Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package java-17-openjdk for openSUSE:Factory
checked in at 2026-10-27 17:08:44
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/java-17-openjdk (Old)
and /work/SRC/openSUSE:Factory/.java-17-openjdk.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "java-17-openjdk"
Tue Oct 27 17:08:44 2026 rev:52 rq:1393093 version:17.0.21.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/java-17-openjdk/java-17-openjdk.changes
2026-08-25 13:19:44.387218277 +0200
+++
/work/SRC/openSUSE:Factory/.java-17-openjdk.new.2252680/java-17-openjdk.changes
2026-10-27 17:09:41.478568909 +0100
@@ -1,0 +2,388 @@
+Tue Oct 27 13:17:41 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Upgrade to upstream tag jdk-17.0.21+9 (Octobre 2026 CPU)
+ * Security fixes
+ + JDK-8383679, CVE-2026-87294, bsc#1286490: Enhance Certificate
+ Name Checks
+ + JDK-8384654, CVE-2026-87367, bsc#1286943: Enhance Template
+ Handling
+ + JDK-8383699, CVE-2026-87290, bsc#1286484: Enhance XPath
+ Expressions
+ + JDK-8383439, CVE-2026-83395, bsc#1286479: Enhance HTTP Client
+ Response Handling
+ + JDK-8386783: WebRowSet empty elements read value of previous
+ element
+ + JDK-8383301, CVE-2026-83387, bsc#1286478: Enhance WebRowSets
+ + JDK-8380715, CVE-2026-83374, bsc#1286472: Enhance PKCS5
+ padding
+ + JDK-8384736, CVE-2026-91379, bsc#1286498: Enhance JShell
+ + JDK-8383047, CVE-2026-83380, bsc#1286476: Enhance LDAP logins
+ + JDK-8384468: Enhance jpackage Packaging
+ + JDK-8384021, CVE-2026-101516, bsc#1286395: Enhance Certificate
+ Constraint Checking
+ + JDK-8387152, CVE-2026-91462, bsc#1286547: Enhance krb5 tokens
+ + JDK-8387238, CVE-2026-91464, bsc#1286550: Enhance Kerberos
+ validation
+ + JDK-8386013: Enhance EventListenerList
+ + JDK-8382407: Enhance LDAP Lookups
+ + JDK-8390400, CVE-2026-91487, bsc#1286551: Enhance C2
+ comparisons
+ + JDK-8385209, CVE-2026-91394, bsc#1286507: Enhance HTTP client
+ caching
+ + JDK-8386535, CVE-2026-91453, bsc#1286545: Improve HTTP headers
+ + JDK-8386923, CVE-2026-91461, bsc#1286546: Enhance TLS
+ Extensions
+ + JDK-8387217, CVE-2026-91463, bsc#1286549: Enhance krb5 client
+ + JDK-8386515, CVE-2026-91451, bsc#1286542: Enhance HTTP server
+ parsing
+ + JDK-8373677: Clear text HttpServer connection could fail fast
+ if receiving SSL ClientHello
+ + JDK-8384872, CVE-2026-91332, bsc#1286491: Enhance HTTP Client
+ + JDK-8383756, CVE-2026-87292, bsc#1286486: Enhance Network
+ Clients
+ + JDK-8383281: Enhance MD5 Digesting
+ + JDK-8384664, CVE-2026-91335, bsc#1286494: Enhance Image
+ Handling
+ + JDK-8386552, CVE-2026-91418, bsc#1286539: Enhance GIF loading
+ + JDK-8270915: GIFImageReader disregards ignoreMetadata flag
+ which causes memory exhaustion
+ + JDK-8384746, CVE-2026-91380, bsc#1286500: Enhance Preferences
+ + JDK-8385476, CVE-2026-91400, bsc#1286517: Enhance MIDI file
+ handling
+ + JDK-8384688, CVE-2026-91375, bsc#1286497: Enhance jmod
+ handling
+ + JDK-8387075: RemoteHostImpl constructor correction (jstatd)
+ + JDK-8386525, CVE-2026-91452, bsc#1286544: Enhance HTTP Server
+ Handler
+ + JDK-8386187, CVE-2026-91415, bsc#1286537: Enhance font
+ rendering
+ + JDK-8385260, CVE-2026-91398, bsc#1286515: Enhance SOCKS5
+ support
+ + JDK-8385249, CVE-2026-91397, bsc#1286513: Enhance diagnostic
+ sessions
+ + JDK-8384930, CVE-2026-91374, bsc#1286496: Enhance jstatd
+ + JDK-8384771, CVE-2026-91373, bsc#1286495: Enhance TLS
+ handshakes
+ + JDK-8384455: Enhance DataFlavor
+ + JDK-8384445, CVE-2026-91334, bsc#1286493: Enhance JPEG loading
+ + JDK-8384031, CVE-2026-83400, bsc#1286480: Enhance XML
+ Processing
+ + JDK-8383076, CVE-2026-83381, bsc#1286477: Enhance SASL
+ Authentication
+ + JDK-8382178, CVE-2026-83376, bsc#1286474: Enhance TLS
+ certificate handling
+ * Other fixes
+ + JDK-8387235: JShell tests failing
+ + JDK-8394845: [17u] Remove designator
+ DEFAULT_PROMOTED_VERSION_PRE=ea for release 17.0.21
+ + JDK-8394772: [17u] Update tzmappings.override location after
+ JDK-8343788 backport
+ + JDK-8394265: [21u] Add explicit zone offset test for
+ America/Rainy_River
+ + JDK-8393848: Align the JDK with Microsoft's new timezone name
+ for Manitoba
+ + JDK-8392538: Align the JDK with Microsoft's new timezone names
+ for British Columbia/Alberta
+ + JDK-8343788: Provide means to alter lib/tzmappings entries on
+ Windows
+ + JDK-8317126: Redundant entries in Windows `tzmappings` file
+ + JDK-8393337: (tz) Update Timezone Data to 2026e
+ + JDK-8393344: Cherry-pick metazone changes from CLDR to support
+ tzdata2026e for JDK update releases
+ + JDK-8392377: (tz) Update Timezone Data to 2026d
+ + JDK-8392519: Cherry-pick metazone changes from CLDR for
+ tzdata2026d, for JDK update release
+ + JDK-8377992: (zipfs) Align ZipFileSystem END header validation
+ with the ZipFile implementation
+ + JDK-8377983: (zipfs) ZipFileSystem.initCEN needlessly reads
+ END header
+ + JDK-8316391: (zipfs) ZipFileSystem.readFullyAt does not
+ tolerate short reads
+ + JDK-8280404: Unexpected exception thrown when CEN file entry
+ comment length is not valid
+ + JDK-8391807: Inconsistent TimeZone Names Displayed across JDK
+ release trains
+ + JDK-8386273: Some javax/sound/sampled tests fail on systems
+ with high CPU core number and running with high concurrency
+ + JDK-8392072: Follow-on fix for Improve certification checking
+ + JDK-8391256: TestZoneTextPrinterParser.java assertion fails
+ with expected: <Mountain Standard Time> but was: <Mountain
+ Daylight Time>
+ + JDK-8388214: (tz) Update Timezone Data to 2026c
+ + JDK-8390380: Cherry-pick metazone changes from CLDR to support
+ tzdata2026c for JDK update releases
+ + JDK-8390388: Cherry-pick tz attributes from newer CLDR data
+ for jdk25u and earlier
+ + JDK-8381379: Support std/dstOffset attributes in CLDR's
+ metazone definitions
+ + JDK-8389648: [TEST_BUG] java/awt/TextField/CaretPositionTest/
+ /CaretPositionTest.java fails in OL-9
+ + JDK-8380223: Refactor test/jdk/sun/util/resources TestNG tests
+ to JUnit
+ + JDK-8374434: Several JShell tests report JUnit discovery
+ warnings
+ + JDK-8349759: Add unit test for CertificateBuilder and
+ SimpleOCSPServer test utilities
+ + JDK-8379515: draft-ietf-lamps-kyber-certificates is now RFC
+ 9935
+ + JDK-8387123: Remove LuxTrust Global Root CA
+ + JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
+ Private Key Encodings
+ + JDK-8374755: ML-KEM's 12-bit decompression can be simplified
+ on aarch64
+ + JDK-8368677: acvp test should throw SkippedException when no
+ ACVP-Server available
+ + JDK-8368694: PKCS11-NSS generic keys generated by DH have
+ leading zeroes stripped
+ + JDK-8390327: [17u] test/jdk/java/net/httpclient/lib/jdk/
+ /httpclient/test/lib/common/HttpServerAdapters.java fails to
+ compile in Java 17 after JDK-8343855 backport
+ + JDK-8301793: AlgorithmId should not encode a missing
+ parameters field as NULL unless hardcoded
+ + JDK-8365776: Convert JShell tests to use JUnit instead of
+ TestNG
+ + JDK-8359735: [Ubuntu 25.10] java/lang/ProcessBuilder/
+ /Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to
+ rust-coreutils
+ + JDK-8189441: Define algorithm names for keys derived from
+ KeyAgreement
+ + JDK-8340493: Fix some Asserts failure messages
+ + JDK-8333754: Add a Test against ECDSA and ECDH NIST Test
+ vector
+ + JDK-8354926: Remove remnants of debugging in the fix for
+ JDK-8348561 and JDK-8349721
+ + JDK-8356051: Update SignatureUtil.java with the new KnownOIDs
+ + JDK-8354305: SHAKE128 and SHAKE256 MessageDigest algorithms
+ + JDK-8378506: [macOS] Window content not updated when rendering
+ to multiple windows
+ + JDK-8389492: [21u] java/io/Serializable/records/
+ /ProhibitedMethods.java fails after JDK-8307843 backport in
+ othervm mode
+ + JDK-7067310: 3 tests from closed/javax/sound/sampled caused
+ BSOD on win 7 x86
+ + JDK-8307574: ClipIsRunningAfterStop.java failed with
+ "../nptl/pthread_mutex_lock.c:81: __pthread_mutex_lock:
+ Assertion `mutex->__data.__owner == 0' failed."
+ + JDK-8308395: javax/sound/sampled/Clip/ClipFlushCrash.java
+ timed out
+ + JDK-8390325: [17u] test/jdk/sun/security/x509/GeneralName/
+ /DNSNameTest.java fails to compile in Java 17 after
+ JDK-8381771 backport
+ + JDK-8361125: Fix typo in onTradAbsence
+ + JDK-8347608: Optimize Java implementation of ML-KEM
+ + JDK-8347606: Optimize Java implementation of ML-DSA
+ + JDK-8353478: Update crypto microbenchmarks to cover ML-DSA,
+ ML-KEM, and HSS algorithms
+ + JDK-8349721: Add aarch64 intrinsics for ML-KEM
+ + JDK-8381937: Make exceptions in
+ Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
+ more specific
+ + JDK-8350589: Investigate cleaner implementation of AArch64
+ ML-DSA intrinsic introduced in JDK-8348561
+ + JDK-8348561: Add aarch64 intrinsics for ML-DSA
+ + JDK-8374452: [17u]
+ TestUseSHA512IntrinsicsOptionOnUnsupportedCPU failed with
+ java.lang.AssertionError
+ + JDK-8381771: Add a check for DNS label not to end with a
+ hyphen
+ + JDK-8349017: Update ML tests to verify against ACVP 1.1.0.38
+ version
+ + JDK-8284813: x86 Code cleanup related to move instructions.
+ + JDK-8345533: Switch ML-DSA implementation to FIPS 204 final
+ + JDK-8345512: Remove wrapper functions for intrinsics in PQC
+ algorithms
+ + JDK-8345057: ML_KEM NamedParameterSpec constants removed by
+ ML-DSA integration
+ + JDK-8298387: Implement JEP 497: Quantum-Resistant
+ Module-Lattice-Based Digital Signature Algorithm
+ + JDK-8275047: Optimize existing fill stubs for AVX-512 target
+ + JDK-8298390: Implement JEP 496: Quantum-Resistant
+ Module-Lattice-Based Key Encapsulation Mechanism
+ + JDK-8342002: sun/security/tools/keytool/GenKeyPairSigner.java
+ failed due to missing certificate output
+ + JDK-8300167: Add validation of the raster's layout before
+ using in native
+ + JDK-8341625: Improve ZipFile validation of the END header
+ + JDK-8342442: Static ACVP sample tests
+ + JDK-8340327: A common framework to support public key
+ algorithms with standard parameter sets
+ + JDK-8342003: ProblemList sun/security/tools/keytool/
+ /GenKeyPairSigner.java
+ + JDK-8387625: Add "dt_socket" to
+ `CheckedFeatures.notImplemented` for Windows/ARM64
+ + JDK-8377991: TestLimitsUpdating.java fails with runtime
+ exception even after JDK-8370492 is fixed
+ + JDK-8304013: Add a fast, non-manual alternative to
+ test/jdk/java/util/zip/ZipFile/TestTooManyEntries
+ + JDK-8298240: Replace the usage of ImageLayoutException by the
+ CMMException
+ + JDK-8282633: jarsigner output does not explain why an EC key
+ is disabled if its curve has been disabled
+ + JDK-8365498: jdk/jfr/event/os/TestCPULoad.java fails with
+ Expected at least one event
+ + JDK-8372757: MacOS, Accessibility: Crash in [MenuAccessibility
+ accessibilityChildren] after JDK-8341311
+ + JDK-8318662: Refactor some jdk/java/net/httpclient/http2 tests
+ to JUnit
+ + JDK-8346683: Problem list automated tests that fail on macOS15
+ + JDK-8313612: Use JUnit in lib-test/jdk tests
+ + JDK-8348309: MultiNST tests need more debugging and timing
+ + JDK-8380011: Path-to-gcroots search should not trigger stack
+ overflows
+ + JDK-8196440: Regression automated Test 'java/awt/TrayIcon/
+ /PopupMenuLeakTest/PopupMenuLeakTest.java' fails
+ + JDK-8365983: Tests should throw SkippedException when SCTP not
+ supported
+ + JDK-8343739: Test java/awt/event/KeyEvent/ExtendedKeyCode/
+ /ExtendedKeyCodeTest.java failed: Wrong extended key code
+ + JDK-8365863: /test/jdk/sun/security/pkcs11/Cipher tests skip
+ without SkippedException
+ + JDK-8296910: Add EdDSA/XDH/RSASSA-PSS to
+ KeyPairGeneratorBench.java
+ + JDK-8333857: Test sun/security/ssl/SSLSessionImpl/
+ /ResumeChecksServer.java failed: Existing session was used
+ + JDK-8148041: Test
+ java/awt/Mouse/TitleBarDoubleClick/TitleBarDoubleClick fails
+ on Ubuntu with mouseReleased event after double click on title
+ bar
+ + JDK-8194946: Regression automated Test 'javax/swing/
+ /JFileChooser/6738668/bug6738668.java' fails
+ + JDK-8334502: gtest/GTestWrapper.java fails on armhf due to
+ LogDecorations.iso8601_utctime_test
+ + JDK-8386991: Insets are incorrectly set in newer Gnome
+ versions
+ + JDK-8300805: Update autoconf build-aux files with latest from
+ 2022-09-17
+ + JDK-8355241: Move NativeDialogToFrontBackTest.java PL test to
+ manual category
+ + JDK-8196367: java/awt/List/SingleModeDeselect/
+ /SingleModeDeselect.java times out
+ + JDK-8202932: java/awt/Component/NativeInLightShow/
+ /NativeInLightShow.java fails
+ + JDK-8213120: java/awt/TextArea/AutoScrollOnSelectAndAppend/
+ /AutoScrollOnSelectAndAppend.java fails on mac10.13
+ + JDK-8365426: [macos26] Graphics2D tests fail on new macOS 26
+ + JDK-8305780: javax/swing/JTable/7068740/bug7068740.java fails
+ on Ubunutu 20.04
+ + JDK-8196018: java/awt/Scrollbar/ScrollbarMouseWheelTest/
+ /ScrollbarMouseWheelTest.java fails
+ + JDK-8303136: MemoryPoolMBean/
+ /isCollectionUsageThresholdExceeded/isexceeded005 failed with
+ "isCollectionUsageThresholdExceeded() returned true, while
+ threshold = 1 and used = 0"
+ + JDK-8380993: [REDO] Incorrect Interpretation of POSIX TZ
+ Environment Variable on AIX
+ + JDK-8023814: Test java/awt/im/memoryleak/
+ /InputContextMemoryLeakTest.java fails
+ + JDK-6626492: Event time in future part 2, now on X
+ + JDK-8129778: Few awt test fail for Solaris 11 with
+ RuntimeException
+ + JDK-8284965: closed test sun/java2d/OpenGL/XORPaint.java is
+ unstable
+ + JDK-8168388: GetMousePositionTest fails with the message
+ "Mouse position should not be null"
+ + JDK-8164464: Consistent failure of java/awt/dnd/
+ /MissingEventsOnModalDialog/
+ /MissingEventsOnModalDialogTest.java
+ + JDK-8286737: Test vmTestbase/gc/gctests/WeakReference/weak006/
+ /weak006.java fails: Last soft reference has not been cleared
+ + JDK-8377347: jdk/jfr/event/gc/detailed/
+ /TestZAllocationStallEvent.java intermittent OOME
+ + JDK-8278102: containers/docker/TestJcmd.java failed with
+ "RuntimeException: Could not find specified process"
+ + JDK-8296405: java/util/concurrent/forkjoin/
+ /AsyncShutdownNow.java is too slow
+ + JDK-8378180: Compiling OpenJDK with C23 C-Compiler gives
+ warning: initialization discards ‘const’ qualifier from
+ pointer target type
++++ 91 more lines (skipped)
++++ between /work/SRC/openSUSE:Factory/java-17-openjdk/java-17-openjdk.changes
++++ and
/work/SRC/openSUSE:Factory/.java-17-openjdk.new.2252680/java-17-openjdk.changes
Old:
----
jdk-17.0.20.1+1.tar.gz
tzdata-2026c.patch
New:
----
JDK-8395142-17u.patch
jdk-17.0.21+9.tar.gz
----------(Old B)----------
Old:- Removed patch:
* tzdata-2026c.patch
+ not needed any more
----------(Old E)----------
----------(New B)----------
New:- Added patch:
* JDK-8395142-17u.patch
+ JDK-8395142, CVE-2026-91403, bsc#1287264: CA Enhancements
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ java-17-openjdk.spec ++++++
--- /var/tmp/diff_new_pack.bpOC2n/_old 2026-10-27 17:09:45.860752466 +0100
+++ /var/tmp/diff_new_pack.bpOC2n/_new 2026-10-27 17:09:45.863752592 +0100
@@ -37,9 +37,9 @@
# Standard JPackage naming and versioning defines.
%global featurever 17
%global interimver 0
-%global updatever 20
-%global patchver 1
-%global buildver 1
+%global updatever 21
+#global patchver 0
+%global buildver 9
%global openjdk_repo jdk17u
%global openjdk_tag
jdk-%{featurever}.%{interimver}.%{updatever}%{?patchver:.%{patchver}}+%{buildver}
%global openjdk_dir
%{openjdk_repo}-jdk-%{featurever}.%{interimver}.%{updatever}%{?patchver:.%{patchver}}-%{buildver}
@@ -209,7 +209,7 @@
Patch301: JDK-8303509.patch
Patch302: disable-doclint-by-default.patch
#
-Patch400: tzdata-2026c.patch
+Patch400: JDK-8395142-17u.patch
#
BuildRequires: alsa-lib-devel
BuildRequires: autoconf
@@ -246,7 +246,6 @@
# Requires rest of java
Requires: %{name}-headless = %{version}-%{release}
Requires: fontconfig
-Requires(post): file
%if 0%{?suse_version} > 1315 || 0%{?java_bootstrap}
# Standard JPackage base provides.
Provides: java = %{javaver}
@@ -794,7 +793,7 @@
# check if the java-cacerts is a valid keystore (bnc#781690)
if [ X"`%{_bindir}/file --mime-type -b %{javacacerts}`" \
- != "Xapplication/x-java-keystore;" ]; then
+ != "Xapplication/x-java-keystore" ]; then
%if 0%{?suse_version} <= 1310
# workaround for bnc#847952 - pre 13.1 keyring.jar attempts to load
invalid keystore and fail on it
rm -f "%{javacacerts}"
@@ -810,7 +809,7 @@
# if cacerts does exists, neither does not contain/point to a
# valid keystore (bnc#781690) ...
if [ X"`%{_bindir}/file --mime-type -b -L %{cacerts}`" \
- != "Xapplication/x-java-keystore;" ]; then
+ != "Xapplication/x-java-keystore" ]; then
# bnc#727223
rm -f %{cacerts}
ln -s %{javacacerts} %{cacerts}
++++++ JDK-8395142-17u.patch ++++++
>From 10d196353d5abdcc64f6d4bcf4f5ddcbfd97839e Mon Sep 17 00:00:00 2001
From: Sergey Bylokhov <[email protected]>
Date: Thu, 22 Oct 2026 15:17:04 +0000
Subject: [PATCH] 8395142: CA Enhancements
Reviewed-by: abakhtin
Backport-of: 22bc7357ce6bc5f1ed2f1e83e0544b2c25f781d4
---
.../blockedcertsconverter/blocked.certs.pem | 430 ++++++++++++++++++
.../BlockedCertsConverter.java | 41 +-
.../sun/security/lib/CheckBlockedCerts.java | 16 +-
3 files changed, 468 insertions(+), 19 deletions(-)
diff --git a/make/data/blockedcertsconverter/blocked.certs.pem
b/make/data/blockedcertsconverter/blocked.certs.pem
index 4a3b33b0307..59b08d76b8c 100644
--- a/make/data/blockedcertsconverter/blocked.certs.pem
+++ b/make/data/blockedcertsconverter/blocked.certs.pem
@@ -747,3 +747,433 @@
lZA8SFd5CTDy3EBUU5UwzXUc5HoIRUxXSPycu3aIBWawg3sCdKiAoikScPAWj0bM
0vmsP/8QSlTOBqO+QFQ6R82BtTvBNU3qbVICV4QObsxib++FAFL56NApPqskg7Vz
LfNIAjKabHUcjbuZkmg6jr4BfYW7+oQDHCsYgADjjKGdKz/8U/fP
-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// a0:24:fd:f4:ba:66:5c:78:5c:e4:a0:20:48:38:58:b7
+-----BEGIN CERTIFICATE-----
+MIIDzjCCAragAwIBAgIRAKAk/fS6Zlx4XOSgIEg4WLcwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBEViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAATnntnASpdzxHNeUREdqFrCvV5kqzdLgOEsvCA47B5PDjuBL8mFnh5nr7BO
+L4vJf3SFumWqkR7opORbYtXMA9Vr5nizw4y03JN8okYOI4RTyJKTXSnUT5HhVga2
+PM7atGijggE1MIIBMTAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQU4h4v5xwZOQ5VS2LBICRXNSSKJRQwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDEGA1UdIAQqMCgwCAYGZ4EMAQIBMA0GCysGAQQBg44hAQABMA0GCysGAQQBg44h
+AQJkMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB
+QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQBzQ1IoqpdotM6gFrR4Q3YrKifOLeaj5XXunldpVE/vZn2TxC2y0s8oYiLR5ICE
+wqVXSB7N6BM1Mp+Nif7Jbhb2IswAfSR4Iik8+B0iRmi7lYoNlycCgHjmsjOmZaxM
+QkPmjXAJbG5f4V41OsvJZmS7lI3r0IuvEDVX3GAZ13on6IImSs9ybNpHQ7NCqkMQ
+7wH4uAO1dtpFycgJSdHaCOhHjrox2BTYGLdpUrYwY3EOAjlZ8UGgsxs7mG+xquMl
+bN1LFURwfnkVMP3T/DBIZ/ys2+lNFyxK3FlArrV4/000uTnVB1lO8oGORYdXoT5V
+GUyRCEIDhF5TBUuKF4E3kf1h
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// d8:f8:68:5e:4f:2b:d9:d8:24:02:a8:5a:1c:1e:b7:31
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIRANj4aF5PK9nYJAKoWhwetzEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBFViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAQl26haZNOX2gsQUunqVG5Ie+/qnJ2daKDF6tz+73Wmm7XW/AH0K/vKbrQL
+zWTAdn42/9Bdl6gTxaoMbJUw55z18IZkaPE4BkIKpchRhAseJSVA55DktlTDhS7W
+SvHoZX2jggE0MIIBMDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUPtwg2YlGmId7hz/YgUeyXBXYRwYwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDAGA1UdIAQpMCcwBwYFZ4EMAQEwDQYLKwYBBAGDjiEBAAEwDQYLKwYBBAGDjiEB
+AngwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFB
+Q2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUF
+BzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQADggEB
+AJNFuAFW9Gnw/8+kCO4KIlZdnM1Sh2u+8cK0EYAHhXpb5FlGvYkcARigo5oS7VoM
+7FOYlTueV6yICZKNAYawZPJPhNCGK+rp3cQBEz6d0n8OZEYZov9lb3ll8ORgSDuf
+FVIW6Gagg/UnOamLBTOR8eD5V73SCme/B2cHUDw+m5E8cc+0Ujzz3Cn3ex5JrhXk
+2T3s8PoVzEmhTgGboFfcWO1EYhPPrYwdxPYRQIXAXUXhLEOVNL9ASbZJLFI8E1IM
+m7NwxVN2s38jWpaCUaaF0tg7hfiy7oe13rzJfHsdqldJVTTUTPWVx8TC4ju0VLet
+bAlwhwFT6AP8uIVMGUHNw24=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// e9:42:23:bd:e9:2f:91:4e:5a:b9:ac:ab:fd:ac:37:10
+-----BEGIN CERTIFICATE-----
+MIIDzjCCAragAwIBAgIRAOlCI73pL5FOWrmsq/2sNxAwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK56Ks1xwy
+Ko42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDftDIVOTMEv
+TPhkbQ2jggE1MIIBMTAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDEGA1UdIAQqMCgwCAYGZ4EMAQICMA0GCysGAQQBg44hAQABMA0GCysGAQQBg44h
+AQJuMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB
+QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQALRoOSvkzRa+tN5Rje9W5GiXd/qsicd9N6Gnh0SWC7VyWH+HycIqAnFCMYZznj
+CeGusomFYHE42SHWr85JDIbgzy6y3dO4i9n9w0Bx7yrXWBbDzFS8VgA3+EY4Cg7y
+mtoC3RPOJVtaXXPZ+68X804g1Mj+3vCSHj2lNPVgco0OzSIOJ/KMg1R9MLBkiKzb
+bERAGZHejY0HBhYd76IINZN8z6bBNah2UdFYxsOisLynPQUkol6gRLum024/FzVl
+CCDfnUusrkr+mAfPAvD/Vb8bhpA7jYtepuU+2mIdShj5lLlvAwZphn+ypWycuo2x
+0k9mldz2dqI9nhCiY+TTIOOR
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 91:f3:47:f1:a5:b7:d3:99:62:b9:5e:0e:e4:e2:99:d1
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIRAJHzR/Glt9OZYrleDuTimdEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0CAQYFK4EE
+ACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFypDPjYw8C
+vRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpVbMyLpQVh
+3xsqRB0Bo4IBNTCCATEwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQw
+HQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMA4GA1UdDwEB/wQEAwIBBjAS
+BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjAxBgNVHSAEKjAoMAgGBmeBDAECATANBgsrBgEEAYOOIQEAATANBgsrBgEEAYOO
+IQECZDBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9B
+QUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYB
+BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOC
+AQEAr7b6Mx11TIJgVzHt6EH5qGNWeiiqoMrp8E5/k8s+jvupx1n083pZ5XOzUzND
+wEUe0W4C4FIGUHNQ4XDwqOw0yK42xqm2dvCKgsko2UvDlT0haZVtTCeWMQOe5J/J
+ziaMfZwsZNfZ3aaI6XPtWDZtwY8AaNfyaeCpbtm5GcGnyNWk4jSNpbtpo6NjfXuP
+CFOm3rTjJ4zytP7Tso6iMm0L01cYFOlTmoPv4515R2r3SPnKDtijoB/D/vgxzojv
+DafgyG9afX8+laO9NbMMz4sqC1vZx3984i/sBNFiugm3Vvdq5OdJRjuGC1QILIs6
+dg/K3i8VQqRpbfaM9kIlMzZ3dQ==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 8d:5a:48:11:93:9e:f4:47:d7:71:11:cd:d9:84:9a:e9
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIRAI1aSBGTnvRH13ERzdmEmukwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0CAQYFK4EE
+ACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZfjpRIOHv
+1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+N7ulaVSf
+HAKycO1no4IBNTCCATEwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQw
+HQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMA4GA1UdDwEB/wQEAwIBBjAS
+BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjAxBgNVHSAEKjAoMAgGBmeBDAECAjANBgsrBgEEAYOOIQEAATANBgsrBgEEAYOO
+IQECbjBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9B
+QUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYB
+BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOC
+AQEAHlbhZpjhkPEAQVhPHRtBDaHqiisVD20pQ1TUeSx3l62Qe7NQ0b7vWQy7DN0i
+KOu7BGpP5EnIjvXbz9FhpfPJ4FhKEt3tQ51rqXz2oD8vRaryvExWPobDUz3j7HN6
+OzBsVMIe3PD7AAkpky0x8zMSi/ep5R9OMzybmNptbtppyuB5ytgq+h7lQdRIP+CQ
+TaJX3qTgfMqzntYre5GljmEB5hU2/rSn8zoSU2APkJidlZFpghtgbD4I2VRHZvCw
+FFr/SrFM9pwrgbJNZ1MtyTSVgI5NlNb0aMfLR+/r6jJt3ROeY2yh2QQ2dx+Yqgdb
+uL5ChFWOQU+ErSDnUq7yr+pjBQ==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// d6:a5:ef:61:3b:39:0f:32:ef:9c:df:34:9f:77:28:41
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIRANal72E7OQ8y75zfNJ93KEEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEaMBgGA1UEAwwRRU0gT1YgQ1MgQ0EgLSBHM0MwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAS58OBjRwKmnKaq3UQ8/WLEG5uksgkkaX15dOdpGhJvuWr7PjTC/TvF9IMG
+HyZdwqWENjRzI1EENrKPBPOGI2MGeYDiUD4CUy1lRiNacWWiWaHvSW90G1/e53hy
+COS4+u+jggEsMIIBKDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQU7m9zKY1vv6ezG8OVNPYVVkR4ZrcwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwMgYDVR0gBCsw
+KTAIBgZngQwBBAEwDQYLKwYBBAGDjiEBAAEwDgYMKwYBBAGDjiEBAoFIMEMGA1Ud
+HwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmlj
+YXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0
+cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBgGbZ+NDkn
+2Fr5dCVs/51+6cT5iEPP1stglX4TI2UaNh9LmPdltxXw3crV8gK5L8i+d+ScGibF
+y0obtBHNTldXDgLnAHIzY3n+pceyKj7O2ae9CYnyuu5RBifeI3XYKowWE+oXnVGF
+Oy0CvCJ/JsdP6aYgoCa9hGnAYicYQQL6MOMQZ5PuhcSM8t4giIzrpgrEkUP93GYE
+emDG5Z8BYwKs80lLeQNBnwg/VHJ3iEF/o84RXYwrlrKqJ+33C094o6LNikMJCqOK
+/WYHZSR8Xyhf8GXFAj5pZuI6Bcpug2V/E7i42j8OBhc25aNYDqK+B0qmb90sjNUB
+g3tJeSIb/599
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 41:e3:2b:73:ac:18:5d:6c:e0:d7:48:0b:ac:f8:4e:69
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIQQeMrc6wYXWzg10gLrPhOaTANBgkqhkiG9w0BAQsFADB7
+MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
+VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE
+AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTI1MDUxNDAwMDAwMFoXDTI4
+MTIzMTIzNTk1OVowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRocmEgQlYx
+GjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUObNKBDHK/+
+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jordd7EAZPKr
+5eBQo4IBLDCCASgwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYD
+VR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMA4GA1UdDwEB/wQEAwIBBjASBgNV
+HRMBAf8ECDAGAQH/AgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDIGA1UdIAQrMCkw
+CAYGZ4EMAQQBMA0GCysGAQQBg44hAQABMA4GDCsGAQQBg44hAQKBSDBDBgNVHR8E
+PDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0
+ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6
+Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAIh0OzWsdBYhY
+7+yxPGyosRL+uUSN6/Mrd30fBuougs5FVWQ3cRgLhImnUUgXADY9buugWhMmfT3c
+yU5T1MFXZXClCILm5mfg+oqm/ikUWJl3Ayf2GvYf2O++6vzqvkn418nI5Lpdt0O7
+Li524YS/3CZHDA+zZQ7rrHpZXgQ9Hmp8AUQ4FneaGjNanFoYxiZxwCyW5z4u7AoK
+0bmOVqKtcDFoVNz5++G9TYDJdhWOXmKKgzqRo1MK0PjazNT7MGHqknP93SqMVJ1g
+mX/qNWxYteAjlvFanQxBNX/+TRxDjuFsEHO/7BvqSpIIck0UEEfizhN8zNpWLbcl
+EqVgl0g39A==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// a4:ae:e6:78:f2:33:62:b4:c0:e4:60:b7:72:f2:14
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1
+NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J
+hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p
+1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO
+Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8
+gt2TlfJbHii+KNvK
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 58:8b:2e:3c:2b:b8:cd:a1:3e:1a:12:09:25:43:21
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1
+MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy
+pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV
+bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg
+yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd
+AEKwaJ0mVzScy2+6
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// c7:c4:1e:fe:92:d8:25:f0:5e:ae:84:1a:4a:82:c1
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw
+MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB
+9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ
+5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA
+lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6
+MN/P+ByGeiRMghzB
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 80:09:92:8a:64:10:76:01:af:05:fa:2f:19:f1:09
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz
+OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11
+ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+
+bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm
+xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9
+i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq
+MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG
+AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc
+9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f
+Aal1GNxsOutLnr0Y
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root CS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 78:18:93:3f:8f:85:b4:61:9a:2b:35:fb:a8:3d:0a
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy
+N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo
+cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb
+NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord
+d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r
+zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG
+AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc
+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG
+Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At
+Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp
+Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo
+dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03
+YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9
+HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrM=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root CS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 54:4b:7f:92:2c:31:ae:22:0a:4a:92:29:16:f6:e6
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0
+MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo
+cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9
+O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb
+X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN
+q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr
+BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW
+HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG
+BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw
+LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z
+aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl
+aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E
+BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg
+8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg
+euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 6c:ad:a3:67:fb:1c:10:00:88:12:0e:a2:02:d5:68
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw
+MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk
+aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB
+BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK
+56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft
+DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ
+QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo
+BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE
+AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc
+28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe
+8Dz3bQjauvy9uw==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 29:69:26:c2:27:a3:a1:52:63:92:b1:94:82:a5:04
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3
+NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ
+fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+
+N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c
+NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79
+4rSb9vGqxZzelQth
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 05:f0:78:75:2d:ec:e7:a1:bb:85:95:d3:03:16:71:71
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIQBfB4dS3s56G7hZXTAxZxcTANBgkqhkiG9w0BAQsFADB7
+MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
+VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE
+AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTI1MDUxNDAwMDAwMFoXDTI4
+MTIzMTIzNTk1OVowQDELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRocmEgSW5j
+MRswGQYDVQQDDBJFTSBFViBUTFMgQ0EgLSBHM0MwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAQtVugppvuCxkpGl9lgr5UekGeukfkm00MG2kioqut4abamfm0nQm4EQqoD
+s24ZiN/2NlFO4c8H9bpLP/KgZkWufTHVhmrTGqPSRusLMXfumct1ZsUWznSAimaP
+kfDEf8qjggE0MIIBMDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUpiVegKlNt/OWfBvHkd+SvO5L618wDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDAGA1UdIAQpMCcwBwYFZ4EMAQEwDQYLKwYBBAGDjiEBAAEwDQYLKwYBBAGDjiEB
+AngwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFB
+Q2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUF
+BzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQADggEB
+AIFfHiaMSjnrdZygRYV4ekRBmG7ybcFk4hGQWMMyMFi0cAEk2+dGfz5bl8IaIbLq
+z+uVJzhOgVEX7WqIfgbWfFsfPYHYjPHBmy7SlZ3BwA86IQ6qF/etpX2/qL9A5yRN
+N3nVowUpaqV6H3aCpkAh3wR2ZNkvAbLDvPz3J0l+sEWjWv+ZISOV4R+hXDTdPXV0
+1lKxnbwqEsdo/sE2QkCDKwFrZh/0uKjWspydJj+jSaDLTrGNx50Dgmn7VEcD1ZI5
+FXjknVUiO25YlmS1dtVZSBbyUKSjlrP/yDwPcZunoAsmCAAtCKsFLviLaymzvsKI
+eSSDGxpSySp2VCxompGDk8g=
+-----END CERTIFICATE-----
diff --git
a/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
b/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
index 1b2a3ebebaf..9103f47bd4d 100644
---
a/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
+++
b/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2013, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -27,12 +27,14 @@ package build.tools.blockedcertsconverter;
import java.io.IOException;
import java.math.BigInteger;
+import java.security.AlgorithmParameters;
+import java.security.GeneralSecurityException;
import java.security.MessageDigest;
-import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
-import java.security.interfaces.ECPublicKey;
+import java.security.spec.ECGenParameterSpec;
+import java.security.spec.ECParameterSpec;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
@@ -140,11 +142,8 @@ public class BlockedCertsConverter {
List<DerValue> algIds = Arrays.asList(seq[1], altAlgId(seq[1]));
List<DerValue> sigs;
- PublicKey p = c.getPublicKey();
- if (p instanceof ECPublicKey) {
- ECPublicKey ep = (ECPublicKey) p;
- BigInteger mod = ep.getParams().getOrder();
- sigs = Arrays.asList(seq[2], altSig(mod, seq[2]));
+ if (c.getSigAlgName().contains("ECDSA")) {
+ sigs = Arrays.asList(seq[2], altSig(seq[2]));
} else {
sigs = Arrays.asList(seq[2]);
}
@@ -163,14 +162,27 @@ public class BlockedCertsConverter {
return result;
}
- private static DerValue altSig(BigInteger mod, DerValue sig)
+ private static DerValue altSig(DerValue sig)
throws IOException {
byte[] sigBits = sig.getBitString();
+ int sigLength = sigBits.length;
DerInputStream in =
- new DerInputStream(sigBits, 0, sigBits.length, false);
+ new DerInputStream(sigBits, 0, sigLength, false);
DerValue[] values = in.getSequence(2);
BigInteger r = values[0].getBigInteger();
BigInteger s = values[1].getBigInteger();
+ BigInteger mod;
+ // The following checks cover more than 99.99999% of signature lengths
+ // for the three NIST-P curves. Fail if the length lies outside.
+ if (sigLength >= 100 && sigLength <= 104) {
+ mod = order("secp384r1");
+ } else if (sigLength >= 68 && sigLength <= 72) {
+ mod = order("secp256r1");
+ } else if (sigLength >= 135 && sigLength <= 139) {
+ mod = order("secp521r1");
+ } else {
+ throw new RuntimeException("Unrecognized signature length: " +
sigLength);
+ }
BigInteger s2 = s.negate().mod(mod);
DerOutputStream out = new DerOutputStream();
out.putInteger(r);
@@ -193,4 +205,13 @@ public class BlockedCertsConverter {
tmp.write(DerValue.tag_Sequence, bytes);
return new DerValue(tmp.toByteArray());
}
+ private static BigInteger order(String curve) throws IOException {
+ try {
+ AlgorithmParameters ap = AlgorithmParameters.getInstance("EC");
+ ap.init(new ECGenParameterSpec(curve));
+ return ap.getParameterSpec(ECParameterSpec.class).getOrder();
+ } catch (GeneralSecurityException e) {
+ throw new IOException(e);
+ }
+ }
}
diff --git a/test/jdk/sun/security/lib/CheckBlockedCerts.java
b/test/jdk/sun/security/lib/CheckBlockedCerts.java
index e5561bf15b8..b0e3511dae1 100644
--- a/test/jdk/sun/security/lib/CheckBlockedCerts.java
+++ b/test/jdk/sun/security/lib/CheckBlockedCerts.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2013, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -56,21 +56,19 @@ public class CheckBlockedCerts {
}
}
- // All certs in the pem files
- Set<Certificate> blocked = new HashSet<>();
-
// Assumes the full src is available
File blockedCertsFile = new File(System.getProperty("test.src"),
"../../../../../make/data/blockedcertsconverter/blocked.certs.pem");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
+ int expectedCount = 0;
try (FileInputStream fis = new FileInputStream(blockedCertsFile)) {
Collection<? extends Certificate> certs
= cf.generateCertificates(fis);
System.out.println(certs.size());
for (Certificate c: certs) {
- blocked.add(c);
X509Certificate cert = ((X509Certificate)c);
+ expectedCount += cert.getSigAlgName().contains("ECDSA") ? 4 :
2;
if (!UntrustedCertificates.isUntrusted(cert)) {
System.out.println(cert.getSubjectX500Principal() +
" is trusted");
@@ -101,11 +99,11 @@ public class CheckBlockedCerts {
failed = true;
}
// There are two unique fingerprints for each RSA certificate
- if (ccount != blocked.size() * 2
- && !blocked.isEmpty()) {
+ if (ccount != expectedCount
+ && expectedCount != 0) {
System.out.println("Wrong blocked.certs size: "
- + ccount + " fingerprints, "
- + blocked.size() + " certs");
+ + ccount + " fingerprints, expected"
+ + expectedCount);
failed = true;
}
}
--
2.56.0
++++++ fips.patch ++++++
--- /var/tmp/diff_new_pack.bpOC2n/_old 2026-10-27 17:09:46.006758582 +0100
+++ /var/tmp/diff_new_pack.bpOC2n/_new 2026-10-27 17:09:46.011758792 +0100
@@ -504,7 +504,7 @@
import static sun.security.util.SecurityConstants.PROVIDER_VER;
import static sun.security.util.SecurityProviderConstants.*;
-@@ -78,6 +79,10 @@ import static sun.security.util.SecurityProviderConstants.*;
+@@ -80,6 +81,10 @@ import static sun.security.util.SecurityProviderConstants.*;
public final class SunJCE extends Provider {
@@ -515,7 +515,7 @@
@java.io.Serial
private static final long serialVersionUID = 6812507587804302833L;
-@@ -143,6 +148,7 @@ public final class SunJCE extends Provider {
+@@ -145,6 +150,7 @@ public final class SunJCE extends Provider {
void putEntries() {
// reuse attribute map and reset before each reuse
HashMap<String, String> attrs = new HashMap<>(3);
@@ -523,7 +523,7 @@
attrs.put("SupportedKeyClasses",
"java.security.interfaces.RSAPublicKey" +
"|java.security.interfaces.RSAPrivateKey");
-@@ -425,6 +431,7 @@ public final class SunJCE extends Provider {
+@@ -427,6 +433,7 @@ public final class SunJCE extends Provider {
psA("KeyPairGenerator", "DiffieHellman",
"com.sun.crypto.provider.DHKeyPairGenerator",
null);
@@ -531,7 +531,7 @@
/*
* Algorithm parameter generation engines
-@@ -433,6 +440,7 @@ public final class SunJCE extends Provider {
+@@ -435,6 +442,7 @@ public final class SunJCE extends Provider {
"DiffieHellman",
"com.sun.crypto.provider.DHParameterGenerator",
null);
@@ -539,7 +539,7 @@
/*
* Key Agreement engines
*/
-@@ -442,6 +450,7 @@ public final class SunJCE extends Provider {
+@@ -444,6 +452,7 @@ public final class SunJCE extends Provider {
psA("KeyAgreement", "DiffieHellman",
"com.sun.crypto.provider.DHKeyAgreement",
attrs);
@@ -547,7 +547,7 @@
/*
* Algorithm Parameter engines
-@@ -613,6 +622,7 @@ public final class SunJCE extends Provider {
+@@ -615,6 +624,7 @@ public final class SunJCE extends Provider {
ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256",
"com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256");
@@ -555,7 +555,7 @@
// PBKDF2
psA("SecretKeyFactory", "PBKDF2WithHmacSHA1",
"com.sun.crypto.provider.PBKDF2Core$HmacSHA1",
-@@ -726,6 +736,7 @@ public final class SunJCE extends Provider {
+@@ -745,6 +755,7 @@ public final class SunJCE extends Provider {
"com.sun.crypto.provider.TlsRsaPremasterSecretGenerator",
List.of("SunTls12RsaPremasterSecret"), null);
}
@@ -1029,28 +1029,31 @@
/*
* SecureRandom engines
*/
-@@ -177,6 +183,8 @@ public final class SunEntries {
- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
- add(p, "Signature", "SHA3-512withDSAinP1363Format",
- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
+@@ -184,6 +190,7 @@ public final class SunEntries {
+ addWithAlias(p, "Signature", "ML-DSA-44",
"sun.security.provider.ML_DSA_Impls$SIG2", attrs);
+ addWithAlias(p, "Signature", "ML-DSA-65",
"sun.security.provider.ML_DSA_Impls$SIG3", attrs);
+ addWithAlias(p, "Signature", "ML-DSA-87",
"sun.security.provider.ML_DSA_Impls$SIG5", attrs);
+ }
-+
+
/*
* Key Pair Generator engines
- */
-@@ -184,9 +192,11 @@ public final class SunEntries {
+@@ -191,6 +198,7 @@ public final class SunEntries {
+ attrs.clear();
attrs.put("ImplementedIn", "Software");
- attrs.put("KeySize", "2048"); // for DSA KPG and APG only
+ if (!systemFipsEnabled) {
String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
+ attrs.put("KeySize", "2048");
+@@ -201,6 +209,7 @@ public final class SunEntries {
+ addWithAlias(p, "KeyPairGenerator", "ML-DSA-44",
"sun.security.provider.ML_DSA_Impls$KPG2", attrs);
+ addWithAlias(p, "KeyPairGenerator", "ML-DSA-65",
"sun.security.provider.ML_DSA_Impls$KPG3", attrs);
+ addWithAlias(p, "KeyPairGenerator", "ML-DSA-87",
"sun.security.provider.ML_DSA_Impls$KPG5", attrs);
+ }
/*
* Algorithm Parameter Generator engines
-@@ -201,6 +211,7 @@ public final class SunEntries {
+@@ -216,6 +225,7 @@ public final class SunEntries {
addWithAlias(p, "AlgorithmParameters", "DSA",
"sun.security.provider.DSAParameters", attrs);
@@ -1058,10 +1061,10 @@
/*
* Key factories
*/
-@@ -235,6 +246,7 @@ public final class SunEntries {
- "sun.security.provider.SHA3$SHA384", attrs);
- addWithAlias(p, "MessageDigest", "SHA3-512",
- "sun.security.provider.SHA3$SHA512", attrs);
+@@ -259,6 +269,7 @@ public final class SunEntries {
+ "sun.security.provider.SHA3$SHAKE128Hash", attrs);
+ addWithAlias(p, "MessageDigest", "SHAKE256-512",
+ "sun.security.provider.SHA3$SHAKE256Hash", attrs);
+ }
/*
++++++ jdk-17.0.20.1+1.tar.gz -> jdk-17.0.21+9.tar.gz ++++++
/work/SRC/openSUSE:Factory/java-17-openjdk/jdk-17.0.20.1+1.tar.gz
/work/SRC/openSUSE:Factory/.java-17-openjdk.new.2252680/jdk-17.0.21+9.tar.gz
differ: char 14, line 1
