From didi at redhat.com Wed Jan 29 02:11:59 2014 Content-Type: multipart/mixed; boundary="===============8269340024326798482==" MIME-Version: 1.0 From: Yedidyah Bar David To: users at ovirt.org Subject: Re: [Users] Hosted Engine adding host SSL Failure (w/ engine custom cert) Date: Wed, 29 Jan 2014 02:11:58 -0500 Message-ID: <643851512.10315974.1390979518045.JavaMail.root@redhat.com> In-Reply-To: 1005561226.10313198.1390979106293.JavaMail.root@redhat.com --===============8269340024326798482== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ------=3D_Part_10315973_1426242418.1390979518044 Content-Type: text/plain; charset=3Dutf-8 Content-Transfer-Encoding: 7bit > From: "Yedidyah Bar David" > To: "Andrew Lau" > Cc: "users" > Sent: Wednesday, January 29, 2014 9:05:06 AM > Subject: Re: [Users] Hosted Engine adding host SSL Failure (w/ engine cus= tom > cert) > > From: "Andrew Lau" > = > > To: "users" > = > > Sent: Wednesday, January 29, 2014 8:38:33 AM > = > > Subject: [Users] Hosted Engine adding host SSL Failure (w/ engine custom > > cert) > = > > Hi, > = > > After running through the new patch posted in BZ 1055153 I'm adding a > > second > > host to the hosted-engine cluster but it seems to fail right before the > > finish: > = > > [ ERROR ] Failed to execute stage 'Closing up': [ERROR]::oVirt API > > connection > > failure, [Errno 1] _ssl.c:492: error:14090086:SSL > > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > = > > Couple Extra Notes: > = > > Engine has a custom SSL cert but the CA has been trusted by the new hos= t. > > When I temporarily return the engine's SSL back to the default generated > > one > > the install will succeed. > = > > Setup logs: http://www.fpaste.org/72624/13909770/ > = > > What confuses me is: > = > > curl https://engine.example.net with the custom SSL cert will succeed b= ut > > with the original self-signed gives the expected "insecure" message. Wh= at > > criteria need to be met so the install will pass? > = > Seems like a bug (or a missing feature) - hosted-engine only supports the > self-signed cert. Can you please open a bug for this? > You might manage to make it work by replacing /etc/pki/ovirt-engine/ca.pem > with the certificate of your ca, but this will prevent adding hosts (beca= use > it's needed to create a certificate for them). Perhaps other things will > break too, I didn't try that. On a second thought, I don't think it will work. The engine will still sign= certs for hosts with its private key, but the hosts will try to verify tha= t with the ca.pem you put there and fail. = -- = Didi = ------=3D_Part_10315973_1426242418.1390979518044 Content-Type: text/html; charset=3Dutf-8 Content-Transfer-Encoding: quoted-printable
From: "Yedidyah Bar David" <didi= =3D @redhat.com>
To: "Andrew Lau" <andrew(a)andrewklau.com><= br=3D >Cc: "users" <users(a)ovirt.org>
Sent: Wednesday, Ja= nu=3D ary 29, 2014 9:05:06 AM
Subject: Re: [Users] Hosted Engine adding= =3D host SSL Failure (w/ engine        = =3D ;custom        cert)

From: "Andrew Lau" <andrew(a)andrewklau.com>
= To: "users" <users(a)ovirt.org>
Sent: Wednesday, Janua= ry=3D 29, 2014 8:38:33 AM
Subject: [Users] Hosted Engine adding host S= =3D SL Failure (w/ engine custom        = =3D ;cert)

Hi,

After running through the new patch posted in BZ 1055153 I'm adding a = =3D second host to the hosted-engine cluster but it seems to fail right before = =3D the finish:

[ ERROR ] Failed to = ex=3D ecute stage 'Closing up': [ERROR]::oVirt API connection failure, [Errno 1] = =3D _ssl.c:492: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certifi= =3D cate verify failed

Couple Extra Note= s:=3D
Engine has a custom SS= L =3D cert but the CA has been trusted by the new host. When I temporarily return= =3D the engine's SSL back to the default generated one the install will succee= =3D d.


What confuses me is:
<= di=3D v style=3D3D"font-family:tahoma,sans-serif">
curl https://engine.example.net with the custom SSL cert will succe= =3D ed but with the original self-signed gives the expected "insecure" message.= =3D What criteria need to be met so the install will pass?

Seems like a bug (or a missing feature) - ho= =3D sted-engine only supports the self-signed cert. Can you please open a bug f= =3D or this?

You might manage to make it work by repla= =3D cing /etc/pki/ovirt-engine/ca.pem with the certificate of your ca, but= =3D this will prevent adding hosts (because it's needed to create a certificat= =3D e for them). Perhaps other things will break too, I didn't try that.
<= =3D /div>

On a second thought, I don't think it= =3D will work. The engine will still sign certs for hosts with its private key= =3D , but the hosts will try to verify that with the ca.pem you put there and f= =3D ail.
-- 
<=3D span name=3D3D"x">Didi

<= /div=3D >
------=3D_Part_10315973_1426242418.1390979518044-- --===============8269340024326798482== Content-Type: multipart/alternative MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.bin" LS0tLS0tPV9QYXJ0XzEwMzE1OTczXzE0MjYyNDI0MTguMTM5MDk3OTUxODA0NApDb250ZW50LVR5 cGU6IHRleHQvcGxhaW47IGNoYXJzZXQ9dXRmLTgKQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzog N2JpdAoKPiBGcm9tOiAiWWVkaWR5YWggQmFyIERhdmlkIiA8ZGlkaUByZWRoYXQuY29tPgo+IFRv OiAiQW5kcmV3IExhdSIgPGFuZHJld0BhbmRyZXdrbGF1LmNvbT4KPiBDYzogInVzZXJzIiA8dXNl cnNAb3ZpcnQub3JnPgo+IFNlbnQ6IFdlZG5lc2RheSwgSmFudWFyeSAyOSwgMjAxNCA5OjA1OjA2 IEFNCj4gU3ViamVjdDogUmU6IFtVc2Vyc10gSG9zdGVkIEVuZ2luZSBhZGRpbmcgaG9zdCBTU0wg RmFpbHVyZSAody8gZW5naW5lIGN1c3RvbQo+IGNlcnQpCgo+ID4gRnJvbTogIkFuZHJldyBMYXUi IDxhbmRyZXdAYW5kcmV3a2xhdS5jb20+Cj4gCj4gPiBUbzogInVzZXJzIiA8dXNlcnNAb3ZpcnQu b3JnPgo+IAo+ID4gU2VudDogV2VkbmVzZGF5LCBKYW51YXJ5IDI5LCAyMDE0IDg6Mzg6MzMgQU0K PiAKPiA+IFN1YmplY3Q6IFtVc2Vyc10gSG9zdGVkIEVuZ2luZSBhZGRpbmcgaG9zdCBTU0wgRmFp bHVyZSAody8gZW5naW5lIGN1c3RvbQo+ID4gY2VydCkKPiAKCj4gPiBIaSwKPiAKCj4gPiBBZnRl ciBydW5uaW5nIHRocm91Z2ggdGhlIG5ldyBwYXRjaCBwb3N0ZWQgaW4gQlogMTA1NTE1MyBJJ20g YWRkaW5nIGEKPiA+IHNlY29uZAo+ID4gaG9zdCB0byB0aGUgaG9zdGVkLWVuZ2luZSBjbHVzdGVy IGJ1dCBpdCBzZWVtcyB0byBmYWlsIHJpZ2h0IGJlZm9yZSB0aGUKPiA+IGZpbmlzaDoKPiAKCj4g PiBbIEVSUk9SIF0gRmFpbGVkIHRvIGV4ZWN1dGUgc3RhZ2UgJ0Nsb3NpbmcgdXAnOiBbRVJST1Jd OjpvVmlydCBBUEkKPiA+IGNvbm5lY3Rpb24KPiA+IGZhaWx1cmUsIFtFcnJubyAxXSBfc3NsLmM6 NDkyOiBlcnJvcjoxNDA5MDA4NjpTU0wKPiA+IHJvdXRpbmVzOlNTTDNfR0VUX1NFUlZFUl9DRVJU SUZJQ0FURTpjZXJ0aWZpY2F0ZSB2ZXJpZnkgZmFpbGVkCj4gCgo+ID4gQ291cGxlIEV4dHJhIE5v dGVzOgo+IAo+ID4gRW5naW5lIGhhcyBhIGN1c3RvbSBTU0wgY2VydCBidXQgdGhlIENBIGhhcyBi ZWVuIHRydXN0ZWQgYnkgdGhlIG5ldyBob3N0Lgo+ID4gV2hlbiBJIHRlbXBvcmFyaWx5IHJldHVy biB0aGUgZW5naW5lJ3MgU1NMIGJhY2sgdG8gdGhlIGRlZmF1bHQgZ2VuZXJhdGVkCj4gPiBvbmUK PiA+IHRoZSBpbnN0YWxsIHdpbGwgc3VjY2VlZC4KPiAKCj4gPiBTZXR1cCBsb2dzOiBodHRwOi8v d3d3LmZwYXN0ZS5vcmcvNzI2MjQvMTM5MDk3NzAvCj4gCgo+ID4gV2hhdCBjb25mdXNlcyBtZSBp czoKPiAKCj4gPiBjdXJsIGh0dHBzOi8vZW5naW5lLmV4YW1wbGUubmV0IHdpdGggdGhlIGN1c3Rv bSBTU0wgY2VydCB3aWxsIHN1Y2NlZWQgYnV0Cj4gPiB3aXRoIHRoZSBvcmlnaW5hbCBzZWxmLXNp Z25lZCBnaXZlcyB0aGUgZXhwZWN0ZWQgImluc2VjdXJlIiBtZXNzYWdlLiBXaGF0Cj4gPiBjcml0 ZXJpYSBuZWVkIHRvIGJlIG1ldCBzbyB0aGUgaW5zdGFsbCB3aWxsIHBhc3M/Cj4gCgo+IFNlZW1z IGxpa2UgYSBidWcgKG9yIGEgbWlzc2luZyBmZWF0dXJlKSAtIGhvc3RlZC1lbmdpbmUgb25seSBz dXBwb3J0cyB0aGUKPiBzZWxmLXNpZ25lZCBjZXJ0LiBDYW4geW91IHBsZWFzZSBvcGVuIGEgYnVn IGZvciB0aGlzPwoKPiBZb3UgbWlnaHQgbWFuYWdlIHRvIG1ha2UgaXQgd29yayBieSByZXBsYWNp bmcgL2V0Yy9wa2kvb3ZpcnQtZW5naW5lL2NhLnBlbQo+IHdpdGggdGhlIGNlcnRpZmljYXRlIG9m IHlvdXIgY2EsIGJ1dCB0aGlzIHdpbGwgcHJldmVudCBhZGRpbmcgaG9zdHMgKGJlY2F1c2UKPiBp dCdzIG5lZWRlZCB0byBjcmVhdGUgYSBjZXJ0aWZpY2F0ZSBmb3IgdGhlbSkuIFBlcmhhcHMgb3Ro ZXIgdGhpbmdzIHdpbGwKPiBicmVhayB0b28sIEkgZGlkbid0IHRyeSB0aGF0LgoKT24gYSBzZWNv bmQgdGhvdWdodCwgSSBkb24ndCB0aGluayBpdCB3aWxsIHdvcmsuIFRoZSBlbmdpbmUgd2lsbCBz dGlsbCBzaWduIGNlcnRzIGZvciBob3N0cyB3aXRoIGl0cyBwcml2YXRlIGtleSwgYnV0IHRoZSBo b3N0cyB3aWxsIHRyeSB0byB2ZXJpZnkgdGhhdCB3aXRoIHRoZSBjYS5wZW0geW91IHB1dCB0aGVy ZSBhbmQgZmFpbC4gCi0tIApEaWRpIAoKLS0tLS0tPV9QYXJ0XzEwMzE1OTczXzE0MjYyNDI0MTgu MTM5MDk3OTUxODA0NApDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD11dGYtOApDb250 ZW50LVRyYW5zZmVyLUVuY29kaW5nOiBxdW90ZWQtcHJpbnRhYmxlCgo8aHRtbD48Ym9keT48ZGl2 IHN0eWxlPTNEImZvbnQtZmFtaWx5OiB0aW1lcyBuZXcgcm9tYW4sIG5ldyB5b3JrLCB0aW1lcywg c2U9CnJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogIzAwMDAwMCI+PGRpdj48L2Rpdj48Ymxv Y2txdW90ZSBzdHlsZT0zRCJib3JkZT0Kci1sZWZ0OjJweCBzb2xpZCAjMTAxMEZGO21hcmdpbi1s ZWZ0OjVweDtwYWRkaW5nLWxlZnQ6NXB4O2NvbG9yOiMwMDA7Zm9udC13PQplaWdodDpub3JtYWw7 Zm9udC1zdHlsZTpub3JtYWw7dGV4dC1kZWNvcmF0aW9uOm5vbmU7Zm9udC1mYW1pbHk6SGVsdmV0 aWNhLEE9CnJpYWwsc2Fucy1zZXJpZjtmb250LXNpemU6MTJwdDsiPjxiPkZyb206IDwvYj4iWWVk aWR5YWggQmFyIERhdmlkIiAmbHQ7ZGlkaT0KQHJlZGhhdC5jb20mZ3Q7PGJyPjxiPlRvOiA8L2I+ IkFuZHJldyBMYXUiICZsdDthbmRyZXdAYW5kcmV3a2xhdS5jb20mZ3Q7PGJyPQo+PGI+Q2M6IDwv Yj4idXNlcnMiICZsdDt1c2Vyc0BvdmlydC5vcmcmZ3Q7PGJyPjxiPlNlbnQ6IDwvYj5XZWRuZXNk YXksIEphbnU9CmFyeSAyOSwgMjAxNCA5OjA1OjA2IEFNPGJyPjxiPlN1YmplY3Q6IDwvYj5SZTog W1VzZXJzXSBIb3N0ZWQgRW5naW5lIGFkZGluZz0KIGhvc3QgU1NMIEZhaWx1cmUgKHcvIGVuZ2lu ZSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwPQo7Y3VzdG9t Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Y2VydCk8YnI+ PGRpdj48YnI+PC89CmRpdj48ZGl2IHN0eWxlPTNEImZvbnQtZmFtaWx5OiB0aW1lcyBuZXcgcm9t YW4sIG5ldyB5b3JrLCB0aW1lcywgc2VyaWY7IGZvbj0KdC1zaXplOiAxMnB0OyBjb2xvcjogIzAw MDAwMCI+PGJsb2NrcXVvdGUgc3R5bGU9M0QiYm9yZGVyLWxlZnQ6MnB4IHNvbGlkICMxPQowMTBG RjttYXJnaW4tbGVmdDo1cHg7cGFkZGluZy1sZWZ0OjVweDtjb2xvcjojMDAwO2ZvbnQtd2VpZ2h0 Om5vcm1hbDtmb250LXM9CnR5bGU6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25lO2ZvbnQtZmFt aWx5OkhlbHZldGljYSxBcmlhbCxzYW5zLXNlcmlmO2Zvbj0KdC1zaXplOjEycHQ7Ij48Yj5Gcm9t OiA8L2I+IkFuZHJldyBMYXUiICZsdDthbmRyZXdAYW5kcmV3a2xhdS5jb20mZ3Q7PGJyPjxiPQo+ VG86IDwvYj4idXNlcnMiICZsdDt1c2Vyc0BvdmlydC5vcmcmZ3Q7PGJyPjxiPlNlbnQ6IDwvYj5X ZWRuZXNkYXksIEphbnVhcnk9CiAyOSwgMjAxNCA4OjM4OjMzIEFNPGJyPjxiPlN1YmplY3Q6IDwv Yj5bVXNlcnNdIEhvc3RlZCBFbmdpbmUgYWRkaW5nIGhvc3QgUz0KU0wgRmFpbHVyZSAody8gZW5n aW5lIGN1c3RvbSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw PQo7Y2VydCk8YnI+PGRpdj48YnI+PC9kaXY+PGRpdiBkaXI9M0QibHRyIj48ZGl2IGNsYXNzPTNE ImdtYWlsX2RlZmF1bHQiIHN0eWw9CmU9M0QiZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYi PkhpLDwvZGl2PjxkaXYgY2xhc3M9M0QiZ21haWxfZGVmYXVsdCIgcz0KdHlsZT0zRCJmb250LWZh bWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9M0QiZ21haWxfZGVm YXVsPQp0IiBzdHlsZT0zRCJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZiI+CgpBZnRlciBy dW5uaW5nIHRocm91Z2ggdGhlIG5ldyBwYXRjaCBwb3N0ZWQgaW4gQlombmJzcDsxMDU1MTUzIEkn bSBhZGRpbmcgYSA9CnNlY29uZCBob3N0IHRvIHRoZSBob3N0ZWQtZW5naW5lIGNsdXN0ZXIgYnV0 IGl0IHNlZW1zIHRvIGZhaWwgcmlnaHQgYmVmb3JlID0KdGhlIGZpbmlzaDo8L2Rpdj48ZGl2IGNs YXNzPTNEImdtYWlsX2RlZmF1bHQiIHN0eWxlPTNEImZvbnQtZmFtaWx5OnRhaG9tYSxzPQphbnMt c2VyaWYiPjxicj48L2Rpdj48ZGl2IGNsYXNzPTNEImdtYWlsX2RlZmF1bHQiPjxkaXYgY2xhc3M9 M0QiZ21haWxfZGVmYXU9Cmx0Ij48c3BhbiBzdHlsZT0zRCJmb250LWZhbWlseTogdGFob21hLCBz YW5zLXNlcmlmOyI+WyBFUlJPUiBdIEZhaWxlZCB0byBleD0KZWN1dGUgc3RhZ2UgJ0Nsb3Npbmcg dXAnOiBbRVJST1JdOjpvVmlydCBBUEkgY29ubmVjdGlvbiBmYWlsdXJlLCBbRXJybm8gMV0gPQpf c3NsLmM6NDkyOiBlcnJvcjoxNDA5MDA4NjpTU0wgcm91dGluZXM6U1NMM19HRVRfU0VSVkVSX0NF UlRJRklDQVRFOmNlcnRpZmk9CmNhdGUgdmVyaWZ5IGZhaWxlZDwvc3Bhbj48L2Rpdj48ZGl2IHN0 eWxlPTNEImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj0KPjxicj48L2Rpdj48ZGl2IHN0 eWxlPTNEImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj5Db3VwbGUgRXh0cmEgTm90ZXM6 PQo8L2Rpdj48ZGl2IHN0eWxlPTNEImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmIj5Fbmdp bmUgaGFzIGEgY3VzdG9tIFNTTCA9CmNlcnQgYnV0IHRoZSBDQSBoYXMgYmVlbiB0cnVzdGVkIGJ5 IHRoZSBuZXcgaG9zdC4gV2hlbiBJIHRlbXBvcmFyaWx5IHJldHVybj0KIHRoZSBlbmdpbmUncyBT U0wgYmFjayB0byB0aGUgZGVmYXVsdCBnZW5lcmF0ZWQgb25lIHRoZSBpbnN0YWxsIHdpbGwgc3Vj Y2VlPQpkLjwvZGl2PjxkaXYgc3R5bGU9M0QiZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYi Pjxicj48L2Rpdj48ZGl2IHN0eWxlPQo9M0QiZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYi PlNldHVwIGxvZ3M6Jm5ic3A7PGEgaHJlZj0zRCJodHRwOi8vd3d3LmY9CnBhc3RlLm9yZy83MjYy NC8xMzkwOTc3MC8iIHRhcmdldD0zRCJfYmxhbmsiPmh0dHA6Ly93d3cuZnBhc3RlLm9yZy83MjYy NC8xMz0KOTA5NzcwLzwvYT48YnI+PC9kaXY+PGRpdiBzdHlsZT0zRCJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZiI+PGJyPjwvZGl2PQo+PGRpdiBzdHlsZT0zRCJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZiI+V2hhdCBjb25mdXNlcyBtZSBpczo8L2Rpdj48ZGk9CnYgc3R5bGU9M0Qi Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWYiPjxicj48L2Rpdj48ZGl2IHN0eWxlPTNEImZv bnQtZmFtaT0KbHk6dGFob21hLHNhbnMtc2VyaWYiPmN1cmwgPGEgaHJlZj0zRCJodHRwczovL2Vu Z2luZS5leGFtcGxlLm5ldCIgdGFyZ2V0PTNEPQoiX2JsYW5rIj5odHRwczovL2VuZ2luZS5leGFt cGxlLm5ldDwvYT4gd2l0aCB0aGUgY3VzdG9tIFNTTCBjZXJ0IHdpbGwgc3VjY2U9CmVkIGJ1dCB3 aXRoIHRoZSBvcmlnaW5hbCBzZWxmLXNpZ25lZCBnaXZlcyB0aGUgZXhwZWN0ZWQgImluc2VjdXJl IiBtZXNzYWdlLj0KIFdoYXQgY3JpdGVyaWEgbmVlZCB0byBiZSBtZXQgc28gdGhlIGluc3RhbGwg d2lsbCBwYXNzPzwvZGl2PjwvZGl2PjwvZGl2PjwvPQpibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2 PjxkaXY+U2VlbXMgbGlrZSBhIGJ1ZyAob3IgYSBtaXNzaW5nIGZlYXR1cmUpIC0gaG89CnN0ZWQt ZW5naW5lIG9ubHkgc3VwcG9ydHMgdGhlIHNlbGYtc2lnbmVkIGNlcnQuIENhbiB5b3UgcGxlYXNl IG9wZW4gYSBidWcgZj0Kb3IgdGhpcz88L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PllvdSBtaWdo dCBtYW5hZ2UgdG8gbWFrZSBpdCB3b3JrIGJ5IHJlcGxhPQpjaW5nJm5ic3A7L2V0Yy9wa2kvb3Zp cnQtZW5naW5lL2NhLnBlbSB3aXRoIHRoZSBjZXJ0aWZpY2F0ZSBvZiB5b3VyIGNhLCBidXQ9CiB0 aGlzIHdpbGwgcHJldmVudCBhZGRpbmcgaG9zdHMgKGJlY2F1c2UgaXQncyBuZWVkZWQgdG8gY3Jl YXRlIGEgY2VydGlmaWNhdD0KZSBmb3IgdGhlbSkuIFBlcmhhcHMgb3RoZXIgdGhpbmdzIHdpbGwg YnJlYWsgdG9vLCBJIGRpZG4ndCB0cnkgdGhhdC48L2Rpdj48PQovZGl2PjwvYmxvY2txdW90ZT48 ZGl2Pjxicj48L2Rpdj48ZGl2Pk9uIGEgc2Vjb25kIHRob3VnaHQsIEkgZG9uJ3QgdGhpbmsgaXQ9 CiB3aWxsIHdvcmsuIFRoZSBlbmdpbmUgd2lsbCBzdGlsbCBzaWduIGNlcnRzIGZvciBob3N0cyB3 aXRoIGl0cyBwcml2YXRlIGtleT0KLCBidXQgdGhlIGhvc3RzIHdpbGwgdHJ5IHRvIHZlcmlmeSB0 aGF0IHdpdGggdGhlIGNhLnBlbSB5b3UgcHV0IHRoZXJlIGFuZCBmPQphaWwuPC9kaXY+PGRpdj48 c3BhbiBzdHlsZT0zRCJmb250LXNpemU6IDEycHQ7Ij4tLSZuYnNwOzwvc3Bhbj48L2Rpdj48ZGl2 Pjw9CnNwYW4gbmFtZT0zRCJ4Ij48L3NwYW4+RGlkaTxzcGFuIG5hbWU9M0QieCI+PC9zcGFuPjxi cj48L2Rpdj48ZGl2Pjxicj48L2Rpdj0KPjwvZGl2PjwvYm9keT48L2h0bWw+Ci0tLS0tLT1fUGFy dF8xMDMxNTk3M18xNDI2MjQyNDE4LjEzOTA5Nzk1MTgwNDQtLQo= --===============8269340024326798482==--