODq?Ro&KZZsuG_W>JhPwf`$rm-a)+<`ha15&xlkmG;4RU=x14va;@WP3f`5 zj>VPNvwsU@B3g%Ll6t$fqA)zeOAaIs;OORbVuCLfTUoQ<6~=`U>&Vsj*4nwpaz!hxHO_osZ8`Tle{ym)d=dDV{7n#9~)v{eX zeiwehvZt+74U;a}iqa+9%rRszGNseE;00kLJn0e zR?*!CtN3vlvK#ZAe`k4IWd2RzC7?s%ZW4*=mDNK~7POID;JdRO8B!6618fki_Nif6 zd%ndVpW5akW@|8>0Dwd3x@ackA$)CRnh?*y=t)g-;(VFYSDff?1g7_ifiE6R#X6*L z04G(5O9pYmc|P4X#<)8`jZk%|^;Kr`tP?Cv9E-ykvh-MYDf7x(N9oLN6;#JHh1b7q z*O|+8)Br*i5vGzfWsazJD-%(IZcfze2+O`!DW1IskK|AY3}5igc}Et6HlaO5+Km{! zCyQCfUXvTzE_l;}NDirp#sL<-h4{+dMg8#1dYZ?Ecy8dBuTQToKV(L82>{Zh)?$lK z6Jv{VIXtI=ieh*s-7OY$&>~|Eza&9B#97dRSWEn^XYhL#5C;laX}^P1K6sshhF$ROI&M}@W!lJ7CefH zw4QFBPmv||KIv*Cjw|G1a7NkgV`h>XiPvzi5l1W3F2L<2xw?qPxam!cS)p1s*rS*? zd`$8>4vNdE{-1lIY?{2our`8xUz&V*d1PbKZ*GMXFT8NO+-W?tv4m2@+GnURW%PzJ zd^ew@qy+$r}DMHT0KW~Di2NXuE zFnfZ`UO7!ZR$rU-^6x>6pA;?Ku`_-TBlO1ZOlephSL)2wX)~a)jr977?$+)WL2)3L zP$Bcc+W`|65K9SM@J`pxxi($Rs}s*v8jZJ7Pbk!N_z~cUjA-Vt02==9!Dq+XckQwe z?YfexpjK!fcLcxXWPbSZf{}BnmK9=Chcf*Uw;1}R2A5oSJ9WC8SJwvh3;mr zzA2sneTy=kfkZsnEffuY3Z{Sb2vqa-kJ$H3z#rKDnxFzAWMuMk)HgVSwuk~ry-(>z!sui}%}LN(dX z*XsOunlHazIRF5rRDV)g!OJ>n4=yj`&2#lkZdeB!TLq5D+QkdglszsrVMY2I`wYl? z6Yr#}sFA0pQZ9_=j3}NK>zsPO6AUjJ*Vk4~2Ca+IG)u~^Zyl6Ijc;K;oF`jhDwXx~ z?{Alr6V;>1=nr(z?5FB?TxXaI;JJWLNZw zu(Ra{?rYWTf1l&+t-uX@sZ(xm$EpN&rcSLgh4||A-E7B-V|n*&8%d;E9Kbk7tzellR6Nj+ZO)mj}<#)+$cJ4*f3VH`J`rDyXLG^w#uyxdmL)TjHc z({XThgz$SNVi?(wkcm0Pinrz#T&HqgdSBSh&1Y=BcP$`GY{MKjoU7V+=61d8Sk`(Tnx#A)dl_V=q+l~-Y5bk1#)=lB2o-M#8j z3Wd01C0SCdd^E6;!ij_X6;S(Q1tUkSVBe{7l)44&3daHagLrZ;r~8g4Idu(0{R zgvbwMM}vlR--(=&-W8=@3&x{ArNa4HGH{R(We4KlWSO^wN3^^ z0hAD@GRRl?#&nlNOlOaeTIvd2#>(#W7iH)E(uYDLCV~`kVS3@JrvutfjIBF&2C2{k z-9>5VdpPj1)1-Yfr|4;3Or78b)@5USNL5lE%5E9lC-b9MQw`EG^toO~#UOH6$-rL2 zDP>jo0K00?KBI{fW%&I;k1j3xs{h$jeUIg8EE!mBe-#SOV^`4D>J>uR9?IomRHyH5 zdzC$)BB{PI&|Iu~iJ$1%f&6Rj7&XmB=uFGS#G;F{1lz3Q&&me($QvZa^*WQtvD+vX z+9%=iO8!UbQB{v2j@4Th<8@!U_Y&g-9@u_U!itS_@@~mzdCggYURbbCa?=*RE`yXw zZTx!0?Bqf}=3Vyh-vvO0u##=0Lk{YM`kc~bB?qIZ^iOrW#3)fFNX01eA_ z#_sgsFJ(+iZdPXe!*-K%c(`!hw3n0E%3Zz9bXZbW8p50HY&-<3s+IJupfB^7(UUr5 z?MDJ$*5?mPD8Z?xXM5B|MBHWLE25ie+BF+4IV0lmE{J|fUp(jRobw-Dxt^`PtG2T$ nb&RY?1~z?HTCUKYv`g!M>Dli^*klbt=|>f6+jrmZQ%(K@0ZD3K diff --git a/README.d/03-check-certs.avif b/README.d/03-check-certs.avif index 0477c398b41b439ec6eff03c8bcd2357f2637857..f24c6b567a0696bfd30899f66157ec7c23248212 100644 GIT binary patch delta 10014 zcmV+(C*jz+Ue;cadlPj402bi@0ssI20RR92TL1tT8j+620xkoSR{?+lkh9nU4h4Ve zIv%g7*;%!QlN@n8AV|m{j7UZZYzD~V8Oi**R#4G3CXKJtNR_SPQ3C*gksv@bv~osy z&N0njx7M$c%F$O|^3n+N96Mtr9H|^<^5@sDHDgA1I()ugj3KrLa>glQT$aN8z_IlM zr}uI>7_OL9igux406e#+^?EUNxe4w;4X3xL55yW9G^o{wvIHd zG8r{ZC6jSG+2&AN88`!WRO1|AbgP~ul34tSM~dLp9Vae4sL&MPWrsZd)%knzRxhlq zb^FA%ZxbmfQGgpOf38g%*uZ(nmk3P zvb^d(&V15NazP|#*B_CsO9$}mWG&{0b#Q!?QX`Rv?*Ji~ko^k+dJGD)KZUHV=eM{2 z0EC(cxsGLpB1lxUWR_!}pNtT5=uI*WCrW~Q%T@6_f4PYY%n?F1L1Lg5JI^@kFi(1z zQiZKH{!Eodi&m4D-{?Ih@T`Bbg@?me@31g%CS#HS@4M^Axcq9`9T{MdUHEeGr1ObJ zjLDBLi~=`(@4e5dA4-PceS=k7J1uD%+C}poMJTa(&xR8J4ozwxJu6t&! zMJ2-N_V7*Nn})d-@*}_YTJCuZu~rR^z^Lec@4ZmdH8;|(r?!t+A_#4q$0R6#yM5q+ zm>dG!_vX6fYwNp(Yfl_U<;12!S~%ayP+OKG1Jv~XA=ZFu|j{{YBu5jsglZN9wU zF7l;|Juzs6G1n zReNbIR^LDJE#l{WZEm_d{zoTe;q6ON-S#+AQn=m($O>c=gOYzS!k@~Wf8m{DOtUw4 zcAi`Twr}%Mx#`dnYW|0EEp;Jl2C^+p!7nY-s+EnESb#yuVsb`9W9IK&Gq#he=;j;m z6-?$y1IrW7A0&lr#oM{JV5hZT9@jdH?whJ7yQdJMOgo?st}rIeBkaoPX$3ZT$7MaeQJbx{pOoM z?j?7+*8?%!ccsKbE?v(&WP$+a-_obvxmsA^D6ZP;!hRexs@nLb1&x7i@|0|RqmBsV zo!{3TPIjZA=(ai}v%{@NcY3V55;jl>ILO<{<0R)lg;6I-6uP7~>mjnWnM8K#5-XI5 z?O2(6pdf!X8MBZ%7$&DEF9mMg;CphuVr_HK7 za_X9`sLXy#p_|NT!ahg`cL3wC?~HRxt=wt$aXMM}w^O>AfjIk9vXQm1oGvm*QH=4Q z#(+1Ie7c;X+r#=t+e^z9`0fLdC(0Y7eSUGDqjZ1dn-X2>=G)1eLbJF-bmmXr;01D9 zYXXBR7C<=9-RY1;dGGd(z_qaZ4zGAFCEPAyib+fPjU#-(a1K{zLy~Kt@VJSuS@p}E zU&@krL{c!gR+2HizTYo7V0Mv{(>>?|de#kE!#L2a76_o342?JhF8$vw)EjfVrre#q zyVZZVms?GuZ5Gn<(q=N49(4c!C1MWs1OdHIpz?)aYu{&0a{2TfTJ7=yf(3cR+lWCX z;OYs^3G2~DdI3;RcdN_&p0?BLO5bNcXlRVi+ru#676Tj(ha8`!0Cd*Z8ruDm%lj%K z43VM)yZ|z?F+7zl237gUBZVC~exZHjX*YjYcX}?G_Hs_F;M}uqW>JBIA0I9;=m`4O zUxs!}9zPNdVWacV!yy+W?F#3jk^u}5j-+ll&1>qGeiriOjt11`fJ)_{nk%!o>>?x1 z0LCL;K_}P@&<8qvc+pF4vgr1~A&r%xjethVARoeb0Z$n}dmXAD_)bXq7fu2#t@3}F zK`hKLS&3Y?Q`f#dDgHFJ@YS?RG`E!B8FInWWj~fK37lny{nC+yvFT)4!&<1 z+uSs!Z5&9lXDago0N$(s8!>^m@y|J{w!abMv_wSFBV|bZunfb2jCMdc?de<{6vTC} z;~NPjF5Vop*vzi+hET4-TxEvNd3=BV0J=Bvjxec`#j366(06F70?Oc@= zlcNTbu@z~?tGxI7zay`>@m7lSszc$+NbSVR%^`^ljDtBC#sMUb{9>VB7TJHT&D$@B z?AG3B)l%I;g+d43KQGPCJoLqK)KdDrKk2h2g{9l^X2z+mE%e@HwUkz5DxfKi$`k+q zU;*em(izxG2`2Gyi2IGC?lLlvE^9-cR5lCB@a!bxAo5z zMNrP(4+!7)`y0m*uQ!x6b)ULdT#`IVE%KxbISb!f}5RLKY1nB6W6< z6`yLE2*%guyIHqQVwwOp@+(CG#S= z2ju8N?D`*S6UO$)%m#mhZqc+JNmg)hIL6VpXc-wJZV5kyanw);Zy%4XAoBjr;rMOD zXvm@|RAVF)&dl{6j!(8S_1_cQ>vl;I(xZmqPyBob1&GdZ_d&qt01!Fv#dDNU2cme7 zTGhNUb7N^VI#t6<0^Tf%6qy^tE;3uM2dAm^IkVxNcUkd;)#iVl4YrGJ1SWY5kUrK1 zL{dKYecd~Zj`hoGPogHGpYbfcv$uO31(GkH%p{Q@1%_7`$33W4u#Zx?Tg@8cAli8H zVq0^SkOgLtsbTW*Cpqc*0C&3AgZ0Zf(_MSLI$3n`nu5gyQn6yB00`aFG4?s@?N|}~ zWbrIXZi{cG;ub0m#7;Nh5r)I`=QtST3gJzy?@NCpwc6Fw|HAsn%wLR#@(5jww>7dvB@#x>UwcjZs5>7tC>^6ddw;VeC=r4 zV;e{W{P-9oepCUcto%9D_1$yrGHVtROEB0>2*p>+1qkX$!HnnMK8GAWq;Y_2pc>90KLm|)N_H?p`s7?My2ux z{32SpA=i4vY+E2>E0X-@2hiexJno9_Onx77S|1N;!ZiRAZA)Y4U-tXqhdJbrdb&@A zCtw%CTEHS4ke2LuAgFJ@(|77Ur~}SuuI?*84#g#*9vau2@7Uru_Qzw# zLVuAiiqKrVz8BP$7hn$+s~vzwyRu8*9oauZCgzCAQ%R zTxsK159V7qj5aaP&yj_ z5N9R(6_jV(cg+BBbXR(bqemo&d?l(pN&(*X>>M$6Cpc_lXa>oapZ|#HmAHt{EGzmPw zo*LGQmPbvnHgLhP3E$AB)K=Gu652gjEv}n$r=W>*4a7z^EzVBTP6y-K zv1kCIiYNf0iYNo6yVKWEHj-RxwrmpK6d&r)qLdA{3VGUCuQ)s!A5ST9EW=*0X;v?@ zt8QE}Y!PGr`8duxbJnYWZE4tuwuupV5o4(d_%0;$1+8(S}HkG%85kAHmr70A(0no@18I|7_9eq9cte-P_4UPND6f!)gj<|x8}@}79_ zfI0N3WxKowKk$%Q1&?gGNTUR@lOPxakQs@`bK9kIR91Bpl&=?LVOBDnuLsJzZ~2{l zrn#$2J&u|G00|Ae7N#sLrZ~Wa1tbD-!Q-xTlUoyiXdSmt<9}TtrHM>xph8GeP@E2* zc~t!uk4p23DjX*Em*9w%I*!(#;EuA(Qn=J4lEz(XJAKOT(#;eiHu*N~&ry{Dah`*v zZGF2_xM-sP0EEWCVnrmhcIXg^7DYMFAU7u-gbl*H=8DlP8@G0PK)Te@CE4SBFd|9i z?As6k9{BD6^nV8jfyXsvX4fXOhfulkZJbuOCM-!MtU39D^#_g1-<~#~O7iM+NbI3m z*nj{4o`d|8OhKFHx_J)5LY49{o(4sZGU$_B51eODg;ACWQ2qzpfO_NtmIj+Cq zCDZK@XY!*~SWe)P#-W$!p#dFmJDv{%OStU|lYnvs0DpDfC)TwHZr7ZL@Ir$B z005Rb5XKHz?mX?t=by{cr2hbf851=2ArZW%4{W5D?I5GSRb+7#IP65!j2= zic?J==z0bU0>;GQ=9alBokOwe=avkBdv54V!CP^@d$(x0)(S^!&@oFct3dshjp64> z#QvHz4o|#qw(bH+lbFLChG{QjVETj8xI;Q-5r-gAu>OzWu;?NjW)4lyO3M*O%_~_EO?N7$l)pGi!C>uNxzZxw$5Ra_^ z7QebGQCFk^`X2eluWr8&?gF#Ve1)xK@))<$S~7b?lMrNa1`CQ6QT>13kpUDxsG2M-($8-o+-T4 z+m9_2s)E4XD*xAuAGUpwmzF_sx|5R?pXQ`A9BF9UD z8wLpG^;gd&F#+-gAcNFUY2jOqMpu*K?KaAB!`G&)cLIY^_^?e7=r zbc2#aAO_!b5IuPrEGY@dp>VpJzWtL_rQ-Bm#l3%ki8}mA9&GSn2KVX#fhO^8!Q|!3 z^B10-(-ka?+h91P{8GkXfMTLy?(K^%*JcNc9*}DmgjGYS;30WPb9_vVjYZ5QA@k$0 z9&E}X%)ipcwyafu)zgTG)k+|zmq}9r89=$aBNuS~yXG`CO;v@7AVK zNBToT=eG+~`!XAnZr$-j{6j_}1oOD{*2irPFuI#y#SyzO6B_eWpp@ctg=@yU@zTJ& z=*E^0otggqkx$2+CnrSF{4}=JvK<>=&J{=m4Cas5SzDlgaT$N)+s@l};T(s1YA}Mj z2Sy!<40UNX=DXS?9f*_EdzO{meyaq1SQ;7ghn2Klt&03ON~Q9M9Nx<@Ue}JrZ5SAKS879(AS>p%(f}gZzNZ)3ndPbOALy=!R3p``;9WQpE#g#S{DEutOmI# zhL1UTCAU5YRpaQWFhA>l3k~&?FBXOHjb)};TouCROxCsTlzTQE(T-7f{gKx$Zmm)Q zBClm_cC7)wXvq+ZO(g;9ME+VeXUK!Op$-+9QZYtrR|5NyEs2R{mFHU7KSpE0@t59X?i$Sh6Xn7Ku&V8)LD)iWL^V zx1unAosyWO;C}n-feni~9SB#b(j%vbI4jvi@txF3}cPQVUL{!v-sDHz^W zFM{X7;DkwzskX{Rg+DNkmIH?|Hl2!==3!%)x#Jl>98i|A=G*3&NzT~z<|ZmigPX;s zLg;T0H1Tu-L>&X_hEp_iUZio~w;{Ctzdta4#nZF5QKjfWIVg~y?tv2KTSkv%geQC#BDKfjE`l_vQ6_!<3h22Og-<0OhvDF zy47e|j^KxPf_QjtqXZ`5b0R8bUljgDUG9-IZD_A9e z=&)Zzz|1WYFMj*($AXP;Pz9Kh0jC(pp(ah#I;NTwX>!x&og-jxjy#(ohOyVijDNG*8ZJV+$y7W*alj*TVq!D2jA!ZWs zfNbCw;6&LQErMVDXhh^>i?HYoQz^*Nq(K@#5Rtg#iME;Ohk(rXUGZ8?PP)9rxvLFQ zVVwG|3h=x9jcAsFwZF@H0fd{gv&nN#-ee0=c6KL9hQEP@K zK1S1mK|& zHG)(v08-Ng$qC*&G4ai*q=V^yOR*X*vzxZX6L07sJmA26FKr{eDi`m(Mlr*<0Vz)b z>oy!$I&g~JYn6S1XxJzm>Z2@k_I^9f7%xdZn#W((cLZW4ILrDOcVi2jlN!xvCsete z%w(-El{UsY@-Px!H0Rx+N%Ulh#nmPZ{3@^(sX}lrc^rEf^im^rA}1<;Zy|H$tS`%y z_X-$0dKI?&K3XDlCA`aBmp7?Z^>p4LkH}`pBPsTA%Xxrsgip1m4try*xI)&)ROW}j z|EuBada;cMpreQHo~`59$!?j=q_-jd2I#0=7+I)N0mHu}nmpcFp~cb)j<*$I?qBLt zRW=@ysC!R#15JOX?m;|%@7Dr1#1AP7-yGsEXkvYMa6t}-wh$Ui{o$w$yW{TKJNaZO z!AelOFQUcxhi6x9O@#ubtH1P#2|n&NQ~40})HHnvBx*QY&?;@uL@)V&)%>aJV0c7^L{P01 zr3)(f2OlzTL={bpEE6khBo2#(A_VR`Ci(c6TAOszxFgrOr^c517c9^N!n6fsk(KRm z+f028CCY69hr4bvyYRDW1T!nbN8cE$HklcXxkcDlu8@#Ll6#^Yv5q5WYhq^9;p^`& z!36h6+aQ{??`|!Bstu64;MfmhZ}xX1?F);v-t+;gyqgT|He()fXy%u!qSX~dth)TE+5hZ+7EwVnLr0IwNoT{O@jOXb#?@Fpk$$a8+&r>Lh& zZdRIqcXj5&)O_uf9ta3`Lnzo+Nx)#^xQn@R6NAFTl};3fxFgG|H-;P0q>qoEP1T3f9@2Q*mO!lw8N}nfS#pfU zjo(Hkz>{(9SIl%8PH@6{0vo&uE-qyFBz3i;vb#v?N*IR#*4QV6u4!~HM^JS`kH~wa!t0XH}V+>up!J2IMvD1&H+44y-i}u10 zEVxQBsj`TLP{Q^-T|Nc-x;KRx4a(Vn`!#Dk)Nzw$Vj6@PUPo5)v-(NCyt0t&plE2w znkte^27(0}_16&NU}+P8sj3ot72`@6-jKxX#GT#18M(!c$*|?=pn`OJtb&ZMZ#`~; zcJ}e3QkoQ459O=BFWnmr?Pu*Gz=d_J6cL(pgh(eMxmYoU%*Ciqm3r*n#(x5TJ2xoq zO}l0Zr(5Y<5B_m06RzRe9R*EtH#Z$-soPetsNnU@2zD-=6I6{NYxS;Z=CaV)B8oeC zOLko3DgG*=C;;LaM1W=O&kRIhOy4buyk=Kp9R|-AzgTAT^sZ5pD98q<#XG(KvRhxc z#VoaRjU?clkvL$;^-~i=6&`+nkZ{1}bC=M}>Xv`HdF*+Y@c{2Ub?w8^;cZ0w%k5{2__fb1mSQO zv=8)U(u~`FzzQ69F_)h(c1|K=f`f~NJd>j=5Pk?GX~o2kz%@m8SZky~N*#XID0qg@ zHMuvR1;qMX=6Un=WV&OV5ULURm$kPV$U4kZwuR=U0meDhL$s=Kt<3*ByyC`Eh())C zI`Rk6^Ror3Sdp5!sQie3_iJCQcal_n<*L}6(mL>_=sc1&58JOYP?$7Do8iD3vaeeZ zix@QE=OTtYTh0>!sx*BnZ2VLj()y4BI<9dfp6X}wZaW>)1&xRe(aOsd`s?J>+XSU- z%Ricy6v|5W*`{zk)}xbhxFu8ynS)$8Fg2T^jXB#ApfmfG+AIivN3L#N+Yj6t)Wo=b z!?RC?tI@v`Q$=Z-K_uPMpetp$U*uqbV6ujD^m{RfEKg6mDZQsu-s9<-S>@3kyg1G}YieO`$a141KUktR0Xx+_qf0d0DlHZ+@WR=(+fB7lt>6a87N3Ew?%wsPTz zvpTxP`q%QnpxUE%GP2oGg*{RD-k?p(`A_R|kIr;QwUuh;W*bQ_0tyO7m{pO=(Qd*9 z!nf@&8WuU1A@6*@Mq?&>$`J+R>hRfV+fgwr@7guIgH=mem&jr|Vt0HmNr1NqCbc*E zH*=md%UG0u!mjc!!;LDn<(K}g*EcCKPQ1rbv!CguT%wKYyIk@wG5~U}Pyi3H)^J+p z|Du-7awO^cKJ_|jUkXloR0Asqzfre%(__Np&5{m|{n!(Vz}P3qqx6`wiZaqontX zWeGoj*W8GaL&((^z&?8LM}>u2_eDZ=qhIOCiXPH*zD`XR2)1rT7_-YXc$G7y*h1iK zW*i=!4vdm^*bgu6)xj*aPOYazMw%km#-H`#V%^|vTU!t?>yHRx&XRyhX8X$^xQkBS z$rL70r*A=&e3X_JJ@Y%T;WQg%yDI(VmM6b|vMSl^cRa9??($S7&`7N!Jl8mRNQ9e+ z9Ft5=yY^-RwfnKlsfwqn35VE*r~w@~x@WTy^1$6hxmwzYY+6=u#DeqFE!4S>nf2W2 zax0JAtO1JAU4&XKfB5cdBa`i>S`ncOjz#Z|a} z>QnA@={h?bM|K-@U$CXod_%Y=X)JjC2>Qc{`yOkVh})o?_%4I$@_LS^i4U+3@j@WI z`-25J;U6g#T|1?ZBR^Gkda623`fH$M97;1;U~Q}tHp+c7nMMTKn%Ou8X0h`0!rF&* z!s?udmY|E8)-;PJlQMt~9AX~6GX2zlNS774gQp8QzO~uH=jY9>lYbF_9Q!}FlH`J5 zWW4mmwxPXIahCTMMz{{wZ2Ut)c@Dd|@H2;d%+jF8_ShK}n4`J;B!M2~G_uvA2%78kv)8d>3Xl9(5Pwb5mD1a0Ne5-~}CQj#!e zvS9V@gT(qlq>K7{*4=Xehz?jhLoBwCY@pX!2sX$Kt`!Am{cN+cpa zx2p`Fv90u&+ZrwPPIs?>Jhz%8=&s+G(Q70*zmDE~;}F6FS#luN@_oU8WC=;dZ#xnZ zuhVoJ;GqMNwO$j>Bahd&Tw1b!UZ-5o7K<J=2t<~=_!<9qEkr7{PQ$xNjKx#{?9_+K|A;D7CKedD z+-{gHN?LfOQw(TP3Gyq%C+?mKN5BApDp`>>;UL=U?`W;( z$k`@<*=$rU7j7$}4rvvC2^BE_%j&~>GRx8``p^K)5RQzzaMY4@O9sr-NF4?D`{^5b zvq0H|TT|{pdPOaSs|t%1(Mi{wQ?KVCfiH_tfUfbi41TwY?nH%Y2I;i0)U&3oE#{KC zyP5#TVk(N&p5o!El*q81KnVFCynyCY9U900`x-m?l0G ob3~xrE02aCc0ssI20RR92TL1tTB$1BC0xjl~R{?+lnX}jd4h4T| zIu5O=TG_sxr6hLpTcWuhLV1n`;`}!m1$`?lXquBo*Xg86*6}ETfIvu)AQ{>@BRuCA z=C9l9SIK2)tFL)!1bL1fv67Bdjx+gl>(`pGqdT2GUoXZG+XFdc6tON#VSZp(`hnB? zxg3mFOeY>|$A3evoo;W3p_%=YIv9WDlS8>*G?^Qjy(BZw!|Tj?AL~Hdh3O=bm%LX<7SKXQ!s0kn2Bel9ryDen&GXvS@$t7M{xU zsQWqdNjb>`k)K?CMzt&-!?BRJnjO`_@=-{RMjyNYhGIkXED7i^D$M>CvbUbz-~JM4 z9_Bfg6p0~H(UMt?ets}P&!IHPG@U95?=4rv@&4u{D=z?qIn1HSLC9^>(=Xmn+QL3iQH#*@w^8Z#z5 zzAy;g_rCW&qnYZTXdSqZ{AJnDHyF`}*UEWlUw_=>q*pf{XFmfLwJeON-J&k=KlaAfR4ja zl3Ct;F6qkvhi$3(PT_yp0fT@?YKCnaQ;nUQOT3K-KQ+6I4Dr-gU27bPE!D(cGL11L zLRm~Jw4dH8<1N%Gw*Y?-`qQoT2G(t&TmJwT$pjJ<^O2S`b{=Cd7(XTzLGRbntJ_Ix zw)y`6k#83}>uYt<-|{&-FAr*3j_;C`@>l$U5ySudV z;0?2XnvKs+fRk7BJJ_r>SnbBH_VL_GrsCu%AqdZ?U{54&2OQ^|S4nhqyZG*`@4Q(o z*6k{=kIjsh`G_uGZaOF-M<4(_E2=K&?UGl}<1aihu2@d+&!yb&L6-8<%meXUiew%h z)owK_jXFCvH+Fyd^J8XJ*a5*gCm8px{yWQg37PzFy>1}}YzWbdrHbkrKbJ#OOAhe<8LJXN3Los-50|qhg%!%d}}sPW6HYPO>> z`7VZUF{23iARXKTj>En&%`Ufbr`g2mXX4#X>ShGv?M})@*2ZwS$stBF#(x?B=`60U zBGg1Sx(=1OJj-DeS6NNLkg(dQMt*UgIw|RjsWg8&ubB(~0A$;;!#b5BU|KiM^5vc~ zPIoED$s0)QMR8x+Hv-nf>^i;RxR-FbhAAa4<}{7-0l+z3oeoK^gTmq_y=T`hb$=>J z;Sor};aW(>^80+e<$>BpPfYiq4wy-;M{jc!x+SQ9lIOpF9MC!drKdCF>ji0H}`)Ub%3&$Y;uITe1#uFokAmDNsb`_Q3 zos$QT#DiF9{PZx$Maertx#*;TLj)tK8;&zt`lX+Ryt!k6wK<>?xo9Se?Cv`Vi1UCk zh}V!w_5(Bl%FW`d7>u#S;p=O2Bu^VOZkfZ5ISGsoILBe0`MLi93mXosnowP`G@pO# z!Q|)tj@c*cgW90+rMHHyqEV&1rufU24wEVJviQi558?8I?NL5+u#9Ib&rbfN^{yI< zVmhmD7u!NC1iCbH{fCH*k_KWhF}Qz~Cx*!wz~l^YD=S;o1V{(N602lyz4*5R#;?3uDOhnw~L79o#+ejGTa1P!&VR77=<0!2o2*p_& zrD&+Fk=&1nhs)FBltNv9eVWXii~*n-7gaAEeZ(d5$t(ZKwZvM zf=NTuXzl%T#Zgoqal5!W^n&ar84$J-%i$sQ7XnZ|u6{M=+p;s6zOl4a; zdwGBO_H&V%tuKt4MrRgVWyFYw&B#=6i-HRL#42@Sc{#^HT(uMd*uRb;FiR3>u!Wja zB)gqSe8{dr`8p80K8JtWgz>$yGXbF6v~35HRh%3SF|=*k21ZERf=}UGbrb>H$K&fr zJioJeej9NbGAN2w7|8_lvpq-SlkJSXcf|Jk-I7FfsNuL%{{SBW!D2I9~c1aTAUB1YxlKInD+-0=cbgNVu0#nteY-)L^nI7$lag zyD%``yks8rn3Mbvy?@Out@Jae>HGXCti16^1kAA#vv4|`UDJoFj#AR4;Q!<|oE*FMuGv0)^$4TQjqReZ2ej--qj&VBRf zamIL$!jIv*TUjQ)hIhCm1&9&`6I5!NteU9@?-FZu755(qw=+(<+0Zr@&-ut z{b{z(;mH+L_&-#U)n1_Z)4`4sgSq zjD1NJ2AH}Z+4kRfV^WrOfbI}lw$)U#@+XFwHva&^ zC9NrR#`U!z@_)P^tDn2JPqUN2Y&pj4XCJA@ z98d?IQC@;#@cT87o8c{HJA#{KM7KC*Dsog7=bVwBLFhq>RPg*R%6v7dAa`cOmW`EC zjkFKmf4YAHd+-6l(O!vio*XmW$NvBbj*du zb+Ic!Cx0?qF#)r~1>c+u5P9|d061zZ&|_T&IOJCFma8KPnfDu3U5HqfU%q+|I#_d?l{sWNnfgbCcJD^8v@EJAO0)=X6(~u<+9xXk+lUvA!TYz-_Y9WA795dMh3= z-_omF+USm!=3fo#4=jFJa+a;OKtLeiKN&mm>VE>CP(V0(D__KR)|Q&Dmt|#tXBUYa)OOD58K0D58KmTfIGX6KN&JyJo>H;X(eb3MoL_aHpN6it~fP zq4e^X63jL07L{WAI=1D*Cczdz?~{zo!(8YQ^Fem;EM12+0(U2pdlF%t`0Waq|)PPdKd2 zM_tqJwI8%aq1)QQumcQC22OhCZaQ((xqs%WO{m*R1)OPMk+c)MuH$JkD{R7_m!R6m zoR6IGjw_lx+|K)aj+pcFyY2EezqYkG^`;W|i4gO8Ug3o~TrZ*H|# z;5NS^OM9!@t0X|7Xyc25&PtG^bH;wJ?~}LTeOA$Q4;o_A$y>W|WnzX8_(-B*w{8+N+L#=3f!L0E=iO;n#5&Eqb0k{jqN9~8 zsSH3JpkRTwjBOalpsq%WwK!W?{w(Q);TYOcyY6*U__JP?=3h5iibEVHYX~C4f3wpa z&#!-4lGnywAa#g;ZX`?&{{Wf@hJVryIXL&v;arUs38g05)37PR_vO&)C-DxmHRMJ0 zm>t}(E@F%*A1UXK_yeCxmRq~PbN>Jd1&~RODQq|fH?t}oOeCCS0zPfQ8`NS zc19IrDa!DCtG53Dnb+EDnzXan>7VeB+resL!pdWe2tZOmCmbF+=Q%a8H-Gkl+jRal z(i&Kl#;OD)g(V5V>GzdS(RlQ)IHIA#Z)tuAiBqWUY5oZ7EVV0*LP;!T)}y!FuI((* zLL+aJZrt@5P!}2KI#$=)wL6B2FZfJs1|(8TM{a=#kz`Yx@&j^l=s?^n&ScpP(9R&8=?ICTr37TLvXa$>}iTEm~1FHm^g zz4_y5^sg?bG>*y@ornMc3Ftq`G{kq-I*t9^wV9j6))6#P7*aED7GPbYoVMQh85tP> zf_q1#&8+_bWQ)e}9-m@7;TlHb0#3-|T&eb5fPwwq=Yzr0?mI%{;C~!}Kpl69^{ql1 zx3_(64Nc16&jfK8*$7}pK=(X*=BwX$w_iwJ5vr_^%&d$O7=}SrEI1$SW3OuFD52GLUI(RNQ9u{9 zU1I+LTfO^cqi|=RXkFz(@$>)==BUv{02EP002EP00Du4401^NS2{>i)JT?#z&}lNN zvxFEJ0e{KR1s*unJv(4XN9&XMr4;0P`+2`);X2XhOEnxOkfne|`gfE$L8iRZi8Nf| zV^Cp*s!W?nUn_jik(PsV z?t{W60cSm)uC}eGS2sxe^niD$Tl&}mn0Me9X!S&d3+gYZzd8?5)Ych>R#gN1bZK06 zr{g{O`~$rdG0Pa639jApZ|zJ8uGV;GtUia3k3O>m@y8HZ?&$~}%G!SK}KbKY4d{4eA{EW${ z?WWv(J7$iO&Jw1?lP_x5&uxXziX#uN8|=$^Rk_}|CVV1J7A z=(&5j2H>&MaRUL-CzPnezLQ&4#c2^2!9)IDOM7sWZ9Aztn1l};_yzA*#?faoDY$&`zP%~YNItbX$8>_9}HC~>pW-MHiPb`S21eH0N` zc1&<0D(1|ZkCWMMA3S}i9}K{u6n_dFk|hkLZS~$`)8_6lPQ?CZ&FpOzFfA;P@7N#& zer6!i1I3O-Y$(7qbg^TB@&s6n#Q6L~58Drv4k%KA%v=1Ed{{9A9EZ--zA(Hr=>E}e zoUa*N32?W~_%+=SXpv2~UD1DAYEe06Y>AScy z+S5Gr3Ec^iWp=^K>-99P6cin9j#^MOoH!f{wX}~InOJiaz_g-myaP*r$l5a0h)V^( zpA)@l2xyo%jt$hT;FUxfv#8>OV&FjM z)=Nwle{n`fvezGeiKbCH$l8^z?-3hy*VYj9cxX!tUJc`xmUdBJv}0x8XRj|SAmQ}F z*;Ga=H2JjB`G3BB%P-0vj?(1CYfNgG@-dp@7Pm7>#n#zW>~|LmezsC}lW`xAke#l1 zWnMci63f{g?Nu2p8@T90on_}iJ0MX=nTv-%ME-gp9Vxjrax7R_$xF8ZVBu zij*r=4P|zBuPr#+&r!#iD}HGGmGaFv#MzwxT)1GNmwzgMkD4{nH^kQ2WYoXi)FU)Z zwQ|A0L#DA3xN!F?0id09FC}nDssIw23m+yN1Oj7IV+OT!iQx$kmX?gvsE40jV(gQ- z%u#*1lI)!{^cbgdI0qT?WNdN?&!x1jU(&PHp62hDPsfG|E|CTR2~jglX+yN20SxLRXT-Ni*2aA4WD~JwzElU+(Er#upxv`TX`(i?a!zYS0 zGn6oKwrJ=z*y^{_|C4DLV3h@5GqUL;>MZn1d`Y`){raRqI{5aRcXgP;#`h{OH`rpo z&$$M`W4;Mz^P-BFx`Yu^ozsnmvONChMSq{ZAML+wjN@M5%vSi+dZs@&7-$qahp6we zYV?J^nKKZ7&I(Q#hrN0{miu3sE21~ECQ_7Km3Tja#%9r3^>oE)?3^$As?TxFl4^N`x?fCixD$IxpnS%0z@ z)L^+YT>^g@{?w~J5#0@c`?n%-{r-;++IM|&mQqjo4g$o~_V>~JpRwqB`YJ9yQA3yt zQ?~!WC+VXPoyWIA^`mlgp@#k2r+@ykVh{r!!Kyx8W~oD!Wz7BU*UUfMAVz9uGf=Wn z?$FyB%zVh8O~iTWGR7x&mKN5L*5_jB^P9?DJ876RZdF@G7$tW_e#J%Jlm|Q>1lS$c zAdw1~uHRaQN?*5$h%@;!4TIh%s+dl`Gr+p##xv4bn;l1oNHjSfyXc+0)PFZ=?4>ee zZ|H^dVMW=YybRdcPsaOm!;LTO}CIIEmE%0MQVx7Rd_ZC0Rcf@+LE1$$PX@x>K_X)=czlCWa&{ zTk5^BvChnyh`+rs)xuW>NeTxA3s-anl``t~Q6-0GO74H- zydBs|@G+(PkN3%-D}T}FkW%9}Td6X#3_A3q#p|E}Z7~L5Cf0aZu$QKVdjHiAaO`HT z=wR-A_unft(GR5^08-5yNEmHv`s&v*Xpddn3E{YNBQU(C(YsJ?G1m9EfuA}JZ7vKo zO|er292@1Je!~Br%tqk%!@RVz+Nn#8bYz((@3_}IZ*Mwo(|?8^ZLU`kG0$T=)7g0K z{Zkv6{c*+@J$xY5@E%73<}Rw6^W8Zf*+*Vh=GfUHB;WAS3uJNL)UIp@3ak}}CBE** ziLVtXX$Z1i#0)CRYix2;n?clppov?gpcU0oySJz$E8(qY;mFYAE07^Q=*egq?Owd# z)Q8h>n!Ibs4u8yHX;phQ*?itL24^A%L|mLpMgKuja#?nBcENF9y~LRIp0b}n>6$K!NP}%*A=x{C4%grukBP1!q=UZe+GYUWt8HsX`+gs zq{wSuVfF6>dcH=((Un6mAaYejmOD$_78FC~^MPpk zz_SwPy(TtNCi9P;;&_YyO80S|EC3&(PdW0ZF8*mtKw{sAP1UE->1#qB>b7m1pG)zTtQp1FiC8NhyD*1JeLviq+VXb z1lwL(pnvg(BmZq)aQQscT-%Lac&6E=y=msgq%<!>(Vt<=6mQ7B>PO44k@h*Lm!oCIF_RLP+ zgtHPrD;WzfGkusy@mTV7ITz#uay3Fb9_LNqGDmKMD)em{Z82X1B58E-nz?ZlQGue9c*P55Bf~rmqFo z&(A@tz`UAZ?a&^w_~BF>3Cp4%Cmh(Mfiv&BGO-R7$f6>lIZr3|B+FMqoiFGs!;1TS z7dxdgoezWp=lgS3pVtKY#9asSyKwm#e z_u@KS?mOz!Z9O{M>W#>=y6G;~()x1@`00pC=qu{nvhp%h5`Bd8NyRHP3tPm-z~2Ad z3k^(Su!Tug91Gh`HRQm&QrR8+k~KRFDehL%%QEAP(k{!N1~h({`IwSl6{Iv_+e3kd zV!fMOX9BYlH)bF{{YkEGv&cb+Sbv+*7@=!zNwn0GUb}AQ7vtu(=^8PZ;{9H_>jRdP zDjK)WX>54hq}-Zs%U^VAwT*ujPkPE2y=@?1l|mVtTzlR%EU>ciHpTJ|%&*^<&%J7P zcpf%&;`c!-)NodCKzX4~Pk#Ca?sm^`GQU*T4u~PzP{c$^HHHVS^m28il7F@zg8I+C znvdo_j6=MO=Dv&R0gMSQVdYqASbrw8TnvA>v4BN*Om_Urr!9V;CT&g0R1yZN-L@ib z-{9xsWk(*&#|wH#F7g%X0RpzR!e6=niqLLbKt7oq=l9E2(q?0w7J$`*DXnyqhjTPq zO_XA13tRbCgl^p^i+{p#sDFa$4y#2Z(4XwFd)ClH|JamL%*f$;wsB$apS|bI&Mib8 zC7H^9pNRWx7LbmNlw8L@>cNYb6_pz>Z2I00a;mAqRHzW!zPyrJUcE2e@bb5Vwl{=0 z*}x#FscnX?K%6g+-BqI|i@2PXF{ZY(1bk!eTkEKHY6`4~yHsrKDej7#5hdCb*@HXW*XU(|@94fq24m{eFB1f?BjE^CMl@fc7`%VLC`cDU9-#U&6F1W7hg0 z+?6s3-4=r}OOgdhr&BLZNo-vO0lZpeJ4B^Ta9SgXu7(-)kfV^5|I&U_RgxP7ogo`W zFjC4dDv$Hg&6FvS>+>kHD8$vNLKRD;bE!=aJ4kS{KUd(`X@47~J4i`heO1`)5*0)9 zRB0ritvCxvo_CVF_VpFL_svIS*xrs;Xxg6 zAexB&5I_->d+E!rW(h4m-;>PA7;88WIrYP;tJbO(Q`4T1ZU)CCr=_E95G03;r6`H6 zH}49}_PtMk`bwPi?U|L>5A}?m69ecH5wkK-%6H7U_J8MQF^$9iv_il7G-XXaB3rb_u+`KP~QrhYJBBNb9=h zKC-#mKz%O1&hQBX#!0HC-D=p{&T4<#$H2h|tGx_8Q(E$3JGH!=T8(mnmZ4)_t^se6 zLe?`Er7KS+T%{+FE_c*#*2)FD&*JMBAi6X-qK!oFOAaS6sg~x!ekdVuZl%%cW@3c}P?RXd;Vl`#x<~ zRMo&i8TW;_I63T1c6U%XJLmVyIPD7Ilehh_0W>WNvv0U`vI^UL%>YXyk`pF^jDPKE LW+fw9Oi7tgtG9@| diff --git a/README.md b/README.md index b6e529d..1ad5aca 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ download the certificates. If you intend to download the scripts from a different location (for example from github.com) install the corresponding certificate chain. - /tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/E1.pem" dst-path="letsencrypt-E1.pem"; + /tool/fetch "https://git.eworm.de/cgit/routeros-scripts/plain/certs/E5.pem" dst-path="letsencrypt-E5.pem"; ![screenshot: download certs](README.d/01-download-certs.avif) @@ -78,11 +78,11 @@ want to be safe download with your workstations's browser and transfer the files to your MikroTik device. * [ISRG Root X2](https://letsencrypt.org/certs/isrg-root-x2.pem) -* Let's Encrypt [E1](https://letsencrypt.org/certs/lets-encrypt-e1.pem) +* Let's Encrypt [E5](https://letsencrypt.org/certs/2024/e5.pem) Then we import the certificates. - /certificate/import file-name=letsencrypt-E1.pem passphrase=""; + /certificate/import file-name=letsencrypt-E5.pem passphrase=""; Do not worry that the command is not shown - that happens because it contains a sensitive property, the passphrase. @@ -90,13 +90,13 @@ a sensitive property, the passphrase. ![screenshot: import certs](README.d/02-import-certs.avif) For basic verification we rename the certificates and print them by -fingerprint. Make sure exactly these two certificates ("*E1*" and +fingerprint. Make sure exactly these two certificates ("*E5*" and "*ISRG-Root-X2*") are shown. Also remove the left over file. - /certificate/set name="E1" [ find where common-name="E1" ]; + /certificate/set name="E5" [ find where common-name="E5" ]; /certificate/set name="ISRG-Root-X2" [ find where common-name="ISRG Root X2" ]; - /certificate/print proplist=name,fingerprint where fingerprint="46494e30379059df18be52124305e606fc59070e5b21076ce113954b60517cda" or fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470"; - /file/remove [ find where name="letsencrypt-E1.pem" ]; + /certificate/print proplist=name,fingerprint where fingerprint="e788d14b0436b5120bbee3f15c15badf08c1407fe72568a4f16f9151c380e1e3" or fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470"; + /file/remove [ find where name="letsencrypt-E5.pem" ]; ![screenshot: check certs](README.d/03-check-certs.avif) diff --git a/certs/E5.pem b/certs/E5.pem new file mode 100644 index 0000000..3f9e915 --- /dev/null +++ b/certs/E5.pem @@ -0,0 +1,119 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 18:6e:75:d4:ee:b0:a0:5d:fd:2d:a8:20:86:5d:1e:31 + Signature Algorithm: ecdsa-with-SHA384 + Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X2 + Validity + Not Before: Mar 13 00:00:00 2024 GMT + Not After : Mar 12 23:59:59 2027 GMT + Subject: C=US, O=Let's Encrypt, CN=E5 + Subject Public Key Info: + Public Key Algorithm: id-ecPublicKey + Public-Key: (384 bit) + pub: + 04:0d:0b:3a:8a:6b:61:8e:b6:ef:dc:5f:58:e7:c6: + 42:45:54:ab:63:f6:66:61:48:0a:2e:59:75:b4:81: + 02:37:50:b7:3f:16:79:dc:98:ec:a1:28:97:72:20: + 1c:2c:cf:d5:7c:52:20:4e:54:78:5b:84:14:6b:c0: + 90:ae:85:ec:c0:51:41:3c:5a:87:7f:06:4d:d4:fe: + 60:d1:fa:6c:2d:e1:7d:95:10:88:a2:08:54:0f:99: + 1a:4c:e6:ea:0a:ac:d8 + ASN1 OID: secp384r1 + NIST CURVE: P-384 + X509v3 extensions: + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + X509v3 Extended Key Usage: + TLS Web Client Authentication, TLS Web Server Authentication + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:0 + X509v3 Subject Key Identifier: + 9F:2B:5F:CF:3C:21:4F:9D:04:B7:ED:2B:2C:C4:C6:70:8B:D2:D7:0D + X509v3 Authority Key Identifier: + 7C:42:96:AE:DE:4B:48:3B:FA:92:F8:9E:8C:CF:6D:8B:A9:72:37:95 + Authority Information Access: + CA Issuers - URI:http://x2.i.lencr.org/ + X509v3 Certificate Policies: + Policy: 2.23.140.1.2.1 + X509v3 CRL Distribution Points: + Full Name: + URI:http://x2.c.lencr.org/ + Signature Algorithm: ecdsa-with-SHA384 + Signature Value: + 30:64:02:30:1b:6d:2e:45:41:1c:45:3e:d9:5f:34:18:74:67: + 13:79:ba:ab:29:b5:b6:10:4e:83:27:4a:8b:45:4e:c7:7b:cf: + f4:40:30:1d:61:a5:e6:1c:6d:a4:90:09:92:6e:46:4b:02:30: + 46:29:18:84:34:7a:bc:fb:de:d8:1b:d8:19:a7:04:f5:cb:7e: + e7:6d:84:d9:da:8e:ea:ce:36:30:b9:a2:80:4c:2c:e6:60:12: + 4b:a9:76:aa:e8:6d:95:47:da:72:09:0c +-----BEGIN CERTIFICATE----- +MIICtDCCAjugAwIBAgIQGG511O6woF39Lagghl0eMTAKBggqhkjOPQQDAzBPMQsw +CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg +R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yNDAzMTMwMDAwMDBaFw0y +NzAzMTIyMzU5NTlaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNy +eXB0MQswCQYDVQQDEwJFNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABA0LOoprYY62 +79xfWOfGQkVUq2P2ZmFICi5ZdbSBAjdQtz8WedyY7KEol3IgHCzP1XxSIE5UeFuE +FGvAkK6F7MBRQTxah38GTdT+YNH6bC3hfZUQiKIIVA+ZGkzm6gqs2KOB+DCB9TAO +BgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIG +A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJ8rX888IU+dBLftKyzExnCL0tcN +MB8GA1UdIwQYMBaAFHxClq7eS0g7+pL4nozPbYupcjeVMDIGCCsGAQUFBwEBBCYw +JDAiBggrBgEFBQcwAoYWaHR0cDovL3gyLmkubGVuY3Iub3JnLzATBgNVHSAEDDAK +MAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDIuYy5sZW5jci5v +cmcvMAoGCCqGSM49BAMDA2cAMGQCMBttLkVBHEU+2V80GHRnE3m6qym1thBOgydK +i0VOx3vP9EAwHWGl5hxtpJAJkm5GSwIwRikYhDR6vPve2BvYGacE9ct+522E2dqO +6s42MLmigEws5mASS6l2quhtlUfacgkM +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 41:d2:9d:d1:72:ea:ee:a7:80:c1:2c:6c:e9:2f:87:52 + Signature Algorithm: ecdsa-with-SHA384 + Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X2 + Validity + Not Before: Sep 4 00:00:00 2020 GMT + Not After : Sep 17 16:00:00 2040 GMT + Subject: C = US, O = Internet Security Research Group, CN = ISRG Root X2 + Subject Public Key Info: + Public Key Algorithm: id-ecPublicKey + Public-Key: (384 bit) + pub: + 04:cd:9b:d5:9f:80:83:0a:ec:09:4a:f3:16:4a:3e: + 5c:cf:77:ac:de:67:05:0d:1d:07:b6:dc:16:fb:5a: + 8b:14:db:e2:71:60:c4:ba:45:95:11:89:8e:ea:06: + df:f7:2a:16:1c:a4:b9:c5:c5:32:e0:03:e0:1e:82: + 18:38:8b:d7:45:d8:0a:6a:6e:e6:00:77:fb:02:51: + 7d:22:d8:0a:6e:9a:5b:77:df:f0:fa:41:ec:39:dc: + 75:ca:68:07:0c:1f:ea + ASN1 OID: secp384r1 + NIST CURVE: P-384 + X509v3 extensions: + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 7C:42:96:AE:DE:4B:48:3B:FA:92:F8:9E:8C:CF:6D:8B:A9:72:37:95 + Signature Algorithm: ecdsa-with-SHA384 + 30:65:02:30:7b:79:4e:46:50:84:c2:44:87:46:1b:45:70:ff: + 58:99:de:f4:fd:a4:d2:55:a6:20:2d:74:d6:34:bc:41:a3:50: + 5f:01:27:56:b4:be:27:75:06:af:12:2e:75:98:8d:fc:02:31: + 00:8b:f5:77:6c:d4:c8:65:aa:e0:0b:2c:ee:14:9d:27:37:a4: + f9:53:a5:51:e4:29:83:d7:f8:90:31:5b:42:9f:0a:f5:fe:ae: + 00:68:e7:8c:49:0f:b6:6f:5b:5b:15:f2:e7 +-----BEGIN CERTIFICATE----- +MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw +CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg +R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00 +MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBT +ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYw +EAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW ++1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9 +ItgKbppbd9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZI +zj0EAwMDaAAwZQIwe3lORlCEwkSHRhtFcP9Ymd70/aTSVaYgLXTWNLxBo1BfASdW +tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1 +/q4AaOeMSQ+2b1tbFfLn +-----END CERTIFICATE----- diff --git a/certs/R10.pem b/certs/R10.pem new file mode 100644 index 0000000..e8c1c4a --- /dev/null +++ b/certs/R10.pem @@ -0,0 +1,231 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 4b:a8:52:93:f7:9a:2f:a2:73:06:4b:a8:04:8d:75:d0 + Signature Algorithm: sha256WithRSAEncryption + Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1 + Validity + Not Before: Mar 13 00:00:00 2024 GMT + Not After : Mar 12 23:59:59 2027 GMT + Subject: C=US, O=Let's Encrypt, CN=R10 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:cf:57:e5:e6:c4:54:12:ed:b4:47:fe:c9:27:58: + 76:46:50:28:8c:1d:3e:88:df:05:9d:d5:b5:18:29: + bd:dd:b5:5a:bf:fa:f6:ce:a3:be:af:00:21:4b:62: + 5a:5a:3c:01:2f:c5:58:03:f6:89:ff:8e:11:43:eb: + c1:b5:e0:14:07:96:8f:6f:1f:d7:e7:ba:81:39:09: + 75:65:b7:c2:af:18:5b:37:26:28:e7:a3:f4:07:2b: + 6d:1a:ff:ab:58:bc:95:ae:40:ff:e9:cb:57:c4:b5: + 5b:7f:78:0d:18:61:bc:17:e7:54:c6:bb:49:91:cd: + 6e:18:d1:80:85:ee:a6:65:36:bc:74:ea:bc:50:4c: + ea:fc:21:f3:38:16:93:94:ba:b0:d3:6b:38:06:cd: + 16:12:7a:ca:52:75:c8:ad:76:b2:c2:9c:5d:98:45: + 5c:6f:61:7b:c6:2d:ee:3c:13:52:86:01:d9:57:e6: + 38:1c:df:8d:b5:1f:92:91:9a:e7:4a:1c:cc:45:a8: + 72:55:f0:b0:e6:a3:07:ec:fd:a7:1b:66:9e:3f:48: + 8b:71:84:71:58:c9:3a:fa:ef:5e:f2:5b:44:2b:3c: + 74:e7:8f:b2:47:c1:07:6a:cd:9a:b7:0d:96:f7:12: + 81:26:51:54:0a:ec:61:f6:f7:f5:e2:f2:8a:c8:95: + 0d:8d + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + X509v3 Extended Key Usage: + TLS Web Client Authentication, TLS Web Server Authentication + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:0 + X509v3 Subject Key Identifier: + BB:BC:C3:47:A5:E4:BC:A9:C6:C3:A4:72:0C:10:8D:A2:35:E1:C8:E8 + X509v3 Authority Key Identifier: + 79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E + Authority Information Access: + CA Issuers - URI:http://x1.i.lencr.org/ + X509v3 Certificate Policies: + Policy: 2.23.140.1.2.1 + X509v3 CRL Distribution Points: + Full Name: + URI:http://x1.c.lencr.org/ + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 92:b1:e7:41:37:eb:79:9d:81:e6:cd:e2:25:e1:3a:20:e9:90: + 44:95:a3:81:5c:cf:c3:5d:fd:bd:a0:70:d5:b1:96:28:22:0b: + d2:f2:28:cf:0c:e7:d4:e6:43:8c:24:22:1d:c1:42:92:d1:09: + af:9f:4b:f4:c8:70:4f:20:16:b1:5a:dd:01:f6:1f:f8:1f:61: + 6b:14:27:b0:72:8d:63:ae:ee:e2:ce:4b:cf:37:dd:bb:a3:d4: + cd:e7:ad:50:ad:bd:bf:e3:ec:3e:62:36:70:99:31:a7:e8:8d: + dd:ea:62:e2:12:ae:f5:9c:d4:3d:2c:0c:aa:d0:9c:79:be:ea: + 3d:5c:44:6e:96:31:63:5a:7d:d6:7e:4f:24:a0:4b:05:7f:5e: + 6f:d2:d4:ea:5f:33:4b:13:d6:57:b6:ca:de:51:b8:5d:a3:09: + 82:74:fd:c7:78:9e:b3:b9:ac:16:da:4a:2b:96:c3:b6:8b:62: + 8f:f9:74:19:a2:9e:03:de:e9:6f:9b:b0:0f:d2:a0:5a:f6:85: + 5c:c2:04:b7:c8:d5:4e:32:c4:bf:04:5d:bc:29:f6:f7:81:8f: + 0c:5d:3c:53:c9:40:90:8b:fb:b6:08:65:b9:a4:21:d5:09:e5: + 13:84:84:37:82:ce:10:28:fc:76:c2:06:25:7a:46:52:4d:da: + 53:72:a4:27:3f:62:70:ac:be:69:48:00:fb:67:0f:db:5b:a1: + e8:d7:03:21:2d:d7:c9:f6:99:42:39:83:43:df:77:0a:12:08: + f1:25:d6:ba:94:19:54:18:88:a5:c5:8e:e1:1a:99:93:79:6b: + ec:1c:f9:31:40:b0:cc:32:00:df:9f:5e:e7:b4:92:ab:90:82: + 91:8d:0d:e0:1e:95:ba:59:3b:2e:4b:5f:c2:b7:46:35:52:39: + 06:c0:bd:aa:ac:52:c1:22:a0:44:97:99:f7:0c:a0:21:a7:a1: + 6c:71:47:16:17:01:68:c0:ca:a6:26:65:04:7c:b3:ae:c9:e7: + 94:55:c2:6f:9b:3c:1c:a9:f9:2e:c5:20:1a:f0:76:e0:be:ec: + 18:d6:4f:d8:25:fb:76:11:e8:bf:e6:21:0f:e8:e8:cc:b5:b6: + a7:d5:b8:f7:9f:41:cf:61:22:46:6a:83:b6:68:97:2e:7c:ea: + 4e:95:db:23:eb:2e:c8:2b:28:84:a4:60:e9:49:f4:44:2e:3b: + f9:ca:62:57:01:e2:5d:90:16:f9:c9:fc:7a:23:48:8e:a6:d5: + 81:72:f1:28:fa:5d:ce:fb:ed:4e:73:8f:94:2e:d2:41:94:98: + 99:db:a7:af:70:5f:f5:be:fb:02:20:bf:66:27:6c:b4:ad:fa: + 75:12:0b:2b:3e:ce:03:9e +-----BEGIN CERTIFICATE----- +MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP +MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy +Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa +Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF +bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL +YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a +/6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4 +FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR +mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3 +DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG +MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/ +AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5 +tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG +Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD +VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B +AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo +zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd +u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9 +1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0 +GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh +1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ +QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N +4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz +rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei +RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx +KPpdzvvtTnOPlC7SQZSYmdunr3Bf9b77AiC/ZidstK36dRILKz7OA54= +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 82:10:cf:b0:d2:40:e3:59:44:63:e0:bb:63:82:8b:00 + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1 + Validity + Not Before: Jun 4 11:04:38 2015 GMT + Not After : Jun 4 11:04:38 2035 GMT + Subject: C = US, O = Internet Security Research Group, CN = ISRG Root X1 + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public-Key: (4096 bit) + Modulus: + 00:ad:e8:24:73:f4:14:37:f3:9b:9e:2b:57:28:1c: + 87:be:dc:b7:df:38:90:8c:6e:3c:e6:57:a0:78:f7: + 75:c2:a2:fe:f5:6a:6e:f6:00:4f:28:db:de:68:86: + 6c:44:93:b6:b1:63:fd:14:12:6b:bf:1f:d2:ea:31: + 9b:21:7e:d1:33:3c:ba:48:f5:dd:79:df:b3:b8:ff: + 12:f1:21:9a:4b:c1:8a:86:71:69:4a:66:66:6c:8f: + 7e:3c:70:bf:ad:29:22:06:f3:e4:c0:e6:80:ae:e2: + 4b:8f:b7:99:7e:94:03:9f:d3:47:97:7c:99:48:23: + 53:e8:38:ae:4f:0a:6f:83:2e:d1:49:57:8c:80:74: + b6:da:2f:d0:38:8d:7b:03:70:21:1b:75:f2:30:3c: + fa:8f:ae:dd:da:63:ab:eb:16:4f:c2:8e:11:4b:7e: + cf:0b:e8:ff:b5:77:2e:f4:b2:7b:4a:e0:4c:12:25: + 0c:70:8d:03:29:a0:e1:53:24:ec:13:d9:ee:19:bf: + 10:b3:4a:8c:3f:89:a3:61:51:de:ac:87:07:94:f4: + 63:71:ec:2e:e2:6f:5b:98:81:e1:89:5c:34:79:6c: + 76:ef:3b:90:62:79:e6:db:a4:9a:2f:26:c5:d0:10: + e1:0e:de:d9:10:8e:16:fb:b7:f7:a8:f7:c7:e5:02: + 07:98:8f:36:08:95:e7:e2:37:96:0d:36:75:9e:fb: + 0e:72:b1:1d:9b:bc:03:f9:49:05:d8:81:dd:05:b4: + 2a:d6:41:e9:ac:01:76:95:0a:0f:d8:df:d5:bd:12: + 1f:35:2f:28:17:6c:d2:98:c1:a8:09:64:77:6e:47: + 37:ba:ce:ac:59:5e:68:9d:7f:72:d6:89:c5:06:41: + 29:3e:59:3e:dd:26:f5:24:c9:11:a7:5a:a3:4c:40: + 1f:46:a1:99:b5:a7:3a:51:6e:86:3b:9e:7d:72:a7: + 12:05:78:59:ed:3e:51:78:15:0b:03:8f:8d:d0:2f: + 05:b2:3e:7b:4a:1c:4b:73:05:12:fc:c6:ea:e0:50: + 13:7c:43:93:74:b3:ca:74:e7:8e:1f:01:08:d0:30: + d4:5b:71:36:b4:07:ba:c1:30:30:5c:48:b7:82:3b: + 98:a6:7d:60:8a:a2:a3:29:82:cc:ba:bd:83:04:1b: + a2:83:03:41:a1:d6:05:f1:1b:c2:b6:f0:a8:7c:86: + 3b:46:a8:48:2a:88:dc:76:9a:76:bf:1f:6a:a5:3d: + 19:8f:eb:38:f3:64:de:c8:2b:0d:0a:28:ff:f7:db: + e2:15:42:d4:22:d0:27:5d:e1:79:fe:18:e7:70:88: + ad:4e:e6:d9:8b:3a:c6:dd:27:51:6e:ff:bc:64:f5: + 33:43:4f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 79:B4:59:E6:7B:B6:E5:E4:01:73:80:08:88:C8:1A:58:F6:E9:9B:6E + Signature Algorithm: sha256WithRSAEncryption + 55:1f:58:a9:bc:b2:a8:50:d0:0c:b1:d8:1a:69:20:27:29:08: + ac:61:75:5c:8a:6e:f8:82:e5:69:2f:d5:f6:56:4b:b9:b8:73: + 10:59:d3:21:97:7e:e7:4c:71:fb:b2:d2:60:ad:39:a8:0b:ea: + 17:21:56:85:f1:50:0e:59:eb:ce:e0:59:e9:ba:c9:15:ef:86: + 9d:8f:84:80:f6:e4:e9:91:90:dc:17:9b:62:1b:45:f0:66:95: + d2:7c:6f:c2:ea:3b:ef:1f:cf:cb:d6:ae:27:f1:a9:b0:c8:ae: + fd:7d:7e:9a:fa:22:04:eb:ff:d9:7f:ea:91:2b:22:b1:17:0e: + 8f:f2:8a:34:5b:58:d8:fc:01:c9:54:b9:b8:26:cc:8a:88:33: + 89:4c:2d:84:3c:82:df:ee:96:57:05:ba:2c:bb:f7:c4:b7:c7: + 4e:3b:82:be:31:c8:22:73:73:92:d1:c2:80:a4:39:39:10:33: + 23:82:4c:3c:9f:86:b2:55:98:1d:be:29:86:8c:22:9b:9e:e2: + 6b:3b:57:3a:82:70:4d:dc:09:c7:89:cb:0a:07:4d:6c:e8:5d: + 8e:c9:ef:ce:ab:c7:bb:b5:2b:4e:45:d6:4a:d0:26:cc:e5:72: + ca:08:6a:a5:95:e3:15:a1:f7:a4:ed:c9:2c:5f:a5:fb:ff:ac: + 28:02:2e:be:d7:7b:bb:e3:71:7b:90:16:d3:07:5e:46:53:7c: + 37:07:42:8c:d3:c4:96:9c:d5:99:b5:2a:e0:95:1a:80:48:ae: + 4c:39:07:ce:cc:47:a4:52:95:2b:ba:b8:fb:ad:d2:33:53:7d: + e5:1d:4d:6d:d5:a1:b1:c7:42:6f:e6:40:27:35:5c:a3:28:b7: + 07:8d:e7:8d:33:90:e7:23:9f:fb:50:9c:79:6c:46:d5:b4:15: + b3:96:6e:7e:9b:0c:96:3a:b8:52:2d:3f:d6:5b:e1:fb:08:c2: + 84:fe:24:a8:a3:89:da:ac:6a:e1:18:2a:b1:a8:43:61:5b:d3: + 1f:dc:3b:8d:76:f2:2d:e8:8d:75:df:17:33:6c:3d:53:fb:7b: + cb:41:5f:ff:dc:a2:d0:61:38:e1:96:b8:ac:5d:8b:37:d7:75: + d5:33:c0:99:11:ae:9d:41:c1:72:75:84:be:02:41:42:5f:67: + 24:48:94:d1:9b:27:be:07:3f:b9:b8:4f:81:74:51:e1:7a:b7: + ed:9d:23:e2:be:e0:d5:28:04:13:3c:31:03:9e:dd:7a:6c:8f: + c6:07:18:c6:7f:de:47:8e:3f:28:9e:04:06:cf:a5:54:34:77: + bd:ec:89:9b:e9:17:43:df:5b:db:5f:fe:8e:1e:57:a2:cd:40: + 9d:7e:62:22:da:de:18:27 +-----BEGIN CERTIFICATE----- +MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 +WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu +ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY +MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc +h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ +0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U +A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW +T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH +B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC +B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv +KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn +OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn +jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw +qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI +rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq +hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL +ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ +3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK +NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 +ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur +TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC +jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc +oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq +4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA +mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d +emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= +-----END CERTIFICATE----- diff --git a/global-config.rsc b/global-config.rsc index 8a42b81..a0835f8 100644 --- a/global-config.rsc +++ b/global-config.rsc @@ -92,11 +92,11 @@ :global FwAddrLists { # "allow"={ # { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/allow"; -# cert="E1"; timeout=1w }; +# cert="E5"; timeout=1w }; # }; "block"={ # { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/block"; -# cert="E1" }; +# cert="E5" }; { url="https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt"; cert="GlobalSign Atlas R3 DV TLS CA 2022 Q3" }; { url="https://sslbl.abuse.ch/blacklist/sslipblacklist.txt"; @@ -112,7 +112,7 @@ }; # "mikrotik"={ # { url="https://git.eworm.de/cgit/routeros-scripts/plain/fw-addr-lists.d/mikrotik"; -# cert="E1"; timeout=1w }; +# cert="E5"; timeout=1w }; # }; }; :global FwAddrListTimeOut 1d; diff --git a/global-functions.rsc b/global-functions.rsc index 447d6e9..eb700ef 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -999,7 +999,7 @@ :global SymbolForNotification; :global ValidateSyntax; - :if ([ $CertificateAvailable "E1" ] = false) do={ + :if ([ $CertificateAvailable "E5" ] = false) do={ $LogPrint warning $0 ("Downloading certificate failed, trying without."); }