From 3967501d6d1512f8e644fca71efb18854ea0fd4c Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon-tobias.schweizer@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 15:25:40 +0200
Subject: [PATCH 1/6] added files for DSF v1.9.0

---
 docs/src/.vuepress/layouts/PageLayout.vue     |   5 +-
 docs/src/.vuepress/theme.ts                   |   5 +-
 docs/src/operations/latest                    |   2 +-
 docs/src/operations/v1.9.0/allowList-mgm.md   |  34 +
 .../v1.9.0/bpe-reverse-proxy/README.md        |   6 +
 .../v1.9.0/bpe-reverse-proxy/configuration.md |  99 +++
 docs/src/operations/v1.9.0/bpe/README.md      |   8 +
 .../operations/v1.9.0/bpe/access-control.md   | 104 +++
 .../operations/v1.9.0/bpe/configuration.md    | 695 ++++++++++++++++++
 docs/src/operations/v1.9.0/bpe/oidc.md        |  56 ++
 .../v1.9.0/fhir-reverse-proxy/README.md       |   6 +
 .../fhir-reverse-proxy/configuration.md       |  99 +++
 docs/src/operations/v1.9.0/fhir/README.md     |   8 +
 .../operations/v1.9.0/fhir/access-control.md  | 129 ++++
 .../operations/v1.9.0/fhir/configuration.md   | 427 +++++++++++
 docs/src/operations/v1.9.0/fhir/oidc.md       |  63 ++
 docs/src/operations/v1.9.0/index.md           |  23 +
 docs/src/operations/v1.9.0/install-plugins.md |  56 ++
 docs/src/operations/v1.9.0/install.md         | 230 ++++++
 .../operations/v1.9.0/passwords-secrets.md    |  33 +
 docs/src/operations/v1.9.0/release-notes.md   |  13 +
 .../operations/v1.9.0/root-certificates.md    | 208 ++++++
 docs/src/operations/v1.9.0/upgrade-from-0.md  |  32 +
 docs/src/operations/v1.9.0/upgrade-from-1.md  | 137 ++++
 24 files changed, 2473 insertions(+), 5 deletions(-)
 create mode 100644 docs/src/operations/v1.9.0/allowList-mgm.md
 create mode 100644 docs/src/operations/v1.9.0/bpe-reverse-proxy/README.md
 create mode 100644 docs/src/operations/v1.9.0/bpe-reverse-proxy/configuration.md
 create mode 100644 docs/src/operations/v1.9.0/bpe/README.md
 create mode 100644 docs/src/operations/v1.9.0/bpe/access-control.md
 create mode 100644 docs/src/operations/v1.9.0/bpe/configuration.md
 create mode 100644 docs/src/operations/v1.9.0/bpe/oidc.md
 create mode 100644 docs/src/operations/v1.9.0/fhir-reverse-proxy/README.md
 create mode 100644 docs/src/operations/v1.9.0/fhir-reverse-proxy/configuration.md
 create mode 100644 docs/src/operations/v1.9.0/fhir/README.md
 create mode 100644 docs/src/operations/v1.9.0/fhir/access-control.md
 create mode 100644 docs/src/operations/v1.9.0/fhir/configuration.md
 create mode 100644 docs/src/operations/v1.9.0/fhir/oidc.md
 create mode 100644 docs/src/operations/v1.9.0/index.md
 create mode 100644 docs/src/operations/v1.9.0/install-plugins.md
 create mode 100644 docs/src/operations/v1.9.0/install.md
 create mode 100644 docs/src/operations/v1.9.0/passwords-secrets.md
 create mode 100644 docs/src/operations/v1.9.0/release-notes.md
 create mode 100644 docs/src/operations/v1.9.0/root-certificates.md
 create mode 100644 docs/src/operations/v1.9.0/upgrade-from-0.md
 create mode 100644 docs/src/operations/v1.9.0/upgrade-from-1.md

diff --git a/docs/src/.vuepress/layouts/PageLayout.vue b/docs/src/.vuepress/layouts/PageLayout.vue
index d3d001b06..e7d293fbb 100644
--- a/docs/src/.vuepress/layouts/PageLayout.vue
+++ b/docs/src/.vuepress/layouts/PageLayout.vue
@@ -4,7 +4,7 @@ import { useRoute, useRouter } from "vue-router";
 import { ref, onMounted } from 'vue'
 
 const version = ref("");
-const latestVersion = "v1.8.0";
+const latestVersion = "v1.9.0";
 
 
 function setVersionBasedOnCurrentPath() : void {
@@ -55,7 +55,8 @@ function navigateToNewVersion() {
       <div class="version-selector" v-if="route.path.startsWith('/operations/')">
         <label class="vp-sidebar-header" for="version-select"><strong>Version:</strong> </label>
         <select id="version-select" class="vp-sidebar-header" v-model="version" @change="navigateToNewVersion">
-        <option value="v1.8.0">latest (1.8.0)</option>
+        <option value="v1.9.0">latest (1.9.0)</option>
+        <option value="v1.8.0">1.8.0</option>
         <option value="v1.7.1">1.7.1</option>
         <option value="v1.7.0">1.7.0</option>
         <option value="v1.6.0">1.6.0</option>
diff --git a/docs/src/.vuepress/theme.ts b/docs/src/.vuepress/theme.ts
index 6d755a59e..350a88595 100644
--- a/docs/src/.vuepress/theme.ts
+++ b/docs/src/.vuepress/theme.ts
@@ -116,8 +116,9 @@ export default hopeTheme({
     "/operations/next/": [],
     "/operations/v2.0.0-M4/": [],
     "/operations/v2.0.0-M3/": [],
-    "/operations/v1.8.0/": generate_v1_latest_sidebar(),
-    "/operations/v1.7.1/": generate_v1_latest_sidebar(),
+    "/operations/v1.9.0/": generate_v1_latest_sidebar(),
+    "/operations/v1.8.0/": generate_v1_gt_eq_1_7_0_sidebar(),
+    "/operations/v1.7.1/": generate_v1_gt_eq_1_7_0_sidebar(),
     "/operations/v1.7.0/": generate_v1_gt_eq_1_7_0_sidebar(),
     "/operations/v1.6.0/": generate_v1_gt_eq_1_5_0_sidebar(),
     "/operations/v1.5.2/": generate_v1_gt_eq_1_5_0_sidebar(),
diff --git a/docs/src/operations/latest b/docs/src/operations/latest
index 4e2cea3bb..e2f650c40 120000
--- a/docs/src/operations/latest
+++ b/docs/src/operations/latest
@@ -1 +1 @@
-v1.8.0
\ No newline at end of file
+v1.9.0
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/allowList-mgm.md b/docs/src/operations/v1.9.0/allowList-mgm.md
new file mode 100644
index 000000000..f15eb7144
--- /dev/null
+++ b/docs/src/operations/v1.9.0/allowList-mgm.md
@@ -0,0 +1,34 @@
+---
+title: Allow List Management
+icon: share
+---
+You can read all about the concept of Allow Lists [in our introduction](/explore/concepts/allow-list.md).
+
+## Overview
+To simplify the DSF Allow List Management we have built a portal for administration. The portal is managed by the GECKO Institute at Heilbronn University. You as an DSF administrator can create or update your Allow List information. The information you provide on this portal will be transferred to us and will be used to built Allow List bundles that get distributed to the communication partners of the distributed processes. 
+
+The DSF Allow List management tool uses client certificates for authentication. You can either use a personal client certificate or the client certificate from your DSF BPE, which needs to be added to your web-browsers certificate store.
+
+
+## Prerequisites
+1. Deployed DSF instance (test or production infrastructure)
+    1.1  If none exists yet, read [the installation guide](install)
+2. Certificate 
+    2.1  If none exists yet, read [the certificate requirements](install#client-server-certificates)
+3. Organization identifier, shortest FQDN of your organizations website, e.g. `my-hospital.de`
+4. FHIR endpoint URL, e.g. `https://dsf.my-hospital.de/fhir`
+5. Contact details from a responsible person of your organization
+6. Access to the E-Mail address from your organization for verification 
+ 
+
+## Start here
+When you have fulfilled all the prerequisites, you can start managing your Allow Lists via the environment specific Allow List Management Tool:
+
+- [**Test** infrastructure](https://allowlist-test.gecko.hs-heilbronn.de)
+- [**Production** infrastructure](https://allowlist.gecko.hs-heilbronn.de)
+
+We use different highlight colors for the DSF Allow List Management Tool: Green for the **Test** environment and blue for the **Production** infrastructure. To access the site, you have to authenticate yourself with a client certificate. Your web-browser will show a dialog to choose a valid certificate.
+
+::: tip Ideas for improvement?
+Have you found an error or is something unclear to you? Then please feel free to contact us on the <a href="https://mii.zulipchat.com/#narrow/stream/392426-Data-Sharing-Framework-.28DSF.29">MII-Zulip Channel</a> or write us at <a href="mailto:dsf-gecko@hs-heilbronn.de">dsf-gecko@hs-heilbronn.de</a>. Thank you very much!
+:::
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/bpe-reverse-proxy/README.md b/docs/src/operations/v1.9.0/bpe-reverse-proxy/README.md
new file mode 100644
index 000000000..4e6a614a0
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe-reverse-proxy/README.md
@@ -0,0 +1,6 @@
+---
+title: BPE Reverse Proxy
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
diff --git a/docs/src/operations/v1.9.0/bpe-reverse-proxy/configuration.md b/docs/src/operations/v1.9.0/bpe-reverse-proxy/configuration.md
new file mode 100644
index 000000000..feffa2541
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe-reverse-proxy/configuration.md
@@ -0,0 +1,99 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### APP_SERVER_IP
+- **Required:** Yes
+- **Description:** Hostname or IP-Address of the DSF BPE server application container, the reverse proxy target
+- **Example:** `app`, `172.28.1.3`
+
+
+### HTTPS_SERVER_NAME_PORT
+- **Required:** Yes
+- **Description:** FQDN of your DSF BPE server with port, typically `443`
+- **Example:** `my-external.fqdn:443`
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_WS
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### PROXY_PASS_TIMEOUT_WS
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### SERVER_CONTEXT_PATH
+- **Required:** No
+- **Description:** Reverse proxy context path that delegates to the app server, `/` character at start, no `/` character at end, use `''` (empty string) to configure root as context path
+- **Default:** `/bpe`
+
+
+### SSL_CA_CERTIFICATE_FILE
+- **Required:** No
+- **Description:** Certificate chain file including all issuing, intermediate and root certificates used to validate client certificates, PEM encoded, sets the apache httpd parameter `SSLCACertificateFile`
+- **Recommendation:** Use docker secret file to configure
+- **Default:** `ca/client_cert_ca_chains.pem`
+
+
+### SSL_CA_DN_REQUEST_FILE
+- **Required:** No
+- **Description:** File containing all signing certificates excepted, will be used to specify the `Acceptable client certificate CA names` send to the client, during TLS handshake, sets the apache httpd parameter `SSLCADNRequestFile`; if omitted all entries from `SSL_CA_CERTIFICATE_FILE` are used
+- **Recommendation:** Use docker secret file to configure
+- **Default:** `ca/client_cert_issuing_cas.pem`
+
+
+### SSL_CERTIFICATE_CHAIN_FILE
+- **Required:** No
+- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via `SSL_CERTIFICATE_FILE` contains the certificate chain
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
+
+
+### SSL_CERTIFICATE_FILE
+- **Required:** Yes
+- **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit `SSL_CERTIFICATE_CHAIN_FILE` if chain included
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_file.pem`
+
+
+### SSL_CERTIFICATE_KEY_FILE
+- **Required:** Yes
+- **Description:** Server certificate private key file, PEM encoded, unencrypted, sets the apache httpd parameter `SSLCertificateKeyFile`
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_key_file.pem`
+
+
+### SSL_EXPECTED_CLIENT_S_DN_C_VALUES
+- **Required:** No
+- **Description:** Expected client certificate subject DN country `C` values, must be a comma-separated list of strings in single quotation marks, e.g. `'DE', 'FR'`. If a client certificate with a not configured subject country `C` value is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'DE'`
+
+
+### SSL_EXPECTED_CLIENT_I_DN_CN_VALUES
+- **Required:** No
+- **Description:** Expected client certificate issuer DN common-name `CN` values, must be a comma-separated list of strings in single quotation marks. If a client certificate from a not configured issuing ca common-name is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'GEANT TLS ECC 1', 'HARICA OV TLS ECC', 'GEANT TLS RSA 1', 'HARICA OV TLS RSA', 'GEANT S/MIME ECC 1', 'HARICA S/MIME ECC', 'GEANT S/MIME RSA 1', 'HARICA S/MIME RSA', 'DFN-Verein Global Issuing CA', 'Fraunhofer User CA - G02', 'D-TRUST SSL Class 3 CA 1 2009', 'Sectigo RSA Organization Validation Secure Server CA', 'GEANT OV RSA CA 4', 'GEANT Personal CA 4', 'GEANT eScience Personal CA 4', 'Sectigo ECC Organization Validation Secure Server CA', 'GEANT OV ECC CA 4', 'GEANT Personal ECC CA 4', 'GEANT eScience Personal ECC CA 4', 'D-TRUST Limited Basic CA 1-2 2019', 'D-TRUST Limited Basic CA 1-3 2019'`
+
+
+### SSL_VERIFY_CLIENT
+- **Required:** No
+- **Description:** Modifies the apache mod_ssl config parameter `SSLVerifyClient`
+- **Recommendation:** Set to `optional` when using OIDC authentication
+- **Default:** `require`
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/bpe/README.md b/docs/src/operations/v1.9.0/bpe/README.md
new file mode 100644
index 000000000..669fe4a4a
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe/README.md
@@ -0,0 +1,8 @@
+---
+title: BPE Server
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
+- [Access Control](access-control)
+- [OpenID Connect](oidc)
diff --git a/docs/src/operations/v1.9.0/bpe/access-control.md b/docs/src/operations/v1.9.0/bpe/access-control.md
new file mode 100644
index 000000000..e51587c62
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe/access-control.md
@@ -0,0 +1,104 @@
+---
+title: Access Control
+icon: config
+---
+
+## Overview
+
+The DSF BPE server provides a user interface for administrators. Without any additional configuration the user interface is not accessible with the organizations X.509 client certificate or any other certificate or OpenID Connect authenticated user.
+
+::: tip OpenID Connect
+To enable OpenID Connect authentication of local user, see the DSF BPE server OpenID Connect [configuration page](oidc).
+:::
+
+Access to the user interface can be enabled for client certificates and local users authenticating via OAuth 2.0 OpenID Connect. Access can be configured for so called roles, with all roles specified using the configuration parameter [DEV_DSF_BPE_SERVER_ROLECONFIG](configuration#dev-dsf-bpe-server-roleconfig). The value for this environment variable is specified as YAML using the block scalar `|`.
+
+The listing below shows a minimal configuration to enable access for a specific client-certificate:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - example_read_only_role:
+            thumbprint: 00474993fa261b0225f93c5a66aa6fcc... [a-f0-9]{128}
+            dsf-role:
+              - ADMIN
+```
+The list of user roles above contains a single rule-entry `example_read_only_role`, matching the user via a client certificate SHA-512 thumprint and assigning three DSF roles. Any string can be used as the name for the rule-enty.
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+Multiple user roles can be specified and all matching roles will be applied to an authenticated users. Use an empty string `""` or a single block scalar `|` character as the value for the configuration parameter [DEV_DSF_BPE_SERVER_ROLECONFIG](configuration#dev-dsf-bpe-server-roleconfig) if no roles should be configured.
+
+## Matching Users
+
+To apply roles, users can be matched via the `thumbprint`, `email`, `token-role` or `token-group` properties. A single value or a list of values can be specified.
+
+#### thumbprint
+
+The property `thumbprint` can used to specify one or multiple SHA-512 certificate thumbprints. Roles from this rule are applied to the authenticating user if the certificate matches one of the specified thumbprints.
+
+#### email
+
+Using the property `email` users can be matched against e-mail addresses specified in X.509 client certificates and in OpenID Connect access tokens. Values will be matched against e-mail addresses specified in the subject DN (via PKCS#9 extension 1.2.840.113549.1.9.1) and RFC-822 Name entries of the Subject Alternative Name field. If the user authenticates via OpenID Connect, the `email` [claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) from the access token will be matched against the property values.
+
+#### token-role and token-group
+
+With the properties `token-role` and `token-group` role and group names can be specified to match against role and group claims within OAuth 2.0 access tokens.
+
+
+## DSF and Practitioner Roles
+
+Two types of roles can be applied to matched users. 
+
+#### dsf-role
+
+DSF roles specified via the `dsf-role` property define general access to the user interface. Allowed values are:
+
+`ADMIN`.
+
+#### practitioner-role
+
+The BPE server currently does not support any practionier-roles.
+
+
+## Examples
+
+The first example defines a group of DSF administrators. Two client certificates match against this role:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - certificate-admins:
+            thumbprint: 
+              - afb68b1d9d47e691b8b3d50fd9848467cada8b1c76f5f4b45f00c9f8432d505361a3ee27805f4aa06799d9ac8dace94b3f1942fce44d84866961259b13be825d
+              - 2441bfddcad97eeb83c8c31fe181b90652787b8b59bf4e569219da7db4429e389479cb7c4a2f311e34217357d594ecad7d58ccfeef2a9e93c6fcf8d98897d88c
+            dsf-role:
+              - ADMIN
+```
+
+
+The second example defines a group of DSF administrators by specifying an `admin` role that gets matched against OAuth 2.0 access tokens:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - token-role-admins:
+            token-role: admin
+            dsf-role:
+              - ADMIN
+```
+
+
+The third example allows administrator access and users e-mail addresses to match this role. E-mail addresses from X.509 client certificates and OAuth 2.0 access tokens are matched:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - email-admins:
+            email:
+              - first.user@test.org
+              - second.user@test.org
+            dsf-role:
+              - ADMIN
+```
diff --git a/docs/src/operations/v1.9.0/bpe/configuration.md b/docs/src/operations/v1.9.0/bpe/configuration.md
new file mode 100644
index 000000000..46f3882aa
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe/configuration.md
@@ -0,0 +1,695 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### DEV_DSF_BPE_DB_LIQUIBASE_FORCEUNLOCK
+- **Property:** dev.dsf.bpe.db.liquibase.forceUnlock
+- **Required:** No
+- **Description:** To force liquibase to unlock the migration lock set to `true`
+- **Recommendation:** Only use this option temporarily to unlock a stuck DB migration step
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_LOCKWAITTIME
+- **Property:** dev.dsf.bpe.db.liquibase.lockWaitTime
+- **Required:** No
+- **Description:** Liquibase change lock wait time in minutes, default 2 minutes
+- **Default:** `2`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD or DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.liquibase.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server to execute database migrations
+- **Recommendation:** Use docker secret file to configure by using *DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_liquibase.password`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_USERNAME
+- **Property:** dev.dsf.bpe.db.liquibase.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server to execute database migrations
+- **Default:** `liquibase_user`
+
+
+### DEV_DSF_BPE_DB_URL
+- **Property:** dev.dsf.bpe.db.url
+- **Required:** Yes
+- **Description:** Address of the database used for the DSF BPE server
+- **Recommendation:** Change only if you don't use the provided docker-compose from the installation guide or made changes to the database settings/networking in the docker-compose
+- **Example:** `jdbc:postgresql://db/bpe`
+
+
+### DEV_DSF_BPE_DB_USER_CAMUNDA_GROUP
+- **Property:** dev.dsf.bpe.db.user.camunda.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF BPE server for camunda processes
+- **Default:** `camunda_users`
+
+
+### DEV_DSF_BPE_DB_USER_CAMUNDA_PASSWORD or DEV_DSF_BPE_DB_USER_CAMUNDA_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.user.camunda.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server for camunda processes
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_DB_USER_CAMUNDA_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user_camunda.password`
+
+
+### DEV_DSF_BPE_DB_USER_CAMUNDA_USERNAME
+- **Property:** dev.dsf.bpe.db.user.camunda.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server for camunda processes
+- **Recommendation:** Use a different user then in *DEV_DSF_BPE_DB_USER_USERNAME*
+- **Default:** `camunda_server_user`
+
+
+### DEV_DSF_BPE_DB_USER_GROUP
+- **Property:** dev.dsf.bpe.db.user.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF BPE server
+- **Default:** `bpe_users`
+
+
+### DEV_DSF_BPE_DB_USER_PASSWORD or DEV_DSF_BPE_DB_USER_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.user.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_DB_USER_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user.password`
+
+
+### DEV_DSF_BPE_DB_USER_USERNAME
+- **Property:** dev.dsf.bpe.db.user.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server
+- **Default:** `bpe_server_user`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_CURRENTUSER
+- **Property:** dev.dsf.bpe.debug.log.message.currentUser
+- **Required:** No
+- **Description:** To enable logging of the currently requesting user set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_DBSTATEMENT
+- **Property:** dev.dsf.bpe.debug.log.message.dbStatement
+- **Required:** No
+- **Description:** To enable logging of DB queries set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_ONACTIVITYEND
+- **Property:** dev.dsf.bpe.debug.log.message.onActivityEnd
+- **Required:** No
+- **Description:** To enable debug log messages for every bpmn activity end, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_ONACTIVITYSTART
+- **Property:** dev.dsf.bpe.debug.log.message.onActivityStart
+- **Required:** No
+- **Description:** To enable debug log messages for every bpmn activity start, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_VARIABLES
+- **Property:** dev.dsf.bpe.debug.log.message.variables
+- **Required:** No
+- **Description:** To enable logging of bpmn variables for every bpmn activity start or end, when logging of these events is enabled, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_VARIABLESLOCAL
+- **Property:** dev.dsf.bpe.debug.log.message.variablesLocal
+- **Required:** No
+- **Description:** To enable logging of local bpmn variables for every bpmn activity start or end, when logging of these events is enabled, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_WEBSERVICEREQUEST
+- **Property:** dev.dsf.bpe.debug.log.message.webserviceRequest
+- **Required:** No
+- **Description:** To enable logging of webservices requests set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.bpe.fhir.client.certificate
+- **Required:** Yes
+- **Description:** PEM encoded file with local client certificate for https connections to local and remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate.pem`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.bpe.fhir.client.certificate.private.key
+- **Required:** Yes
+- **Description:** Private key corresponding to the local client certificate as PEM encoded file. Use DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.fhir.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_TIMEOUT_CONNECT
+- **Property:** dev.dsf.bpe.fhir.client.local.timeout.connect
+- **Required:** No
+- **Description:** Timeout in milliseconds until a connection is established with the local DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `2000`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_TIMEOUT_READ
+- **Property:** dev.dsf.bpe.fhir.client.local.timeout.read
+- **Required:** No
+- **Description:** Timeout in milliseconds until reading a resource from the local DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `60000`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_VERBOSE
+- **Property:** dev.dsf.bpe.fhir.client.local.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from the local DSF FHIR server, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_TIMEOUT_CONNECT
+- **Property:** dev.dsf.bpe.fhir.client.remote.timeout.connect
+- **Required:** No
+- **Description:** Timeout in milliseconds until a connection is established with a remote DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `5000`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_TIMEOUT_READ
+- **Property:** dev.dsf.bpe.fhir.client.remote.timeout.read
+- **Required:** No
+- **Description:** Timeout in milliseconds until a reading a resource from a remote DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `60000`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_VERBOSE
+- **Property:** dev.dsf.bpe.fhir.client.remote.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from remote DSF FHIR servers, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.bpe.fhir.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to local and remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/server_cert_root_cas.pem`
+
+
+### DEV_DSF_BPE_FHIR_QUESTIONNAIRE_RESPONSE_SUBSCRIPTION_SEARCH_PARAMETER
+- **Property:** dev.dsf.bpe.fhir.questionnaire.response.subscription.search.parameter
+- **Required:** No
+- **Description:** Subscription to receive notifications about questionnaire response resources from the DSF FHIR server
+- **Default:** `?criteria=QuestionnaireResponse%3Fstatus%3Dcompleted&status=active&type=websocket&payload=application/fhir%2Bjson`
+
+
+### DEV_DSF_BPE_FHIR_SERVER_BASE_URL
+- **Property:** dev.dsf.bpe.fhir.server.base.url
+- **Required:** Yes
+- **Description:** Base address of the local DSF FHIR server to read/store fhir resources
+- **Example:** `https://foo.bar/fhir`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_RETRY_MAX
+- **Property:** dev.dsf.bpe.fhir.task.subscription.retry.max
+- **Required:** No
+- **Description:** Number of retries until a websocket connection can be established with the DSF FHIR server, `-1` means infinite number of retries
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_RETRY_SLEEP
+- **Property:** dev.dsf.bpe.fhir.task.subscription.retry.sleep
+- **Required:** No
+- **Description:** Milliseconds between two retries to establish a websocket connection with the DSF FHIR server
+- **Default:** `5000`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_SEARCH_PARAMETER
+- **Property:** dev.dsf.bpe.fhir.task.subscription.search.parameter
+- **Required:** No
+- **Description:** Subscription to receive notifications about task resources from the DSF FHIR server
+- **Default:** `?criteria=Task%3Fstatus%3Drequested&status=active&type=websocket&payload=application/fhir%2Bjson`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.bpe.mail.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate used to authenticate against the SMTP server. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_client_certificate.pem`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.bpe.mail.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponging to the SMTP server client certificate as PEM encoded file. Use DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_client_certificate_private_key.pem`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/smtp_server_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_BPE_MAIL_FROMADDRESS
+- **Property:** dev.dsf.bpe.mail.fromAddress
+- **Required:** No
+- **Description:** Mail service sender address
+- **Example:** `sender@localhost`
+
+
+### DEV_DSF_BPE_MAIL_HOST
+- **Property:** dev.dsf.bpe.mail.host
+- **Required:** No
+- **Description:** SMTP server hostname
+- **Example:** `smtp.server.de`
+
+
+### DEV_DSF_BPE_MAIL_MAILONERRORLOGEVENTBUFFERSIZE
+- **Property:** dev.dsf.bpe.mail.mailOnErrorLogEventBufferSize
+- **Required:** No
+- **Description:** Number of previous INFO, WARN log messages to include in ERROR log event mails (>=0); requires send mail on ERROR log event option to be enabled to have an effect
+- **Default:** `4`
+
+
+### DEV_DSF_BPE_MAIL_MAILONERRORLOGEVENTDEBUGLOGLOCATION
+- **Property:** dev.dsf.bpe.mail.mailOnErrorLogEventDebugLogLocation
+- **Required:** No
+- **Description:** Location of the BPE debug log as displayed in the footer of ERROR log event mails, does not modify the actual location of the debug log file; requires send mail on ERROR log event option to be enabled to have an effect
+- **Default:** `/opt/bpe/log/bpe.log`
+
+
+### DEV_DSF_BPE_MAIL_PASSWORD or DEV_DSF_BPE_MAIL_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.password
+- **Required:** No
+- **Description:** SMTP server authentication password
+- **Recommendation:** Configure if the SMTP server reqiures username/password authentication; use docker secret file to configure using *DEV_DSF_BPE_MAIL_PASSWORD_FILE*; enable SMTP over TLS via *DEV_DSF_BPE_MAIL_USESMTPS*
+
+
+### DEV_DSF_BPE_MAIL_PORT
+- **Property:** dev.dsf.bpe.mail.port
+- **Required:** No
+- **Description:** SMTP server port
+- **Example:** `465`
+- **Default:** `0`
+
+
+### DEV_DSF_BPE_MAIL_REPLYTOADDRESSES
+- **Property:** dev.dsf.bpe.mail.replyToAddresses
+- **Required:** No
+- **Description:** Mail service reply to addresses; comma or space separated list, YAML block scalars supported
+- **Example:** `reply.to@localhost`
+
+
+### DEV_DSF_BPE_MAIL_SENDMAILONERRORLOGEVENT
+- **Property:** dev.dsf.bpe.mail.sendMailOnErrorLogEvent
+- **Required:** No
+- **Description:** To enable mails being send for every ERROR logged, set to `true`; requires SMTP server to be configured
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_MAIL_SENDTESTMAILONSTARTUP
+- **Property:** dev.dsf.bpe.mail.sendTestMailOnStartup
+- **Required:** No
+- **Description:** To enable a test mail being send on startup of the BPE, set to `true`; requires SMTP server to be configured
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE
+- **Property:** dev.dsf.bpe.mail.smime.p12Keystore
+- **Required:** No
+- **Description:** PKCS12 encoded file with S/MIME certificate, private key and certificate chain to enable send mails to be S/MIME signed
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smime_certificate.p12`
+
+
+### DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD or DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.smime.p12Keystore.password
+- **Required:** No
+- **Description:** Password to decrypt the PKCS12 encoded S/MIMIE certificate file
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD_FILE*
+- **Example:** `/run/secrets/smime_certificate.p12.password`
+
+
+### DEV_DSF_BPE_MAIL_TOADDRESSES
+- **Property:** dev.dsf.bpe.mail.toAddresses
+- **Required:** No
+- **Description:** Mail service recipient addresses, configure at least one; comma or space separated list, YAML block scalars supported
+- **Example:** `recipient@localhost`
+
+
+### DEV_DSF_BPE_MAIL_TOADDRESSESCC
+- **Property:** dev.dsf.bpe.mail.toAddressesCc
+- **Required:** No
+- **Description:** Mail service CC recipient addresses; comma or space separated list, YAML block scalars supported
+- **Example:** `cc.recipient@localhost`
+
+
+### DEV_DSF_BPE_MAIL_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.bpe.mail.trust.server.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted root certificates to validate the server certificate of the SMTP server. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_trust_certificates.pem`
+- **Default:** `ca/server_cert_root_cas.pem`
+
+
+### DEV_DSF_BPE_MAIL_USERNAME
+- **Property:** dev.dsf.bpe.mail.username
+- **Required:** No
+- **Description:** SMTP server authentication username
+- **Recommendation:** Configure if the SMTP server reqiures username/password authentication; enable SMTP over TLS via *DEV_DSF_BPE_MAIL_USESMTPS*
+
+
+### DEV_DSF_BPE_MAIL_USESMTPS
+- **Property:** dev.dsf.bpe.mail.useSmtps
+- **Required:** No
+- **Description:** To enable SMTP over TLS (smtps), set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_COREPOOLSIZE
+- **Property:** dev.dsf.bpe.process.engine.corePoolSize
+- **Required:** No
+- **Description:** Process engine job executor core pool size
+- **Default:** `4`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_MAXPOOLSIZE
+- **Property:** dev.dsf.bpe.process.engine.maxPoolSize
+- **Required:** No
+- **Description:** Process engine job executor max pool size, additional threads until max pool size are created if the queue is full
+- **Default:** `10`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_QUEUESIZE
+- **Property:** dev.dsf.bpe.process.engine.queueSize
+- **Required:** No
+- **Description:** Process engine job executor queue size, jobs are added to the queue if all core pool threads are busy
+- **Default:** `40`
+
+
+### DEV_DSF_BPE_PROCESS_EXCLUDED
+- **Property:** dev.dsf.bpe.process.excluded
+- **Required:** No
+- **Description:** List of process names that should be excluded from deployment during startup of the DSF BPE server; comma or space separated list, YAML block scalars supported
+- **Recommendation:** Only deploy processes that can be started depending on your organization's roles in the Allow-List
+- **Example:** `dsfdev_updateAllowList|1.0, another_process|x.y`
+
+
+### DEV_DSF_BPE_PROCESS_FHIR_SERVER_RETRY_MAX
+- **Property:** dev.dsf.bpe.process.fhir.server.retry.max
+- **Required:** No
+- **Description:** Number of retries until a connection can be established with the local DSF FHIR server during process deployment, `-1` means infinite number of retries
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_PROCESS_FHIR_SERVER_RETRY_SLEEP
+- **Property:** dev.dsf.bpe.process.fhir.server.retry.sleep
+- **Required:** No
+- **Description:** Milliseconds between two retries to establish a connection with the local DSF FHIR server during process deployment
+- **Default:** `5000`
+
+
+### DEV_DSF_BPE_PROCESS_PLUGIN_DIRECTROY
+- **Property:** dev.dsf.bpe.process.plugin.directroy
+- **Required:** No
+- **Description:** Directory containing the DSF BPE process plugins for deployment on startup of the DSF BPE server
+- **Recommendation:** Change only if you don't use the provided directory structure from the installation guide or made changes to tit
+- **Default:** `process`
+
+
+### DEV_DSF_BPE_PROCESS_RETIRED
+- **Property:** dev.dsf.bpe.process.retired
+- **Required:** No
+- **Description:** List of already deployed process names that should be retired during startup of the DSF BPE server; comma or space separated list, YAML block scalars supported
+- **Recommendation:** Retire processes that where deployed previously but are not anymore available
+- **Example:** `old_process|x.y`
+
+
+### DEV_DSF_BPE_PROCESS_THREADS
+- **Property:** dev.dsf.bpe.process.threads
+- **Required:** No
+- **Description:** Number of parallel Task / QuestionnaireResponse threads to start new or continue existing processes, a value `<= 0` means number of cpu cores
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_SERVER_BASE_URL
+- **Property:** dev.dsf.bpe.server.base.url
+- **Required:** No
+- **Description:** Base address of the BPE server, configure when exposing the web-ui
+- **Example:** `https://foo.bar/bpe`
+- **Default:** `https://localhost/bpe`
+
+
+### DEV_DSF_BPE_SERVER_ROLECONFIG
+- **Property:** dev.dsf.bpe.server.roleConfig
+- **Required:** No
+- **Description:** Role config YAML as defined in [FHIR Server: Access Control](access-control)
+
+
+### DEV_DSF_BPE_SERVER_STATIC_RESOURCE_CACHE
+- **Property:** dev.dsf.bpe.server.static.resource.cache
+- **Required:** No
+- **Description:** To disable static resource caching, set to `false`
+- **Recommendation:** Only set to `false` for development
+- **Default:** `true`
+
+
+### DEV_DSF_BPE_SERVER_UI_THEME
+- **Property:** dev.dsf.bpe.server.ui.theme
+- **Required:** No
+- **Description:** UI theme parameter, adds a color indicator to the ui to distinguish `dev`, `test` and `prod` environments im configured; supported values: `dev`, `test` and `prod`
+
+
+### DEV_DSF_PROXY_NOPROXY
+- **Property:** dev.dsf.proxy.noProxy
+- **Required:** No
+- **Description:** Forward proxy no-proxy list, entries will match exactly or agianst (one level) sub-domains, if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supported
+- **Example:** `foo.bar, test.com:8080`
+
+
+### DEV_DSF_PROXY_PASSWORD or DEV_DSF_PROXY_PASSWORD_FILE
+- **Property:** dev.dsf.proxy.password
+- **Required:** No
+- **Description:** Forward Proxy password
+- **Recommendation:** Configure password if proxy requires authentication, use docker secret file to configure using *DEV_DSF_PROXY_PASSWORD_FILE*
+
+
+### DEV_DSF_PROXY_URL
+- **Property:** dev.dsf.proxy.url
+- **Required:** No
+- **Description:** Forward (http/https) proxy url, use *DEV_DSF_BPE_PROXY_NOPROXY* to list domains that do not require a forward proxy
+- **Example:** `http://proxy.foo:8080`
+
+
+### DEV_DSF_PROXY_USERNAME
+- **Property:** dev.dsf.proxy.username
+- **Required:** No
+- **Description:** Forward proxy username
+- **Recommendation:** Configure username if proxy requires authentication
+
+
+### DEV_DSF_SERVER_API_HOST
+- **Property:** dev.dsf.server.api.host
+- **Required:** No
+- **Description:** API connector host, default in docker image: `0.0.0.0`
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_API_PORT
+- **Property:** dev.dsf.server.api.port
+- **Required:** No
+- **Description:** API connector port, default in docker image: `8080`
+
+
+### DEV_DSF_SERVER_AUTH_CLIENT_CERTIFICATE_HEADER
+- **Property:** dev.dsf.server.auth.client.certificate.header
+- **Required:** No
+- **Description:** Name of HTTP header with client certificate from reverse proxy
+- **Default:** `X-ClientCert`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW
+- **Property:** dev.dsf.server.auth.oidc.authorization.code.flow
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC authorization code flow
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL*, *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET* or *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC back-channel logout
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* to be set to `true` (enabled), *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout.path
+- **Required:** No
+- **Description:** Path called by the OIDC provide to request back-channel logout
+- **Default:** `/back-channel-logout`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN
+- **Property:** dev.dsf.server.auth.oidc.bearer.token
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC bearer token authentication
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID
+- **Property:** dev.dsf.server.auth.oidc.client.id
+- **Required:** No
+- **Description:** OIDC provider client_id, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET or DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE
+- **Property:** dev.dsf.server.auth.oidc.client.secret
+- **Required:** No
+- **Description:** OIDC provider client_secret, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client.secret`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponding to the client certificate for the OIDC provider as PEM encoded file. Use *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the client certificate for the OIDC provider encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CONNECTTIMEOUT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.connectTimeout
+- **Required:** No
+- **Description:** OIDC provider client connect timeout in milliseconds
+- **Default:** `5000`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_IDLETIMEOUT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.idleTimeout
+- **Required:** No
+- **Description:** OIDC provider client idle timeout in milliseconds
+- **Default:** `30000`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.oidc.provider.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_trust_certificates.pem`
+- **Default:** `ca/server_cert_root_cas.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL
+- **Property:** dev.dsf.server.auth.oidc.provider.realm.base.url
+- **Required:** No
+- **Description:** OIDC provider realm base url
+- **Example:** `https://keycloak.test.com:8443/realms/example-realm-name`
+
+
+### DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.trust.client.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted full CA chains to validate client certificates for https connections from local and remote clients
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/client_cert_ca_chains.pem`
+
+
+### DEV_DSF_SERVER_CERTIFICATE
+- **Property:** dev.dsf.server.certificate
+- **Required:** No
+- **Description:** Server certificate file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_CHAIN
+- **Property:** dev.dsf.server.certificate.chain
+- **Required:** No
+- **Description:** Server certificate chain file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY
+- **Property:** dev.dsf.server.certificate.key
+- **Required:** No
+- **Description:** Server certificate private key file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD or DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.certificate.key.password
+- **Required:** No
+- **Description:** Server certificate private key file password for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CONTEXT_PATH
+- **Property:** dev.dsf.server.context.path
+- **Required:** No
+- **Description:** Web application context path, default in `bpe` docker image: `/bpe`, default in `fhir` docker image: `/fhir`
+- **Recommendation:** Only modify for testing
+
+
+### DEV_DSF_SERVER_STATUS_HOST
+- **Property:** dev.dsf.server.status.host
+- **Required:** No
+- **Description:** Status connector host
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_STATUS_PORT
+- **Property:** dev.dsf.server.status.port
+- **Required:** No
+- **Description:** Status connector port, default in docker image: `10000`
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/bpe/oidc.md b/docs/src/operations/v1.9.0/bpe/oidc.md
new file mode 100644
index 000000000..5ba035d2c
--- /dev/null
+++ b/docs/src/operations/v1.9.0/bpe/oidc.md
@@ -0,0 +1,56 @@
+---
+title: OpenID Connect
+icon: config
+---
+
+## Overview
+Access to the DSF BPE server user interface can be configured via [access control roles](access-control). By default users are only authenticated using X.509 client certificates, but authentication for local users via OAuth 2.0 OpenID Connect can also be enabled.
+
+The DSF BPE server supports [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) for the user interface. [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) is also supported.
+
+
+::: tip BPE Reverse Proxy
+The DSF BPE reverse proxy requires client certificates by default. To use OpenID Connect authentication the configuration parameter [SSL_VERIFY_CLIENT](configuration/reverseproxy.html#ssl-verify-client) needs to be set to `optional`.
+:::
+
+
+## Authorization Code Flow
+
+To enable authentication via OpenID Connect authorization code flow, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW](configuration#dev-dsf-server-auth-oidc-authorization-code-flow) to `true` and specify the following parameters:
+
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID](configuration#dev-dsf-server-auth-oidc-client-id)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET](configuration#dev-dsf-server-auth-oidc-client-secret)
+
+Optionally, back channel logout can be enabled by setting [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT](configuration#dev-dsf-server-auth-oidc-back-channel-logout) to `true`. The DSF BPE server accepts logout tokens at [DEV_DSF_BPE_SERVER_BASE_URL](configuration#dev-dsf-bpe-server-base-url) + `/back-channel-logout`. The path can be modified via [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH](configuration#dev-dsf-server-auth-oidc-back-channel-logout-path).
+
+## Additional ODIC Configuration Parameter
+
+A number of additional `DEV_DSF_SERVER_AUTH_OIDC ...` configuration parameter are specify on the DSF BPE server [configuration parameter page](configuration).
+
+For example the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](configuration#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas) can be used to specify a PEM encoded file with trusted root certificates to be used when accessing the OpenID Connect provider. If not specify the JVM default trusted root certificates are used for this connection.
+
+
+## Example
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/bpe:1.5.2
+    # ...
+    secrets:
+      - keycloak_root_ca.pem
+      # ...
+    environment:
+      # ...
+      DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL: https://keycloak.test.org/realms/dsf
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/keycloak_root_ca.pem
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dsf-bpe
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET: n9bCMtjugv3Y_.szktXyQ2RH5se+J%o3
+    # ...
+secrets:
+  keycloak_root_ca.pem:
+    file: ./secrets/keycloak_root_ca.pem
+```
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/fhir-reverse-proxy/README.md b/docs/src/operations/v1.9.0/fhir-reverse-proxy/README.md
new file mode 100644
index 000000000..d88afe12a
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir-reverse-proxy/README.md
@@ -0,0 +1,6 @@
+---
+title: FHIR Reverse Proxy
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
diff --git a/docs/src/operations/v1.9.0/fhir-reverse-proxy/configuration.md b/docs/src/operations/v1.9.0/fhir-reverse-proxy/configuration.md
new file mode 100644
index 000000000..3b93d3e90
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir-reverse-proxy/configuration.md
@@ -0,0 +1,99 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### APP_SERVER_IP
+- **Required:** Yes
+- **Description:** Hostname or IP-Address of the DSF FHIR server application container, the reverse proxy target
+- **Example:** `app`, `172.28.1.3`
+
+
+### HTTPS_SERVER_NAME_PORT
+- **Required:** Yes
+- **Description:** External FQDN of your DSF FHIR server with port, typically `443`
+- **Example:** `my-external.fqdn:443`
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_WS
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### PROXY_PASS_TIMEOUT_WS
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### SERVER_CONTEXT_PATH
+- **Required:** No
+- **Description:** Reverse proxy context path that delegates to the app server, `/` character at start, no `/` character at end, use `''` (empty string) to configure root as context path
+- **Default:** `/fhir`
+
+
+### SSL_CA_CERTIFICATE_FILE
+- **Required:** No
+- **Description:** Certificate chain file including all issuing, intermediate and root certificates used to validate client certificates, PEM encoded, sets the apache httpd parameter `SSLCACertificateFile`
+- **Recommendation:** Use docker secret file to configure
+- **Default:** `ca/client_cert_ca_chains.pem`
+
+
+### SSL_CA_DN_REQUEST_FILE
+- **Required:** No
+- **Description:** File containing all signing certificates excepted, will be used to specify the `Acceptable client certificate CA names` send to the client, during TLS handshake, sets the apache httpd parameter `SSLCADNRequestFile`; if omitted all entries from `SSL_CA_CERTIFICATE_FILE` are used
+- **Recommendation:** Use docker secret file to configure
+- **Default:** `ca/client_cert_issuing_cas.pem`
+
+
+### SSL_CERTIFICATE_CHAIN_FILE
+- **Required:** No
+- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via `SSL_CERTIFICATE_FILE` contains the certificate chain
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
+
+
+### SSL_CERTIFICATE_FILE
+- **Required:** Yes
+- **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit `SSL_CERTIFICATE_CHAIN_FILE` if chain included
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_file.pem`
+
+
+### SSL_CERTIFICATE_KEY_FILE
+- **Required:** Yes
+- **Description:** Server certificate private key file, PEM encoded, unencrypted, sets the apache httpd parameter `SSLCertificateKeyFile`
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_key_file.pem`
+
+
+### SSL_EXPECTED_CLIENT_S_DN_C_VALUES
+- **Required:** No
+- **Description:** Expected client certificate subject DN country `C` values, must be a comma-separated list of strings in single quotation marks, e.g. `'DE', 'FR'`. If a client certificate with a not configured subject country `C` value is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'DE'`
+
+
+### SSL_EXPECTED_CLIENT_I_DN_CN_VALUES
+- **Required:** No
+- **Description:** Expected client certificate issuer DN common-name `CN` values, must be a comma-separated list of strings in single quotation marks. If a client certificate from a not configured issuing ca common-name is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'GEANT TLS ECC 1', 'HARICA OV TLS ECC', 'GEANT TLS RSA 1', 'HARICA OV TLS RSA', 'GEANT S/MIME ECC 1', 'HARICA S/MIME ECC', 'GEANT S/MIME RSA 1', 'HARICA S/MIME RSA', 'DFN-Verein Global Issuing CA', 'Fraunhofer User CA - G02', 'D-TRUST SSL Class 3 CA 1 2009', 'Sectigo RSA Organization Validation Secure Server CA', 'GEANT OV RSA CA 4', 'GEANT Personal CA 4', 'GEANT eScience Personal CA 4', 'Sectigo ECC Organization Validation Secure Server CA', 'GEANT OV ECC CA 4', 'GEANT Personal ECC CA 4', 'GEANT eScience Personal ECC CA 4', 'D-TRUST Limited Basic CA 1-2 2019', 'D-TRUST Limited Basic CA 1-3 2019'`
+
+
+### SSL_VERIFY_CLIENT
+- **Required:** No
+- **Description:** Modifies the apache mod_ssl config parameter `SSLVerifyClient`
+- **Recommendation:** Set to `optional` when using OIDC authentication
+- **Default:** `require`
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/fhir/README.md b/docs/src/operations/v1.9.0/fhir/README.md
new file mode 100644
index 000000000..cedc99c38
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir/README.md
@@ -0,0 +1,8 @@
+---
+title: FHIR Server
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
+- [Access Control](access-control)
+- [OpenID Connect](oidc)
diff --git a/docs/src/operations/v1.9.0/fhir/access-control.md b/docs/src/operations/v1.9.0/fhir/access-control.md
new file mode 100644
index 000000000..60e7162b7
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir/access-control.md
@@ -0,0 +1,129 @@
+---
+title: Access Control
+icon: config
+---
+
+## Overview
+
+The DSF FHIR server implements a subset of the FHIR R4 [REST API](http://hl7.org/fhir/R4/http.html). When accessing the API with a web browser a limited graphical user interface is shown. Without any additional configuration the API and user interface is only accessible with the X.509 client certificate configured for the organization via the configuration parameter: [DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT](configuration#dev-dsf-fhir-server-organization-thumbprint)
+
+::: tip OpenID Connect
+To enable OpenID Connect authentication of local user, see the DSF FHIR server OpenID Connect [configuration page](oidc).
+:::
+
+Access to the API and user interface can be enabled for additional client certificates and local users authenticating via OAuth 2.0 OpenID Connect. Access can be configured for so called roles, with all roles specified using the configuration parameter [DEV_DSF_FHIR_SERVER_ROLECONFIG](configuration#dev-dsf-fhir-server-roleconfig). The value for this environment variable is specified as YAML using the block scalar `|`.
+
+The listing below shows a minimal configuration to enable read access for a specific client-certificate:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - example_read_only_role:
+            thumbprint: 00474993fa261b0225f93c5a66aa6fcc... [a-f0-9]{128}
+            dsf-role:
+              - READ
+              - SEARCH
+              - HISTORY
+```
+The list of user roles above contains a single rule-entry `example_read_only_role`, matching the user via a client certificate SHA-512 thumprint and assigning three DSF roles. Any string can be used as the name for the rule-enty.
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+Multiple user roles can be specified and all matching roles will be applied to an authenticated users. Use an empty string `""` or a single block scalar `|` character as the value for the configuration parameter [DEV_DSF_FHIR_SERVER_ROLECONFIG](configuration#dev-dsf-fhir-server-roleconfig) if no roles should be configured.
+
+## Matching Users
+
+To apply roles, users can be matched via the `thumbprint`, `email`, `token-role` or `token-group` properties. A single value or a list of values can be specified.
+
+#### thumbprint
+
+The property `thumbprint` can used to specify one or multiple SHA-512 certificate thumbprints. Roles from this rule are applied to the authenticating user if the certificate matches one of the specified thumbprints.
+
+#### email
+
+Using the property `email` users can be matched against e-mail addresses specified in X.509 client certificates and in OpenID Connect access tokens. Values will be matched against e-mail addresses specified in the subject DN (via PKCS#9 extension 1.2.840.113549.1.9.1) and RFC-822 Name entries of the Subject Alternative Name field. If the user authenticates via OpenID Connect, the `email` [claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) from the access token will be matched against the property values.
+
+#### token-role and token-group
+
+With the properties `token-role` and `token-group` role and group names can be specified to match against role and group claims within OAuth 2.0 access tokens.
+
+
+## DSF and Practitioner Roles
+
+Two types of roles can be applied to matched users. 
+
+#### dsf-role
+
+DSF roles specified via the `dsf-role` property define general access to the REST API and user interface. Allowed values are:
+
+`CREATE`, `READ`, `UPDATE`, `DELETE`, `SEARCH`, `HISTORY`, `PERMANENT_DELETE` and `WEBSOCKET`.
+
+#### practitioner-role
+
+In order to allow users to start processes, the property `practitioner-role` can be used to assign codes from FHIR [CodeSystem](http://hl7.org/fhir/R4/codesystem.html) resources. Codes are specified in the form `system-url|code`.
+If the uses has a code specified here that match with a `requester` extension within the process plugin's [ActivityDefinition](http://hl7.org/fhir/R4/activitydefinition.html) resource, the user can start the process if he also has the `dsf-role` `CREATE`.
+
+Process plugins can defined and use there own code-systems. However, the DSF specifies a standard set of practitioner roles within the CodeSystem `http://dsf.dev/fhir/CodeSystem/practitioner-role`:
+
+`UAC_USER`, `COS_USER`, `CRR_USER`, `DIC_USER`, `DMS_USER`, `DTS_USER`, `HRP_USER`, `TTP_USER`, `AMS_USER` and `DSF_ADMIN`.
+
+
+## Examples
+
+The first example defines a group of DSF administrators. Two client certificates match against this role:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - certificate-admins:
+            thumbprint: 
+              - afb68b1d9d47e691b8b3d50fd9848467cada8b1c76f5f4b45f00c9f8432d505361a3ee27805f4aa06799d9ac8dace94b3f1942fce44d84866961259b13be825d
+              - 2441bfddcad97eeb83c8c31fe181b90652787b8b59bf4e569219da7db4429e389479cb7c4a2f311e34217357d594ecad7d58ccfeef2a9e93c6fcf8d98897d88c
+            dsf-role:
+              - CREATE
+              - READ
+              - UPDATE
+              - DELETE
+              - SEARCH
+              - HISTORY
+            practitioner-role:
+              - http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN
+
+```
+
+
+The second example defines a group of DSF administrators by specifying an `admin` role that gets matched against OAuth 2.0 access tokens:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - token-role-admins:
+            token-role: admin
+            dsf-role:
+              - CREATE
+              - READ
+              - UPDATE
+              - DELETE
+              - SEARCH
+              - HISTORY
+            practitioner-role:
+              - http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN
+
+```
+
+
+The third example allows read-only access. Two e-mail addresses are used to match this role. E-mail addresses from X.509 client certificates and OAuth 2.0 access tokens are matched:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - read-only:
+            email:
+              - first.user@test.org
+              - second.user@test.org
+            dsf-role:
+              - READ
+              - SEARCH
+              - HISTORY
+```
diff --git a/docs/src/operations/v1.9.0/fhir/configuration.md b/docs/src/operations/v1.9.0/fhir/configuration.md
new file mode 100644
index 000000000..66fd7afb3
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir/configuration.md
@@ -0,0 +1,427 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.fhir.client.certificate
+- **Required:** Yes
+- **Description:** PEM encoded file with local client certificate for https connections to remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate.pem`
+
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.fhir.client.certificate.private.key
+- **Required:** Yes
+- **Description:** Private key corresponding to the local client certificate as PEM encoded file. Use *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem`
+
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_FHIR_CLIENT_TIMEOUT_CONNECT
+- **Property:** dev.dsf.fhir.client.timeout.connect
+- **Required:** No
+- **Description:** Timeout in milliseconds until a connection is established between this DSF FHIR server and a remote DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `2000`
+
+
+### DEV_DSF_FHIR_CLIENT_TIMEOUT_READ
+- **Property:** dev.dsf.fhir.client.timeout.read
+- **Required:** No
+- **Description:** Timeout in milliseconds until a reading a resource from a remote DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `10000`
+
+
+### DEV_DSF_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.fhir.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/server_cert_root_cas.pem`
+
+
+### DEV_DSF_FHIR_CLIENT_VERBOSE
+- **Property:** dev.dsf.fhir.client.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from remote DSF FHIR servers, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_FORCEUNLOCK
+- **Property:** dev.dsf.fhir.db.liquibase.forceUnlock
+- **Required:** No
+- **Description:** To force liquibase to unlock the migration lock set to `true`
+- **Recommendation:** Only use this option temporarily to unlock a stuck DB migration step
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_LOCKWAITTIME
+- **Property:** dev.dsf.fhir.db.liquibase.lockWaitTime
+- **Required:** No
+- **Description:** Liquibase change lock wait time in minutes, default 2 minutes
+- **Default:** `2`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD or DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.liquibase.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server to execute database migrations
+- **Recommendation:** Use docker secret file to configure by using *DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_liquibase.password`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_USERNAME
+- **Property:** dev.dsf.fhir.db.liquibase.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server to execute database migrations
+- **Default:** `liquibase_user`
+
+
+### DEV_DSF_FHIR_DB_URL
+- **Property:** dev.dsf.fhir.db.url
+- **Required:** Yes
+- **Description:** Address of the database used for the DSF FHIR server
+- **Recommendation:** Change only if you don't use the provided docker-compose from the installation guide or made changes to the database settings/networking in the docker-compose
+- **Example:** `jdbc:postgresql://db/fhir`
+
+
+### DEV_DSF_FHIR_DB_USER_GROUP
+- **Property:** dev.dsf.fhir.db.user.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF FHIR server
+- **Default:** `fhir_users`
+
+
+### DEV_DSF_FHIR_DB_USER_PASSWORD or DEV_DSF_FHIR_DB_USER_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.user.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_DB_USER_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user.password`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_GROUP
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF FHIR server for permanent deletes
+- **Default:** `fhir_permanent_delete_users`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD or DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server for permanent deletes
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user_permanent_delete.password`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_USERNAME
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server for permanent deletes
+- **Recommendation:** Use a different user then *DEV_DSF_FHIR_DB_USER_USERNAME*
+- **Default:** `fhir_server_permanent_delete_user`
+
+
+### DEV_DSF_FHIR_DB_USER_USERNAME
+- **Property:** dev.dsf.fhir.db.user.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server
+- **Default:** `fhir_server_user`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_CURRENTUSER
+- **Property:** dev.dsf.fhir.debug.log.message.currentUser
+- **Required:** No
+- **Description:** To enable logging of the currently requesting user set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_DBSTATEMENT
+- **Property:** dev.dsf.fhir.debug.log.message.dbStatement
+- **Required:** No
+- **Description:** To enable logging of DB queries set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_WEBSERVICEREQUEST
+- **Property:** dev.dsf.fhir.debug.log.message.webserviceRequest
+- **Required:** No
+- **Description:** To enable logging of webservices requests set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_SERVER_BASE_URL
+- **Property:** dev.dsf.fhir.server.base.url
+- **Required:** Yes
+- **Description:** Base address of this DSF FHIR server to read/store fhir resources
+- **Example:** `https://foo.bar/fhir`
+
+
+### DEV_DSF_FHIR_SERVER_INIT_BUNDLE
+- **Property:** dev.dsf.fhir.server.init.bundle
+- **Required:** No
+- **Description:** Fhir bundle containing the initial Allow-List, loaded on startup of the DSF FHIR server
+- **Recommendation:** Change only if you don't use the provided files from the installation guide, have local changes in the Allow-List or received an Allow-List from another source
+- **Default:** `conf/bundle.xml`
+
+
+### DEV_DSF_FHIR_SERVER_ORGANIZATION_IDENTIFIER_VALUE
+- **Property:** dev.dsf.fhir.server.organization.identifier.value
+- **Required:** Yes
+- **Description:** Local identifier value used in the Allow-List
+- **Recommendation:** By convention: The shortest possible FQDN that resolve the homepage of the organization
+- **Example:** `hospital.com`
+
+
+### DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT
+- **Property:** dev.dsf.fhir.server.organization.thumbprint
+- **Required:** Yes
+- **Description:** The SHA-512 thumbprint of the local organization client certificate
+- **Recommendation:** The thumbprint can be calculated via `certtool --fingerprint --hash=sha512 --infile=client_certificate.pem`
+
+
+### DEV_DSF_FHIR_SERVER_PAGE_COUNT
+- **Property:** dev.dsf.fhir.server.page.count
+- **Required:** No
+- **Description:** Page size returned by the DSF FHIR server when reading/searching fhir resources
+- **Default:** `20`
+
+
+### DEV_DSF_FHIR_SERVER_ROLECONFIG
+- **Property:** dev.dsf.fhir.server.roleConfig
+- **Required:** No
+- **Description:** Role config YAML as defined in [FHIR Server: Access Control](access-control)
+
+
+### DEV_DSF_FHIR_SERVER_STATIC_RESOURCE_CACHE
+- **Property:** dev.dsf.fhir.server.static.resource.cache
+- **Required:** No
+- **Description:** To disable static resource caching, set to `false`
+- **Recommendation:** Only set to `false` for development
+- **Default:** `true`
+
+
+### DEV_DSF_FHIR_SERVER_UI_THEME
+- **Property:** dev.dsf.fhir.server.ui.theme
+- **Required:** No
+- **Description:** UI theme parameter, adds a color indicator to the ui to distinguish `dev`, `test` and `prod` environments im configured; supported values: `dev`, `test` and `prod`
+
+
+### DEV_DSF_PROXY_NOPROXY
+- **Property:** dev.dsf.proxy.noProxy
+- **Required:** No
+- **Description:** Forward proxy no-proxy list, entries will match exactly or agianst (one level) sub-domains, if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supported
+- **Example:** `foo.bar, test.com:8080`
+
+
+### DEV_DSF_PROXY_PASSWORD or DEV_DSF_PROXY_PASSWORD_FILE
+- **Property:** dev.dsf.proxy.password
+- **Required:** No
+- **Description:** Forward Proxy password
+- **Recommendation:** Configure password if proxy requires authentication, use docker secret file to configure using *DEV_DSF_PROXY_PASSWORD_FILE*
+
+
+### DEV_DSF_PROXY_URL
+- **Property:** dev.dsf.proxy.url
+- **Required:** No
+- **Description:** Forward (http/https) proxy url, use *DEV_DSF_BPE_PROXY_NOPROXY* to list domains that do not require a forward proxy
+- **Example:** `http://proxy.foo:8080`
+
+
+### DEV_DSF_PROXY_USERNAME
+- **Property:** dev.dsf.proxy.username
+- **Required:** No
+- **Description:** Forward proxy username
+- **Recommendation:** Configure username if proxy requires authentication
+
+
+### DEV_DSF_SERVER_API_HOST
+- **Property:** dev.dsf.server.api.host
+- **Required:** No
+- **Description:** API connector host, default in docker image: `0.0.0.0`
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_API_PORT
+- **Property:** dev.dsf.server.api.port
+- **Required:** No
+- **Description:** API connector port, default in docker image: `8080`
+
+
+### DEV_DSF_SERVER_AUTH_CLIENT_CERTIFICATE_HEADER
+- **Property:** dev.dsf.server.auth.client.certificate.header
+- **Required:** No
+- **Description:** Name of HTTP header with client certificate from reverse proxy
+- **Default:** `X-ClientCert`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW
+- **Property:** dev.dsf.server.auth.oidc.authorization.code.flow
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC authorization code flow
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL*, *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET* or *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC back-channel logout
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* to be set to `true` (enabled), *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout.path
+- **Required:** No
+- **Description:** Path called by the OIDC provide to request back-channel logout
+- **Default:** `/back-channel-logout`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN
+- **Property:** dev.dsf.server.auth.oidc.bearer.token
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC bearer token authentication
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID
+- **Property:** dev.dsf.server.auth.oidc.client.id
+- **Required:** No
+- **Description:** OIDC provider client_id, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET or DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE
+- **Property:** dev.dsf.server.auth.oidc.client.secret
+- **Required:** No
+- **Description:** OIDC provider client_secret, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client.secret`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponding to the client certificate for the OIDC provider as PEM encoded file. Use *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the client certificate for the OIDC provider encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CONNECTTIMEOUT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.connectTimeout
+- **Required:** No
+- **Description:** OIDC provider client connect timeout in milliseconds
+- **Default:** `5000`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_IDLETIMEOUT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.idleTimeout
+- **Required:** No
+- **Description:** OIDC provider client idle timeout in milliseconds
+- **Default:** `30000`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.oidc.provider.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_trust_certificates.pem`
+- **Default:** `ca/server_cert_root_cas.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL
+- **Property:** dev.dsf.server.auth.oidc.provider.realm.base.url
+- **Required:** No
+- **Description:** OIDC provider realm base url
+- **Example:** `https://keycloak.test.com:8443/realms/example-realm-name`
+
+
+### DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.trust.client.certificate.cas
+- **Required:** No
+- **Description:** PEM encoded file with one or more trusted full CA chains to validate client certificates for https connections from local and remote clients
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/client_cert_ca_chains.pem`
+
+
+### DEV_DSF_SERVER_CERTIFICATE
+- **Property:** dev.dsf.server.certificate
+- **Required:** No
+- **Description:** Server certificate file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_CHAIN
+- **Property:** dev.dsf.server.certificate.chain
+- **Required:** No
+- **Description:** Server certificate chain file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY
+- **Property:** dev.dsf.server.certificate.key
+- **Required:** No
+- **Description:** Server certificate private key file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD or DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.certificate.key.password
+- **Required:** No
+- **Description:** Server certificate private key file password for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CONTEXT_PATH
+- **Property:** dev.dsf.server.context.path
+- **Required:** No
+- **Description:** Web application context path, default in `bpe` docker image: `/bpe`, default in `fhir` docker image: `/fhir`
+- **Recommendation:** Only modify for testing
+
+
+### DEV_DSF_SERVER_STATUS_HOST
+- **Property:** dev.dsf.server.status.host
+- **Required:** No
+- **Description:** Status connector host
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_STATUS_PORT
+- **Property:** dev.dsf.server.status.port
+- **Required:** No
+- **Description:** Status connector port, default in docker image: `10000`
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/fhir/oidc.md b/docs/src/operations/v1.9.0/fhir/oidc.md
new file mode 100644
index 000000000..97a435b38
--- /dev/null
+++ b/docs/src/operations/v1.9.0/fhir/oidc.md
@@ -0,0 +1,63 @@
+---
+title: OpenID Connect
+icon: config
+---
+
+## Overview
+Access to the DSF FHIR server REST API and user interface can be configured via [access control roles](access-control). By default users are only authenticated using X.509 client certificates, but authentication for local users via OAuth 2.0 OpenID Connect can also be enabled.
+
+The DSF FHIR server supports [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) for the user interface as well as [Bearer Token Authentication](https://datatracker.ietf.org/doc/html/rfc6750) for the REST API. [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) is also supported.
+
+
+::: tip FHIR Reverse Proxy
+The DSF FHIR reverse proxy requires client certificates by default. To use OpenID Connect authentication the configuration parameter [SSL_VERIFY_CLIENT](/fhir-reverse-proxy/configuration.html#ssl-verify-client) needs to be set to `optional`.
+:::
+
+
+## Authorization Code Flow
+
+To enable authentication via OpenID Connect authorization code flow, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW](configuration#dev-dsf-server-auth-oidc-authorization-code-flow) to `true` and specify the following parameters:
+
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID](configuration#dev-dsf-server-auth-oidc-client-id)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET](configuration#dev-dsf-server-auth-oidc-client-secret)
+
+Optionally, back channel logout can be enabled by setting [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT](configuration#dev-dsf-server-auth-oidc-back-channel-logout) to `true`. The DSF FHIR server accepts logout tokens at [DEV_DSF_FHIR_SERVER_BASE_URL](configuration#dev-dsf-fhir-server-base-url) + `/back-channel-logout`. The path can be modified via [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH](configuration#dev-dsf-server-auth-oidc-back-channel-logout-path).
+
+
+## Bearer Token Authentication
+
+To enable bearer token authentication, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN](configuration#dev-dsf-server-auth-oidc-bearer-token) to `true` and specify the following parameter:
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+
+
+## Additional ODIC Configuration Parameter
+
+A number of additional `DEV_DSF_SERVER_AUTH_OIDC ...` configuration parameter are specify on the DSF FHIR server [configuration parameter page](configuration).
+
+For example the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](configuration#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas) can be used to specify a PEM encoded file with trusted root certificates to be used when accessing the OpenID Connect provider. If not specify the JVM default trusted root certificates are used for this connection.
+
+
+## Example
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/fhir:1.5.2
+    # ...
+    secrets:
+      - keycloak_root_ca.pem
+      # ...
+    environment:
+      # ...
+      DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL: https://keycloak.test.org/realms/dsf
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/keycloak_root_ca.pem
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dsf-fhir
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET: n9bCMtjugv3Y_.szktXyQ2RH5se+J%o3
+    # ...
+secrets:
+  keycloak_root_ca.pem:
+    file: ./secrets/keycloak_root_ca.pem
+```
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/index.md b/docs/src/operations/v1.9.0/index.md
new file mode 100644
index 000000000..ca25dc519
--- /dev/null
+++ b/docs/src/operations/v1.9.0/index.md
@@ -0,0 +1,23 @@
+---
+title: DSF 1.9.0
+icon: guide
+---
+
+Data Sharing Framework 1.x is the current major release of the Data Sharing Framework.
+
+# System Administrators
+
+- [Install DSF 1.9.0](install)
+- [Upgrade from DSF 1.8.0](upgrade-from-1)
+- [Upgrade from DSF 0.9.x.](upgrade-from-0)
+
+
+## New features
+- See [Release Notes](https://github.com/datasharingframework/dsf/releases/tag/v1.9.0)
+
+<!--
+This breaks the page with a 
+Hydration completed but contains mismatches.
+error
+<releas-notes  path="release-notes.md" />
+-->
diff --git a/docs/src/operations/v1.9.0/install-plugins.md b/docs/src/operations/v1.9.0/install-plugins.md
new file mode 100644
index 000000000..ed4ff8996
--- /dev/null
+++ b/docs/src/operations/v1.9.0/install-plugins.md
@@ -0,0 +1,56 @@
+---
+title: Install Plugins
+icon: plugin
+---
+
+::: tip Marketplace for process plugins
+To install and learn more about each Process Plugin, you can visit the Marketplace [here](https://hub.dsf.dev).
+:::
+
+
+## **Overview**
+- You can find an overview of compatable process plugins below (last updated 2025-01-22).
+
+
+| Process Plugin | released for test | released for production |
+| -------------- | ----------------- | ----------------------- |
+| [Ping-Pong](https://github.com/datasharingframework/dsf-process-ping-pong/releases) | [v1.0.1.0](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v1.0.1.0) | [v1.0.1.0](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v1.0.1.0) |
+| [Allow-List](https://github.com/datasharingframework/dsf-process-allow-list/releases) | [v1.0.0.1](https://github.com/datasharingframework/dsf-process-allow-list/releases/tag/v1.0.0.1) | [v1.0.0.1](https://github.com/datasharingframework/dsf-process-allow-list/releases/tag/v1.0.0.1) |
+| [MII Process Feasibility](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases) | [v1.0.0.8](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases/tag/v1.0.0.8) | [v1.0.0.8](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases/tag/v1.0.0.8) |
+| [MII Process Report](https://github.com/medizininformatik-initiative/mii-process-report/releases) | [v1.1.2.0](https://github.com/medizininformatik-initiative/mii-process-report/releases/tag/v1.1.2.0) | [v1.1.2.0](https://github.com/medizininformatik-initiative/mii-process-report/releases/tag/v1.1.2.0) |
+| [MII Process Data Transfer](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases) | [v1.0.3.1](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases/tag/v1.0.3.1) | [v1.0.3.1](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases/tag/v1.0.3.1) |
+| [MII Process Data Sharing](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases) | [v1.0.2.1](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/tag/v1.0.2.1) | [v1.0.2.1](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/tag/v1.0.2.1) |
+| [NUM-RDP](https://github.com/num-codex/codex-processes-ap1/releases) | [v1.1.0.0](https://github.com/num-codex/codex-processes-ap1/releases/tag/v1.1.0.0) | [v1.1.0.0](https://github.com/num-codex/codex-processes-ap1/releases/tag/v1.1.0.0) |
+
+
+- Explore and install Process Plugins in the Marketplace. Details on each plugin are available [here](https://hub.dsf.dev/).
+- Deploying the process plugin to the DSF involves copy the process jar-file and configuring environment variable for the business process engine (BPE).
+
+
+### Prerequisites
+- A DSF installation of version 1.3.x or higher. An installation guide can be found [here](https://dsf.dev/operations/latest/install.html).
+
+### Deployment
+- Add the process jar-file to the DSF BPE folder `/opt/bpe/process`: 
+```
+wget (your jar-file download link)
+```
+
+For example:
+```
+ wget https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/download/v1.0.0.1/mii-process-data-sharing-1.0.0.1.jar
+```
+
+- Make sure the process is readable by the bpe user or group, for example by executing:
+```
+sudo chmod 440 (your jar-file name.jar)
+sudo chown root:bpe (your jar-file name.jar)
+```
+For example:
+```
+sudo chmod 440 mii-process-data-sharing-1.0.0.1.jar
+sudo chown root:bpe mii-process-data-sharing-1.0.0.1.jar
+```
+
+- Modify the process exclude config in `/opt/bpe/docker-compose.yml`
+- **Reminder:** Update/verify required configurations in `docker-compose.yml`
diff --git a/docs/src/operations/v1.9.0/install.md b/docs/src/operations/v1.9.0/install.md
new file mode 100644
index 000000000..ee4ec1a31
--- /dev/null
+++ b/docs/src/operations/v1.9.0/install.md
@@ -0,0 +1,230 @@
+---
+title: Install DSF 1.9.0
+icon: install
+---
+
+In the following installation manual we will show you how you can install your own DSF instance to be part of an already existing DSF network.
+
+::: tip Unified installation manual
+
+The installation instructions of DSF 0.9.x for different application use cases (e.g. NUM CODEX or HiGHmed) are now combined under one common manual. The specific steps for process installation and configuration are documented at the process plugin documentation pages.
+:::
+
+## Prerequisites
+### Virtual Machines
+* DSF FHIR VM: min. 4 GB RAM, 4 vCPU, 20 GB HDD
+* DSF BPE VM: min. 4 GB RAM, 4 vCPU, 20 GB HDD
+### Docker / Docker-Compose
+Both VMs need latest docker (>= 24.0.0) and docker compose. For the latest install guide see https://docs.docker.com/engine/install. 
+
+```
+sudo apt-get update
+sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get update
+sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin
+sudo systemctl enable docker.service
+sudo systemctl enable containerd.service
+```
+
+The current version of docker compose is installed with the current docker version.
+
+### Client/Server Certificates
+Two Certificates from a list of allowed certificate authorities (see [details about certificates](root-certificates.html)) are needed:
+* Certificate _A_: Server Certificate  - `TLS Web Server Authentication`
+* Certificate _B_: Client Certificate  - `TLS Web Client Authentication`
+
+If you use GÉANT TCS certificates, then they are configured by default with the necessary *X509v3 Extended Key Usage*s: `TLS Web Server Authentication, TLS Web Client Authentication`.
+
+For further details on supported Root Certificate Authorities click [here](root-certificates.html#list-of-default-trusted-certificate-authorities)
+
+
+### Network setup / Network access
+
+* The DSF FHIR server needs to be accessible via the internet and able to access the internet without TLS interception.
+* The BPE FHIR server should only be accessible by the internal network and able to access your DSF FHIR server via its external FQDN and the internet without TLS interception.
+
+Here is a quick overview of the expected network setup.
+
+| Source                        | Target                        | Port | Protocol               |
+| ----------------------------- | ----------------------------- | ---- | ---------------------- |
+| DSF BPE (local)               | DSF FHIR (local)              | 443  | https, wss             |
+| DSF BPE (local)               | DSF FHIR (other DSF communication partners)	| 443  | https                  |
+| DSF FHIR (local)              | DSF FHIR (other DSF communication partners)	| 443  | https (HTTP HEAD only) |
+| DSF BPE (other DSF communication partners)  | DSF FHIR (local)              | 443  | https                  |
+| DSF FHIR (other DSF communication partners) | DSF FHIR (local)              | 443  | https (HTTP HEAD only) |
+
+ Connections to services that are used by process plugins (e.g. a fTTP, a terminology server, simplifier.net or a local FHIR server) are not listed. Please refer to the respective process plugin documentation pages for more information.
+
+
+
+## Setup
+### Prepare Certificates
+1. Server Certificate (certificate _A_)  
+    _This certificate will be used as the DSF FHIR servers server certificate (ssl_certificate_file.pem, ssl_certificate_key_file.pem)_
+    * Store PEM encoded certificate as `ssl_certificate_file.pem`
+    * Store unencrypted, PEM encoded private-key as `ssl_certificate_key_file.pem`
+    * Store PEM encoded certificate chain (all intermediate CAs between the server and the root certificate, excluding root) as `ssl_certificate_chain_file.pem`
+
+1. Client Certificate (Certificate _B_)  
+    _This certificate will be used as the DSF BPE servers client certificate (client_certificate.pem, client_certificate_private_key.pem) as well as the DSF FHIR servers client certificate (client_certificate.pem, client_certificate_private_key.pem)_
+    * Store PEM encoded certificate as `client_certificate.pem`
+    * Store encrypted or not encrypted, PEM encoded private-key as `client_certificate_private_key.pem`
+
+### DSF FHIR Server
+1. Add Group/User  
+    Add group and user used by the DSF FHIR java application. Ubuntu compatible commands below:
+    ```
+    sudo groupadd --gid 2101 fhir
+    sudo useradd --system --no-create-home --uid 2101 --gid 2101 fhir
+    ```
+
+1. Download and Extract Config Files  
+    Download and unpack the prepared DSF FHIR server config files and folder structure:
+    ```
+    cd /opt
+    wget https://dsf.dev/download/dsf_fhir_1_9_0.tar.gz
+    sudo tar --same-owner -zxvf dsf_fhir_1_9_0.tar.gz
+    ```
+    _The `tar` command will unpack the config files at `/opt/fhir` assuming you changed into the `/opt` directory._
+
+1. Verify that the `fhir` system user or group can write into the following folder
+   * `/opt/fhir/log`
+
+1. Add certificates and keys
+    * Add the server certificate (certificate _A_), the corresponding private-key and the certificate chain (one file with all intermediate certificates, excluding the root CA) to **/opt/fhir/secrets/**
+        * ssl_certificate_file.pem (chmod: 440, chown: fhir:docker)
+        * ssl_certificate_key_file.pem (chmod: 440, chown: fhir:docker)
+        * ssl_certificate_chain_file.pem  (chmod: 440, chown: fhir:docker)
+    * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/fhir/secrets/**
+        * client_certificate.pem (chmod: 440, chown: fhir:docker)
+        * client_certificate_private_key.pem (chmod: 440, chown: fhir:docker)
+    * If the private key is encrypted, add a password file with the password as the only content to **/opt/fhir/secrets/client_certificate_private_key.pem.password**
+    * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
+        ```
+        L34:      - app_client_certificate_private_key.pem.password
+        ...
+        L47:      DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE: /run/secrets/app_client_certificate_private_key.pem.password
+        ...
+        L109:  app_client_certificate_private_key.pem.password:
+        L110:    file: ./secrets/client_certificate_private_key.pem.password
+        ```
+
+    ::: tip How to chmod / chown
+    For the example *ssl_certificate_file.pem (chmod: 440, chown: fhir:docker)* you must:
+
+    1. Set the file content as requested
+    2. Change the file permissions to 440 (allow read access to the owner of the file and the group the file belongs to, deny write access to everybody and deny read for other users):
+    `chmod 440 /opt/fhir/secrets/ssl_certificate_file.pem`
+    3. Change the owner of the file to the user `fhir` and the group the file belongs to to `docker`:
+    `chown fhir:docker /opt/fhir/secrets/ssl_certificate_file.pem`
+
+    :::
+
+1. Modify database passwords
+    * **/opt/fhir/secrets/db_liquibase.password**
+        * Generate a random password (min. 32 characters recommended) and replace the content of the file.
+    * **/opt/fhir/secrets/db_user.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+    * **/opt/fhir/secrets/db_user_permanent_delete.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+
+1. Modify the docker-compose.yml file and set environment variables to the appropriate values
+    * **services -> proxy -> environment:**
+        * **HTTPS_SERVER_NAME_PORT**: `dsf.todo.organization.com:443`
+            Set your FHIR servers external FQDN, e.g. `https://foo.bar.de` -> `foo.bar.de:443`
+        * For additional environment variables, see the FHIR Reverse Proxy [Configuration Parameters](fhir-reverse-proxy/configuration) page.
+    * **services -> app -> environment:**
+        * **DEV_DSF_FHIR_SERVER_ORGANIZATION_IDENTIFIER_VALUE**: `todo.organization.com`  
+            Set your Organizations DSF identifier, aka the shortest FQDN that resolves to the main homepage of the organization, e.g. `hs-heilbronn.de`
+        * **DEV_DSF_FHIR_SERVER_BASE_URL**: `https://dsf.todo.organization.com/fhir`  
+            Set your FHIR servers external FQDN, e.g. `foo.bar.de` -> `https://foo.bar.de/fhir`
+        * **DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT**: `f4344032fe77bffb912ff5abfd44da89fe64d355affb8d0f14c9ecb8bdbf92c7fe5f995b1ec0c453e4228b395e331052e4639044df4933d57721de508a84d26f`  
+            Set the SHA-512 Hash (lowercase hex) of your client certificate (Certificate _B_)  
+            Use `certtool --fingerprint --hash=sha512 --infile=client_certificate.pem` to generate the hash.
+        * **DEV_DSF_FHIR_SERVER_ROLECONFIG**: `|`
+            (Optional) You can add other client certificates (e.g. personal certificates from admins) to your DSF instance. For additional information, see the FHIR server [Access Control](fhir/access-control) page.
+            
+        * For additional environment variables, see the FHIR server [Configuration Parameters](fhir/configuration) page.
+
+1. Start the DSF FHIR Server  
+    Start using: `docker compose up -d && docker compose logs -f` (Ctrl-C will close log, but not stop container)
+
+### DSF BPE Server
+1. Add Group/User  
+    Add group and user used by the DSF BPE java application. Ubuntu compatible commands below:
+    ```
+    sudo groupadd --gid 2202 bpe
+    sudo useradd --system --no-create-home --uid 2202 --gid 2202 bpe
+    ```
+1. Download and Extract Config Files  
+    Download and extract prepared DSF BPE server config files and folder structure:  
+    ```
+    cd /opt
+    wget https://dsf.dev/download/dsf_bpe_1_9_0.tar.gz
+    sudo tar --same-owner -zxvf dsf_bpe_1_9_0.tar.gz
+    ```
+    _The `tar` command will unpack the config files at `/opt/bpe` assuming you changed into the `/opt` directory._
+
+1. Verify that the `bpe` system user or group can write into the following folders
+   * `/opt/bpe/log`
+
+1. Add certificates and keys
+    * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/bpe/secrets/**
+        * client_certificate.pem (chmod: 440 chown: bpe:docker)
+        * client_certificate_private_key.pem (chmod: 440 chown: bpe:docker)
+    * If the private key is encrypted, add a password file with the password as the only content to **/opt/bpe/secrets/client_certificate_private_key.pem.password**
+    * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
+        ```
+        L12:      - app_client_certificate_private_key.pem.password
+        ...
+        L32:      DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE: /run/secrets/app_client_certificate_private_key.pem.password
+        ...
+        L83:  app_client_certificate_private_key.pem.password:
+        L84:    file: ./secrets/client_certificate_private_key.pem.password
+        ```
+1. Modify database passwords
+    * **/opt/bpe/secrets/db_liquibase.password**
+        * Generate a random password (min. 32 characters recommended) and replace the content of the file.
+    * **/opt/bpe/secrets/db_user.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+    * **/opt/bpe/secrets/db_user_camunda.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+
+1. Modify the docker-compose.yml file and set environment variables to the appropriate values
+    * **services -> app -> environment:**
+        * **DEV_DSF_BPE_FHIR_SERVER_BASE_URL**: `https://dsf.todo.organization.com/fhir`  
+            Set your FHIR servers external FQDN, e.g. `foo.bar.de` -> `https://foo.bar.de/fhir`
+            
+        * For additional environment variables, see the BPE server [Configuration Parameters](bpe/configuration) page.
+
+1. Start the DSF BPE Server (without process plugins)  
+    Start using: `docker compose up -d && docker compose logs -f` (Ctrl-C will close log, but not stop container)
+
+1. Verify DSF BPE Startup  
+    * Check that the BPE was able to download new Task resources from the DSF FHIR server during startup.
+    * Check that the BPE was able to download a Subscription resource from the DSF FHIR server during startup.
+    * Check that the BPE was able to connect to the websocket endpoint of the DSF FHIR server during startup.
+
+    If you need to debug the TLS connection to your DSF FHIR server use for example:  
+    `docker run -it --rm alpine/openssl s_client your-fhir-server.fqdn:443`  
+    The command above should print the server certificate of your DSF FHIR server (certificate _A_) and end with a message like `[...]tlsv13 alert certificate required[...]`
+
+
+### Logs
+By default, we will log both to the console (collected by docker) and to files in the log directory, so you can use `docker compose logs -f` in `/opt/bpe` and `/opt/fhir` to view informational, warning and error logs. If you encounter any error and the reported information is not detailled enough, you can also check the logs in the `/opt/fhir/log` and `/opt/bpe/log` directories with debugging logs. There, you will also find older log files. If you have any questions and can't resolve them by yourself please always include the latest logs from `/opt/fhir/log` and `/opt/bpe/log` in your support request.
+
+On a successful BPE start, you should see the following entries in your BPE log:
+
+```
+INFO Grizzly(1) -  INFO Grizzly(1) - ClientEndpoint.onOpen(37) | Websocket open, session SOME_RANDOM_UUID1
+INFO Grizzly(1) -  INFO Grizzly(1) - ClientEndpoint.onOpen(37) | Websocket open, session SOME_RANDOM_UUID2
+```
+
+### On-Boarding
+Please visit the on boarding website of your network for more information.
+
+::: tip Ideas for improvement?
+Have you found an error or is something unclear to you? Then please feel free to write to us at <a href="mailto:dsf-gecko@hs-heilbronn.de">dsf-gecko@hs-heilbronn.de</a>. Thank you very much!
+:::
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/passwords-secrets.md b/docs/src/operations/v1.9.0/passwords-secrets.md
new file mode 100644
index 000000000..62bb2ef1f
--- /dev/null
+++ b/docs/src/operations/v1.9.0/passwords-secrets.md
@@ -0,0 +1,33 @@
+---
+title: Passwords and Secrets
+icon: safe
+---
+
+Environment variables ending in `_PASSWORD` or `_SECRET` can be configured using plain-text files. To achieve this, environment variable should be defined with `_FILE` appended to the name with the value defined as the location of the file. For all variables ending in `_PASSWORD_FILE` or `_SECRET_FILE` the DSF FHIR and DSF BPE applications will read the content of the fist line of the referenced file and dynamically define the corresponding `_PASSWORD` or `_SECRET` environment variables with the read values.
+
+### Example Environment Variables
+- **DEV_DSF_BPE_DB_USER_PASSWORD_FILE**: If set to `/run/secrets/db_user_password`, the application will read the contents of the `/run/secrets/db_user_password` file and set the `DEV_DSF_BPE_DB_USER_PASSWORD` environment variable with the content from that file.
+- **DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE**: If set to `/run/secrets/oidc_client_secret`, the application will read the contents of the referenced file and set the `DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET` environment variable accordingly.
+
+### Docker Secrets
+
+It is recommended to use [docker secrets](https://docs.docker.com/compose/how-tos/use-secrets) as files for these environment variables. Docker secrets are mounted as files in `/run/secrets/<secret_name>` inside the container.
+
+#### Example docker-compose
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/fhir
+    secrets:
+      - db_user_password
+      - oidc_client_secret
+    environment:
+      DEV_DSF_BPE_DB_USER_PASSWORD_FILE: /run/secrets/db_user_password
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_secret
+
+secrets:
+  db_user_password:
+    file: ./secrets/db_user.password
+  api_key:
+    file: ./secrets/oidc_client.secret
+```
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/release-notes.md b/docs/src/operations/v1.9.0/release-notes.md
new file mode 100644
index 000000000..ddc2610df
--- /dev/null
+++ b/docs/src/operations/v1.9.0/release-notes.md
@@ -0,0 +1,13 @@
+---
+title: Release Notes (v1.9.0)
+icon: note
+---
+
+## [Release Notes for v1.9.0](https://github.com/datasharingframework/dsf/releases/tag/v1.9.0)
+
+::: tip Release Notes
+You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
+:::
+
+
+Release notes will be added after the release is published.
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/root-certificates.md b/docs/src/operations/v1.9.0/root-certificates.md
new file mode 100644
index 000000000..be531960c
--- /dev/null
+++ b/docs/src/operations/v1.9.0/root-certificates.md
@@ -0,0 +1,208 @@
+---
+title: Default Root Certificates
+icon: safe
+---
+
+A number of trusted certificate authorities (CAs) are included in the DSF docker images [fhir_proxy](https://github.com/datasharingframework/dsf/pkgs/container/fhir_proxy), [fhir](https://github.com/datasharingframework/dsf/pkgs/container/fhir), [bpe_proxy](https://github.com/datasharingframework/dsf/pkgs/container/bpe_proxy) and [bpe](https://github.com/datasharingframework/dsf/pkgs/container/bpe) by default. Root and intermediate certificates as well as the configured usage of issuing CAs as either **server**, **client** oder **server and client** CA are listed at the end.
+
+:::info
+Please ensure that you are using an organization-validated certificate (OV). We check for the presence of certain elements in the FHIR proxy. These are not set for domain-validated (DV) certificates. DV-validated certificates cannot be used in the standard setup.
+:::
+
+## Extending or Replacing Trusted Certificate Authorities
+X.509 certificates of default trusted CAs are stored as .pem files containing multiple certificates in the docker images and can be replaced by either using docker [bind mounts](https://docs.docker.com/engine/storage/bind-mounts) or configuring appropriate environment variables with different targets.
+
+### FHIR Reverse Proxy
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates (Apache httpd mod_ssl configuration option [SSLCACertificateFile](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatefile)) as well as the CA Certificates for defining acceptable CA names (option [SSLCADNRequestFile](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcadnrequestfile)).
+Use the following environment variable to configure non default .pem files or override the existing files using docker bind mounts:
+* [SSL_CA_CERTIFICATE_FILE](fhir-reverse-proxy/configuration.html#ssl-ca-certificate-file)
+  Default Value: [ca/client_cert_ca_chains.pem](/download/1.9.0/client_cert_ca_chains.pem)
+* [SSL_CA_DN_REQUEST_FILE](fhir-reverse-proxy/configuration.html#ssl-ca-dn-request-file)
+  Default Value: [ca/client_cert_issuing_cas.pem](/download/1.9.0/client_cert_issuing_cas.pem)
+
+**Note:** Default file location are relative to the docker image work directory `/usr/local/apache2`.
+**Also Note:** Using non default .pem files for the environment variables above may require also modifying the default values of the environment variables [SSL_EXPECTED_CLIENT_S_DN_C_VALUES](fhir-reverse-proxy/configuration.html#ssl-expected-client-s-dn-c-values) and [SSL_EXPECTED_CLIENT_I_DN_CN_VALUES](fhir-reverse-proxy/configuration.html#ssl-expected-client-i-dn-cn-values).
+
+### FHIR Server
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates as well as root CAs used for validating server certificates of remote DSF FHIR servers and the OIDC provider when using [OpenID Connect](fhir/oidc.html) for authenticating local users.
+Use the following environment variable to configure non default .pem files or override the existing files using docker bind mounts:
+* [DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-server-auth-trust-client-certificate-cas)
+  Default Value: [ca/client_cert_ca_chains.pem](/download/1.9.0/client_cert_ca_chains.pem)
+* [DEV_DSF_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-fhir-client-trust-server-certificate-cas)
+  Default Value: [ca/server_cert_root_cas.pem](/download/1.9.0/server_cert_root_cas.pem)
+* [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas)
+  Default Value: [ca/server_cert_root_cas.pem](/download/1.9.0/server_cert_root_cas.pem)
+
+**Note:** Default file location are relative to the docker image work directory `/opt/fhir`.
+
+### BPE Reverse Proxy
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates (Apache httpd mod_ssl configuration option [SSLCACertificateFile](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatefile)) as well as the CA Certificates for defining acceptable CA names (option [SSLCADNRequestFile](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcadnrequestfile)).
+Use the following environment variable to configure non default .pem files or override the existing files using docker bind mounts:
+* [SSL_CA_CERTIFICATE_FILE](bpe-reverse-proxy/configuration.html#ssl-ca-certificate-file)
+  Default Value: [ca/client_cert_ca_chains.pem](/download/1.9.0/client_cert_ca_chains.pem)
+* [SSL_CA_DN_REQUEST_FILE](bpe-reverse-proxy/configuration.html#ssl-ca-dn-request-file)
+  Default Value: [ca/client_cert_issuing_cas.pem](/download/1.9.0/client_cert_issuing_cas.pem)
+
+**Note:** Default file location are relative to the docker image work directory `/usr/local/apache2`.
+**Also Note:** Using non default .pem files for the environment variables above may require also modifying the default values of the environment variables [SSL_EXPECTED_CLIENT_S_DN_C_VALUES](bpe-reverse-proxy/configuration.html#ssl-expected-client-s-dn-c-values) and [SSL_EXPECTED_CLIENT_I_DN_CN_VALUES](bpe-reverse-proxy/configuration.html#ssl-expected-client-i-dn-cn-values).
+
+### BPE Server
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates as well as root CAs used for validating server certificates of local and remote DSF FHIR servers, the local mail server (if configured and SMTP over TLS required) and the OIDC provider when using [OpenID Connect](fhir/oidc.html) for authenticating local users.
+Use the following environment variable to configure non default .pem files or override the existing files using docker bind mounts:
+* [DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-server-auth-trust-client-certificate-cas)
+  Default Value: [ca/client_cert_ca_chains.pem](/download/1.9.0/client_cert_ca_chains.pem)
+* [DEV_DSF_BPE_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-bpe-fhir-client-trust-server-certificate-cas)
+  Default Value: [ca/server_cert_root_cas.pem](/download/1.9.0/server_cert_root_cas.pem)
+  [DEV_DSF_BPE_MAIL_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-bpe-mail-trust-server-certificate-cas)
+  Default Value: [ca/server_cert_root_cas.pem](/download/1.9.0/server_cert_root_cas.pem)
+* [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas)
+  Default Value: [ca/server_cert_root_cas.pem](/download/1.9.0/server_cert_root_cas.pem)
+
+**Note:** Default file location are relative to the docker image work directory `/opt/bpe`.
+
+## List of Default Trusted Certificate Authorities
+If not mentioned explicitly, issuing CAs listed will sign X.509 certificates with [Extended Key Usage](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12) entries `TLS WWW server authentication` and `TLS WWW client authentication`.
+
+### CAs Trusted by Common Web Browsers and Operating Systems
+
+* Root CA: **HARICA TLS ECC Root CA 2021**
+  Info: https://crt.sh/?caid=202185
+  X509 Certificate: https://crt.sh/?id=4147045948
+  Not after: Feb 13 11:01:09 2045 GMT
+    * Issuing CA: **GEANT TLS ECC 1**
+      Info: https://crt.sh/?caid=390050
+      X509 Certificate: https://crt.sh/?id=16099180990
+      Not after: Dec 31 11:14:20 2039 GMT
+    * Issuing CA: **HARICA OV TLS ECC**
+      Info: https://crt.sh/?caid=207661
+      X509 Certificate: https://crt.sh/?id=4442848530
+      Not after: Mar 15 09:33:51 2036 GMT
+* Root CA: **HARICA TLS RSA Root CA 2021**
+  Info: https://crt.sh/?caid=202184
+  X509 Certificate: https://crt.sh/?id=4147041876
+  Not after: Feb 13 10:55:37 2045 GMT
+    * Issuing CA: **GEANT TLS RSA 1**
+      Info: https://crt.sh/?caid=390054
+      X509 Certificate: https://crt.sh/?id=16099180997
+      Not after: Dec 31 11:14:59 2039 GMT
+    * Issuing CA: **HARICA OV TLS RSA**
+      Info: https://crt.sh/?caid=207660
+      X509 Certificate: https://crt.sh/?id=4442848529
+      Not after: Mar 15 09:34:16 2036 GMT
+* Root CA: **HARICA Client ECC Root CA 2021**
+  Info: https://crt.sh/?caid=202189
+  X509 Certificate: https://crt.sh/?id=4147052292
+  Not after: Feb 13 11:03:33 2045 GMT
+    * Issuing CA: **GEANT S/MIME ECC 1** [client/smime certificates only]
+      Info: https://crt.sh/?caid=390048
+      X509 Certificate: https://crt.sh/?id=16099180988
+      Not after: Dec 31 11:11:39 2039 GMT
+    * Issuing CA: **HARICA S/MIME ECC** [client/smime certificates only]
+      Info: https://crt.sh/?caid=207659
+      X509 Certificate: https://crt.sh/?id=4442848523
+      Not after: Mar 15 09:36:57 2036 GMT
+* Root CA: **HARICA Client RSA Root CA 2021**
+  Info: https://crt.sh/?caid=202188
+  X509 Certificate: https://crt.sh/?id=4147049674
+  Not after: Feb 13 10:58:45 2045 GMT
+    * Issuing CA: **GEANT S/MIME RSA 1** [client/smime certificates only]
+      Info: https://crt.sh/?caid=390049
+      X509 Certificate: https://crt.sh/?id=16099180989
+      Not after: Dec 31 11:13:07 2039 GMT
+    * Issuing CA: **HARICA S/MIME RSA** [client/smime certificates only]
+      Info: https://crt.sh/?caid=207658
+      X509 Certificate: https://crt.sh/?id=4442848517
+      Not after: Mar 15 09:37:37 2036 GMT
+* Root CA: **T-TeleSec GlobalRoot Class 2** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=6068
+  X509 Certificate: https://crt.sh/?id=8733622
+  Not after: Oct 1 23:59:59 2033 GMT
+    * Intermediate Root CA: **DFN-Verein Certification Authority 2**
+      Info: https://crt.sh/?caid=22818
+      X509 Certificate: https://crt.sh/?id=23908438
+      Not after: Feb 22 23:59:59 2031 GMT
+      * Issuing CA: **DFN-Verein Global Issuing CA** [existing, still valid client certificates, no new certificates]
+        Info: https://crt.sh/?caid=23770
+        X509 Certificate: https://crt.sh/?id=25484751
+        Not after: Feb 22 23:59:59 2031 GMT
+      * Issuing CA: **Fraunhofer User CA - G02** [existing, still valid client certificates, no new certificates]
+        Info: https://crt.sh/?caid=23772
+        X509 Certificate: https://crt.sh/?id=25484789
+        Not after: Feb 22 23:59:59 2031 GMT
+* Root CA: **D-TRUST Root Class 3 CA 2 2009**
+  Info: https://crt.sh/?caid=712
+  X509 Certificate: https://crt.sh/?id=133226
+  Not after: Nov 5 08:35:58 2029 GMT
+    * Issuing CA: **D-TRUST SSL Class 3 CA 1 2009** [server certificates via TMF e.V.]
+      Info: https://crt.sh/?caid=713
+      X509 Certificate: https://crt.sh/?id=133227
+      Not after: Nov 5 08:35:58 2029 GMT
+* Root CA: **USERTrust ECC Certification Authority** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=1390
+  X509 Certificate: https://crt.sh/?id=2841410
+  Not after: Jan 18 23:59:59 2038 GMT
+    * Issuing CA: **Sectigo ECC Organization Validation Secure Server CA**
+      Info: https://crt.sh/?caid=105483
+      X509 Certificate: https://crt.sh/?id=924467859
+      Not after: Dec 31 23:59:59 2030 GMT
+    * Issuing CA: **GEANT OV ECC CA 4**
+      Info: https://crt.sh/?caid=160140
+      X509 Certificate: https://crt.sh/?id=2475254970
+    * Issuing CA: **GEANT Personal ECC CA 4** [client/smime certificates only]
+      Info: https://crt.sh/?caid=160136
+      X509 Certificate: https://crt.sh/?id=2475254903
+      Not after: May 1 23:59:59 2033 GMT
+    * Issuing CA: **GEANT eScience Personal ECC CA 4** [client/smime certificates only]
+      Info: https://crt.sh/?caid=160138
+      X509 Certificate: https://crt.sh/?id=2475254888
+      Not after: May 1 23:59:59 2033 GMT
+* Root CA: **USERTrust RSA Certification Authority** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=1167
+  X509 Certificate: https://crt.sh/?id=1199354
+  Not after: Jan 18 23:59:59 2038 GMT
+    * Issuing CA: **Sectigo RSA Organization Validation Secure Server CA**
+      Info: https://crt.sh/?caid=105487
+      X509 Certificate: https://crt.sh/?id=924467857
+      Not after: Dec 31 23:59:59 2030 GMT
+    * Issuing CA: **GEANT OV RSA CA 4**
+      Info: https://crt.sh/?caid=160137
+      X509 Certificate: https://crt.sh/?id=2475254782
+      Not after: May 1 23:59:59 2033 GMT
+    * Issuing CA: **GEANT Personal CA 4** [client/smime certificates only]
+      Info: https://crt.sh/?caid=160144
+      X509 Certificate: https://crt.sh/?id=2475255043
+      Not after: May 1 23:59:59 2033 GMT
+    * Issuing CA: **GEANT eScience Personal CA 4** [client/smime certificates only]
+      Info: https://crt.sh/?caid=160134
+      X509 Certificate: https://crt.sh/?id=2475253350
+      Not after: May 1 23:59:59 2033 GMT
+
+### Other CAs
+
+* Root CA: **HARICA Client ECC Root CA 2021**
+  Info: https://crt.sh/?caid=202188
+  X509 Certificate: https://crt.sh/?id=1199354
+  Not after: Jan 18 23:59:59 2038 GMT
+  * Issuing CA: **HARICA Client Authentication ECC** [client certificates only]
+    Info: https://crt.sh/?caid=207670
+    X509 Certificate: https://crt.sh/?id=4442848518
+    Not after: Mar 15 09:17:38 2036 GMT
+* Root CA: **HHARICA Client RSA Root CA 2021**
+  Info: https://crt.sh/?caid=207670
+  X509 Certificate: https://crt.sh/?id=1199354
+  Not after: Jan 18 23:59:59 2038 GMT
+  * Issuing CA: **HARICA Client Authentication RSA** [client certificates only]
+    Info: https://crt.sh/?caid=207671
+    X509 Certificate: https://crt.sh/?id=4442848531
+    Not after: Mar 15 09:19:36 2036 GMT
+
+* Root CA: **D-TRUST Limited Basic Root CA 1 2019**
+  X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_Root_CA_1_2019.crt
+  Not after: Jun 19 08:15:51 2034 GMT
+    * Issuing CA: **D-TRUST Limited Basic CA 1-2 2019** [client certificates via TMF e.V.]
+      X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-2_2019.crt
+      Not after: Jun 19 08:15:51 2034 GMT
+    * Issuing CA: **D-TRUST Limited Basic CA 1-3 2019** [client certificates via TMF e.V.]
+      X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-3_2019.crt
+      Not after: Jun 19 08:15:51 2034 GMT
+
diff --git a/docs/src/operations/v1.9.0/upgrade-from-0.md b/docs/src/operations/v1.9.0/upgrade-from-0.md
new file mode 100644
index 000000000..58dea1a00
--- /dev/null
+++ b/docs/src/operations/v1.9.0/upgrade-from-0.md
@@ -0,0 +1,32 @@
+---
+title: Upgrade from DSF 0.9.x
+icon: update
+---
+
+A direct upgrade from DSF 0.9.x to DSF 1.x is not supported. 
+
+:::danger Do not use your 0.9.x configuration as starting point
+There are too many changes between DSF 0.9.x and DSF 1.x to use the old configuration as starting point and just adapt some configuration parameter names.
+
+**Please** use the new installation manual to perform a new installation and use the old setup only for reference.
+:::
+
+
+Instead, please perform the following steps:
+
+
+1. Shut down your DSF instances (DSF FHIR Server and DSF BPE).
+2. Backup your DSF instances (e.g. by moving the folders `/opt/bpe` and `/opt/fhir` to `/opt/bpe_0.9` and `/opt/fhir_0.9`)
+3. Install the new DSF according to the [instructions](install).
+4. You can copy **your** certificates (server- and client certificates) to your new installation. Please do **not** copy the CA certificate files from your old installation, as the new version will contain additional CAs (e.g. D-Trust).
+5. Configure your processes according to the **new** process plugin [documentation](./install-plugins). You can use your **test** environment configuration and your old production setup configuration for reference. Please ensure to use the **new** configuration parameter names, as many of them will have new prefixes (like `DEV_DSF` instead of `ORG_HIGHMED`).
+6. If you perform the installation before the change of the according environment, you can start the old instances again (out of the `/opt/fhir_0.9` and `/opt/bpe_0.9` directories).
+7. If you want to replace the old setup with the new one, shutdown the old instances (FHIR + BPE) and start the new ones.
+
+::: tip New process plugins
+Please do not copy your old process plugins into the new DSF. There will be a new release for each process plugin at the time you will be prompted to update your DSF instance.
+:::
+
+::: tip Use your old virtual machine
+We recommand the usage of your old DSF 0.9.x virtual machine for your new DSF 1.x setup. This will ensure that you already have the required firewall settings in place.
+:::
\ No newline at end of file
diff --git a/docs/src/operations/v1.9.0/upgrade-from-1.md b/docs/src/operations/v1.9.0/upgrade-from-1.md
new file mode 100644
index 000000000..1b7dc1b7d
--- /dev/null
+++ b/docs/src/operations/v1.9.0/upgrade-from-1.md
@@ -0,0 +1,137 @@
+---
+title: Upgrade from DSF 1.8.0
+icon: update
+---
+
+Upgrading the DSF from 1.8.0 to 1.9.0 involves modifying the docker-compose.yml files, changing secret permissions, and recreating the containers. 
+
+::: warning Update to DSF 1.7.0 first
+When upgrading from DSF version < 1.7.0 it is important to migrate to [DSF 1.7.0 first](../v1.7.0/upgrade-from-1).
+:::
+
+
+## Modify DSF FHIR Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/fhir` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/fhir /opt/fhir_backup_pre_1.9.0_upgrade`
+
+2. Modify the DSF FHIR docker-compose.yml file, replace the version number with 1.9.0.
+```diff
+ version: '3.8'
+ services:
+   proxy:
+-    image: ghcr.io/datasharingframework/fhir_proxy:1.8.0
++    image: ghcr.io/datasharingframework/fhir_proxy:1.9.0
+     restart: on-failure
+...
+   app:
+-    image: ghcr.io/datasharingframework/fhir:1.8.0
++    image: ghcr.io/datasharingframework/fhir:1.9.0
+     restart: on-failure
+...
+ 
+```
+
+3. **Adjust secret permissions (new in 1.9.0)**
+   Starting with DSF 1.9.0, the FHIR Proxy service runs as a **non-root user** inside its container.
+   To ensure continued access to certificates and keys, you must adjust ownership and permissions of the secrets folder.
+
+   **Target permissions:**
+
+   * **FHIR Server (app)** runs as `uid=2101`/`gid=2101` → must read **all secrets except** the proxy-only SSL files.
+   * **FHIR Proxy (proxy)** runs as `uid=4101`/`gid=4101` → must read **only** secrets starting with `ssl_` (e.g. `ssl_certificate_file.pem`, `ssl_certificate_key_file.pem`).
+   * To make this simple and compatible, we make all `ssl_*` files except (`ssl_certificate_file.pem`, `ssl_certificate_key_file.pem`) **world-readable (0444)**, allowing both users to access them.
+
+   **Example (on FHIR host `/opt/fhir`):**
+
+   ```bash
+   # 1) Make directory traversable for all (no write access)
+   sudo chown root:2101 secrets
+   sudo chmod 555 secrets
+
+   # 2) Default: all secrets owned by root:2101, readable by owner+group
+   sudo chown root:2101 secrets/*
+   sudo chmod 440 secrets/*
+
+   # 3) Exceptions: SSL files also readable by proxy, except the certificate and private
+   sudo chmod 444 secrets/ssl_*
+
+   # 4) Ensure the SSL certificate and private key files are only readable by the proxy
+   sudo chown root:4101 secrets/ssl_certificate_file.pem
+   sudo chown root:4101 secrets/ssl_certificate_key_file.pem
+   sudo chmod 440 secrets/ssl_certificate_file.pem
+   sudo chmod 440 secrets/ssl_certificate_key_file.pem
+   ```
+
+   **Advanced configuration to further constrain access privileges (Optional)**
+   
+   If you prefer not to make ssl_* world-readable, use ACLs instead:
+
+   ```bash
+    sudo apt-get install -y acl  # if needed
+    sudo setfacl -m g:2101:r,g:4101:r secrets/ssl_*
+    sudo setfacl -m o::0 secrets/ssl_*
+   ```
+
+4. Upgrade the DSF FHIR containers  
+    From `/opt/fhir` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+## Modify DSF BPE Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/bpe` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/bpe /opt/bpe_backup_pre_1.9.0_upgrade`
+
+2. Modify the DSF BPE docker-compose.yml file, replace the version number with 1.9.0.
+```diff
+ version: '3.8'
+ services:
+   app:
+-    image: ghcr.io/datasharingframework/bpe:1.8.0
++    image: ghcr.io/datasharingframework/bpe:1.9.0
+     restart: on-failure
+...
+```
+
+3. **Adjust secret permissions (only if using BPE Proxy)**
+   If your setup includes a BPE Proxy (disabled by default), it also runs as non-root and needs read access to its certificate files.
+
+   **Target permissions:**
+
+   * **BPE Server (app)** runs as `uid=2202`/`gid=2202` → read all secrets except proxy-only SSL files.
+   * **BPE Proxy (proxy)** runs as `uid=4202`/`gid=4202` → read only `ssl_*` files.
+
+   **Example (on `/opt/bpe`):**
+
+   ```bash
+   sudo chown root:2202 secrets
+   sudo chmod 555 secrets
+   sudo chown root:2202 secrets/*
+   sudo chmod 440 secrets/*
+
+   sudo chmod 444 secrets/ssl_*
+
+   sudo chown root:4202 secrets/ssl_certificate_file.pem
+   sudo chown root:4202 secrets/ssl_certificate_key_file.pem
+
+   sudo chmod 440 secrets/ssl_certificate_file.pem
+   sudo chmod 440 secrets/ssl_certificate_key_file.pem
+   ```
+
+4. Upgrade the DSF BPE containers  
+    From `/opt/bpe` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+5. Verify your upgrade:
+    * Verify the DSF FHIR server is running in version 1.9.0. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-fhir-server-jetty, version: 1.9.0, [...]`
+    * Verify the DSF FHIR server started without errors
+    * Verify the DSF FHIR server is accessible via https, for example by browsing to https://your-dsf-endpoint.de/fhir/ (authentication with your client-certificate)
+    * Verify the DSF BPE server is running in version 1.9.0. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-bpe-server-jetty, version: 1.9.0, [...]`
+    * Verify the DSF BPE server started without errors
+    * Verify your install with a ping/pong test  

From 6074ad4e13b056f18ab29ff9d7cee01daa20d405 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon-tobias.schweizer@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 15:34:46 +0200
Subject: [PATCH 2/6] changed permission section to allow new fhir proxy
 without root privs

---
 docs/src/operations/v1.9.0/install.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/src/operations/v1.9.0/install.md b/docs/src/operations/v1.9.0/install.md
index ee4ec1a31..b1a971349 100644
--- a/docs/src/operations/v1.9.0/install.md
+++ b/docs/src/operations/v1.9.0/install.md
@@ -94,12 +94,12 @@ Here is a quick overview of the expected network setup.
 
 1. Add certificates and keys
     * Add the server certificate (certificate _A_), the corresponding private-key and the certificate chain (one file with all intermediate certificates, excluding the root CA) to **/opt/fhir/secrets/**
-        * ssl_certificate_file.pem (chmod: 440, chown: fhir:docker)
-        * ssl_certificate_key_file.pem (chmod: 440, chown: fhir:docker)
-        * ssl_certificate_chain_file.pem  (chmod: 440, chown: fhir:docker)
+        * ssl_certificate_file.pem (chmod: 440, chown: root:4101, 4101 is the user of the fhir proxy)
+        * ssl_certificate_key_file.pem (chmod: 440, chown: root:4101)
+        * ssl_certificate_chain_file.pem  (chmod: 444, chown: root:fhir)
     * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/fhir/secrets/**
-        * client_certificate.pem (chmod: 440, chown: fhir:docker)
-        * client_certificate_private_key.pem (chmod: 440, chown: fhir:docker)
+        * client_certificate.pem (chmod: 440, chown: root:fhir)
+        * client_certificate_private_key.pem (chmod: 440, chown: root:fhir)
     * If the private key is encrypted, add a password file with the password as the only content to **/opt/fhir/secrets/client_certificate_private_key.pem.password**
     * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
         ```
@@ -112,12 +112,12 @@ Here is a quick overview of the expected network setup.
         ```
 
     ::: tip How to chmod / chown
-    For the example *ssl_certificate_file.pem (chmod: 440, chown: fhir:docker)* you must:
+    For the example *ssl_certificate_file.pem (chmod: 440, chown: root:4101)* you must:
 
     1. Set the file content as requested
     2. Change the file permissions to 440 (allow read access to the owner of the file and the group the file belongs to, deny write access to everybody and deny read for other users):
     `chmod 440 /opt/fhir/secrets/ssl_certificate_file.pem`
-    3. Change the owner of the file to the user `fhir` and the group the file belongs to to `docker`:
+    3. Change the owner of the file to the user root and the group the file belongs to to the id 4101:
     `chown fhir:docker /opt/fhir/secrets/ssl_certificate_file.pem`
 
     :::
@@ -172,8 +172,8 @@ Here is a quick overview of the expected network setup.
 
 1. Add certificates and keys
     * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/bpe/secrets/**
-        * client_certificate.pem (chmod: 440 chown: bpe:docker)
-        * client_certificate_private_key.pem (chmod: 440 chown: bpe:docker)
+        * client_certificate.pem (chmod: 440 chown: root:bpe)
+        * client_certificate_private_key.pem (chmod: 440 chown: root:bpe)
     * If the private key is encrypted, add a password file with the password as the only content to **/opt/bpe/secrets/client_certificate_private_key.pem.password**
     * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
         ```

From c02adc51d035436589dc670e667c0b056d1865b7 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon-tobias.schweizer@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 15:53:40 +0200
Subject: [PATCH 3/6] add crt.sh urls and updated not after dates

---
 docs/src/operations/v1.9.0/root-certificates.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/src/operations/v1.9.0/root-certificates.md b/docs/src/operations/v1.9.0/root-certificates.md
index be531960c..7218cb1d0 100644
--- a/docs/src/operations/v1.9.0/root-certificates.md
+++ b/docs/src/operations/v1.9.0/root-certificates.md
@@ -180,19 +180,19 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
 ### Other CAs
 
 * Root CA: **HARICA Client ECC Root CA 2021**
-  Info: https://crt.sh/?caid=202188
-  X509 Certificate: https://crt.sh/?id=1199354
-  Not after: Jan 18 23:59:59 2038 GMT
+  Info: https://crt.sh/?caid=202189
+  X509 Certificate: https://crt.sh/?id=4147052292
+  Not after: Feb 13 11:03:33 2045 GMT
   * Issuing CA: **HARICA Client Authentication ECC** [client certificates only]
-    Info: https://crt.sh/?caid=207670
+    Info: https://crt.sh/?caid=207671
     X509 Certificate: https://crt.sh/?id=4442848518
     Not after: Mar 15 09:17:38 2036 GMT
 * Root CA: **HHARICA Client RSA Root CA 2021**
-  Info: https://crt.sh/?caid=207670
-  X509 Certificate: https://crt.sh/?id=1199354
-  Not after: Jan 18 23:59:59 2038 GMT
+  Info: https://crt.sh/?caid=202188
+  X509 Certificate: https://crt.sh/?id=4147049674
+  Not after: Feb 13 10:58:45 2045 GMT
   * Issuing CA: **HARICA Client Authentication RSA** [client certificates only]
-    Info: https://crt.sh/?caid=207671
+    Info: https://crt.sh/?caid=207670
     X509 Certificate: https://crt.sh/?id=4442848531
     Not after: Mar 15 09:19:36 2036 GMT
 

From c8bc9c7fc16af3bbc30c806f1d34a49aad73e50a Mon Sep 17 00:00:00 2001
From: Hauke Hund <hauke.hund@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 16:33:21 +0200
Subject: [PATCH 4/6] certificate and tar.gz files for 1.9.0

---
 .../download/1.9.0/client_cert_ca_chains.pem  | 975 ++++++++++++++++++
 .../1.9.0/client_cert_issuing_cas.pem         | 715 +++++++++++++
 .../download/1.9.0/server_cert_root_cas.pem   | 152 +++
 .../public/download/dsf_bpe_1_9_0.tar.gz      | Bin 0 -> 1654 bytes
 .../public/download/dsf_fhir_1_9_0.tar.gz     | Bin 0 -> 2050 bytes
 5 files changed, 1842 insertions(+)
 create mode 100644 docs/src/.vuepress/public/download/1.9.0/client_cert_ca_chains.pem
 create mode 100644 docs/src/.vuepress/public/download/1.9.0/client_cert_issuing_cas.pem
 create mode 100644 docs/src/.vuepress/public/download/1.9.0/server_cert_root_cas.pem
 create mode 100644 docs/src/.vuepress/public/download/dsf_bpe_1_9_0.tar.gz
 create mode 100644 docs/src/.vuepress/public/download/dsf_fhir_1_9_0.tar.gz

diff --git a/docs/src/.vuepress/public/download/1.9.0/client_cert_ca_chains.pem b/docs/src/.vuepress/public/download/1.9.0/client_cert_ca_chains.pem
new file mode 100644
index 000000000..5868e931f
--- /dev/null
+++ b/docs/src/.vuepress/public/download/1.9.0/client_cert_ca_chains.pem
@@ -0,0 +1,975 @@
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Limited Basic Root CA 1 2019
+-----BEGIN CERTIFICATE-----
+MIIETjCCAzagAwIBAgIDD+UpMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTArBgNVBAMMJEQtVFJVU1QgTGltaXRl
+ZCBCYXNpYyBSb290IENBIDEgMjAxOTAeFw0xOTA2MTkwODE1NTFaFw0zNDA2MTkw
+ODE1NTFaMFMxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTAr
+BgNVBAMMJEQtVFJVU1QgTGltaXRlZCBCYXNpYyBSb290IENBIDEgMjAxOTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN81X083S74JbInkPxAL5tQg5SOF
+ttjX/rviq7s4HG4zBvUF4KgwqXysC+mA5nRwEkFXnI6ZQTB8M0DI6vSBnpAOghZN
+QgXFu07WsQWOTTlywst138t1t6YU8QPUVb1UbxiVu4WtycFaq98Rbfcsu6YIoENB
+gjeXZRJPzxPhIf1oLtSkgBihX/7eVxZdVRGzAtuMZP9TqI3bQpZ1yY/7Od54ra4Q
+SPy2La4VOqUSAyS2yRreugLL8aqSt7dh+YsDSgtHEn2HgrunptIFN45kVM4PEOHx
+/gi5lpZ+pKRmLuoXMmvBUwa/HlySSV7bVv6xfHFZjjs3YjXvZh+8StvEY9cCAwEA
+AaOCASkwggElMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFONo4hcITMmOHGJE
+DKkpkQJiC6OTMA4GA1UdDwEB/wQEAwIBBjCB4gYDVR0fBIHaMIHXMIGJoIGGoIGD
+hoGAbGRhcDovL2RpcmVjdG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwTGlt
+aXRlZCUyMEJhc2ljJTIwUm9vdCUyMENBJTIwMSUyMDIwMTksTz1ELVRydXN0JTIw
+R21iSCxDPURFP2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3QwSaBHoEWGQ2h0dHA6
+Ly9jcmwuZC10cnVzdC5uZXQvY3JsL2QtdHJ1c3RfbGltaXRlZF9iYXNpY19yb290
+X2NhXzFfMjAxOS5jcmwwDQYJKoZIhvcNAQELBQADggEBALzcGA/9SQuKkkdFSUT+
+8mU4RTV7PWB3DpmqNt9kcB00oYqohwCyRXJygjcN/lNHi4828us0H7DtGdl2CQp4
+WbTcWtdBbjwaU0XH/FXdtxgo9BzM/VVfFUZUai8CtlDn6fJjLhVmPWQtX1EByEe/
+ulEwyxHipVD5pI1dY+ctdqXtWZ+HsudvZC5a/CFS/hElq2yTlS2SuKeTovGGM8GB
+Y+XI16N3w/ItEjnQJJNPxPRfNjQdvhicaujXEOErHP8UGWgCJ+aDGboSq2dVbczE
+m4DnKPXpWydVWZLI9d6a1RUWwmB9GD1/JKvxPThbwkHnWixlLkSKKr7uMaiWGaCX
+oVQ=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Limited Basic CA 1-2 2019
+-----BEGIN CERTIFICATE-----
+MIIFuTCCBKGgAwIBAgIDD+VKMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTArBgNVBAMMJEQtVFJVU1QgTGltaXRl
+ZCBCYXNpYyBSb290IENBIDEgMjAxOTAeFw0xOTA4MjAxMjMyMjJaFw0zNDA2MTkw
+ODE1NTFaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAo
+BgNVBAMMIUQtVFJVU1QgTGltaXRlZCBCYXNpYyBDQSAxLTIgMjAxOTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANxlUGXW81Y2JG/BtEO5dlbELYat4Zx9
+5b4RUux5scPTZX3wrEW+PK4EwQCvV8FH0SoDatOJcFiGduX2r29c0aFFyVKu6xHF
+DApYNYV99+z5TiqXFdVkOUti56r10KsaO3FkcgAt4wDFgYd0dDseYo2SQqpKeqFR
+QMVQVdLCt66yU8qbiaZ/sL2pcNsJMD/DkEV/axpTwzzk6H+kGUIJ+jpKpYw2pMFF
+wYlqW91ICfLtTHvJqFb3DZ7yFNSiXgYBYH9R142vjflh1vg+GuqORiTLi/AhIjlb
+3XUAFIZzJ77+PLQprYlRHGGBMaJ+3VbI+hWPTHpwVt6wHNVcfHUnA3kCAwEAAaOC
+ApcwggKTMB8GA1UdIwQYMBaAFONo4hcITMmOHGJEDKkpkQJiC6OTMIIBMgYIKwYB
+BQUHAQEEggEkMIIBIDBABggrBgEFBQcwAYY0aHR0cDovL2xpbWl0ZWQtYmFzaWMt
+cm9vdC1jYS0xLTIwMTkub2NzcC5kLXRydXN0Lm5ldDBTBggrBgEFBQcwAoZHaHR0
+cDovL3d3dy5kLXRydXN0Lm5ldC9jZ2ktYmluL0QtVFJVU1RfTGltaXRlZF9CYXNp
+Y19Sb290X0NBXzFfMjAxOS5jcnQwgYYGCCsGAQUFBzAChnpsZGFwOi8vZGlyZWN0
+b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBS
+b290JTIwQ0ElMjAxJTIwMjAxOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y0FDZXJ0
+aWZpY2F0ZT9iYXNlPzAYBgNVHSAEETAPMA0GCysGAQQBpTQCg3QBMIHcBgNVHR8E
+gdQwgdEwgc6ggcuggciGgYBsZGFwOi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NO
+PUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBSb290JTIwQ0ElMjAxJTIwMjAx
+OSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlz
+dIZDaHR0cDovL2NybC5kLXRydXN0Lm5ldC9jcmwvZC10cnVzdF9saW1pdGVkX2Jh
+c2ljX3Jvb3RfY2FfMV8yMDE5LmNybDAdBgNVHQ4EFgQU0A0+3Aiv40EIZuDc8vqZ
+ai3fGLkwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwDQYJKoZI
+hvcNAQELBQADggEBAH8NXqPrIcKiZC51vfxvajB1HhFnRFFN/G3ZU4yR7XI+uGec
+DjR8tOHdFYFmZG4qbDl70ZuRG4bs6H8cvfWyo1NmWZqjAkr6o1kIRTnFwn4JsssJ
+7HR2RmJ4ar0C9miIk9sTNLwKy1/kBvCFqssdKdQwBSi85KRxPFYvv+vnMCvSL0Ob
++65q6V7QzvCk7ojiSrcfvHS8QnHJE9ReFRKD4KXAd7+OcZc1K3Mf+uNNHt3CP3ie
+DN9K90sI81IWucEeN2NYvw/tJNDH5L4Ah3cn8XzxQVzOfAnn1isf2pci1IEj5f3Y
+9JA7LYLLeH7n4+E5JWRiIUAhqNhQTchmwKLdR+E=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Limited Basic CA 1-3 2019
+-----BEGIN CERTIFICATE-----
+MIIFvzCCBKegAwIBAgIDD+UsMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTArBgNVBAMMJEQtVFJVU1QgTGltaXRl
+ZCBCYXNpYyBSb290IENBIDEgMjAxOTAeFw0xOTA2MjAxMTQ2NDlaFw0zNDA2MTkw
+ODE1NTFaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAo
+BgNVBAMMIUQtVFJVU1QgTGltaXRlZCBCYXNpYyBDQSAxLTMgMjAxOTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL7RBVVVynr23OCuKpkrzJK87yspTQVh
+vJRTtHS7zXG0jzpNLUV8D6Qjd3nOVs2VnW+rpfgQmFeic3E8G5jJmGv18O6LOGJS
+CXbiF2eonBQ0oTF97oVukj/8SRYWEBjeBjB//U3gwdt14qATw1zk3B8K/u0zxtQ0
+1xMTL5ckilQ7/+x+RVCGanvx/FscQ1He0fkhfLgqaDJimWu7b0phwZqyyI1GEjEN
+9FLWJxh4OeIzupAT4b1j5oaXHCY4BGT5zk6PbOYC7U2Jnt4zKU+pJVIJ+EhYOJS5
+tQM7YFG/eECAHcBtgdUIDgBZqrrx+k14aSQcW701sGqQT7cKcLen+yMCAwEAAaOC
+Ap0wggKZMB8GA1UdIwQYMBaAFONo4hcITMmOHGJEDKkpkQJiC6OTMIIBMgYIKwYB
+BQUHAQEEggEkMIIBIDBABggrBgEFBQcwAYY0aHR0cDovL2xpbWl0ZWQtYmFzaWMt
+cm9vdC1jYS0xLTIwMTkub2NzcC5kLXRydXN0Lm5ldDBTBggrBgEFBQcwAoZHaHR0
+cDovL3d3dy5kLXRydXN0Lm5ldC9jZ2ktYmluL0QtVFJVU1RfTGltaXRlZF9CYXNp
+Y19Sb290X0NBXzFfMjAxOS5jcnQwgYYGCCsGAQUFBzAChnpsZGFwOi8vZGlyZWN0
+b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBS
+b290JTIwQ0ElMjAxJTIwMjAxOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y0FDZXJ0
+aWZpY2F0ZT9iYXNlPzAYBgNVHSAEETAPMA0GCysGAQQBpTQCg3QBMIHiBgNVHR8E
+gdowgdcwgYmggYaggYOGgYBsZGFwOi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NO
+PUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBSb290JTIwQ0ElMjAxJTIwMjAx
+OSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlz
+dDBJoEegRYZDaHR0cDovL2NybC5kLXRydXN0Lm5ldC9jcmwvZC10cnVzdF9saW1p
+dGVkX2Jhc2ljX3Jvb3RfY2FfMV8yMDE5LmNybDAdBgNVHQ4EFgQUZeInnG91+3Vn
+CLczeuOdjnssKIgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+DQYJKoZIhvcNAQELBQADggEBAJLvDm1ZuBMhO2qR2R4H/GDDYETRBNqvtvWHRvBw
+vryhtDm7tovqDg2v7x+vcSqZApFVW+zs+OvzNRXtyyIlkqxP5CL0okpHqqmKaaHn
+tH8D93pV/p7xE39gFE6NNceSx6DHBxuOcOEha8zA8ixH+j+fzLX6SEOAhBIfCgDb
+qg9Xtxi7+uupq4koQcXrDNTRHxuoNxAHnwYtgapwKwyBwMMaLliqxVyDcwN6aJEQ
+tVoyOibUnUXej4bXh8FPCSU7m98nLY9aKk1O30jsgSiLxuVKBav8JaDPY1i69CSd
+vn2adNlHjbl/57GVQ4VoTDzlmhRQGR9TIRPYA5F6VdeI4ak=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Root Class 3 CA 2 2009
+-----BEGIN CERTIFICATE-----
+MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NTha
+ME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMM
+HkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOADER03
+UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42
+tSHKXzlABF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9R
+ySPocq60vFYJfxLLHLGvKZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsM
+lFqVlNpQmvH/pStmMaTJOKDfHR+4CS7zp+hnUquVH+BGPtikw8paxTGA6Eian5Rp
+/hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUCAwEAAaOCARowggEWMA8G
+A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ4PGEMA4G
+A1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUy
+MENBJTIwMiUyMDIwMDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRl
+cmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js
+L2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL
+BQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni
+acfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0
+o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4K
+zCUqNQT4YJEVdT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8
+PIWmawomDeCTmGCufsYkl4phX5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3Y
+Johw1+qRzT65ysCQblrGXnRl11z+o+I=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST SSL Class 3 CA 1 2009
+-----BEGIN CERTIFICATE-----
+MIIFMjCCBBqgAwIBAgIDCZBjMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMTIxMjQ2NTVaFw0yOTExMDUwODM1NTha
+MEwxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJjAkBgNVBAMM
+HUQtVFJVU1QgU1NMIENsYXNzIDMgQ0EgMSAyMDA5MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAoal0SyLSijE0JkuhHJmOCbmQznyxuSY7DaEwhUsdUpI+
+2llkDLz6s9BWQe1zCVXDhrt3qz5U5H4h6jxm5Ec+ZbFiU3Gv2yxpI5cRPrqj9mJU
+1CGgy1+29khuUnoopzSq66HPuGZGh06I7bJkXTQ7AQ92z1MdL2wATj1UWdNid3sQ
+NiWIm+69nURHY6tmCNenNcG6aV4qjHMUPsjpCRabNY9nUO12rsmiDW2mbAC3gcxQ
+lqLgLYur9HvB8cW0xu2JZ/B3PXmNphVuWskp3Y1u0SvIYzuEsE7lWDbBmtWZtabB
+hzThkDQvd+3keQ1sU/beq1NeXfgKzQ5G+4Ql2PUY/wIDAQABo4ICGjCCAhYwHwYD
+VR0jBBgwFoAU/doUxJ8w3iG9HkI5/KtjI0ng8YQwRAYIKwYBBQUHAQEEODA2MDQG
+CCsGAQUFBzABhihodHRwOi8vcm9vdC1jMy1jYTItMjAwOS5vY3NwLmQtdHJ1c3Qu
+bmV0MF8GA1UdIARYMFYwVAYEVR0gADBMMEoGCCsGAQUFBwIBFj5odHRwOi8vd3d3
+LmQtdHJ1c3QubmV0L2ludGVybmV0L2ZpbGVzL0QtVFJVU1RfUm9vdF9QS0lfQ1BT
+LnBkZjAzBgNVHREELDAqgRBpbmZvQGQtdHJ1c3QubmV0hhZodHRwOi8vd3d3LmQt
+dHJ1c3QubmV0MIHTBgNVHR8EgcswgcgwgYCgfqB8hnpsZGFwOi8vZGlyZWN0b3J5
+LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xhc3MlMjAzJTIwQ0El
+MjAyJTIwMjAwOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZv
+Y2F0aW9ubGlzdDBDoEGgP4Y9aHR0cDovL3d3dy5kLXRydXN0Lm5ldC9jcmwvZC10
+cnVzdF9yb290X2NsYXNzXzNfY2FfMl8yMDA5LmNybDAdBgNVHQ4EFgQUUBkylJrE
+tQRNVtDAgyHVNVWwsXowDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBABM5QRHX/yInsmZLWVlvmWmKb3c4IB3hAIVR
+sAGhkvQJ/RD1GZjZUBBYMWkD1P37fTQxlqTOe3NecVvElkYZuCq7HSM6o7awzb3m
+yLn1kN+hDCsxX0EYbVSNjEjkW3QEkqJH9owH4qeMDxf7tfXB7BVKO+rarYPa2PR8
+Wz2KhjFDmAeFg2J89YcpeJJEEJXoweAkgJEEwwEIfJ2yLjYo78RD0Rvij/+zkfj9
++dSvTiZTuqicyo37qNoYHgchuqXnKodhWkW89oo2NKhfeNHHbqvXEJmx0PbI6YyQ
+50GnYECZRHNKhgbPEtNy/QetU53aWlTlvu4NIwLW5XVsrxlQ2Zw=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client ECC Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIICWjCCAeGgAwIBAgIQMWjZ2OFiVx7SGUSI5hB98DAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTIxMDIxOTExMDMzNFoXDTQ1MDIxMzExMDMzM1owbzEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExJzAlBgNVBAMMHkhBUklDQSBDbGllbnQgRUND
+IFJvb3QgQ0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABAcYrZWWlNBcD4L3
+KkD6AsnJPTamowRqwW2VAYhgElRsXKIrbhM6iJUMHCaGNkqJGbcY3jvoqFAfyt9b
+v0mAFdvjMOEdWscqigEH/m0sNO8oKJe8wflXhpWLNc+eWtFolaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUUgjSvjKBJf31GpfsTl8au1PNkK0wDgYDVR0P
+AQH/BAQDAgGGMAoGCCqGSM49BAMDA2cAMGQCMEwxRUZPqOa+w3eyGhhLLYh7WOar
+lGtEA7AX/9+Cc0RRLP2THQZ7FNKJ7EAM7yEBLgIwL8kuWmwsHdmV4J6wuVxSfPb4
+OMou8dQd8qJJopX4wVheT/5zCu8xsKsjWBOMi947
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT S/MIME ECC 1
+-----BEGIN CERTIFICATE-----
+MIIDdjCCAvugAwIBAgIQDJz22V5XPKzFUHJkSyvftjAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTE0MFoXDTM5MTIzMTExMTEzOVowYzEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGzAZBgNVBAMMEkdFQU5UIFMvTUlNRSBFQ0Mg
+MTB2MBAGByqGSM49AgEGBSuBBAAiA2IABHHzZBx8BXADofSXSxbumNUgOW7oPUFD
+MTBf97xIFnUvxGf449zwH17IBxs6EnsIRSZ80+3fMPGm7PcW4bogQmpStkHsbhl/
+yc+R0YudJcnXnC+HuGwkKlk9hoXX+gtBJ6OCAWYwggFiMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHwYDVR0jBBgwFoAUUgjSvjKBJf31GpfsTl8au1PNkK0wUAYIKwYBBQUH
+AQEERDBCMEAGCCsGAQUFBzAChjRodHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0Et
+Q2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8G
+CCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRzL0NQUzAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwRQYDVR0fBD4wPDA6oDigNoY0
+aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1Sb290LTIwMjEtRUND
+LmNybDAdBgNVHQ4EFgQUccTTotYuiaWImnarwbliZz8kZeswDgYDVR0PAQH/BAQD
+AgGGMAoGCCqGSM49BAMDA2kAMGYCMQDbRE4Sf4j5cdd9PlC4xjnNvJxfsDX5ouYb
+3ffJ6ukmEjI7RnHm6xJ2V++40nWYVfgCMQDfXaawZpZymK4CBIMHxoViSYBHw/Mm
+JOG3trrP+Q4Kb0AfJb/S2ojAD+EAKiiB5hM=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client Authentication ECC
+-----BEGIN CERTIFICATE-----
+MIIDgTCCAwagAwIBAgIQE8HgrQAH0BtzfX3LWvJSfzAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MTczOVoXDTM2MDMxNTA5MTczOFowcTEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExKTAnBgNVBAMMIEhBUklDQSBDbGllbnQgQXV0
+aGVudGljYXRpb24gRUNDMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqEqssLtH6Kkn
+Sa4ms1u/YGAi0JW3Py7nkN33soahf1Vf8p4L3eNEaCV3/sZXeviOVEyg2O+F0PWz
+gLFZdv4U//ZgLA0qjFDCtYVnB0R5y/953IpMTdgKR+cjrpveu10Lo4IBYzCCAV8w
+EgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBRSCNK+MoEl/fUal+xOXxq7
+U82QrTBXBggrBgEFBQcBAQRLMEkwRwYIKwYBBQUHMAKGO2h0dHA6Ly9yZXBvLmhh
+cmljYS5nci9jZXJ0cy9IQVJJQ0EtQ2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQG
+A1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJp
+Y2EuZ3IvZG9jdW1lbnRzL0NQUzATBgNVHSUEDDAKBggrBgEFBQcDAjBFBgNVHR8E
+PjA8MDqgOKA2hjRodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtQ2xpZW50LVJv
+b3QtMjAyMS1FQ0MuY3JsMB0GA1UdDgQWBBQqHWyH7pXv/Mkv8RzX+Dw52v+X3jAO
+BgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAIE3QcG3SB1Dgj0a8gE7
+ZSKgA7KfGlt+/ajMitsDqHvg7RZCHFmc05ggxGbzXcu2CwIxAI0VJVUxKQbaLnm1
+u8MvlJDaH1hHCujJ3PU9lYRPg5CaOwkgvV+H5OzQhvkn4flaDw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA S/MIME ECC
+-----BEGIN CERTIFICATE-----
+MIIDejCCAwGgAwIBAgIQR+QjpXN0lyzfL5Q4f0wP1DAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzY1OFoXDTM2MDMxNTA5MzY1N1owYjEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBTL01JTUUgRUND
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEbidoUrQSTETj3yKvZfP8hz4cjWJYLu2S
+BQVAorbEw3a9bbiaYGSreAJJamuTKI/8EiGjOZ3gAxlWZirpKofebc+lqDa87zjh
+E88mIhT+WYBu4S/0+lb0r59quKF8Y0pHo4IBbTCCAWkwEgYDVR0TAQH/BAgwBgEB
+/wIBADAfBgNVHSMEGDAWgBRSCNK+MoEl/fUal+xOXxq7U82QrTBXBggrBgEFBQcB
+AQRLMEkwRwYIKwYBBQUHMAKGO2h0dHA6Ly9yZXBvLmhhcmljYS5nci9jZXJ0cy9I
+QVJJQ0EtQ2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0g
+ADAxMC8GCCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRz
+L0NQUzAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwRQYDVR0fBD4wPDA6
+oDigNoY0aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1Sb290LTIw
+MjEtRUNDLmNybDAdBgNVHQ4EFgQUTq8v2Rh752P2xakBhmVdLF4791YwDgYDVR0P
+AQH/BAQDAgGGMAoGCCqGSM49BAMDA2cAMGQCMEayoDfZOkZgvT13XbjuSpKc2m/C
+cEQqYDwGIyXBhZqyMoMyDcthQsiEwBW3lHT5IQIwIT2kzroVW2iWhRF3vaTEAo3m
++AosNW84YGle0MMG2SDIoQEJiqhjRfQwZHHeBzCE
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client RSA Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIIFqjCCA5KgAwIBAgIQVVL4HtsbJCyeu5YYzQIoPjANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTIxMDIxOTEwNTg0NloXDTQ1MDIxMzEwNTg0NVow
+bzELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExJzAlBgNVBAMMHkhBUklDQSBDbGllbnQg
+UlNBIFJvb3QgQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+AIHbV0KQLHQ19Pi4dBlNqwlad0WBc2KwNZ/40LczAIcTtparDlQSMAe8m7dI19EZ
+g66O2KnxqQCEsIxenugMj1Rpv/bUCE8mcP4YQWMaszKLQPgHq1cx8MYWdmeatN0v
+8tFrxdCShJFxbg8uY+kfU6TdUhPMCYMpgQzFU3VEsQ5nUxjQwx+IS5+UJLQpvLvo
+Tv1v0hUdSdyNcPIRGiBRVRG6iG/E91B51qox4oQ9XjLIdypQceULL+m26u+rCjM5
+Dv2PpWdDgo6YaQkJG0DNOGdH6snsl3ES3iT1cjzR90NMJveQsonpRUtVPTEFekHi
+lbpDwBfFtoU9GY1kcPNbrM2f0yl1h0uVZ2qm+NHdvJCGiUMpqTdb9V2wJlpTQnaQ
+K8+eVmwrVM9cmmXfW4tIYDh8+8ULz3YEYwIzKn31g2fn+sZD/SsP1CYvd6QywSTq
+ZJ2/szhxMUTyR7iiZkGh+5t7vMdGanW/WqKM6GpEwbiWtcAyCC17dDVzssrG/q8R
+chj258jCz6Uq6nvWWeh8oLJqQAlpDqWW29EAufGIbjbwiLKd8VLyw3y/MIk8Cmn5
+IqRl4ZvgdMaxhZeWLK6Uj1CmORIfvkfygXjTdTaefVogl+JSrpmfxnybZvP+2M/u
+vZcGHS2F3D42U5Z7ILroyOGtlmI+EXyzAISep0xxq0o3AgMBAAGjQjBAMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFKDWBz1eJPd7oEQuJFINGaorBJGnMA4GA1Ud
+DwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEADUf5CWYxUux57sKo8mg+7ZZF
+yzqmmGM/6itNTgPQHILhy9Pl1qtbZyi8nf4MmQqAVafOGyNhDbBX8P7gyr7mkNuD
+LL6DjvR5tv7QDUKnWB9p6oH1BaX+RmjrbHjJ4Orn5t4xxdLVLIJjKJ1dqBp+iObn
+K/Es1dAFntwtvTdm1ASip62/OsKoO63/jZ0z4LmahKGHH3b0gnTXDvkwSD5biD6q
+XGvWLwzojnPCGJGDObZmWtAfYCddTeP2Og1mUJx4e6vzExCuDy+r6GSzGCCdRjVk
+JXPqmxBcWDWJsUZIp/Ss1B2eW8yppRoTTyRQqtkbbbFA+53dWHTEwm8UcuzbNZ+4
+VHVFw6bIGig1Oq5l8qmYzq9byTiMMTt/zNyW/eJb1tBZ9Ha6C8tPgxDHQNAdYOkq
+5UhYdwxFab4ZcQQk4uMkH0rIwT6Z9ZaYOEgloRWwG9fihBhb9nE1mmh7QMwYXAwk
+ndSV9ZmqRuqurL/0FBkk6Izs4/W8BmiKKgwFXwqXdafcfsD913oY3zDROEsfsJhw
+v8x8c/BuxDGlpJcdrL/ObCFKvicjZ/MGVoEKkY624QMFMyzaNAhNTlAjrR+lxdR6
+/uoJ7KcoYItGfLXqm91P+edrFcaIz0Pb5SfcBFZub0YV8VYt6FwMc8MjgTggy8kM
+ac8sqzuEYDMZUv1pFDM=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT S/MIME RSA 1
+-----BEGIN CERTIFICATE-----
+MIIGRDCCBCygAwIBAgIQFfmubKqNLtTTb3h/Htx7ATANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTMwOFoXDTM5MTIzMTExMTMwN1ow
+YzELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExGzAZBgNVBAMMEkdFQU5UIFMvTUlNRSBS
+U0EgMTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKu4bq/+byKjHo25
+Xz32YBmO+Wrkmc+UmfcdXSCI7yawwU9JSMEHAAKAASaJpLr9JAyt+tlB/rn/Sazn
+SwY4ipBIffR0D5k/ndfiI553dWgI4i/tkOGlNej/7JyE2CS9kTlOOs6pg5HaDpwq
+jAhCkje+IByg5gKWH6lzvMJo5jQOtsGB2q6e5cYKwa9LJOAcR8iquds9LFssbHSM
+uVdSuTjpAjcGLqWfW++C0YXpWD+UonjQ6lNEuiKUDmrFc+SEtLw56lYtp4uuxm4L
+W/HQSsx+oGwMBqaR6HhBQ3LydONjsbcbegRqJZFJoLsnwIHorEag44UIvjXzYJAx
+/NTiwVdHldO7cEvWscDbyQLR9koBoliq2HrgYFQs7NQxU+7MLNSh8i6znWVNISUE
+g36M//I8BZl4VqD70ELlhKKN7rx+i7BwKOd2gxdWgFJhkPyQu9o+82R9epXiRblo
+/rdkyv+2BFR7VpbgPUzncdi8/0h4dP/qQFYnA+Df0FFj7gYczwIDAQABo4IBZjCC
+AWIwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBSg1gc9XiT3e6BELiRS
+DRmqKwSRpzBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly9jcnQu
+aGFyaWNhLmdyL0hBUklDQS1DbGllbnQtUm9vdC0yMDIxLVJTQS5jZXIwRAYDVR0g
+BD0wOzA5BgRVHSAAMDEwLwYIKwYBBQUHAgEWI2h0dHA6Ly9yZXBvLmhhcmljYS5n
+ci9kb2N1bWVudHMvQ1BTMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBF
+BgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtQ2xp
+ZW50LVJvb3QtMjAyMS1SU0EuY3JsMB0GA1UdDgQWBBTrsi87/a4CzCpEBl0lzR0S
+ImiwRzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBADveuEX23Dwr
+kygKtsF7DmcTGmi8SE20jmJLe0TMT8Nws1NqppE0ACym1agtY1IjUFm5MWabG/Ic
+vRTh8sB9cRZgDQMqZLNCLofqL4aj/dKBXH4bwH2MVdjNHBoGvZkyhRz/kBE+x1va
+WXclhWQMOX5nVvRMfiEJiYotMP7KM88IaVZ9DkGJJEVftsnUWuvCWUtjagD6XWlq
+LHjNl+LufiZ/h9lDvaWqG1/obfdStgofMc30RL+ES6gYKRwZpCA1coFzXV7Cnwx8
+toTl8bReqCNXexKzxlqAcRXPOmlKkJQuqRI297oNuMPnoNZCY+yLnxyd4kZuu0Xc
+OTNTpVjM8bvg8ACqhSYanrNDi/zTiTk7gwm9GyH1X45fFNGNEFgpIaApjT2UELuk
+DOmP18ZwC4EQeHawPJIqffMEmUJm6qbRPKGnNmcyygh4iZU3QbkRLLp3Z6QV3WoT
+Eqyf5mL9qTGS6WJG65L8oaKw1Xh/bdGuVIDyBahpfP2c2pCd0UH6+x73Rrq9GFlO
+ijVr2OQSvKhzETNG917SvcURCBhMnIQFUXqHQyIY60eH1po6WtNOq/1K5kpOG6Sq
+1RVc02LEit48uK4tRMVUKekSOjruGXW38DmAriPcMHjI6VQbqjc0Sq1VPz76ee4F
+M5uLviSUZHYqDDqMWa8LFImK9iiKI8E3
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client Authentication RSA
+-----BEGIN CERTIFICATE-----
+MIIGzzCCBLegAwIBAgIQZvugWpzzpAYFBJWnGSeXMjANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MTkzN1oXDTM2MDMxNTA5MTkzNlow
+cTELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExKTAnBgNVBAMMIEhBUklDQSBDbGllbnQg
+QXV0aGVudGljYXRpb24gUlNBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEAtdFg0VN118Izv7l4joORHFO+qJQ09hwRqNdfZW9g9SzSjXcAS4mz4+BlOYVC
+PrdKoxs+1iVnoz6Hl1w2wf9xjTI9xQ6O6miM06CbST2rYCo58y0sV6yAs4/ptMHf
+7smx1/ORdAu3AVYbqzYqoCj5gVehlIivyZKpzko7/45N9eWUs24ah3G4nMiVxTOc
+RNYqw3/bfc+WvatbB6qNQRRJfebeDNQ8Hqen3DBPA9qsOf4Nfi4XDVkGgVPJZqfZ
+VTE8fmZIZRq+Ujcp+JRc4V2dFRqvn9xKPA3d+nbbic+JQs24+ZqYiWrcNdYNE64d
+6GlRhU3chNWFCI4RLNa7VpqoBZkFqlx2S5l83VO/G9DELikFa9nvc2BR+2h/pObG
+WmWIqgQf0esW5nzy4+inufbZ4DLwQ9Bao0TMqLsi6ywdyxreFDvfzVuVxm6NWQoO
+fi6uxdgwFEUp7FJ79owErc+RjNUrMzmhW1nlPtoCYaIy/7bW6VAqJ89ZftvRCCdV
+5QeMOYlqdle65NjcaoXh5sC7g8pTA0VlUk2VHaHWPg13HLGQNyo0yWjtRzE6rIpl
+ede96vg/bjB2edSYFUkrEZn5R71C1XhPQ945npiZ6yNv2qMlqasKuQQVEKkpi4bz
+ntA0C8JUWiobnD91o1NXARIlanApakhk21b8ba0O+WsjgyECAwEAAaOCAWMwggFf
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0jBBgwFoAUoNYHPV4k93ugRC4kUg0Z
+qisEkacwVwYIKwYBBQUHAQEESzBJMEcGCCsGAQUFBzAChjtodHRwOi8vcmVwby5o
+YXJpY2EuZ3IvY2VydHMvSEFSSUNBLUNsaWVudC1Sb290LTIwMjEtUlNBLmNlcjBE
+BgNVHSAEPTA7MDkGBFUdIAAwMTAvBggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFy
+aWNhLmdyL2RvY3VtZW50cy9DUFMwEwYDVR0lBAwwCgYIKwYBBQUHAwIwRQYDVR0f
+BD4wPDA6oDigNoY0aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1S
+b290LTIwMjEtUlNBLmNybDAdBgNVHQ4EFgQU8qBdeyXizDQ4cBVNxXMsNAswGCYw
+DgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAr9ecjniPGgn1Le9OW
+sgHWRAEAqAMnFEH7S7zlL6nzEN10kjkxWE4P6776V1rYeRWpSNbB71u2zVqAPcKD
+aGiMP0I9oWlmtWxq2/JjEcf0UgRT+e9e2CleQMmTLbai1hpx08tZj/XMd6X5t78M
+w4WJDfRUnfIjHcWTxu1Nkkj64rfGXI4hzjcLD7wFq6ZXVlhTe9sp5sDCfrVZHCMh
+cHCu9odUF7IXPpPzJrKfB/uidE9mLt+V7DXepDJ2VCySL2JAP3yo4LdjrDEZGFZ7
+YZnHzjdeeq/dn+/DJ7BUVDVIMUQZT3MXoI5yb1PZ9JZrQ4x8jZbP3EPrbQK0RPyU
+4hYjxT52BWjMlP9JXtZw4aVMaOZb9QklKzJHTtWsBrer9pi1seDC2Z2pLw6mK+Yl
+NHdsk/qZ/CpK6NNrs4uWm2U3Jj7z9wFk0TCGXSS1HI024960RZTYe/3laBClflSQ
+7T7xD6HwgPfNivqerXzImw87NHgM275Nd63eV/Lhw4XgH0e+NRGk8vYE6re0p6Y9
+L79OnCWtEqywdJcJ8qr3MvviOBphUXxubDYWZzy56DCACVZEKSRKkZUJIM2UEiCz
+2Q9ATajqiODuPR5/lcmORxGauCkS2VIDKUekblssnemMqfrPEPllcLyLBYnlnM7e
+fV8it5CZjT8kxUrFTcE3ZVkpkw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA S/MIME RSA
+-----BEGIN CERTIFICATE-----
+MIIGyjCCBLKgAwIBAgIQKU8NCxll7jtXyXGT7O5U0zANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzczOFoXDTM2MDMxNTA5MzczN1ow
+YjELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBTL01JTUUg
+UlNBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5TUrmNU21Y8gpvrx
+XCCOJS54uCyv6H6HQ1NCCz2FCg04VaNEuRYFGSXbxC88u/Q3M/MfegErs6MlLg5j
+gaAD7UYRpFMs/rS6Z6Pr45LDaWHTsS7gjhYaq47+iO0+17eTc7VWeTFzZji3ocFA
+CiXc+tEDRXSGal+qu4s6/Zmexmtp3P8QodrLgy6mAXO7necfkCoyBVjUcixIvPeR
+1NeFWfy2io7QU+Wf4Wm18259W+oJgxH0mgfFKgGrz/c2BokxzdXFvuKggVWEh/p0
+jy8uRQOGcMRT2fyUh5LM6zRBGObE8xIiRfforJF2CGSu1B0wj0jCmFG8Z2UN55xk
+EH+HKpQlm+S0mvez7YYUqMobN1RjTWHSZQoX2nuYk0no/cxbUl/AVXE0fq3DkNv4
+fdTGfLkTJ42qdyAIpjEjkLgrb4C4CT2IxPuNCLCE25SnVmydA7CuMmbwfljWwkE4
+JyO23QL90baDIcEg/NYp/IueW9qu8YwCX5ipJhflzqnjONFKDlC93FnoQ/i/ALIk
+MOhjCrHePX3/F7OWXWAoIRdbqoCNvN4KnJfcFJCcPDOGY7qds5cMcII3uKhhsRCQ
+Jg2KKGvVdwp1oBIibuVM+cIZi3QucK8TfssODws1WNce5RV+Gniv5U4dhS+5nPvC
+gQr6a8wL4ha8hc8ovXEhrrBHtOMCAwEAAaOCAW0wggFpMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHwYDVR0jBBgwFoAUoNYHPV4k93ugRC4kUg0ZqisEkacwVwYIKwYBBQUH
+AQEESzBJMEcGCCsGAQUFBzAChjtodHRwOi8vcmVwby5oYXJpY2EuZ3IvY2VydHMv
+SEFSSUNBLUNsaWVudC1Sb290LTIwMjEtUlNBLmNlcjBEBgNVHSAEPTA7MDkGBFUd
+IAAwMTAvBggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50
+cy9DUFMwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEUGA1UdHwQ+MDww
+OqA4oDaGNGh0dHA6Ly9jcmwuaGFyaWNhLmdyL0hBUklDQS1DbGllbnQtUm9vdC0y
+MDIxLVJTQS5jcmwwHQYDVR0OBBYEFJX2FFz9LqSMQ6C3jgW0Orbsgg2fMA4GA1Ud
+DwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAL2XgP79Wk/ijkQOI55UihqPR
+m68QXb1IDKYCmQiJFkqNQOf/Bt10RjtASV2kjDEQoI4cnmwB++Pd8A9kyFdWPwJ2
+bX68XvFvHX6FzejNwJ5b6wIiz1W3QlHZwhTSoV0KHh4H4gzD8N9X4HwfESVYRkQF
+3tTg1VnZJI2ggCg5201X3BI6YLDc4GltF5EORVzT5xPpMiNHxDivoP8tEdijw5Jh
+kpCDG8BbpbfXQ1HjPRawQ4w6w1aXgyhajLAhjZdLOfpmZO5EbYai46m/niK5mKTU
+/RFupYhNsejfD5wm6JEZbisV5SXVPbmIXrTwvt66lGvgSb3X7waCFIVuwr71qc/q
+YNyvXA4ALSchFU8xqWDu2StWrB3i3CzNR2DMz18yYpjeJehuuhsIZu+Ku4CML1O3
+nlKCXx3EbABVAJkXhbDqHnUw0kqPHh9enYcXdJ8zjLhHVBghdLfpOmp9ZtIOjquL
+mi+OEwkhOv6bC4IXpY57c5bBzK9DCoffE1LG/JUfOSE0B6kuTVyXvFhfq7BK5LcJ
+WieXlSD3COOcqBQ62eHKpRPEYOLdAHDdOq6MBHHMAVUkB/pAFgDj0twB+xP2FUUk
+ycRBPSiBgQEnuI8QLrQXB3FDSXqh+I8jfUcVc7JvgvG4bLMjozgFB58A7gJ5YDce
+4P4ckMdKzbAXPa5tY2Y=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA TLS ECC Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIICVDCCAdugAwIBAgIQZ3SdjXfYO2rbIvT/WeK/zjAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTIxMDIxOTExMDExMFoXDTQ1MDIxMzExMDEwOVowbDELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgRUNDIFJvb3Qg
+Q0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDgI/rGgltJ6rK9JOtDA4MM7
+KKrxcm1lAEeIhPyaJmuqS7psBAqIXhfyVYf8MLA04jRYVxqEU+kw2anylnTDUR9Y
+STHMmE5gEYd103KUkE+bECUqqHgtvpBBWJAVcqeht6NCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUyRtTgRL+BNUW0aq8mm+3oJUZbsowDgYDVR0PAQH/BAQD
+AgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAircJRQO9gcS3ujwLEXQNw
+SaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/QwCZ61IygN
+nxS2PFOiTAZpffpskcYqSUXm7LcT4Tps
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT TLS ECC 1
+-----BEGIN CERTIFICATE-----
+MIIDNzCCArygAwIBAgIQQv3c4SYWB+Gl5pNaQAFh3TAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTI1MDEwMzExMTQyMVoXDTM5MTIzMTExMTQyMFowYDELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExGDAWBgNVBAMMD0dFQU5UIFRMUyBFQ0MgMTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABANPWLwh0Za2UqtbLV7/qNRm78zsttgSuvhn73bU
+GtxETsVOEZeMUfMjgHw8EwrsSJI9oj0CgZQFFSEY1NJfcxA/NJiOYJUKPsFbpOrY
+dr0q4g+aBZsXWeh7bMCzx24g/aOCAS0wggEpMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+HwYDVR0jBBgwFoAUyRtTgRL+BNUW0aq8mm+3oJUZbsowTQYIKwYBBQUHAQEEQTA/
+MD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0EtVExTLVJv
+b3QtMjAyMS1FQ0MuY2VyMBEGA1UdIAQKMAgwBgYEVR0gADAdBgNVHSUEFjAUBggr
+BgEFBQcDAgYIKwYBBQUHAwEwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybC5o
+YXJpY2EuZ3IvSEFSSUNBLVRMUy1Sb290LTIwMjEtRUNDLmNybDAdBgNVHQ4EFgQU
+6ZkGjRcfq/uWGlrIW15dXuzanI8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMD
+A2kAMGYCMQD2M1caaY2OwmthgmANUQg3LBLI0/2LiCdxa2zNq0G59wVzbjEk0cR/
+px52OegIwRACMQCk+iTmBlR6Xfv6igiiaFiPYfN2HfbcYLWbot5DZ2H1b4JVJV+V
+rga7uu50SDG9hf4=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA OV TLS ECC
+-----BEGIN CERTIFICATE-----
+MIIDcjCCAvigAwIBAgIQbIPKxKaS8zQphK9yBQyPDDAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTIxMDMxOTA5MzM1MloXDTM2MDMxNTA5MzM1MVowYjELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBPViBUTFMgRUNDMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAECLBRkImpVT10VjeoeRvNhOsxxQe+XVQO37r8
+PPKVlSWR/+78tD+FMEUTLGGjVUd4+KFCM2Yc2V3fZyoQIaxUzbhUYwIavuaF0V9l
+t0cfPISZ1rcQEHn3yAr1ON1eoT3jo4IBZzCCAWMwEgYDVR0TAQH/BAgwBgEB/wIB
+ADAfBgNVHSMEGDAWgBTJG1OBEv4E1RbRqryab7eglRluyjBUBggrBgEFBQcBAQRI
+MEYwRAYIKwYBBQUHMAKGOGh0dHA6Ly9yZXBvLmhhcmljYS5nci9jZXJ0cy9IQVJJ
+Q0EtVExTLVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8G
+CCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRzL0NQUzAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwQgYDVR0fBDswOTA3oDWgM4Yx
+aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLVRMUy1Sb290LTIwMjEtRUNDLmNy
+bDAdBgNVHQ4EFgQUvrSdrMbKJ79Ox9kcg/5aTh6XB58wDgYDVR0PAQH/BAQDAgGG
+MAoGCCqGSM49BAMDA2gAMGUCMQCBJIThQHLwid4SHT+YoWXd7tEFwKf6OsIX+M4U
+fh2/UAp8bCiB7D/lcAvFj9YPajcCME5DsmcLbYE7D44HlLoqVcr7RDdh84nG6Dsp
+8+YS3BnKAIONAWeGq4jawr3lD667Mw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA TLS RSA Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIIFpDCCA4ygAwIBAgIQOcqTHO9D88aOk8f0ZIk4fjANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTIxMDIxOTEwNTUzOFoXDTQ1MDIxMzEwNTUzN1owbDEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgUlNBIFJv
+b3QgQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIvC569l
+mwVnlskNJLnQDmT8zuIkGCyEf3dRywQRNrhe7Wlxp57kJQmXZ8FHws+RFjZiPTgE
+4VGC/6zStGndLuwRo0Xua2s7TL+MjaQenRG56Tj5eg4MmOIjHdFOY9TnuEFE+2uv
+a9of08WRiFukiZLRgeaMOVig1mlDqa2YUlhu2wr7a89o+uOkXjpFc5gH6l8Cct4M
+pbOfrqkdtx2z/IpZ525yZa31MJQjB/OCFks1mJxTuy/K5FrZx40d/JiZ+yykgmvw
+Kh+OC19xXFyuQnspiYHLA6OZyoieC0AJQTPb5lh6/a6ZcMBaD9YThnEvdmn8kN3b
+LW7R8pv1GmuebxWMevBLKKAiOIAkbDakO/IwkfN4E8/BPzWr8R0RI7VDIp4BkrcY
+AuUR0YLbFQDMYTfBKnya4dC6s1BG7oKsnTH4+yPiAwBIcKMJJnkVU2DzOFytOOqB
+AGMUuTNe3QvboEUHGjMJ+E20pwKmafTCWQWIZYVWrkvL4N48fS0ayOn7H6NhStYq
+E613TBoYm5EPWNgGVMWX+Ko/IIqmhaZ39qb8HOLubpQzKoNQhArlT4b4UEV4AIHr
+W2jjJo3Me1xR9BQsQL4aYB16cmEdH2MtiKrOokWQCPxrvrNQKlr9qEgYRtaQQJKQ
+CoReaDH46+0N0x3GfZkYVVYnZS6NRcUk7M7jAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFApII6ZgpJIKM+qTW8VX6iVNvRLuMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAPpBIqm5iFSVmewzVjIuJndftTgfvnNAU
+X15QvWiWkKQUEapobQk1OUAJ2vQJLDSle1mESSmXdMgHHkdt8s4cUCbjnj1AUz/3
+f5Z2EMVGpdAgS1D0NTsY9FVqQRtHBmg8uwkIYtlfVUKqrFOFrJVWNlar5AWMxaja
+H6NpvVMPxP/cyuN+8kyIhkdGGvMA9YCRotxDQpSbIPDRzbLrLFPCU3hKTwSUQZqP
+JzLB5UkZv/HywouoCjkxKLR9YjYsTewfM7Z+d21+UPCfDtcRj88YxeMn/ibvBZ3P
+zzfF0HvaO7AWhAw6k9a+F9sPPg4ZeAnHqQJyIkv3N3a6dcSFA1pj1bF1BcK5vZSt
+jBWZp5N99sXzqnTPBIWUmAD04vnKJGW/4GKvyMX6ssmeVkjaef2WdhW+o45WxLM0
+/L5H9MG0qPzVMIho7suuyWPEdr6sOBjhXlzPrjoiUevRi7PzKzMHVIf6tLITe7pT
+BGIBnfHAT+7hOtSLIBD6Alfm78ELt5BGnBkpjNxvoEppaZS3JGWg/6w/zgH7IS79
+aPib8qXPMThcFarmlwDB31qlpzmq6YR/PFGoOtmUW4y/Twhx5duoXNTSpv4Ao8YW
+xw/ogM4cKGR0GQjTQuPOAF1/sdwTsOEFy9EgqoZ0njnnkf3/W9b3raYvAwtt41dU
+63ZTGI0RmLo=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT TLS RSA 1
+-----BEGIN CERTIFICATE-----
+MIIGBTCCA+2gAwIBAgIQFNV782kiKCGaVWf6kWUbIjANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTUwMFoXDTM5MTIzMTExMTQ1OVowYDEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGDAWBgNVBAMMD0dFQU5UIFRMUyBSU0EgMTCC
+AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKEEaZSzEzznAPk8IEa17GSG
+yJzPTj4cwRY7/vcq2BPT5+IRGxQtaCdgLXIEl2cdPdIkj2eyakFmgMjAtyeju8V8
+dRayQCD/bWjJ7thDlowgLljQaXirxnYbT8bzRHAhCZqBakYgi5KWw9dANLyDHGpX
+UdY259ab0lWEaFE5Uu6IzQSMJOAy4l/Twym8GUiy0qMDEBFSlm31C9BXpdHKKAlh
+vIjMiKoDeTWl5vZaLB2MMRGY1yW2ftPgIP0/MkX1uFITlvHmmMTngxplH1nybEIJ
+FiwHg1KiLk1TprcZgeO2gxE5Lz3wTFWrsUlAzrh5xWmscWkjNi/4BpeuiT5+NExF
+czboLnXOfjuci/7bsnPi1/aZN/iKNbJRnngFoLaKVMmqCS7Xo34f+BITatryQZFE
+u2oDKExQGlxDBCfYMLgLucX/onpLzUSgeQITNLx6i5tGGbUYH+9Dy3GI66L/5tPj
+qzlOsydki8ZYGE5SBJeWCZ2IrhUe0WzZ2b6Zhk6JAQIDAQABo4IBLTCCASkwEgYD
+VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQKSCOmYKSSCjPqk1vFV+olTb0S
+7jBNBggrBgEFBQcBAQRBMD8wPQYIKwYBBQUHMAKGMWh0dHA6Ly9jcnQuaGFyaWNh
+LmdyL0hBUklDQS1UTFMtUm9vdC0yMDIxLVJTQS5jZXIwEQYDVR0gBAowCDAGBgRV
+HSAAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATBCBgNVHR8EOzA5MDeg
+NaAzhjFodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtVExTLVJvb3QtMjAyMS1S
+U0EuY3JsMB0GA1UdDgQWBBSGAXI/jKlw4jEGUxbOAV9becg8OzAOBgNVHQ8BAf8E
+BAMCAYYwDQYJKoZIhvcNAQELBQADggIBABkssjQzYrOo4GMsKegaChP16yNe6Sck
+cWBymM455R2rMeuQ3zlxUNOEt+KUfgueOA2urp4j6TlPbs/XxpwuN3I1f09Luk5b
++ZgRXM7obE6ZLTerVQWKoTShyl34R2XlK8pEy7+67Ht4lcJzt+K6K5gEuoPSGQDP
+ef+fUfmXrFcgBMcMbtfDb9dubFKNZZxo5nAXiqhFMOIyByag3H+tOTuH8zuId9pH
+RDsUpAIHJ9/W2WBfLcKav7IKRlNBRD/sPBy903J9WHPKwl8kQSDA+aa7XCYk7bJt
+Eyf+7GM9F5cZ7+YyknXqnv/rtQEkTKZdQo5Us18VFe9qqj94tXbLdk7PejJYNB4O
+Zlli44Ld7rtqfFlUych7gIxFOmiyxMQQYrYmUi+74lEZvfoNhuref0CupuKpz6O3
+dLv6kO9T10uNdDBoBQTkge3UzHafTIe3R2o3ujXKUGPwyc9m7/FETyKLUCwSU/5O
+AVOeBCU8QtkKKjM8AmbpKpe3pHWcyq3R7B3LmIALkMPTydyDfxen65IDqREbVq8N
+xjhkJThUz40JqOlN6uqKqeDISj/IoucYwsqW24AlO7ZzNmohQmMi8ep23H4hBSh0
+GBTe2XvkuzaNf92syK8l2HzO+13GLCjzYLTPvXTO9UpK8DGyfGZOuamuwbAnbNpE
+3RfjV9IaUQGJ
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA OV TLS RSA
+-----BEGIN CERTIFICATE-----
+MIIGwTCCBKmgAwIBAgIQHEYUQ2gTTV1QnQ3HytsfuDANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzQxN1oXDTM2MDMxNTA5MzQxNlowYjEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBPViBUTFMgUlNB
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBjrEt4NmTflA4DbZjPC
+HIHeSKt4GSvZrb8Wr9K/xCe/US+tRc7lMvp0SJSxtfEbb9tNo5I99YYegbgT2JOo
+8E/d7fblR/x25dHORtfe2xAO8liK8aswTmb69QXIP81zNnC7juFWgnfDZg8Loz7m
+O8qcKeYS7pejngD4YeiVTf3j2jyJ5BI4Y24IWwcO9Er1hW282He04eQTa9z3Ta9K
+00jG7foADE9q9ZOgPAiNV3tDzsaGC5HftgdmJurC/t+SD7wTLNSOGeCBf0g3jIhE
+QW8FAZYp4OpytgVk8yEtos0izSIXqJn9AMG/HH21EO2tb6S09+8NZEFGh/+GoGuD
+vDW2Nhw6FZm/yctI6nvJI4t2du39gyXql15w6ENucbM8nAyn3rcx6sHAjjgGZw98
+PRnaXXj3lMWvRSpWbBBrV0cj7eJaVFhDR+OG/2jPi8xqXaFaFGvInGW43HpQDAE5
+ATZ+8uywd1S8jA484TmyKr2XUx3OIwvpRxZDy0GvHWiqq03liS/d83vFVvZRq34H
+AMKSeLpLt6XpucnwNWJyv5RvmzsTzKfL/XrwJ9tkXWWp+sqGuScZNZApKMUhS+7w
+NKv84eX/YBKmtuQch6Xgbw0D8JjBk4my35qLw4wGhX8AM1gVErcotCrMwswiSTLy
+XJxm/VX2p8xRWCgrS49G2eMCAwEAAaOCAWcwggFjMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwHwYDVR0jBBgwFoAUCkgjpmCkkgoz6pNbxVfqJU29Eu4wVAYIKwYBBQUHAQEE
+SDBGMEQGCCsGAQUFBzAChjhodHRwOi8vcmVwby5oYXJpY2EuZ3IvY2VydHMvSEFS
+SUNBLVRMUy1Sb290LTIwMjEtUlNBLmNlcjBEBgNVHSAEPTA7MDkGBFUdIAAwMTAv
+BggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50cy9DUFMw
+HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMEIGA1UdHwQ7MDkwN6A1oDOG
+MWh0dHA6Ly9jcmwuaGFyaWNhLmdyL0hBUklDQS1UTFMtUm9vdC0yMDIxLVJTQS5j
+cmwwHQYDVR0OBBYEFOCbPX01Y8XsnQdzqKeJIPRPhPujMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQsFAAOCAgEAbd2n5s7VSvUO8NUXH11Ml5Pdh+W+AaWEJdwG
+8qtnSX+/WL33OsJx1YN5jNjSoEWK4kswoEvrrMP7rg8w920kL5lzgoByQbP3jrJL
+Pj4LnvuqIFj6lz9eMA1kgYqy5BvnepQB/smx58K/CNadvXhtxSU+PuIgoaoKexHM
+9AWAMIIKFkE/SbYd8lR2mzp5rgeSD+rYExOxvpG/f713fDFRTH+SyqMREw34d2rD
+dtSBK5GerrV1F7C//KGM016EWCz59kutui8qyZJNq7dw1BChbEo1ho9ekN5nQ8t/
+ckF7lJkrMoYRyZobJbQs45BfDMXyRFT4u4N1Z+2GyEvgryqlIQfQ3SUamELnQ6Ta
+3oia4pLt/SYrRJOJ3I1EhlMgmi9dS/vCiXcDoMqConepk3/gDFtf8NatbQk2+vBW
+mkTcSxlAktWFFu3iAN+0hOPQWDtXofUecFVLwNzAFMhVFw8yd9h8AuM3ThZPNSW1
+0IFer8+cEkvBy2VBbg2MtXn3Duu3NGJk9xf1e752048foDAfrRcuPTZdijtvRFJ+
+G1d/8t9mQqer39S8HONbR+1Zx6KjlFbTkq+Jaivcg6X1JapDjDG8PMiaPX8WE5Tt
+jmZ8mSoDuXjqXaQ03VFrr+IweD985Ryq/eDM79dQc8SawzNwzLdNkmczMhLfE9ut
+wIHJbMg=
+-----END CERTIFICATE-----
+Subject: C=DE,O=T-Systems Enterprise Services GmbH,OU=T-Systems Trust Center,CN=T-TeleSec GlobalRoot Class 2
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
+KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
+BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
+YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1
+OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
+aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
+ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd
+AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC
+FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi
+1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq
+jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ
+wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/
+WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy
+NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC
+uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw
+IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6
+g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
+9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP
+BSeOE6Fuwg==
+-----END CERTIFICATE-----
+Subject: C=DE,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,OU=DFN-PKI,CN=DFN-Verein Certification Authority 2
+-----BEGIN CERTIFICATE-----
+MIIFEjCCA/qgAwIBAgIJAOML1fivJdmBMA0GCSqGSIb3DQEBCwUAMIGCMQswCQYD
+VQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2UgU2VydmljZXMg
+R21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjElMCMGA1UEAwwc
+VC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMjAeFw0xNjAyMjIxMzM4MjJaFw0z
+MTAyMjIyMzU5NTlaMIGVMQswCQYDVQQGEwJERTFFMEMGA1UEChM8VmVyZWluIHp1
+ciBGb2VyZGVydW5nIGVpbmVzIERldXRzY2hlbiBGb3JzY2h1bmdzbmV0emVzIGUu
+IFYuMRAwDgYDVQQLEwdERk4tUEtJMS0wKwYDVQQDEyRERk4tVmVyZWluIENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5IDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDLYNf/ZqFBzdL6h5eKc6uZTepnOVqhYIBHFU6MlbLlz87TV0uNzvhWbBVV
+dgfqRv3IA0VjPnDUq1SAsSOcvjcoqQn/BV0YD8SYmTezIPZmeBeHwp0OzEoy5xad
+rg6NKXkHACBU3BVfSpbXeLY008F0tZ3pv8B3Teq9WQfgWi9sPKUA3DW9ZQ2PfzJt
+8lpqS2IB7qw4NFlFNkkF2njKam1bwIFrEczSPKiL+HEayjvigN0WtGd6izbqTpEp
+PbNRXK2oDL6dNOPRDReDdcQ5HrCUCxLx1WmOJfS4PSu/wI7DHjulv1UQqyquF5de
+M87I8/QJB+MChjFGawHFEAwRx1npAgMBAAGjggF0MIIBcDAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFJPj2DIm2tXxSqWRSuDqS+KiDM/hMB8GA1UdIwQYMBaAFL9Z
+IDYAeaCgImuM1fJh0rgsy4JKMBIGA1UdEwEB/wQIMAYBAf8CAQIwMwYDVR0gBCww
+KjAPBg0rBgEEAYGtIYIsAQEEMA0GCysGAQQBga0hgiweMAgGBmeBDAECAjBMBgNV
+HR8ERTBDMEGgP6A9hjtodHRwOi8vcGtpMDMzNi50ZWxlc2VjLmRlL3JsL1RlbGVT
+ZWNfR2xvYmFsUm9vdF9DbGFzc18yLmNybDCBhgYIKwYBBQUHAQEEejB4MCwGCCsG
+AQUFBzABhiBodHRwOi8vb2NzcDAzMzYudGVsZXNlYy5kZS9vY3NwcjBIBggrBgEF
+BQcwAoY8aHR0cDovL3BraTAzMzYudGVsZXNlYy5kZS9jcnQvVGVsZVNlY19HbG9i
+YWxSb290X0NsYXNzXzIuY2VyMA0GCSqGSIb3DQEBCwUAA4IBAQCHC/8+AptlyFYt
+1juamItxT9q6Kaoh+UYu9bKkD64ROHk4sw50unZdnugYgpZi20wz6N35at8yvSxM
+R2BVf+d0a7Qsg9h5a7a3TVALZge17bOXrerufzDmmf0i4nJNPoRb7vnPmep/11I5
+LqyYAER+aTu/de7QCzsazeX3DyJsR4T2pUeg/dAaNH2t0j13s+70103/w+jlkk9Z
+PpBHEEqwhVjAb3/4ru0IQp4e1N8ULk2PvJ6Uw+ft9hj4PEnnJqinNtgs3iLNi4LY
+2XjiVRKjO4dEthEL1QxSr2mMDwbf0KJTi1eYe8/9ByT0/L3D/UqSApcb8re2z2WK
+GqK1chk5
+-----END CERTIFICATE-----
+Subject: C=DE,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,OU=DFN-PKI,CN=DFN-Verein Global Issuing CA
+-----BEGIN CERTIFICATE-----
+MIIFrDCCBJSgAwIBAgIHG2O60B4sPTANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UE
+BhMCREUxRTBDBgNVBAoTPFZlcmVpbiB6dXIgRm9lcmRlcnVuZyBlaW5lcyBEZXV0
+c2NoZW4gRm9yc2NodW5nc25ldHplcyBlLiBWLjEQMA4GA1UECxMHREZOLVBLSTEt
+MCsGA1UEAxMkREZOLVZlcmVpbiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4X
+DTE2MDUyNDExMzg0MFoXDTMxMDIyMjIzNTk1OVowgY0xCzAJBgNVBAYTAkRFMUUw
+QwYDVQQKDDxWZXJlaW4genVyIEZvZXJkZXJ1bmcgZWluZXMgRGV1dHNjaGVuIEZv
+cnNjaHVuZ3NuZXR6ZXMgZS4gVi4xEDAOBgNVBAsMB0RGTi1QS0kxJTAjBgNVBAMM
+HERGTi1WZXJlaW4gR2xvYmFsIElzc3VpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCdO3kcR94fhsvGadcQnjnX2aIw23IcBX8pX0to8a0Z1kzh
+axuxC3+hq+B7i4vYLc5uiDoQ7lflHn8EUTbrunBtY6C+li5A4dGDTGY9HGRp5Zuk
+rXKuaDlRh3nMF9OuL11jcUs5eutCp5eQaQW/kP+kQHC9A+e/nhiIH5+ZiE0OR41I
+X2WZENLZKkntwbktHZ8SyxXTP38eVC86rpNXp354ytVK4hrl7UF9U1/Isyr1ijCs
+7RcFJD+2oAsH/U0amgNSoDac3iSHZeTn+seWcyQUzdDoG2ieGFmudn730Qp4PIdL
+sDfPU8o6OBDzy0dtjGQ9PFpFSrrKgHy48+enTEzNAgMBAAGjggIFMIICATASBgNV
+HRMBAf8ECDAGAQH/AgEBMA4GA1UdDwEB/wQEAwIBBjApBgNVHSAEIjAgMA0GCysG
+AQQBga0hgiweMA8GDSsGAQQBga0hgiwBAQQwHQYDVR0OBBYEFGs6mIv58lOJ2uCt
+sjIeCR/oqjt0MB8GA1UdIwQYMBaAFJPj2DIm2tXxSqWRSuDqS+KiDM/hMIGPBgNV
+HR8EgYcwgYQwQKA+oDyGOmh0dHA6Ly9jZHAxLnBjYS5kZm4uZGUvZ2xvYmFsLXJv
+b3QtZzItY2EvcHViL2NybC9jYWNybC5jcmwwQKA+oDyGOmh0dHA6Ly9jZHAyLnBj
+YS5kZm4uZGUvZ2xvYmFsLXJvb3QtZzItY2EvcHViL2NybC9jYWNybC5jcmwwgd0G
+CCsGAQUFBwEBBIHQMIHNMDMGCCsGAQUFBzABhidodHRwOi8vb2NzcC5wY2EuZGZu
+LmRlL09DU1AtU2VydmVyL09DU1AwSgYIKwYBBQUHMAKGPmh0dHA6Ly9jZHAxLnBj
+YS5kZm4uZGUvZ2xvYmFsLXJvb3QtZzItY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0
+MEoGCCsGAQUFBzAChj5odHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290
+LWcyLWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNydDANBgkqhkiG9w0BAQsFAAOCAQEA
+gXhFpE6kfw5V8Amxaj54zGg1qRzzlZ4/8/jfazh3iSyNta0+x/KUzaAGrrrMqLGt
+Mwi2JIZiNkx4blDw1W5gjU9SMUOXRnXwYuRuZlHBQjFnUOVJ5zkey5/KhkjeCBT/
+FUsrZpugOJ8Azv2n69F/Vy3ITF/cEBGXPpYEAlyEqCk5bJT8EJIGe57u2Ea0G7UD
+DDjZ3LCpP3EGC7IDBzPCjUhjJSU8entXbveKBTjvuKCuL/TbB9VbhBjBqbhLzmyQ
+GoLkuT36d/HSHzMCv1PndvncJiVBby+mG/qkE5D6fH7ZC2Bd7L/KQaBh+xFJKdio
+LXUV2EoY6hbvVTQiGhONBg==
+-----END CERTIFICATE-----
+Subject: C=DE,ST=Bayern,L=Muenchen,O=Fraunhofer,OU=Fraunhofer Corporate PKI,CN=Fraunhofer User CA - G02
+-----BEGIN CERTIFICATE-----
+MIIFqzCCBJOgAwIBAgIHG2O6xotSQjANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UE
+BhMCREUxRTBDBgNVBAoTPFZlcmVpbiB6dXIgRm9lcmRlcnVuZyBlaW5lcyBEZXV0
+c2NoZW4gRm9yc2NodW5nc25ldHplcyBlLiBWLjEQMA4GA1UECxMHREZOLVBLSTEt
+MCsGA1UEAxMkREZOLVZlcmVpbiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4X
+DTE2MDUyNDExMzgzMFoXDTMxMDIyMjIzNTk1OVowgYwxCzAJBgNVBAYTAkRFMQ8w
+DQYDVQQIDAZCYXllcm4xETAPBgNVBAcMCE11ZW5jaGVuMRMwEQYDVQQKDApGcmF1
+bmhvZmVyMSEwHwYDVQQLDBhGcmF1bmhvZmVyIENvcnBvcmF0ZSBQS0kxITAfBgNV
+BAMMGEZyYXVuaG9mZXIgVXNlciBDQSAtIEcwMjCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAL1FxEM9lv2hli0ZvDCDNvVn2mIcIJ4cvKUQ30l5ZARkKEtY
+KlqSsrof2WmWFdxx1DPwFtp38QgbsbOPKSDoYiWw+ycW403f1ZJAvn6c5N07oT1A
+j3xzYG/QxgY+qkLhKJnV0pr7afC+VIFB/wmNFhvlyXpAVy07NOikiRFlBzw/s4/H
+HdHTL2VKEjCnfD6rzKtTN+D+24UYXiMvNzmPyWQMQhIxuDMPTwfoqBFL7leo334z
+gHm78leaLK52DTzpHvlNHP4DnTRa2ipVpyj3yQWcOBw+75oVE71AbyFPzw1a0J9P
+wisZljQ0eTb6/tkF81W5f6UD7NN4Ie2gxEvZkysCAwEAAaOCAgUwggIBMBIGA1Ud
+EwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMCkGA1UdIAQiMCAwDQYLKwYB
+BAGBrSGCLB4wDwYNKwYBBAGBrSGCLAEBBDAdBgNVHQ4EFgQUoyb1mk/b2jvhtaru
+WIvQ/P+1bVEwHwYDVR0jBBgwFoAUk+PYMiba1fFKpZFK4OpL4qIMz+EwgY8GA1Ud
+HwSBhzCBhDBAoD6gPIY6aHR0cDovL2NkcDEucGNhLmRmbi5kZS9nbG9iYWwtcm9v
+dC1nMi1jYS9wdWIvY3JsL2NhY3JsLmNybDBAoD6gPIY6aHR0cDovL2NkcDIucGNh
+LmRmbi5kZS9nbG9iYWwtcm9vdC1nMi1jYS9wdWIvY3JsL2NhY3JsLmNybDCB3QYI
+KwYBBQUHAQEEgdAwgc0wMwYIKwYBBQUHMAGGJ2h0dHA6Ly9vY3NwLnBjYS5kZm4u
+ZGUvT0NTUC1TZXJ2ZXIvT0NTUDBKBggrBgEFBQcwAoY+aHR0cDovL2NkcDEucGNh
+LmRmbi5kZS9nbG9iYWwtcm9vdC1nMi1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQw
+SgYIKwYBBQUHMAKGPmh0dHA6Ly9jZHAyLnBjYS5kZm4uZGUvZ2xvYmFsLXJvb3Qt
+ZzItY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQDE
+klJ5thEqcbIyroBrhnWl00oAUXYuYQqXDpBTCzF08aBk41FyLZXH54w7NUecdTZp
+aq0SgueogbSv9viT8EzQ5Bt6bapOl5pVjEb6yBrV0Y3d5Vb3h8WA+/E+DRz/uV5M
+gKdVHdazimuXK1HHf0UHSFiEkgiY3xSQr6CRH7UzzivWj9s6B2GUuP4zzfKrgAxQ
+N2IaEUtvWiwl5Mtv55p6wmnBOhCnCtj1Ge5Du7jR8o2xAh//fZ4tz5UQ7XXVoeu5
+iueZp3qNb0cTtiGGPJxVtFmoaFNltp+zI/y52hF9XgjC+mJBVYYahmacW3wMpIAO
+R0lstmlDfiKvecyE6S4v
+-----END CERTIFICATE-----
+Subject: C=US,ST=New Jersey,L=Jersey City,O=The USERTRUST Network,CN=USERTrust ECC Certification Authority
+-----BEGIN CERTIFICATE-----
+MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAx
+MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
+Ck5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUg
+VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlm
+aWNhdGlvbiBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqflo
+I+d61SRvU8Za2EurxtW20eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinng
+o4N+LZfQYcTxmdwlkWOrfzCjtHDix6EznPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0G
+A1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBBHU6+4WMB
+zzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbW
+RNZu9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg=
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT OV ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDeTCCAv+gAwIBAgIRAOuOgRlxKfSvZO+BSi9QzukwCgYIKoZIzj0EAwMwgYgx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJz
+ZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQD
+EyVVU0VSVHJ1c3QgRUNDIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIwMDIx
+ODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowRDELMAkGA1UEBhMCTkwxGTAXBgNVBAoT
+EEdFQU5UIFZlcmVuaWdpbmcxGjAYBgNVBAMTEUdFQU5UIE9WIEVDQyBDQSA0MFkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXYkvGrfrMs2IwdI5+IwpEwPh+igW/BOW
+etmOwP/ZIXC8fNeC3/ZYPAAMyRpFS0v3/c55FDTE2xbOUZ5zeVZYQqOCAYswggGH
+MB8GA1UdIwQYMBaAFDrhCYbUzxnClnZ0SXbc4DXGY2OaMB0GA1UdDgQWBBTttKAz
+ahsIkba9+kGSvZqrq2P0UzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB
+/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwOAYDVR0gBDEwLzAt
+BgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAG
+A1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1
+c3RFQ0NDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgw
+PwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RF
+Q0NBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRy
+dXN0LmNvbTAKBggqhkjOPQQDAwNoADBlAjAfs9nsM0qaJGVu6DpWVy4qojiOpwV1
+h/MWZ5GJxy6CKv3+RMB3STkaFh0+Hifbk24CMQDRf/ujXAQ1b4nFpZGaSIKldygc
+dCDAxbAd9tlxcN/+J534CJDblzd/40REzGWwS5k=
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT Personal ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDfjCCAwSgAwIBAgIQdpAhff5d1sLEUCfF3NFaJjAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjAwMjE4
+MDAwMDAwWhcNMzMwNTAxMjM1OTU5WjBKMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQ
+R0VBTlQgVmVyZW5pZ2luZzEgMB4GA1UEAxMXR0VBTlQgUGVyc29uYWwgRUNDIENB
+IDQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQYZ2cR4O5tfdskg2NNo346Noyo
+enQjWhWQElTQQ+brmMxr5leW1AfpAJ9bsaUadsCJJnA5ycFITYjXfl/XvfPko4IB
+izCCAYcwHwYDVR0jBBgwFoAUOuEJhtTPGcKWdnRJdtzgNcZjY5owHQYDVR0OBBYE
+FKgtbYEyZI3msk+s/hHyZZmFE6luMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E
+CDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDA4BgNVHSAE
+MTAvMC0GBFUdIAAwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9D
+UFMwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3QuY29tL1VT
+RVJUcnVzdEVDQ0NlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
+BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJU
+cnVzdEVDQ0FkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51
+c2VydHJ1c3QuY29tMAoGCCqGSM49BAMDA2gAMGUCMQCCX6P32oo7RiAIk1DIekZM
+nFGZwY+xJoZ5HyChGc1Ncuupnh7Ezukr1EnL+MyAhNcCMD6DlSMWE5I++OBvznnX
+1npjvntLcKogArAPjLglGGeymFt4U6pdy7/C0/miHCPuDA==
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT eScience Personal ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDiDCCAw6gAwIBAgIRAPFVZjGnycu/NlCaWpIPalkwCgYIKoZIzj0EAwMwgYgx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJz
+ZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQD
+EyVVU0VSVHJ1c3QgRUNDIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIwMDIx
+ODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowUzELMAkGA1UEBhMCTkwxGTAXBgNVBAoT
+EEdFQU5UIFZlcmVuaWdpbmcxKTAnBgNVBAMTIEdFQU5UIGVTY2llbmNlIFBlcnNv
+bmFsIEVDQyBDQSA0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3Oad56Xl15SY
+nK3MmKcZUEu17k4jApQvPwTnGUqFxMbgDvAtxJtWqbKk8qvCOcZ/oCyrHkloS6Nf
+AiTDTV5bZ6OCAYswggGHMB8GA1UdIwQYMBaAFDrhCYbUzxnClnZ0SXbc4DXGY2Oa
+MB0GA1UdDgQWBBTt5lFk6mex24xLv7WAJ5g/2CMeZTAOBgNVHQ8BAf8EBAMCAYYw
+EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
+AwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2Vj
+dGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRy
+dXN0LmNvbS9VU0VSVHJ1c3RFQ0NDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2
+BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0
+LmNvbS9VU0VSVHJ1c3RFQ0NBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0
+cDovL29jc3AudXNlcnRydXN0LmNvbTAKBggqhkjOPQQDAwNoADBlAjA8KoDpeqid
+slDXmfwHD7kr0XTY8rOdQBWMzT5uU7nPROEYLK00Dc9w/J4M8CGaLX8CMQDoaX4P
+os4y0yfmvRAPaFZxyJi1ZHaZh+G0dX7ggOEyMHmT0P57T6TjdfcBr1G/J/M=
+-----END CERTIFICATE-----
+Subject: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo ECC Organization Validation Secure Server CA
+-----BEGIN CERTIFICATE-----
+MIIDrjCCAzOgAwIBAgIQNb50Y4yz6d4oBXC3l4CzZzAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgxMTAy
+MDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBlTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
+EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMP
+U2VjdGlnbyBMaW1pdGVkMT0wOwYDVQQDEzRTZWN0aWdvIEVDQyBPcmdhbml6YXRp
+b24gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMFkwEwYHKoZIzj0CAQYIKoZI
+zj0DAQcDQgAEnI5cCmFvoVij0NXO+vxE+f+6Bh57FhpyH0LTCrJmzfsPSXIhTSex
+r92HOlz+aHqoGE0vSe/CSwLFoWcZ8W1jOaOCAW4wggFqMB8GA1UdIwQYMBaAFDrh
+CYbUzxnClnZ0SXbc4DXGY2OaMB0GA1UdDgQWBBRNSu/ERrMSrU9OmrFZ4lGrCBB4
+CDAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAEC
+AjBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNF
+UlRydXN0RUNDQ2VydGlmaWNhdGlvbkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEE
+ajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRy
+dXN0RUNDQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVz
+ZXJ0cnVzdC5jb20wCgYIKoZIzj0EAwMDaQAwZgIxAOk//uo7i/MoeKdcyeqvjOXs
+BJFGLI+1i0d+Tty7zEnn2w4DNS21TK8wmY3Kjm3EmQIxAPI1qHM/I+OS+hx0OZhG
+fDoNifTe/GxgWZ1gOYQKzn6lwP0yGKlrP+7vrVC8IczJ4A==
+-----END CERTIFICATE-----
+Subject: C=US,ST=New Jersey,L=Jersey City,O=The USERTRUST Network,CN=USERTrust RSA Certification Authority
+-----BEGIN CERTIFICATE-----
+MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
+MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
+BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
+aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
+3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
+tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
+Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
+VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
+79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
+c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
+Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
+c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
+UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
+Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
+BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
+Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
+VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
+ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
+8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
+iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
+Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
+XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
+qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
+VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
+L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
+jjxDah2nGN59PRbxYvnKkKj9
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT OV RSA CA 4
+-----BEGIN CERTIFICATE-----
+MIIG5TCCBM2gAwIBAgIRANpDvROb0li7TdYcrMTz2+AwDQYJKoZIhvcNAQEMBQAw
+gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
+ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
+VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIw
+MDIxODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowRDELMAkGA1UEBhMCTkwxGTAXBgNV
+BAoTEEdFQU5UIFZlcmVuaWdpbmcxGjAYBgNVBAMTEUdFQU5UIE9WIFJTQSBDQSA0
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApYhi1aEiPsg9ZKRMAw9Q
+r8Mthsr6R20VSfFeh7TgwtLQi6RSRLOh4or4EMG/1th8lijv7xnBMVZkTysFiPmT
+PiLOfvz+QwO1NwjvgY+Jrs7fSoVA/TQkXzcxu4Tl3WHi+qJmKLJVu/JOuHud6mOp
+LWkIbhODSzOxANJ24IGPx9h4OXDyy6/342eE6UPXCtJ8AzeumTG6Dfv5KVx24lCF
+TGUzHUB+j+g0lSKg/Sf1OzgCajJV9enmZ/84ydh48wPp6vbWf1H0O3Rd3LhpMSVn
+TqFTLKZSbQeLcx/l9DOKZfBCC9ghWxsgTqW9gQ7v3T3aIfSaVC9rnwVxO0VjmDdP
+FNbdoxnh0zYwf45nV1QQgpRwZJ93yWedhp4ch1a6Ajwqs+wv4mZzmBSjovtV0mKw
+d+CQbSToalEUP4QeJq4Udz5WNmNMI4OYP6cgrnlJ50aa0DZPlJqrKQPGL69KQQz1
+2WgxvhCuVU70y6ZWAPopBa1ykbsttpLxADZre5cH573lIuLHdjx7NjpYIXRx2+QJ
+URnX2qx37eZIxYXz8ggM+wXH6RDbU3V2o5DP67hXPHSAbA+p0orjAocpk2osxHKo
+NSE3LCjNx8WVdxnXvuQ28tKdaK69knfm3bB7xpdfsNNTPH9ElcjscWZxpeZ5Iij8
+lyrCG1z0vSWtSBsgSnUyG/sCAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qq
+K0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRvHTVJEGwy+lmgnryK6B+VvnF6DDAO
+BgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggr
+BgEFBQcDAQYIKwYBBQUHAwIwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
+AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0
+dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9u
+QXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6
+Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAl
+BggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0B
+AQwFAAOCAgEAUtlC3e0xj/1BMfPhdQhUXeLjb0xp8UE28kzWE5xDzGKbfGgnrT2R
+lw5gLIx+/cNVrad//+MrpTppMlxq59AsXYZW3xRasrvkjGfNR3vt/1RAl8iI31lG
+hIg6dfIX5N4esLkrQeN8HiyHKH6khm4966IkVVtnxz5CgUPqEYn4eQ+4eeESrWBh
+AqXaiv7HRvpsdwLYekAhnrlGpioZ/CJIT2PTTxf+GHM6cuUnNqdUzfvrQgA8kt1/
+ASXx2od/M+c8nlJqrGz29lrJveJOSEMX0c/ts02WhsfMhkYa6XujUZLmvR1Eq08r
+48/EZ4l+t5L4wt0DV8VaPbsEBF1EOFpz/YS2H6mSwcFaNJbnYqqJHIvm3PLJHkFm
+EoLXRVrQXdCT+3wgBfgU6heCV5CYBz/YkrdWES7tiiT8sVUDqXmVlTsbiRNiyLs2
+bmEWWFUl76jViIJog5fongEqN3jLIGTG/mXrJT1UyymIcobnIGrbwwRVz/mpFQo0
+vBYIi1k2ThVh0Dx88BbF9YiP84dd8Fkn5wbE6FxXYJ287qfRTgmhePecPc73Yrzt
+apdRcsKVGkOpaTIJP/l+lAHRLZxk/dUtyN95G++bOSQqnOCpVPabUGl2E/OEyFrp
+Ipwgu2L/WJclvd6g+ZA/iWkLSMcpnFb+uX6QBqvD6+RNxul1FaB5iHY=
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT Personal CA 4
+-----BEGIN CERTIFICATE-----
+MIIG5jCCBM6gAwIBAgIQMQJw1DW+mySa+FbQ4eKFSTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjAw
+MjE4MDAwMDAwWhcNMzMwNTAxMjM1OTU5WjBGMQswCQYDVQQGEwJOTDEZMBcGA1UE
+ChMQR0VBTlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0Eg
+NDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALNK4iJeJ1vpBFsUBDUy
+IBSutNIxQMbNUMAeoUTKr55KYX8tkN5imzNqLaRCypYBPP9wED2AaO6e8njkbjzJ
+wLgPqDBkW9sG3kmi3GW6cF4Hwr5ysZqve/5EJDhV+9OhfTu/4dMnoR4Q41HcjMk9
+MzLOADAQ0awBZ/29r0d49AUmIKELNeqEqmnTN6fndL7x/2K0TLToZLxqS7sy/Jvi
+0wEFr0CfdjcAsioh7KaD+Jizyb1aRKQzJ6Q20VEHX7UqWc1SkzTkbz6xj0S5ydBB
+FQh0fNiy+qM/deVpK4HgmPSJrrpQZ+LlbHfWabmwoDPxF71QZVYiqrrAoUrGRJ+4
+7iLBiIg8miIYS7Hd2ppvAUt24CugMXUjETjQ+oYh09fNi5n/AvoER8UBvTHLxt+b
+lL0bvL+2z2YiUWk+2Qtn+dD+JU5Z2y71qV7+cr+4YXjvGzF5bYsi8HiwflTb4Php
+3y+k1twKtchdcq2QGc0eDG6Y01nRHUiyr8/PtMAsLHEPNZ2wzsA7fb8mftHiV20Z
+FmYqknJ8AIOfwdTVA+E62JayOJ+sxadqcmFDorsz/mrPwGZ8+txr4xSuvVjg0dlv
+0yuA+1YpBDIYNfL4bkX+IcZ1mTstL4Xw0f4N2iW3bBmnPnYmoYxMM8gflCiTgss7
+3nBvG2f7v1PD7BDGYNO4iD4vAgMBAAGjggGLMIIBhzAfBgNVHSMEGDAWgBRTeb9a
+qitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUaQChxyFY+ODFGyCwCt2nUb8T2eQw
+DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwIGCCsGAQUFBwMEMDgGA1UdIAQxMC8wLQYEVR0gADAlMCMGCCsGAQUF
+BwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzBQBgNVHR8ESTBHMEWgQ6BBhj9o
+dHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlv
+bkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRw
+Oi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQw
+JQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcN
+AQEMBQADggIBAAoFTnsNjx8TOQD9b+xixsPt7Req4wHMeNw/R5dddEPgQAQAYJZK
+z5BEv1cjGbH7nbPH3AxrxhN6OVH40p6OLIo9MXSrrfMzGs7/P+FTCjwgNxFEtLQ1
+KC9NboA3asJcl7mIs3l8h9iAgEH1zLUvq2s+5n++NQmbzudDsTFDMapY3kX1TwyU
+CTRzmItqcbsYIyg2MeIXWfRtqPqC5R4bufmpzA5BPINLX340Sp/CNQ9QZqw3Vkfy
+HWwTo+vO9Gm2L6srNamJT6Lb+TeXZvl8UPL5a72O/pH0GgGHjt6z9QzPARnaRKsh
+VWviNK6ST4WmZHllu3CJg0BXqx1vWyswawgvNeWt1qxITacYe9mSWTbNR2CftvTU
+werruDSY2jMaZPoNqbjUpuG/blYwWzzvVerBUhviAahPXJF/9V48ybWPBq6qKOEo
+kW+s3B4ad5sY96KlovEijaIQDip1HO0SD+rLNYaiBcr9MV2aK+DfbZ8w9BaNCQyF
+EYwzxIKOVk3bYvzHRk5ihUDascmbk/bkiNl74c/KfuKQmJImaqWoWZR6jBcXcPV0
+WUIKz/nILTpFhGojZEQW77by3aezAi9jrEIUBHRG1LwzPbJc2V3SOzYyaJFQatzu
+KZbN1Q9s9y/2x1QXtKwREY8jNgvx0iIfOK35gKgYJJcyDql4XfuEc2nV
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT eScience Personal CA 4
+-----BEGIN CERTIFICATE-----
+MIIG8DCCBNigAwIBAgIRAKoycu7aGxmmN/byVir07vEwDQYJKoZIhvcNAQEMBQAw
+gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
+ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
+VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIw
+MDIxODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowTzELMAkGA1UEBhMCTkwxGTAXBgNV
+BAoTEEdFQU5UIFZlcmVuaWdpbmcxJTAjBgNVBAMTHEdFQU5UIGVTY2llbmNlIFBl
+cnNvbmFsIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCVokk9
+uR1UAJRcNg1NTatsuxEwya7FpTRm5wcbSJqSLeUd5gjI2zHzwjaevHwCjN716blp
+iyvEVr96aGw2y+FrVo/0yr0+/XoK8WdkB64j3KmOdUttTTXERY1T1vXxvkZhchHl
+JvD/VVDIt/V/xg2iDpAa2N3SW0SNSyuAGqtVaCTM4eOEgVT1Nyg5VtQJVLujMrvv
+cW6+1W1rLR2O05FxQtINVnrblTKWotAitEv8yMe9qQr1Fz4sdyVj2cBwEk/zQLok
+JRCSw981Hoh5kwt4AVMSxjfeSRjx0Wt0C6ioRJ8WAfSWGNDZwnUWZ4nJrW2UWtdJ
+Z59t2VByBR3e8MlVTVE4pirg3R5lCCIzPhNLQm25Rap/a4m3+e9A+Jnjgfi3XzSB
+fd+gcMh1xBXK+YOOfbnZW4H8T1Ty9I/HKsUp/isLV8TJsFOLZCyuV14qVfi8jmRU
+0wYIK4vQRj2M7VxCyH4MPn6lgnyecIieL0b4gFNWhE2waH2gfigvpQWH6bQuSWIh
+l0PaRDWFavo1SNTFKdAVQDK7w3Iw3XzOhQnjHgU/idvqd5eaqa2G4VN1vV1pNirC
+LXJccKK49zDSS1IFMX9iQC4YFxc/BbWRndI3smg05dcYn7Di73B0EzFFO6dyg0WD
+r2N9G/8fgjv89biSARMNzjtg2XR2cLxdT8PAYwIDAQABo4IBizCCAYcwHwYDVR0j
+BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFLYvVVqwyWAZ788J
+WtHxE51sjMkEMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
+A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDA4BgNVHSAEMTAvMC0GBFUdIAAw
+JTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwUAYDVR0fBEkw
+RzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJTQUNl
+cnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEBBGowaDA/BggrBgEF
+BQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJTQUFkZFRy
+dXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
+MA0GCSqGSIb3DQEBDAUAA4ICAQB7IGXk1vGM4J73d8UD3f71UqLxom42Icu/IP0V
+nrIRzbAmz+C++7Bir4mqkKWt89dd9ZlIK8Ez5Y97tDEEd2eICo6dTvy5JOxiYsWK
+iubpyqmW/K0xjUqutANMxxGXQOJn13RnI9OHSxNXng5OoM66O5Eq08vXdcQbXF3i
+qPf95g94OJVoyFwlmYiIMuV6cOCVNShbGKvFPpNB4p+7vr2FJ7ZeHEmiZKMXO8ex
+3Uq5j1riVT/4tCemFz7dSpaCkHJ0xj5Ayknj14+t/lwF7IcOdP9/15uDp8HkgNh9
+xXkFqF3wtLkidVvmmbvDmOQiLJL6Hj6MxwEwI7Cf4ZN/UH0eIra7tEgMP+mkdNtR
+K3tB4lQNLquWBr25PbzMiK5LfXPGL+odDAb/7mE1ClQtg28gohf+Ms9hQ4y2rZSG
+sYUgh+U++Yn+HlYKI26tl7qB6lFcQb6Prc1SELAEFob8yMFkZ3UnXXLRUkLeM50K
+WV9s5wu4Rn6Rzp722wdTQoBeaSxZ5bjmT3QerGV2GaRmuYjLxdYGZ5Co07DI+qEJ
+Tj4mbpHx/OiqD7tR9i3rHpPyTjpD6MhJ3U4EjZfd6UMWGMz3Zcw0tvJe1cLpNRX8
+yjTdSxF1/H7ni7/IHkK4trIBuc58YPbZXAfYTcPugPwQE6N7RcfQHA4McFX91SZa
+DskXUg==
+-----END CERTIFICATE-----
+Subject: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Organization Validation Secure Server CA
+-----BEGIN CERTIFICATE-----
+MIIGGTCCBAGgAwIBAgIQE31TnKp8MamkM3AZaIR6jTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
+MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBlTELMAkGA1UEBhMCR0IxGzAZBgNV
+BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
+ChMPU2VjdGlnbyBMaW1pdGVkMT0wOwYDVQQDEzRTZWN0aWdvIFJTQSBPcmdhbml6
+YXRpb24gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAnJMCRkVKUkiS/FeN+S3qU76zLNXYqKXsW2kDwB0Q
+9lkz3v4HSKjojHpnSvH1jcM3ZtAykffEnQRgxLVK4oOLp64m1F06XvjRFnG7ir1x
+on3IzqJgJLBSoDpFUd54k2xiYPHkVpy3O/c8Vdjf1XoxfDV/ElFw4Sy+BKzL+k/h
+fGVqwECn2XylY4QZ4ffK76q06Fha2ZnjJt+OErK43DOyNtoUHZZYQkBuCyKFHFEi
+rsTIBkVtkuZntxkj5Ng2a4XQf8dS48+wdQHgibSov4o2TqPgbOuEQc6lL0giE5dQ
+YkUeCaXMn2xXcEAG2yDoG9bzk4unMp63RBUJ16/9fAEc2wIDAQABo4IBbjCCAWow
+HwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFBfZ1iUn
+Z/kxwklD2TA2RIxsqU/rMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/
+AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYG
+BFUdIAAwCAYGZ4EMAQICMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
+cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
+bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
+dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
+aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAThNA
+lsnD5m5bwOO69Bfhrgkfyb/LDCUW8nNTs3Yat6tIBtbNAHwgRUNFbBZaGxNh10m6
+pAKkrOjOzi3JKnSj3N6uq9BoNviRrzwB93fVC8+Xq+uH5xWo+jBaYXEgscBDxLmP
+bYox6xU2JPti1Qucj+lmveZhUZeTth2HvbC1bP6mESkGYTQxMD0gJ3NR0N6Fg9N3
+OSBGltqnxloWJ4Wyz04PToxcvr44APhL+XJ71PJ616IphdAEutNCLFGIUi7RPSRn
+R+xVzBv0yjTqJsHe3cQhifa6ezIejpZehEU4z4CqN2mLYBd0FUiRnG3wTqN3yhsc
+SPr5z0noX0+FCuKPkBurcEya67emP7SsXaRfz+bYipaQ908mgWB2XQ8kd5GzKjGf
+FlqyXYwcKapInI5v03hAcNt37N3j0VcFcC3mSZiIBYRiBXBWdoY5TtMibx3+bfEO
+s2LEPMvAhblhHrrhFYBZlAyuBbuMf1a+HNJav5fyakywxnB2sJCNwQs2uRHY1ihc
+6k/+JLcYCpsM0MF8XPtpvcyiTcaQvKZN8rG61ppnW5YCUtCC+cQKXA0o4D/I+pWV
+idWkvklsQLI+qGu41SWyxP7x09fn1txDAXYw+zuLXfdKiXyaNb78yvBXAfCNP6CH
+MntHWpdLgtJmwsQt6j8k9Kf5qLnjatkYYaA7jBU=
+-----END CERTIFICATE-----
diff --git a/docs/src/.vuepress/public/download/1.9.0/client_cert_issuing_cas.pem b/docs/src/.vuepress/public/download/1.9.0/client_cert_issuing_cas.pem
new file mode 100644
index 000000000..f961a1a75
--- /dev/null
+++ b/docs/src/.vuepress/public/download/1.9.0/client_cert_issuing_cas.pem
@@ -0,0 +1,715 @@
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Limited Basic CA 1-2 2019
+-----BEGIN CERTIFICATE-----
+MIIFuTCCBKGgAwIBAgIDD+VKMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTArBgNVBAMMJEQtVFJVU1QgTGltaXRl
+ZCBCYXNpYyBSb290IENBIDEgMjAxOTAeFw0xOTA4MjAxMjMyMjJaFw0zNDA2MTkw
+ODE1NTFaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAo
+BgNVBAMMIUQtVFJVU1QgTGltaXRlZCBCYXNpYyBDQSAxLTIgMjAxOTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANxlUGXW81Y2JG/BtEO5dlbELYat4Zx9
+5b4RUux5scPTZX3wrEW+PK4EwQCvV8FH0SoDatOJcFiGduX2r29c0aFFyVKu6xHF
+DApYNYV99+z5TiqXFdVkOUti56r10KsaO3FkcgAt4wDFgYd0dDseYo2SQqpKeqFR
+QMVQVdLCt66yU8qbiaZ/sL2pcNsJMD/DkEV/axpTwzzk6H+kGUIJ+jpKpYw2pMFF
+wYlqW91ICfLtTHvJqFb3DZ7yFNSiXgYBYH9R142vjflh1vg+GuqORiTLi/AhIjlb
+3XUAFIZzJ77+PLQprYlRHGGBMaJ+3VbI+hWPTHpwVt6wHNVcfHUnA3kCAwEAAaOC
+ApcwggKTMB8GA1UdIwQYMBaAFONo4hcITMmOHGJEDKkpkQJiC6OTMIIBMgYIKwYB
+BQUHAQEEggEkMIIBIDBABggrBgEFBQcwAYY0aHR0cDovL2xpbWl0ZWQtYmFzaWMt
+cm9vdC1jYS0xLTIwMTkub2NzcC5kLXRydXN0Lm5ldDBTBggrBgEFBQcwAoZHaHR0
+cDovL3d3dy5kLXRydXN0Lm5ldC9jZ2ktYmluL0QtVFJVU1RfTGltaXRlZF9CYXNp
+Y19Sb290X0NBXzFfMjAxOS5jcnQwgYYGCCsGAQUFBzAChnpsZGFwOi8vZGlyZWN0
+b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBS
+b290JTIwQ0ElMjAxJTIwMjAxOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y0FDZXJ0
+aWZpY2F0ZT9iYXNlPzAYBgNVHSAEETAPMA0GCysGAQQBpTQCg3QBMIHcBgNVHR8E
+gdQwgdEwgc6ggcuggciGgYBsZGFwOi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NO
+PUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBSb290JTIwQ0ElMjAxJTIwMjAx
+OSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlz
+dIZDaHR0cDovL2NybC5kLXRydXN0Lm5ldC9jcmwvZC10cnVzdF9saW1pdGVkX2Jh
+c2ljX3Jvb3RfY2FfMV8yMDE5LmNybDAdBgNVHQ4EFgQU0A0+3Aiv40EIZuDc8vqZ
+ai3fGLkwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwDQYJKoZI
+hvcNAQELBQADggEBAH8NXqPrIcKiZC51vfxvajB1HhFnRFFN/G3ZU4yR7XI+uGec
+DjR8tOHdFYFmZG4qbDl70ZuRG4bs6H8cvfWyo1NmWZqjAkr6o1kIRTnFwn4JsssJ
+7HR2RmJ4ar0C9miIk9sTNLwKy1/kBvCFqssdKdQwBSi85KRxPFYvv+vnMCvSL0Ob
++65q6V7QzvCk7ojiSrcfvHS8QnHJE9ReFRKD4KXAd7+OcZc1K3Mf+uNNHt3CP3ie
+DN9K90sI81IWucEeN2NYvw/tJNDH5L4Ah3cn8XzxQVzOfAnn1isf2pci1IEj5f3Y
+9JA7LYLLeH7n4+E5JWRiIUAhqNhQTchmwKLdR+E=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Limited Basic CA 1-3 2019
+-----BEGIN CERTIFICATE-----
+MIIFvzCCBKegAwIBAgIDD+UsMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxLTArBgNVBAMMJEQtVFJVU1QgTGltaXRl
+ZCBCYXNpYyBSb290IENBIDEgMjAxOTAeFw0xOTA2MjAxMTQ2NDlaFw0zNDA2MTkw
+ODE1NTFaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAo
+BgNVBAMMIUQtVFJVU1QgTGltaXRlZCBCYXNpYyBDQSAxLTMgMjAxOTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL7RBVVVynr23OCuKpkrzJK87yspTQVh
+vJRTtHS7zXG0jzpNLUV8D6Qjd3nOVs2VnW+rpfgQmFeic3E8G5jJmGv18O6LOGJS
+CXbiF2eonBQ0oTF97oVukj/8SRYWEBjeBjB//U3gwdt14qATw1zk3B8K/u0zxtQ0
+1xMTL5ckilQ7/+x+RVCGanvx/FscQ1He0fkhfLgqaDJimWu7b0phwZqyyI1GEjEN
+9FLWJxh4OeIzupAT4b1j5oaXHCY4BGT5zk6PbOYC7U2Jnt4zKU+pJVIJ+EhYOJS5
+tQM7YFG/eECAHcBtgdUIDgBZqrrx+k14aSQcW701sGqQT7cKcLen+yMCAwEAAaOC
+Ap0wggKZMB8GA1UdIwQYMBaAFONo4hcITMmOHGJEDKkpkQJiC6OTMIIBMgYIKwYB
+BQUHAQEEggEkMIIBIDBABggrBgEFBQcwAYY0aHR0cDovL2xpbWl0ZWQtYmFzaWMt
+cm9vdC1jYS0xLTIwMTkub2NzcC5kLXRydXN0Lm5ldDBTBggrBgEFBQcwAoZHaHR0
+cDovL3d3dy5kLXRydXN0Lm5ldC9jZ2ktYmluL0QtVFJVU1RfTGltaXRlZF9CYXNp
+Y19Sb290X0NBXzFfMjAxOS5jcnQwgYYGCCsGAQUFBzAChnpsZGFwOi8vZGlyZWN0
+b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBS
+b290JTIwQ0ElMjAxJTIwMjAxOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y0FDZXJ0
+aWZpY2F0ZT9iYXNlPzAYBgNVHSAEETAPMA0GCysGAQQBpTQCg3QBMIHiBgNVHR8E
+gdowgdcwgYmggYaggYOGgYBsZGFwOi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NO
+PUQtVFJVU1QlMjBMaW1pdGVkJTIwQmFzaWMlMjBSb290JTIwQ0ElMjAxJTIwMjAx
+OSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlz
+dDBJoEegRYZDaHR0cDovL2NybC5kLXRydXN0Lm5ldC9jcmwvZC10cnVzdF9saW1p
+dGVkX2Jhc2ljX3Jvb3RfY2FfMV8yMDE5LmNybDAdBgNVHQ4EFgQUZeInnG91+3Vn
+CLczeuOdjnssKIgwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+DQYJKoZIhvcNAQELBQADggEBAJLvDm1ZuBMhO2qR2R4H/GDDYETRBNqvtvWHRvBw
+vryhtDm7tovqDg2v7x+vcSqZApFVW+zs+OvzNRXtyyIlkqxP5CL0okpHqqmKaaHn
+tH8D93pV/p7xE39gFE6NNceSx6DHBxuOcOEha8zA8ixH+j+fzLX6SEOAhBIfCgDb
+qg9Xtxi7+uupq4koQcXrDNTRHxuoNxAHnwYtgapwKwyBwMMaLliqxVyDcwN6aJEQ
+tVoyOibUnUXej4bXh8FPCSU7m98nLY9aKk1O30jsgSiLxuVKBav8JaDPY1i69CSd
+vn2adNlHjbl/57GVQ4VoTDzlmhRQGR9TIRPYA5F6VdeI4ak=
+-----END CERTIFICATE-----
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST SSL Class 3 CA 1 2009
+-----BEGIN CERTIFICATE-----
+MIIFMjCCBBqgAwIBAgIDCZBjMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMTIxMjQ2NTVaFw0yOTExMDUwODM1NTha
+MEwxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJjAkBgNVBAMM
+HUQtVFJVU1QgU1NMIENsYXNzIDMgQ0EgMSAyMDA5MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAoal0SyLSijE0JkuhHJmOCbmQznyxuSY7DaEwhUsdUpI+
+2llkDLz6s9BWQe1zCVXDhrt3qz5U5H4h6jxm5Ec+ZbFiU3Gv2yxpI5cRPrqj9mJU
+1CGgy1+29khuUnoopzSq66HPuGZGh06I7bJkXTQ7AQ92z1MdL2wATj1UWdNid3sQ
+NiWIm+69nURHY6tmCNenNcG6aV4qjHMUPsjpCRabNY9nUO12rsmiDW2mbAC3gcxQ
+lqLgLYur9HvB8cW0xu2JZ/B3PXmNphVuWskp3Y1u0SvIYzuEsE7lWDbBmtWZtabB
+hzThkDQvd+3keQ1sU/beq1NeXfgKzQ5G+4Ql2PUY/wIDAQABo4ICGjCCAhYwHwYD
+VR0jBBgwFoAU/doUxJ8w3iG9HkI5/KtjI0ng8YQwRAYIKwYBBQUHAQEEODA2MDQG
+CCsGAQUFBzABhihodHRwOi8vcm9vdC1jMy1jYTItMjAwOS5vY3NwLmQtdHJ1c3Qu
+bmV0MF8GA1UdIARYMFYwVAYEVR0gADBMMEoGCCsGAQUFBwIBFj5odHRwOi8vd3d3
+LmQtdHJ1c3QubmV0L2ludGVybmV0L2ZpbGVzL0QtVFJVU1RfUm9vdF9QS0lfQ1BT
+LnBkZjAzBgNVHREELDAqgRBpbmZvQGQtdHJ1c3QubmV0hhZodHRwOi8vd3d3LmQt
+dHJ1c3QubmV0MIHTBgNVHR8EgcswgcgwgYCgfqB8hnpsZGFwOi8vZGlyZWN0b3J5
+LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xhc3MlMjAzJTIwQ0El
+MjAyJTIwMjAwOSxPPUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZv
+Y2F0aW9ubGlzdDBDoEGgP4Y9aHR0cDovL3d3dy5kLXRydXN0Lm5ldC9jcmwvZC10
+cnVzdF9yb290X2NsYXNzXzNfY2FfMl8yMDA5LmNybDAdBgNVHQ4EFgQUUBkylJrE
+tQRNVtDAgyHVNVWwsXowDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDQYJKoZIhvcNAQELBQADggEBABM5QRHX/yInsmZLWVlvmWmKb3c4IB3hAIVR
+sAGhkvQJ/RD1GZjZUBBYMWkD1P37fTQxlqTOe3NecVvElkYZuCq7HSM6o7awzb3m
+yLn1kN+hDCsxX0EYbVSNjEjkW3QEkqJH9owH4qeMDxf7tfXB7BVKO+rarYPa2PR8
+Wz2KhjFDmAeFg2J89YcpeJJEEJXoweAkgJEEwwEIfJ2yLjYo78RD0Rvij/+zkfj9
++dSvTiZTuqicyo37qNoYHgchuqXnKodhWkW89oo2NKhfeNHHbqvXEJmx0PbI6YyQ
+50GnYECZRHNKhgbPEtNy/QetU53aWlTlvu4NIwLW5XVsrxlQ2Zw=
+-----END CERTIFICATE-----
+Subject: C=DE,O=Verein zur Foerderung eines Deutschen Forschungsnetzes e. V.,OU=DFN-PKI,CN=DFN-Verein Global Issuing CA
+-----BEGIN CERTIFICATE-----
+MIIFrDCCBJSgAwIBAgIHG2O60B4sPTANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UE
+BhMCREUxRTBDBgNVBAoTPFZlcmVpbiB6dXIgRm9lcmRlcnVuZyBlaW5lcyBEZXV0
+c2NoZW4gRm9yc2NodW5nc25ldHplcyBlLiBWLjEQMA4GA1UECxMHREZOLVBLSTEt
+MCsGA1UEAxMkREZOLVZlcmVpbiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4X
+DTE2MDUyNDExMzg0MFoXDTMxMDIyMjIzNTk1OVowgY0xCzAJBgNVBAYTAkRFMUUw
+QwYDVQQKDDxWZXJlaW4genVyIEZvZXJkZXJ1bmcgZWluZXMgRGV1dHNjaGVuIEZv
+cnNjaHVuZ3NuZXR6ZXMgZS4gVi4xEDAOBgNVBAsMB0RGTi1QS0kxJTAjBgNVBAMM
+HERGTi1WZXJlaW4gR2xvYmFsIElzc3VpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCdO3kcR94fhsvGadcQnjnX2aIw23IcBX8pX0to8a0Z1kzh
+axuxC3+hq+B7i4vYLc5uiDoQ7lflHn8EUTbrunBtY6C+li5A4dGDTGY9HGRp5Zuk
+rXKuaDlRh3nMF9OuL11jcUs5eutCp5eQaQW/kP+kQHC9A+e/nhiIH5+ZiE0OR41I
+X2WZENLZKkntwbktHZ8SyxXTP38eVC86rpNXp354ytVK4hrl7UF9U1/Isyr1ijCs
+7RcFJD+2oAsH/U0amgNSoDac3iSHZeTn+seWcyQUzdDoG2ieGFmudn730Qp4PIdL
+sDfPU8o6OBDzy0dtjGQ9PFpFSrrKgHy48+enTEzNAgMBAAGjggIFMIICATASBgNV
+HRMBAf8ECDAGAQH/AgEBMA4GA1UdDwEB/wQEAwIBBjApBgNVHSAEIjAgMA0GCysG
+AQQBga0hgiweMA8GDSsGAQQBga0hgiwBAQQwHQYDVR0OBBYEFGs6mIv58lOJ2uCt
+sjIeCR/oqjt0MB8GA1UdIwQYMBaAFJPj2DIm2tXxSqWRSuDqS+KiDM/hMIGPBgNV
+HR8EgYcwgYQwQKA+oDyGOmh0dHA6Ly9jZHAxLnBjYS5kZm4uZGUvZ2xvYmFsLXJv
+b3QtZzItY2EvcHViL2NybC9jYWNybC5jcmwwQKA+oDyGOmh0dHA6Ly9jZHAyLnBj
+YS5kZm4uZGUvZ2xvYmFsLXJvb3QtZzItY2EvcHViL2NybC9jYWNybC5jcmwwgd0G
+CCsGAQUFBwEBBIHQMIHNMDMGCCsGAQUFBzABhidodHRwOi8vb2NzcC5wY2EuZGZu
+LmRlL09DU1AtU2VydmVyL09DU1AwSgYIKwYBBQUHMAKGPmh0dHA6Ly9jZHAxLnBj
+YS5kZm4uZGUvZ2xvYmFsLXJvb3QtZzItY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0
+MEoGCCsGAQUFBzAChj5odHRwOi8vY2RwMi5wY2EuZGZuLmRlL2dsb2JhbC1yb290
+LWcyLWNhL3B1Yi9jYWNlcnQvY2FjZXJ0LmNydDANBgkqhkiG9w0BAQsFAAOCAQEA
+gXhFpE6kfw5V8Amxaj54zGg1qRzzlZ4/8/jfazh3iSyNta0+x/KUzaAGrrrMqLGt
+Mwi2JIZiNkx4blDw1W5gjU9SMUOXRnXwYuRuZlHBQjFnUOVJ5zkey5/KhkjeCBT/
+FUsrZpugOJ8Azv2n69F/Vy3ITF/cEBGXPpYEAlyEqCk5bJT8EJIGe57u2Ea0G7UD
+DDjZ3LCpP3EGC7IDBzPCjUhjJSU8entXbveKBTjvuKCuL/TbB9VbhBjBqbhLzmyQ
+GoLkuT36d/HSHzMCv1PndvncJiVBby+mG/qkE5D6fH7ZC2Bd7L/KQaBh+xFJKdio
+LXUV2EoY6hbvVTQiGhONBg==
+-----END CERTIFICATE-----
+Subject: C=DE,ST=Bayern,L=Muenchen,O=Fraunhofer,OU=Fraunhofer Corporate PKI,CN=Fraunhofer User CA - G02
+-----BEGIN CERTIFICATE-----
+MIIFqzCCBJOgAwIBAgIHG2O6xotSQjANBgkqhkiG9w0BAQsFADCBlTELMAkGA1UE
+BhMCREUxRTBDBgNVBAoTPFZlcmVpbiB6dXIgRm9lcmRlcnVuZyBlaW5lcyBEZXV0
+c2NoZW4gRm9yc2NodW5nc25ldHplcyBlLiBWLjEQMA4GA1UECxMHREZOLVBLSTEt
+MCsGA1UEAxMkREZOLVZlcmVpbiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAyMB4X
+DTE2MDUyNDExMzgzMFoXDTMxMDIyMjIzNTk1OVowgYwxCzAJBgNVBAYTAkRFMQ8w
+DQYDVQQIDAZCYXllcm4xETAPBgNVBAcMCE11ZW5jaGVuMRMwEQYDVQQKDApGcmF1
+bmhvZmVyMSEwHwYDVQQLDBhGcmF1bmhvZmVyIENvcnBvcmF0ZSBQS0kxITAfBgNV
+BAMMGEZyYXVuaG9mZXIgVXNlciBDQSAtIEcwMjCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAL1FxEM9lv2hli0ZvDCDNvVn2mIcIJ4cvKUQ30l5ZARkKEtY
+KlqSsrof2WmWFdxx1DPwFtp38QgbsbOPKSDoYiWw+ycW403f1ZJAvn6c5N07oT1A
+j3xzYG/QxgY+qkLhKJnV0pr7afC+VIFB/wmNFhvlyXpAVy07NOikiRFlBzw/s4/H
+HdHTL2VKEjCnfD6rzKtTN+D+24UYXiMvNzmPyWQMQhIxuDMPTwfoqBFL7leo334z
+gHm78leaLK52DTzpHvlNHP4DnTRa2ipVpyj3yQWcOBw+75oVE71AbyFPzw1a0J9P
+wisZljQ0eTb6/tkF81W5f6UD7NN4Ie2gxEvZkysCAwEAAaOCAgUwggIBMBIGA1Ud
+EwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMCkGA1UdIAQiMCAwDQYLKwYB
+BAGBrSGCLB4wDwYNKwYBBAGBrSGCLAEBBDAdBgNVHQ4EFgQUoyb1mk/b2jvhtaru
+WIvQ/P+1bVEwHwYDVR0jBBgwFoAUk+PYMiba1fFKpZFK4OpL4qIMz+EwgY8GA1Ud
+HwSBhzCBhDBAoD6gPIY6aHR0cDovL2NkcDEucGNhLmRmbi5kZS9nbG9iYWwtcm9v
+dC1nMi1jYS9wdWIvY3JsL2NhY3JsLmNybDBAoD6gPIY6aHR0cDovL2NkcDIucGNh
+LmRmbi5kZS9nbG9iYWwtcm9vdC1nMi1jYS9wdWIvY3JsL2NhY3JsLmNybDCB3QYI
+KwYBBQUHAQEEgdAwgc0wMwYIKwYBBQUHMAGGJ2h0dHA6Ly9vY3NwLnBjYS5kZm4u
+ZGUvT0NTUC1TZXJ2ZXIvT0NTUDBKBggrBgEFBQcwAoY+aHR0cDovL2NkcDEucGNh
+LmRmbi5kZS9nbG9iYWwtcm9vdC1nMi1jYS9wdWIvY2FjZXJ0L2NhY2VydC5jcnQw
+SgYIKwYBBQUHMAKGPmh0dHA6Ly9jZHAyLnBjYS5kZm4uZGUvZ2xvYmFsLXJvb3Qt
+ZzItY2EvcHViL2NhY2VydC9jYWNlcnQuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQDE
+klJ5thEqcbIyroBrhnWl00oAUXYuYQqXDpBTCzF08aBk41FyLZXH54w7NUecdTZp
+aq0SgueogbSv9viT8EzQ5Bt6bapOl5pVjEb6yBrV0Y3d5Vb3h8WA+/E+DRz/uV5M
+gKdVHdazimuXK1HHf0UHSFiEkgiY3xSQr6CRH7UzzivWj9s6B2GUuP4zzfKrgAxQ
+N2IaEUtvWiwl5Mtv55p6wmnBOhCnCtj1Ge5Du7jR8o2xAh//fZ4tz5UQ7XXVoeu5
+iueZp3qNb0cTtiGGPJxVtFmoaFNltp+zI/y52hF9XgjC+mJBVYYahmacW3wMpIAO
+R0lstmlDfiKvecyE6S4v
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT OV ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDeTCCAv+gAwIBAgIRAOuOgRlxKfSvZO+BSi9QzukwCgYIKoZIzj0EAwMwgYgx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJz
+ZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQD
+EyVVU0VSVHJ1c3QgRUNDIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIwMDIx
+ODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowRDELMAkGA1UEBhMCTkwxGTAXBgNVBAoT
+EEdFQU5UIFZlcmVuaWdpbmcxGjAYBgNVBAMTEUdFQU5UIE9WIEVDQyBDQSA0MFkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXYkvGrfrMs2IwdI5+IwpEwPh+igW/BOW
+etmOwP/ZIXC8fNeC3/ZYPAAMyRpFS0v3/c55FDTE2xbOUZ5zeVZYQqOCAYswggGH
+MB8GA1UdIwQYMBaAFDrhCYbUzxnClnZ0SXbc4DXGY2OaMB0GA1UdDgQWBBTttKAz
+ahsIkba9+kGSvZqrq2P0UzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB
+/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwOAYDVR0gBDEwLzAt
+BgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAG
+A1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1
+c3RFQ0NDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgw
+PwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RF
+Q0NBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRy
+dXN0LmNvbTAKBggqhkjOPQQDAwNoADBlAjAfs9nsM0qaJGVu6DpWVy4qojiOpwV1
+h/MWZ5GJxy6CKv3+RMB3STkaFh0+Hifbk24CMQDRf/ujXAQ1b4nFpZGaSIKldygc
+dCDAxbAd9tlxcN/+J534CJDblzd/40REzGWwS5k=
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT OV RSA CA 4
+-----BEGIN CERTIFICATE-----
+MIIG5TCCBM2gAwIBAgIRANpDvROb0li7TdYcrMTz2+AwDQYJKoZIhvcNAQEMBQAw
+gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
+ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
+VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIw
+MDIxODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowRDELMAkGA1UEBhMCTkwxGTAXBgNV
+BAoTEEdFQU5UIFZlcmVuaWdpbmcxGjAYBgNVBAMTEUdFQU5UIE9WIFJTQSBDQSA0
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApYhi1aEiPsg9ZKRMAw9Q
+r8Mthsr6R20VSfFeh7TgwtLQi6RSRLOh4or4EMG/1th8lijv7xnBMVZkTysFiPmT
+PiLOfvz+QwO1NwjvgY+Jrs7fSoVA/TQkXzcxu4Tl3WHi+qJmKLJVu/JOuHud6mOp
+LWkIbhODSzOxANJ24IGPx9h4OXDyy6/342eE6UPXCtJ8AzeumTG6Dfv5KVx24lCF
+TGUzHUB+j+g0lSKg/Sf1OzgCajJV9enmZ/84ydh48wPp6vbWf1H0O3Rd3LhpMSVn
+TqFTLKZSbQeLcx/l9DOKZfBCC9ghWxsgTqW9gQ7v3T3aIfSaVC9rnwVxO0VjmDdP
+FNbdoxnh0zYwf45nV1QQgpRwZJ93yWedhp4ch1a6Ajwqs+wv4mZzmBSjovtV0mKw
+d+CQbSToalEUP4QeJq4Udz5WNmNMI4OYP6cgrnlJ50aa0DZPlJqrKQPGL69KQQz1
+2WgxvhCuVU70y6ZWAPopBa1ykbsttpLxADZre5cH573lIuLHdjx7NjpYIXRx2+QJ
+URnX2qx37eZIxYXz8ggM+wXH6RDbU3V2o5DP67hXPHSAbA+p0orjAocpk2osxHKo
+NSE3LCjNx8WVdxnXvuQ28tKdaK69knfm3bB7xpdfsNNTPH9ElcjscWZxpeZ5Iij8
+lyrCG1z0vSWtSBsgSnUyG/sCAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5v1qq
+K0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRvHTVJEGwy+lmgnryK6B+VvnF6DDAO
+BgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggr
+BgEFBQcDAQYIKwYBBQUHAwIwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUH
+AgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0
+dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9u
+QXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6
+Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAl
+BggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0B
+AQwFAAOCAgEAUtlC3e0xj/1BMfPhdQhUXeLjb0xp8UE28kzWE5xDzGKbfGgnrT2R
+lw5gLIx+/cNVrad//+MrpTppMlxq59AsXYZW3xRasrvkjGfNR3vt/1RAl8iI31lG
+hIg6dfIX5N4esLkrQeN8HiyHKH6khm4966IkVVtnxz5CgUPqEYn4eQ+4eeESrWBh
+AqXaiv7HRvpsdwLYekAhnrlGpioZ/CJIT2PTTxf+GHM6cuUnNqdUzfvrQgA8kt1/
+ASXx2od/M+c8nlJqrGz29lrJveJOSEMX0c/ts02WhsfMhkYa6XujUZLmvR1Eq08r
+48/EZ4l+t5L4wt0DV8VaPbsEBF1EOFpz/YS2H6mSwcFaNJbnYqqJHIvm3PLJHkFm
+EoLXRVrQXdCT+3wgBfgU6heCV5CYBz/YkrdWES7tiiT8sVUDqXmVlTsbiRNiyLs2
+bmEWWFUl76jViIJog5fongEqN3jLIGTG/mXrJT1UyymIcobnIGrbwwRVz/mpFQo0
+vBYIi1k2ThVh0Dx88BbF9YiP84dd8Fkn5wbE6FxXYJ287qfRTgmhePecPc73Yrzt
+apdRcsKVGkOpaTIJP/l+lAHRLZxk/dUtyN95G++bOSQqnOCpVPabUGl2E/OEyFrp
+Ipwgu2L/WJclvd6g+ZA/iWkLSMcpnFb+uX6QBqvD6+RNxul1FaB5iHY=
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT Personal CA 4
+-----BEGIN CERTIFICATE-----
+MIIG5jCCBM6gAwIBAgIQMQJw1DW+mySa+FbQ4eKFSTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjAw
+MjE4MDAwMDAwWhcNMzMwNTAxMjM1OTU5WjBGMQswCQYDVQQGEwJOTDEZMBcGA1UE
+ChMQR0VBTlQgVmVyZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0Eg
+NDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALNK4iJeJ1vpBFsUBDUy
+IBSutNIxQMbNUMAeoUTKr55KYX8tkN5imzNqLaRCypYBPP9wED2AaO6e8njkbjzJ
+wLgPqDBkW9sG3kmi3GW6cF4Hwr5ysZqve/5EJDhV+9OhfTu/4dMnoR4Q41HcjMk9
+MzLOADAQ0awBZ/29r0d49AUmIKELNeqEqmnTN6fndL7x/2K0TLToZLxqS7sy/Jvi
+0wEFr0CfdjcAsioh7KaD+Jizyb1aRKQzJ6Q20VEHX7UqWc1SkzTkbz6xj0S5ydBB
+FQh0fNiy+qM/deVpK4HgmPSJrrpQZ+LlbHfWabmwoDPxF71QZVYiqrrAoUrGRJ+4
+7iLBiIg8miIYS7Hd2ppvAUt24CugMXUjETjQ+oYh09fNi5n/AvoER8UBvTHLxt+b
+lL0bvL+2z2YiUWk+2Qtn+dD+JU5Z2y71qV7+cr+4YXjvGzF5bYsi8HiwflTb4Php
+3y+k1twKtchdcq2QGc0eDG6Y01nRHUiyr8/PtMAsLHEPNZ2wzsA7fb8mftHiV20Z
+FmYqknJ8AIOfwdTVA+E62JayOJ+sxadqcmFDorsz/mrPwGZ8+txr4xSuvVjg0dlv
+0yuA+1YpBDIYNfL4bkX+IcZ1mTstL4Xw0f4N2iW3bBmnPnYmoYxMM8gflCiTgss7
+3nBvG2f7v1PD7BDGYNO4iD4vAgMBAAGjggGLMIIBhzAfBgNVHSMEGDAWgBRTeb9a
+qitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUaQChxyFY+ODFGyCwCt2nUb8T2eQw
+DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwIGCCsGAQUFBwMEMDgGA1UdIAQxMC8wLQYEVR0gADAlMCMGCCsGAQUF
+BwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzBQBgNVHR8ESTBHMEWgQ6BBhj9o
+dHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlv
+bkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRw
+Oi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQw
+JQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcN
+AQEMBQADggIBAAoFTnsNjx8TOQD9b+xixsPt7Req4wHMeNw/R5dddEPgQAQAYJZK
+z5BEv1cjGbH7nbPH3AxrxhN6OVH40p6OLIo9MXSrrfMzGs7/P+FTCjwgNxFEtLQ1
+KC9NboA3asJcl7mIs3l8h9iAgEH1zLUvq2s+5n++NQmbzudDsTFDMapY3kX1TwyU
+CTRzmItqcbsYIyg2MeIXWfRtqPqC5R4bufmpzA5BPINLX340Sp/CNQ9QZqw3Vkfy
+HWwTo+vO9Gm2L6srNamJT6Lb+TeXZvl8UPL5a72O/pH0GgGHjt6z9QzPARnaRKsh
+VWviNK6ST4WmZHllu3CJg0BXqx1vWyswawgvNeWt1qxITacYe9mSWTbNR2CftvTU
+werruDSY2jMaZPoNqbjUpuG/blYwWzzvVerBUhviAahPXJF/9V48ybWPBq6qKOEo
+kW+s3B4ad5sY96KlovEijaIQDip1HO0SD+rLNYaiBcr9MV2aK+DfbZ8w9BaNCQyF
+EYwzxIKOVk3bYvzHRk5ihUDascmbk/bkiNl74c/KfuKQmJImaqWoWZR6jBcXcPV0
+WUIKz/nILTpFhGojZEQW77by3aezAi9jrEIUBHRG1LwzPbJc2V3SOzYyaJFQatzu
+KZbN1Q9s9y/2x1QXtKwREY8jNgvx0iIfOK35gKgYJJcyDql4XfuEc2nV
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT Personal ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDfjCCAwSgAwIBAgIQdpAhff5d1sLEUCfF3NFaJjAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjAwMjE4
+MDAwMDAwWhcNMzMwNTAxMjM1OTU5WjBKMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQ
+R0VBTlQgVmVyZW5pZ2luZzEgMB4GA1UEAxMXR0VBTlQgUGVyc29uYWwgRUNDIENB
+IDQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQYZ2cR4O5tfdskg2NNo346Noyo
+enQjWhWQElTQQ+brmMxr5leW1AfpAJ9bsaUadsCJJnA5ycFITYjXfl/XvfPko4IB
+izCCAYcwHwYDVR0jBBgwFoAUOuEJhtTPGcKWdnRJdtzgNcZjY5owHQYDVR0OBBYE
+FKgtbYEyZI3msk+s/hHyZZmFE6luMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E
+CDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDA4BgNVHSAE
+MTAvMC0GBFUdIAAwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9D
+UFMwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3QuY29tL1VT
+RVJUcnVzdEVDQ0NlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
+BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJU
+cnVzdEVDQ0FkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51
+c2VydHJ1c3QuY29tMAoGCCqGSM49BAMDA2gAMGUCMQCCX6P32oo7RiAIk1DIekZM
+nFGZwY+xJoZ5HyChGc1Ncuupnh7Ezukr1EnL+MyAhNcCMD6DlSMWE5I++OBvznnX
+1npjvntLcKogArAPjLglGGeymFt4U6pdy7/C0/miHCPuDA==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT S/MIME ECC 1
+-----BEGIN CERTIFICATE-----
+MIIDdjCCAvugAwIBAgIQDJz22V5XPKzFUHJkSyvftjAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTE0MFoXDTM5MTIzMTExMTEzOVowYzEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGzAZBgNVBAMMEkdFQU5UIFMvTUlNRSBFQ0Mg
+MTB2MBAGByqGSM49AgEGBSuBBAAiA2IABHHzZBx8BXADofSXSxbumNUgOW7oPUFD
+MTBf97xIFnUvxGf449zwH17IBxs6EnsIRSZ80+3fMPGm7PcW4bogQmpStkHsbhl/
+yc+R0YudJcnXnC+HuGwkKlk9hoXX+gtBJ6OCAWYwggFiMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHwYDVR0jBBgwFoAUUgjSvjKBJf31GpfsTl8au1PNkK0wUAYIKwYBBQUH
+AQEERDBCMEAGCCsGAQUFBzAChjRodHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0Et
+Q2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8G
+CCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRzL0NQUzAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwRQYDVR0fBD4wPDA6oDigNoY0
+aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1Sb290LTIwMjEtRUND
+LmNybDAdBgNVHQ4EFgQUccTTotYuiaWImnarwbliZz8kZeswDgYDVR0PAQH/BAQD
+AgGGMAoGCCqGSM49BAMDA2kAMGYCMQDbRE4Sf4j5cdd9PlC4xjnNvJxfsDX5ouYb
+3ffJ6ukmEjI7RnHm6xJ2V++40nWYVfgCMQDfXaawZpZymK4CBIMHxoViSYBHw/Mm
+JOG3trrP+Q4Kb0AfJb/S2ojAD+EAKiiB5hM=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT S/MIME RSA 1
+-----BEGIN CERTIFICATE-----
+MIIGRDCCBCygAwIBAgIQFfmubKqNLtTTb3h/Htx7ATANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTMwOFoXDTM5MTIzMTExMTMwN1ow
+YzELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExGzAZBgNVBAMMEkdFQU5UIFMvTUlNRSBS
+U0EgMTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKu4bq/+byKjHo25
+Xz32YBmO+Wrkmc+UmfcdXSCI7yawwU9JSMEHAAKAASaJpLr9JAyt+tlB/rn/Sazn
+SwY4ipBIffR0D5k/ndfiI553dWgI4i/tkOGlNej/7JyE2CS9kTlOOs6pg5HaDpwq
+jAhCkje+IByg5gKWH6lzvMJo5jQOtsGB2q6e5cYKwa9LJOAcR8iquds9LFssbHSM
+uVdSuTjpAjcGLqWfW++C0YXpWD+UonjQ6lNEuiKUDmrFc+SEtLw56lYtp4uuxm4L
+W/HQSsx+oGwMBqaR6HhBQ3LydONjsbcbegRqJZFJoLsnwIHorEag44UIvjXzYJAx
+/NTiwVdHldO7cEvWscDbyQLR9koBoliq2HrgYFQs7NQxU+7MLNSh8i6znWVNISUE
+g36M//I8BZl4VqD70ELlhKKN7rx+i7BwKOd2gxdWgFJhkPyQu9o+82R9epXiRblo
+/rdkyv+2BFR7VpbgPUzncdi8/0h4dP/qQFYnA+Df0FFj7gYczwIDAQABo4IBZjCC
+AWIwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBSg1gc9XiT3e6BELiRS
+DRmqKwSRpzBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly9jcnQu
+aGFyaWNhLmdyL0hBUklDQS1DbGllbnQtUm9vdC0yMDIxLVJTQS5jZXIwRAYDVR0g
+BD0wOzA5BgRVHSAAMDEwLwYIKwYBBQUHAgEWI2h0dHA6Ly9yZXBvLmhhcmljYS5n
+ci9kb2N1bWVudHMvQ1BTMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBF
+BgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtQ2xp
+ZW50LVJvb3QtMjAyMS1SU0EuY3JsMB0GA1UdDgQWBBTrsi87/a4CzCpEBl0lzR0S
+ImiwRzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBADveuEX23Dwr
+kygKtsF7DmcTGmi8SE20jmJLe0TMT8Nws1NqppE0ACym1agtY1IjUFm5MWabG/Ic
+vRTh8sB9cRZgDQMqZLNCLofqL4aj/dKBXH4bwH2MVdjNHBoGvZkyhRz/kBE+x1va
+WXclhWQMOX5nVvRMfiEJiYotMP7KM88IaVZ9DkGJJEVftsnUWuvCWUtjagD6XWlq
+LHjNl+LufiZ/h9lDvaWqG1/obfdStgofMc30RL+ES6gYKRwZpCA1coFzXV7Cnwx8
+toTl8bReqCNXexKzxlqAcRXPOmlKkJQuqRI297oNuMPnoNZCY+yLnxyd4kZuu0Xc
+OTNTpVjM8bvg8ACqhSYanrNDi/zTiTk7gwm9GyH1X45fFNGNEFgpIaApjT2UELuk
+DOmP18ZwC4EQeHawPJIqffMEmUJm6qbRPKGnNmcyygh4iZU3QbkRLLp3Z6QV3WoT
+Eqyf5mL9qTGS6WJG65L8oaKw1Xh/bdGuVIDyBahpfP2c2pCd0UH6+x73Rrq9GFlO
+ijVr2OQSvKhzETNG917SvcURCBhMnIQFUXqHQyIY60eH1po6WtNOq/1K5kpOG6Sq
+1RVc02LEit48uK4tRMVUKekSOjruGXW38DmAriPcMHjI6VQbqjc0Sq1VPz76ee4F
+M5uLviSUZHYqDDqMWa8LFImK9iiKI8E3
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT TLS ECC 1
+-----BEGIN CERTIFICATE-----
+MIIDNzCCArygAwIBAgIQQv3c4SYWB+Gl5pNaQAFh3TAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTI1MDEwMzExMTQyMVoXDTM5MTIzMTExMTQyMFowYDELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExGDAWBgNVBAMMD0dFQU5UIFRMUyBFQ0MgMTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABANPWLwh0Za2UqtbLV7/qNRm78zsttgSuvhn73bU
+GtxETsVOEZeMUfMjgHw8EwrsSJI9oj0CgZQFFSEY1NJfcxA/NJiOYJUKPsFbpOrY
+dr0q4g+aBZsXWeh7bMCzx24g/aOCAS0wggEpMBIGA1UdEwEB/wQIMAYBAf8CAQAw
+HwYDVR0jBBgwFoAUyRtTgRL+BNUW0aq8mm+3oJUZbsowTQYIKwYBBQUHAQEEQTA/
+MD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LmhhcmljYS5nci9IQVJJQ0EtVExTLVJv
+b3QtMjAyMS1FQ0MuY2VyMBEGA1UdIAQKMAgwBgYEVR0gADAdBgNVHSUEFjAUBggr
+BgEFBQcDAgYIKwYBBQUHAwEwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybC5o
+YXJpY2EuZ3IvSEFSSUNBLVRMUy1Sb290LTIwMjEtRUNDLmNybDAdBgNVHQ4EFgQU
+6ZkGjRcfq/uWGlrIW15dXuzanI8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMD
+A2kAMGYCMQD2M1caaY2OwmthgmANUQg3LBLI0/2LiCdxa2zNq0G59wVzbjEk0cR/
+px52OegIwRACMQCk+iTmBlR6Xfv6igiiaFiPYfN2HfbcYLWbot5DZ2H1b4JVJV+V
+rga7uu50SDG9hf4=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=GEANT TLS RSA 1
+-----BEGIN CERTIFICATE-----
+MIIGBTCCA+2gAwIBAgIQFNV782kiKCGaVWf6kWUbIjANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTI1MDEwMzExMTUwMFoXDTM5MTIzMTExMTQ1OVowYDEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGDAWBgNVBAMMD0dFQU5UIFRMUyBSU0EgMTCC
+AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKEEaZSzEzznAPk8IEa17GSG
+yJzPTj4cwRY7/vcq2BPT5+IRGxQtaCdgLXIEl2cdPdIkj2eyakFmgMjAtyeju8V8
+dRayQCD/bWjJ7thDlowgLljQaXirxnYbT8bzRHAhCZqBakYgi5KWw9dANLyDHGpX
+UdY259ab0lWEaFE5Uu6IzQSMJOAy4l/Twym8GUiy0qMDEBFSlm31C9BXpdHKKAlh
+vIjMiKoDeTWl5vZaLB2MMRGY1yW2ftPgIP0/MkX1uFITlvHmmMTngxplH1nybEIJ
+FiwHg1KiLk1TprcZgeO2gxE5Lz3wTFWrsUlAzrh5xWmscWkjNi/4BpeuiT5+NExF
+czboLnXOfjuci/7bsnPi1/aZN/iKNbJRnngFoLaKVMmqCS7Xo34f+BITatryQZFE
+u2oDKExQGlxDBCfYMLgLucX/onpLzUSgeQITNLx6i5tGGbUYH+9Dy3GI66L/5tPj
+qzlOsydki8ZYGE5SBJeWCZ2IrhUe0WzZ2b6Zhk6JAQIDAQABo4IBLTCCASkwEgYD
+VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQKSCOmYKSSCjPqk1vFV+olTb0S
+7jBNBggrBgEFBQcBAQRBMD8wPQYIKwYBBQUHMAKGMWh0dHA6Ly9jcnQuaGFyaWNh
+LmdyL0hBUklDQS1UTFMtUm9vdC0yMDIxLVJTQS5jZXIwEQYDVR0gBAowCDAGBgRV
+HSAAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATBCBgNVHR8EOzA5MDeg
+NaAzhjFodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtVExTLVJvb3QtMjAyMS1S
+U0EuY3JsMB0GA1UdDgQWBBSGAXI/jKlw4jEGUxbOAV9becg8OzAOBgNVHQ8BAf8E
+BAMCAYYwDQYJKoZIhvcNAQELBQADggIBABkssjQzYrOo4GMsKegaChP16yNe6Sck
+cWBymM455R2rMeuQ3zlxUNOEt+KUfgueOA2urp4j6TlPbs/XxpwuN3I1f09Luk5b
++ZgRXM7obE6ZLTerVQWKoTShyl34R2XlK8pEy7+67Ht4lcJzt+K6K5gEuoPSGQDP
+ef+fUfmXrFcgBMcMbtfDb9dubFKNZZxo5nAXiqhFMOIyByag3H+tOTuH8zuId9pH
+RDsUpAIHJ9/W2WBfLcKav7IKRlNBRD/sPBy903J9WHPKwl8kQSDA+aa7XCYk7bJt
+Eyf+7GM9F5cZ7+YyknXqnv/rtQEkTKZdQo5Us18VFe9qqj94tXbLdk7PejJYNB4O
+Zlli44Ld7rtqfFlUych7gIxFOmiyxMQQYrYmUi+74lEZvfoNhuref0CupuKpz6O3
+dLv6kO9T10uNdDBoBQTkge3UzHafTIe3R2o3ujXKUGPwyc9m7/FETyKLUCwSU/5O
+AVOeBCU8QtkKKjM8AmbpKpe3pHWcyq3R7B3LmIALkMPTydyDfxen65IDqREbVq8N
+xjhkJThUz40JqOlN6uqKqeDISj/IoucYwsqW24AlO7ZzNmohQmMi8ep23H4hBSh0
+GBTe2XvkuzaNf92syK8l2HzO+13GLCjzYLTPvXTO9UpK8DGyfGZOuamuwbAnbNpE
+3RfjV9IaUQGJ
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT eScience Personal CA 4
+-----BEGIN CERTIFICATE-----
+MIIG8DCCBNigAwIBAgIRAKoycu7aGxmmN/byVir07vEwDQYJKoZIhvcNAQEMBQAw
+gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
+ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
+VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIw
+MDIxODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowTzELMAkGA1UEBhMCTkwxGTAXBgNV
+BAoTEEdFQU5UIFZlcmVuaWdpbmcxJTAjBgNVBAMTHEdFQU5UIGVTY2llbmNlIFBl
+cnNvbmFsIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCVokk9
+uR1UAJRcNg1NTatsuxEwya7FpTRm5wcbSJqSLeUd5gjI2zHzwjaevHwCjN716blp
+iyvEVr96aGw2y+FrVo/0yr0+/XoK8WdkB64j3KmOdUttTTXERY1T1vXxvkZhchHl
+JvD/VVDIt/V/xg2iDpAa2N3SW0SNSyuAGqtVaCTM4eOEgVT1Nyg5VtQJVLujMrvv
+cW6+1W1rLR2O05FxQtINVnrblTKWotAitEv8yMe9qQr1Fz4sdyVj2cBwEk/zQLok
+JRCSw981Hoh5kwt4AVMSxjfeSRjx0Wt0C6ioRJ8WAfSWGNDZwnUWZ4nJrW2UWtdJ
+Z59t2VByBR3e8MlVTVE4pirg3R5lCCIzPhNLQm25Rap/a4m3+e9A+Jnjgfi3XzSB
+fd+gcMh1xBXK+YOOfbnZW4H8T1Ty9I/HKsUp/isLV8TJsFOLZCyuV14qVfi8jmRU
+0wYIK4vQRj2M7VxCyH4MPn6lgnyecIieL0b4gFNWhE2waH2gfigvpQWH6bQuSWIh
+l0PaRDWFavo1SNTFKdAVQDK7w3Iw3XzOhQnjHgU/idvqd5eaqa2G4VN1vV1pNirC
+LXJccKK49zDSS1IFMX9iQC4YFxc/BbWRndI3smg05dcYn7Di73B0EzFFO6dyg0WD
+r2N9G/8fgjv89biSARMNzjtg2XR2cLxdT8PAYwIDAQABo4IBizCCAYcwHwYDVR0j
+BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFLYvVVqwyWAZ788J
+WtHxE51sjMkEMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
+A1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDA4BgNVHSAEMTAvMC0GBFUdIAAw
+JTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwUAYDVR0fBEkw
+RzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJTQUNl
+cnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEBBGowaDA/BggrBgEF
+BQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJTQUFkZFRy
+dXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
+MA0GCSqGSIb3DQEBDAUAA4ICAQB7IGXk1vGM4J73d8UD3f71UqLxom42Icu/IP0V
+nrIRzbAmz+C++7Bir4mqkKWt89dd9ZlIK8Ez5Y97tDEEd2eICo6dTvy5JOxiYsWK
+iubpyqmW/K0xjUqutANMxxGXQOJn13RnI9OHSxNXng5OoM66O5Eq08vXdcQbXF3i
+qPf95g94OJVoyFwlmYiIMuV6cOCVNShbGKvFPpNB4p+7vr2FJ7ZeHEmiZKMXO8ex
+3Uq5j1riVT/4tCemFz7dSpaCkHJ0xj5Ayknj14+t/lwF7IcOdP9/15uDp8HkgNh9
+xXkFqF3wtLkidVvmmbvDmOQiLJL6Hj6MxwEwI7Cf4ZN/UH0eIra7tEgMP+mkdNtR
+K3tB4lQNLquWBr25PbzMiK5LfXPGL+odDAb/7mE1ClQtg28gohf+Ms9hQ4y2rZSG
+sYUgh+U++Yn+HlYKI26tl7qB6lFcQb6Prc1SELAEFob8yMFkZ3UnXXLRUkLeM50K
+WV9s5wu4Rn6Rzp722wdTQoBeaSxZ5bjmT3QerGV2GaRmuYjLxdYGZ5Co07DI+qEJ
+Tj4mbpHx/OiqD7tR9i3rHpPyTjpD6MhJ3U4EjZfd6UMWGMz3Zcw0tvJe1cLpNRX8
+yjTdSxF1/H7ni7/IHkK4trIBuc58YPbZXAfYTcPugPwQE6N7RcfQHA4McFX91SZa
+DskXUg==
+-----END CERTIFICATE-----
+Subject: C=NL,O=GEANT Vereniging,CN=GEANT eScience Personal ECC CA 4
+-----BEGIN CERTIFICATE-----
+MIIDiDCCAw6gAwIBAgIRAPFVZjGnycu/NlCaWpIPalkwCgYIKoZIzj0EAwMwgYgx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtKZXJz
+ZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQD
+EyVVU0VSVHJ1c3QgRUNDIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTIwMDIx
+ODAwMDAwMFoXDTMzMDUwMTIzNTk1OVowUzELMAkGA1UEBhMCTkwxGTAXBgNVBAoT
+EEdFQU5UIFZlcmVuaWdpbmcxKTAnBgNVBAMTIEdFQU5UIGVTY2llbmNlIFBlcnNv
+bmFsIEVDQyBDQSA0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3Oad56Xl15SY
+nK3MmKcZUEu17k4jApQvPwTnGUqFxMbgDvAtxJtWqbKk8qvCOcZ/oCyrHkloS6Nf
+AiTDTV5bZ6OCAYswggGHMB8GA1UdIwQYMBaAFDrhCYbUzxnClnZ0SXbc4DXGY2Oa
+MB0GA1UdDgQWBBTt5lFk6mex24xLv7WAJ5g/2CMeZTAOBgNVHQ8BAf8EBAMCAYYw
+EgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
+AwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2Vj
+dGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRy
+dXN0LmNvbS9VU0VSVHJ1c3RFQ0NDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2
+BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0
+LmNvbS9VU0VSVHJ1c3RFQ0NBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0
+cDovL29jc3AudXNlcnRydXN0LmNvbTAKBggqhkjOPQQDAwNoADBlAjA8KoDpeqid
+slDXmfwHD7kr0XTY8rOdQBWMzT5uU7nPROEYLK00Dc9w/J4M8CGaLX8CMQDoaX4P
+os4y0yfmvRAPaFZxyJi1ZHaZh+G0dX7ggOEyMHmT0P57T6TjdfcBr1G/J/M=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client Authentication ECC
+-----BEGIN CERTIFICATE-----
+MIIDgTCCAwagAwIBAgIQE8HgrQAH0BtzfX3LWvJSfzAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MTczOVoXDTM2MDMxNTA5MTczOFowcTEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExKTAnBgNVBAMMIEhBUklDQSBDbGllbnQgQXV0
+aGVudGljYXRpb24gRUNDMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEqEqssLtH6Kkn
+Sa4ms1u/YGAi0JW3Py7nkN33soahf1Vf8p4L3eNEaCV3/sZXeviOVEyg2O+F0PWz
+gLFZdv4U//ZgLA0qjFDCtYVnB0R5y/953IpMTdgKR+cjrpveu10Lo4IBYzCCAV8w
+EgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBRSCNK+MoEl/fUal+xOXxq7
+U82QrTBXBggrBgEFBQcBAQRLMEkwRwYIKwYBBQUHMAKGO2h0dHA6Ly9yZXBvLmhh
+cmljYS5nci9jZXJ0cy9IQVJJQ0EtQ2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQG
+A1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJp
+Y2EuZ3IvZG9jdW1lbnRzL0NQUzATBgNVHSUEDDAKBggrBgEFBQcDAjBFBgNVHR8E
+PjA8MDqgOKA2hjRodHRwOi8vY3JsLmhhcmljYS5nci9IQVJJQ0EtQ2xpZW50LVJv
+b3QtMjAyMS1FQ0MuY3JsMB0GA1UdDgQWBBQqHWyH7pXv/Mkv8RzX+Dw52v+X3jAO
+BgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAIE3QcG3SB1Dgj0a8gE7
+ZSKgA7KfGlt+/ajMitsDqHvg7RZCHFmc05ggxGbzXcu2CwIxAI0VJVUxKQbaLnm1
+u8MvlJDaH1hHCujJ3PU9lYRPg5CaOwkgvV+H5OzQhvkn4flaDw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA Client Authentication RSA
+-----BEGIN CERTIFICATE-----
+MIIGzzCCBLegAwIBAgIQZvugWpzzpAYFBJWnGSeXMjANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MTkzN1oXDTM2MDMxNTA5MTkzNlow
+cTELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExKTAnBgNVBAMMIEhBUklDQSBDbGllbnQg
+QXV0aGVudGljYXRpb24gUlNBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEAtdFg0VN118Izv7l4joORHFO+qJQ09hwRqNdfZW9g9SzSjXcAS4mz4+BlOYVC
+PrdKoxs+1iVnoz6Hl1w2wf9xjTI9xQ6O6miM06CbST2rYCo58y0sV6yAs4/ptMHf
+7smx1/ORdAu3AVYbqzYqoCj5gVehlIivyZKpzko7/45N9eWUs24ah3G4nMiVxTOc
+RNYqw3/bfc+WvatbB6qNQRRJfebeDNQ8Hqen3DBPA9qsOf4Nfi4XDVkGgVPJZqfZ
+VTE8fmZIZRq+Ujcp+JRc4V2dFRqvn9xKPA3d+nbbic+JQs24+ZqYiWrcNdYNE64d
+6GlRhU3chNWFCI4RLNa7VpqoBZkFqlx2S5l83VO/G9DELikFa9nvc2BR+2h/pObG
+WmWIqgQf0esW5nzy4+inufbZ4DLwQ9Bao0TMqLsi6ywdyxreFDvfzVuVxm6NWQoO
+fi6uxdgwFEUp7FJ79owErc+RjNUrMzmhW1nlPtoCYaIy/7bW6VAqJ89ZftvRCCdV
+5QeMOYlqdle65NjcaoXh5sC7g8pTA0VlUk2VHaHWPg13HLGQNyo0yWjtRzE6rIpl
+ede96vg/bjB2edSYFUkrEZn5R71C1XhPQ945npiZ6yNv2qMlqasKuQQVEKkpi4bz
+ntA0C8JUWiobnD91o1NXARIlanApakhk21b8ba0O+WsjgyECAwEAAaOCAWMwggFf
+MBIGA1UdEwEB/wQIMAYBAf8CAQAwHwYDVR0jBBgwFoAUoNYHPV4k93ugRC4kUg0Z
+qisEkacwVwYIKwYBBQUHAQEESzBJMEcGCCsGAQUFBzAChjtodHRwOi8vcmVwby5o
+YXJpY2EuZ3IvY2VydHMvSEFSSUNBLUNsaWVudC1Sb290LTIwMjEtUlNBLmNlcjBE
+BgNVHSAEPTA7MDkGBFUdIAAwMTAvBggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFy
+aWNhLmdyL2RvY3VtZW50cy9DUFMwEwYDVR0lBAwwCgYIKwYBBQUHAwIwRQYDVR0f
+BD4wPDA6oDigNoY0aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1S
+b290LTIwMjEtUlNBLmNybDAdBgNVHQ4EFgQU8qBdeyXizDQ4cBVNxXMsNAswGCYw
+DgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQAr9ecjniPGgn1Le9OW
+sgHWRAEAqAMnFEH7S7zlL6nzEN10kjkxWE4P6776V1rYeRWpSNbB71u2zVqAPcKD
+aGiMP0I9oWlmtWxq2/JjEcf0UgRT+e9e2CleQMmTLbai1hpx08tZj/XMd6X5t78M
+w4WJDfRUnfIjHcWTxu1Nkkj64rfGXI4hzjcLD7wFq6ZXVlhTe9sp5sDCfrVZHCMh
+cHCu9odUF7IXPpPzJrKfB/uidE9mLt+V7DXepDJ2VCySL2JAP3yo4LdjrDEZGFZ7
+YZnHzjdeeq/dn+/DJ7BUVDVIMUQZT3MXoI5yb1PZ9JZrQ4x8jZbP3EPrbQK0RPyU
+4hYjxT52BWjMlP9JXtZw4aVMaOZb9QklKzJHTtWsBrer9pi1seDC2Z2pLw6mK+Yl
+NHdsk/qZ/CpK6NNrs4uWm2U3Jj7z9wFk0TCGXSS1HI024960RZTYe/3laBClflSQ
+7T7xD6HwgPfNivqerXzImw87NHgM275Nd63eV/Lhw4XgH0e+NRGk8vYE6re0p6Y9
+L79OnCWtEqywdJcJ8qr3MvviOBphUXxubDYWZzy56DCACVZEKSRKkZUJIM2UEiCz
+2Q9ATajqiODuPR5/lcmORxGauCkS2VIDKUekblssnemMqfrPEPllcLyLBYnlnM7e
+fV8it5CZjT8kxUrFTcE3ZVkpkw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA OV TLS ECC
+-----BEGIN CERTIFICATE-----
+MIIDcjCCAvigAwIBAgIQbIPKxKaS8zQphK9yBQyPDDAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTIxMDMxOTA5MzM1MloXDTM2MDMxNTA5MzM1MVowYjELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBPViBUTFMgRUNDMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAECLBRkImpVT10VjeoeRvNhOsxxQe+XVQO37r8
+PPKVlSWR/+78tD+FMEUTLGGjVUd4+KFCM2Yc2V3fZyoQIaxUzbhUYwIavuaF0V9l
+t0cfPISZ1rcQEHn3yAr1ON1eoT3jo4IBZzCCAWMwEgYDVR0TAQH/BAgwBgEB/wIB
+ADAfBgNVHSMEGDAWgBTJG1OBEv4E1RbRqryab7eglRluyjBUBggrBgEFBQcBAQRI
+MEYwRAYIKwYBBQUHMAKGOGh0dHA6Ly9yZXBvLmhhcmljYS5nci9jZXJ0cy9IQVJJ
+Q0EtVExTLVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8G
+CCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRzL0NQUzAd
+BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwQgYDVR0fBDswOTA3oDWgM4Yx
+aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLVRMUy1Sb290LTIwMjEtRUNDLmNy
+bDAdBgNVHQ4EFgQUvrSdrMbKJ79Ox9kcg/5aTh6XB58wDgYDVR0PAQH/BAQDAgGG
+MAoGCCqGSM49BAMDA2gAMGUCMQCBJIThQHLwid4SHT+YoWXd7tEFwKf6OsIX+M4U
+fh2/UAp8bCiB7D/lcAvFj9YPajcCME5DsmcLbYE7D44HlLoqVcr7RDdh84nG6Dsp
+8+YS3BnKAIONAWeGq4jawr3lD667Mw==
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA OV TLS RSA
+-----BEGIN CERTIFICATE-----
+MIIGwTCCBKmgAwIBAgIQHEYUQ2gTTV1QnQ3HytsfuDANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzQxN1oXDTM2MDMxNTA5MzQxNlowYjEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBPViBUTFMgUlNB
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBjrEt4NmTflA4DbZjPC
+HIHeSKt4GSvZrb8Wr9K/xCe/US+tRc7lMvp0SJSxtfEbb9tNo5I99YYegbgT2JOo
+8E/d7fblR/x25dHORtfe2xAO8liK8aswTmb69QXIP81zNnC7juFWgnfDZg8Loz7m
+O8qcKeYS7pejngD4YeiVTf3j2jyJ5BI4Y24IWwcO9Er1hW282He04eQTa9z3Ta9K
+00jG7foADE9q9ZOgPAiNV3tDzsaGC5HftgdmJurC/t+SD7wTLNSOGeCBf0g3jIhE
+QW8FAZYp4OpytgVk8yEtos0izSIXqJn9AMG/HH21EO2tb6S09+8NZEFGh/+GoGuD
+vDW2Nhw6FZm/yctI6nvJI4t2du39gyXql15w6ENucbM8nAyn3rcx6sHAjjgGZw98
+PRnaXXj3lMWvRSpWbBBrV0cj7eJaVFhDR+OG/2jPi8xqXaFaFGvInGW43HpQDAE5
+ATZ+8uywd1S8jA484TmyKr2XUx3OIwvpRxZDy0GvHWiqq03liS/d83vFVvZRq34H
+AMKSeLpLt6XpucnwNWJyv5RvmzsTzKfL/XrwJ9tkXWWp+sqGuScZNZApKMUhS+7w
+NKv84eX/YBKmtuQch6Xgbw0D8JjBk4my35qLw4wGhX8AM1gVErcotCrMwswiSTLy
+XJxm/VX2p8xRWCgrS49G2eMCAwEAAaOCAWcwggFjMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwHwYDVR0jBBgwFoAUCkgjpmCkkgoz6pNbxVfqJU29Eu4wVAYIKwYBBQUHAQEE
+SDBGMEQGCCsGAQUFBzAChjhodHRwOi8vcmVwby5oYXJpY2EuZ3IvY2VydHMvSEFS
+SUNBLVRMUy1Sb290LTIwMjEtUlNBLmNlcjBEBgNVHSAEPTA7MDkGBFUdIAAwMTAv
+BggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50cy9DUFMw
+HQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMEIGA1UdHwQ7MDkwN6A1oDOG
+MWh0dHA6Ly9jcmwuaGFyaWNhLmdyL0hBUklDQS1UTFMtUm9vdC0yMDIxLVJTQS5j
+cmwwHQYDVR0OBBYEFOCbPX01Y8XsnQdzqKeJIPRPhPujMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQsFAAOCAgEAbd2n5s7VSvUO8NUXH11Ml5Pdh+W+AaWEJdwG
+8qtnSX+/WL33OsJx1YN5jNjSoEWK4kswoEvrrMP7rg8w920kL5lzgoByQbP3jrJL
+Pj4LnvuqIFj6lz9eMA1kgYqy5BvnepQB/smx58K/CNadvXhtxSU+PuIgoaoKexHM
+9AWAMIIKFkE/SbYd8lR2mzp5rgeSD+rYExOxvpG/f713fDFRTH+SyqMREw34d2rD
+dtSBK5GerrV1F7C//KGM016EWCz59kutui8qyZJNq7dw1BChbEo1ho9ekN5nQ8t/
+ckF7lJkrMoYRyZobJbQs45BfDMXyRFT4u4N1Z+2GyEvgryqlIQfQ3SUamELnQ6Ta
+3oia4pLt/SYrRJOJ3I1EhlMgmi9dS/vCiXcDoMqConepk3/gDFtf8NatbQk2+vBW
+mkTcSxlAktWFFu3iAN+0hOPQWDtXofUecFVLwNzAFMhVFw8yd9h8AuM3ThZPNSW1
+0IFer8+cEkvBy2VBbg2MtXn3Duu3NGJk9xf1e752048foDAfrRcuPTZdijtvRFJ+
+G1d/8t9mQqer39S8HONbR+1Zx6KjlFbTkq+Jaivcg6X1JapDjDG8PMiaPX8WE5Tt
+jmZ8mSoDuXjqXaQ03VFrr+IweD985Ryq/eDM79dQc8SawzNwzLdNkmczMhLfE9ut
+wIHJbMg=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA S/MIME ECC
+-----BEGIN CERTIFICATE-----
+MIIDejCCAwGgAwIBAgIQR+QjpXN0lyzfL5Q4f0wP1DAKBggqhkjOPQQDAzBvMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBFQ0Mg
+Um9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzY1OFoXDTM2MDMxNTA5MzY1N1owYjEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBTL01JTUUgRUND
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEbidoUrQSTETj3yKvZfP8hz4cjWJYLu2S
+BQVAorbEw3a9bbiaYGSreAJJamuTKI/8EiGjOZ3gAxlWZirpKofebc+lqDa87zjh
+E88mIhT+WYBu4S/0+lb0r59quKF8Y0pHo4IBbTCCAWkwEgYDVR0TAQH/BAgwBgEB
+/wIBADAfBgNVHSMEGDAWgBRSCNK+MoEl/fUal+xOXxq7U82QrTBXBggrBgEFBQcB
+AQRLMEkwRwYIKwYBBQUHMAKGO2h0dHA6Ly9yZXBvLmhhcmljYS5nci9jZXJ0cy9I
+QVJJQ0EtQ2xpZW50LVJvb3QtMjAyMS1FQ0MuY2VyMEQGA1UdIAQ9MDswOQYEVR0g
+ADAxMC8GCCsGAQUFBwIBFiNodHRwOi8vcmVwby5oYXJpY2EuZ3IvZG9jdW1lbnRz
+L0NQUzAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwRQYDVR0fBD4wPDA6
+oDigNoY0aHR0cDovL2NybC5oYXJpY2EuZ3IvSEFSSUNBLUNsaWVudC1Sb290LTIw
+MjEtRUNDLmNybDAdBgNVHQ4EFgQUTq8v2Rh752P2xakBhmVdLF4791YwDgYDVR0P
+AQH/BAQDAgGGMAoGCCqGSM49BAMDA2cAMGQCMEayoDfZOkZgvT13XbjuSpKc2m/C
+cEQqYDwGIyXBhZqyMoMyDcthQsiEwBW3lHT5IQIwIT2kzroVW2iWhRF3vaTEAo3m
++AosNW84YGle0MMG2SDIoQEJiqhjRfQwZHHeBzCE
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA S/MIME RSA
+-----BEGIN CERTIFICATE-----
+MIIGyjCCBLKgAwIBAgIQKU8NCxll7jtXyXGT7O5U0zANBgkqhkiG9w0BAQsFADBv
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEnMCUGA1UEAwweSEFSSUNBIENsaWVudCBS
+U0EgUm9vdCBDQSAyMDIxMB4XDTIxMDMxOTA5MzczOFoXDTM2MDMxNTA5MzczN1ow
+YjELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBS
+ZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExGjAYBgNVBAMMEUhBUklDQSBTL01JTUUg
+UlNBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5TUrmNU21Y8gpvrx
+XCCOJS54uCyv6H6HQ1NCCz2FCg04VaNEuRYFGSXbxC88u/Q3M/MfegErs6MlLg5j
+gaAD7UYRpFMs/rS6Z6Pr45LDaWHTsS7gjhYaq47+iO0+17eTc7VWeTFzZji3ocFA
+CiXc+tEDRXSGal+qu4s6/Zmexmtp3P8QodrLgy6mAXO7necfkCoyBVjUcixIvPeR
+1NeFWfy2io7QU+Wf4Wm18259W+oJgxH0mgfFKgGrz/c2BokxzdXFvuKggVWEh/p0
+jy8uRQOGcMRT2fyUh5LM6zRBGObE8xIiRfforJF2CGSu1B0wj0jCmFG8Z2UN55xk
+EH+HKpQlm+S0mvez7YYUqMobN1RjTWHSZQoX2nuYk0no/cxbUl/AVXE0fq3DkNv4
+fdTGfLkTJ42qdyAIpjEjkLgrb4C4CT2IxPuNCLCE25SnVmydA7CuMmbwfljWwkE4
+JyO23QL90baDIcEg/NYp/IueW9qu8YwCX5ipJhflzqnjONFKDlC93FnoQ/i/ALIk
+MOhjCrHePX3/F7OWXWAoIRdbqoCNvN4KnJfcFJCcPDOGY7qds5cMcII3uKhhsRCQ
+Jg2KKGvVdwp1oBIibuVM+cIZi3QucK8TfssODws1WNce5RV+Gniv5U4dhS+5nPvC
+gQr6a8wL4ha8hc8ovXEhrrBHtOMCAwEAAaOCAW0wggFpMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHwYDVR0jBBgwFoAUoNYHPV4k93ugRC4kUg0ZqisEkacwVwYIKwYBBQUH
+AQEESzBJMEcGCCsGAQUFBzAChjtodHRwOi8vcmVwby5oYXJpY2EuZ3IvY2VydHMv
+SEFSSUNBLUNsaWVudC1Sb290LTIwMjEtUlNBLmNlcjBEBgNVHSAEPTA7MDkGBFUd
+IAAwMTAvBggrBgEFBQcCARYjaHR0cDovL3JlcG8uaGFyaWNhLmdyL2RvY3VtZW50
+cy9DUFMwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEUGA1UdHwQ+MDww
+OqA4oDaGNGh0dHA6Ly9jcmwuaGFyaWNhLmdyL0hBUklDQS1DbGllbnQtUm9vdC0y
+MDIxLVJTQS5jcmwwHQYDVR0OBBYEFJX2FFz9LqSMQ6C3jgW0Orbsgg2fMA4GA1Ud
+DwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAL2XgP79Wk/ijkQOI55UihqPR
+m68QXb1IDKYCmQiJFkqNQOf/Bt10RjtASV2kjDEQoI4cnmwB++Pd8A9kyFdWPwJ2
+bX68XvFvHX6FzejNwJ5b6wIiz1W3QlHZwhTSoV0KHh4H4gzD8N9X4HwfESVYRkQF
+3tTg1VnZJI2ggCg5201X3BI6YLDc4GltF5EORVzT5xPpMiNHxDivoP8tEdijw5Jh
+kpCDG8BbpbfXQ1HjPRawQ4w6w1aXgyhajLAhjZdLOfpmZO5EbYai46m/niK5mKTU
+/RFupYhNsejfD5wm6JEZbisV5SXVPbmIXrTwvt66lGvgSb3X7waCFIVuwr71qc/q
+YNyvXA4ALSchFU8xqWDu2StWrB3i3CzNR2DMz18yYpjeJehuuhsIZu+Ku4CML1O3
+nlKCXx3EbABVAJkXhbDqHnUw0kqPHh9enYcXdJ8zjLhHVBghdLfpOmp9ZtIOjquL
+mi+OEwkhOv6bC4IXpY57c5bBzK9DCoffE1LG/JUfOSE0B6kuTVyXvFhfq7BK5LcJ
+WieXlSD3COOcqBQ62eHKpRPEYOLdAHDdOq6MBHHMAVUkB/pAFgDj0twB+xP2FUUk
+ycRBPSiBgQEnuI8QLrQXB3FDSXqh+I8jfUcVc7JvgvG4bLMjozgFB58A7gJ5YDce
+4P4ckMdKzbAXPa5tY2Y=
+-----END CERTIFICATE-----
+Subject: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo ECC Organization Validation Secure Server CA
+-----BEGIN CERTIFICATE-----
+MIIDrjCCAzOgAwIBAgIQNb50Y4yz6d4oBXC3l4CzZzAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgxMTAy
+MDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBlTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
+EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMP
+U2VjdGlnbyBMaW1pdGVkMT0wOwYDVQQDEzRTZWN0aWdvIEVDQyBPcmdhbml6YXRp
+b24gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMFkwEwYHKoZIzj0CAQYIKoZI
+zj0DAQcDQgAEnI5cCmFvoVij0NXO+vxE+f+6Bh57FhpyH0LTCrJmzfsPSXIhTSex
+r92HOlz+aHqoGE0vSe/CSwLFoWcZ8W1jOaOCAW4wggFqMB8GA1UdIwQYMBaAFDrh
+CYbUzxnClnZ0SXbc4DXGY2OaMB0GA1UdDgQWBBRNSu/ERrMSrU9OmrFZ4lGrCBB4
+CDAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAEC
+AjBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNF
+UlRydXN0RUNDQ2VydGlmaWNhdGlvbkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEE
+ajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVNFUlRy
+dXN0RUNDQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVz
+ZXJ0cnVzdC5jb20wCgYIKoZIzj0EAwMDaQAwZgIxAOk//uo7i/MoeKdcyeqvjOXs
+BJFGLI+1i0d+Tty7zEnn2w4DNS21TK8wmY3Kjm3EmQIxAPI1qHM/I+OS+hx0OZhG
+fDoNifTe/GxgWZ1gOYQKzn6lwP0yGKlrP+7vrVC8IczJ4A==
+-----END CERTIFICATE-----
+Subject: C=GB,ST=Greater Manchester,L=Salford,O=Sectigo Limited,CN=Sectigo RSA Organization Validation Secure Server CA
+-----BEGIN CERTIFICATE-----
+MIIGGTCCBAGgAwIBAgIQE31TnKp8MamkM3AZaIR6jTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
+MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBlTELMAkGA1UEBhMCR0IxGzAZBgNV
+BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
+ChMPU2VjdGlnbyBMaW1pdGVkMT0wOwYDVQQDEzRTZWN0aWdvIFJTQSBPcmdhbml6
+YXRpb24gVmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAnJMCRkVKUkiS/FeN+S3qU76zLNXYqKXsW2kDwB0Q
+9lkz3v4HSKjojHpnSvH1jcM3ZtAykffEnQRgxLVK4oOLp64m1F06XvjRFnG7ir1x
+on3IzqJgJLBSoDpFUd54k2xiYPHkVpy3O/c8Vdjf1XoxfDV/ElFw4Sy+BKzL+k/h
+fGVqwECn2XylY4QZ4ffK76q06Fha2ZnjJt+OErK43DOyNtoUHZZYQkBuCyKFHFEi
+rsTIBkVtkuZntxkj5Ng2a4XQf8dS48+wdQHgibSov4o2TqPgbOuEQc6lL0giE5dQ
+YkUeCaXMn2xXcEAG2yDoG9bzk4unMp63RBUJ16/9fAEc2wIDAQABo4IBbjCCAWow
+HwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFBfZ1iUn
+Z/kxwklD2TA2RIxsqU/rMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/
+AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYG
+BFUdIAAwCAYGZ4EMAQICMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
+cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
+bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
+dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
+aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAThNA
+lsnD5m5bwOO69Bfhrgkfyb/LDCUW8nNTs3Yat6tIBtbNAHwgRUNFbBZaGxNh10m6
+pAKkrOjOzi3JKnSj3N6uq9BoNviRrzwB93fVC8+Xq+uH5xWo+jBaYXEgscBDxLmP
+bYox6xU2JPti1Qucj+lmveZhUZeTth2HvbC1bP6mESkGYTQxMD0gJ3NR0N6Fg9N3
+OSBGltqnxloWJ4Wyz04PToxcvr44APhL+XJ71PJ616IphdAEutNCLFGIUi7RPSRn
+R+xVzBv0yjTqJsHe3cQhifa6ezIejpZehEU4z4CqN2mLYBd0FUiRnG3wTqN3yhsc
+SPr5z0noX0+FCuKPkBurcEya67emP7SsXaRfz+bYipaQ908mgWB2XQ8kd5GzKjGf
+FlqyXYwcKapInI5v03hAcNt37N3j0VcFcC3mSZiIBYRiBXBWdoY5TtMibx3+bfEO
+s2LEPMvAhblhHrrhFYBZlAyuBbuMf1a+HNJav5fyakywxnB2sJCNwQs2uRHY1ihc
+6k/+JLcYCpsM0MF8XPtpvcyiTcaQvKZN8rG61ppnW5YCUtCC+cQKXA0o4D/I+pWV
+idWkvklsQLI+qGu41SWyxP7x09fn1txDAXYw+zuLXfdKiXyaNb78yvBXAfCNP6CH
+MntHWpdLgtJmwsQt6j8k9Kf5qLnjatkYYaA7jBU=
+-----END CERTIFICATE-----
diff --git a/docs/src/.vuepress/public/download/1.9.0/server_cert_root_cas.pem b/docs/src/.vuepress/public/download/1.9.0/server_cert_root_cas.pem
new file mode 100644
index 000000000..5e85fca81
--- /dev/null
+++ b/docs/src/.vuepress/public/download/1.9.0/server_cert_root_cas.pem
@@ -0,0 +1,152 @@
+Subject: C=DE,O=D-Trust GmbH,CN=D-TRUST Root Class 3 CA 2 2009
+-----BEGIN CERTIFICATE-----
+MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NTha
+ME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMM
+HkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOADER03
+UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42
+tSHKXzlABF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9R
+ySPocq60vFYJfxLLHLGvKZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsM
+lFqVlNpQmvH/pStmMaTJOKDfHR+4CS7zp+hnUquVH+BGPtikw8paxTGA6Eian5Rp
+/hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUCAwEAAaOCARowggEWMA8G
+A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ4PGEMA4G
+A1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUy
+MENBJTIwMiUyMDIwMDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRl
+cmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js
+L2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL
+BQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni
+acfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0
+o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4K
+zCUqNQT4YJEVdT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8
+PIWmawomDeCTmGCufsYkl4phX5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3Y
+Johw1+qRzT65ysCQblrGXnRl11z+o+I=
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA TLS ECC Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIICVDCCAdugAwIBAgIQZ3SdjXfYO2rbIvT/WeK/zjAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTIxMDIxOTExMDExMFoXDTQ1MDIxMzExMDEwOVowbDELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgRUNDIFJvb3Qg
+Q0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDgI/rGgltJ6rK9JOtDA4MM7
+KKrxcm1lAEeIhPyaJmuqS7psBAqIXhfyVYf8MLA04jRYVxqEU+kw2anylnTDUR9Y
+STHMmE5gEYd103KUkE+bECUqqHgtvpBBWJAVcqeht6NCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUyRtTgRL+BNUW0aq8mm+3oJUZbsowDgYDVR0PAQH/BAQD
+AgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAircJRQO9gcS3ujwLEXQNw
+SaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/QwCZ61IygN
+nxS2PFOiTAZpffpskcYqSUXm7LcT4Tps
+-----END CERTIFICATE-----
+Subject: C=GR,O=Hellenic Academic and Research Institutions CA,CN=HARICA TLS RSA Root CA 2021
+-----BEGIN CERTIFICATE-----
+MIIFpDCCA4ygAwIBAgIQOcqTHO9D88aOk8f0ZIk4fjANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTIxMDIxOTEwNTUzOFoXDTQ1MDIxMzEwNTUzN1owbDEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgUlNBIFJv
+b3QgQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIvC569l
+mwVnlskNJLnQDmT8zuIkGCyEf3dRywQRNrhe7Wlxp57kJQmXZ8FHws+RFjZiPTgE
+4VGC/6zStGndLuwRo0Xua2s7TL+MjaQenRG56Tj5eg4MmOIjHdFOY9TnuEFE+2uv
+a9of08WRiFukiZLRgeaMOVig1mlDqa2YUlhu2wr7a89o+uOkXjpFc5gH6l8Cct4M
+pbOfrqkdtx2z/IpZ525yZa31MJQjB/OCFks1mJxTuy/K5FrZx40d/JiZ+yykgmvw
+Kh+OC19xXFyuQnspiYHLA6OZyoieC0AJQTPb5lh6/a6ZcMBaD9YThnEvdmn8kN3b
+LW7R8pv1GmuebxWMevBLKKAiOIAkbDakO/IwkfN4E8/BPzWr8R0RI7VDIp4BkrcY
+AuUR0YLbFQDMYTfBKnya4dC6s1BG7oKsnTH4+yPiAwBIcKMJJnkVU2DzOFytOOqB
+AGMUuTNe3QvboEUHGjMJ+E20pwKmafTCWQWIZYVWrkvL4N48fS0ayOn7H6NhStYq
+E613TBoYm5EPWNgGVMWX+Ko/IIqmhaZ39qb8HOLubpQzKoNQhArlT4b4UEV4AIHr
+W2jjJo3Me1xR9BQsQL4aYB16cmEdH2MtiKrOokWQCPxrvrNQKlr9qEgYRtaQQJKQ
+CoReaDH46+0N0x3GfZkYVVYnZS6NRcUk7M7jAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFApII6ZgpJIKM+qTW8VX6iVNvRLuMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAPpBIqm5iFSVmewzVjIuJndftTgfvnNAU
+X15QvWiWkKQUEapobQk1OUAJ2vQJLDSle1mESSmXdMgHHkdt8s4cUCbjnj1AUz/3
+f5Z2EMVGpdAgS1D0NTsY9FVqQRtHBmg8uwkIYtlfVUKqrFOFrJVWNlar5AWMxaja
+H6NpvVMPxP/cyuN+8kyIhkdGGvMA9YCRotxDQpSbIPDRzbLrLFPCU3hKTwSUQZqP
+JzLB5UkZv/HywouoCjkxKLR9YjYsTewfM7Z+d21+UPCfDtcRj88YxeMn/ibvBZ3P
+zzfF0HvaO7AWhAw6k9a+F9sPPg4ZeAnHqQJyIkv3N3a6dcSFA1pj1bF1BcK5vZSt
+jBWZp5N99sXzqnTPBIWUmAD04vnKJGW/4GKvyMX6ssmeVkjaef2WdhW+o45WxLM0
+/L5H9MG0qPzVMIho7suuyWPEdr6sOBjhXlzPrjoiUevRi7PzKzMHVIf6tLITe7pT
+BGIBnfHAT+7hOtSLIBD6Alfm78ELt5BGnBkpjNxvoEppaZS3JGWg/6w/zgH7IS79
+aPib8qXPMThcFarmlwDB31qlpzmq6YR/PFGoOtmUW4y/Twhx5duoXNTSpv4Ao8YW
+xw/ogM4cKGR0GQjTQuPOAF1/sdwTsOEFy9EgqoZ0njnnkf3/W9b3raYvAwtt41dU
+63ZTGI0RmLo=
+-----END CERTIFICATE-----
+Subject: C=DE,O=T-Systems Enterprise Services GmbH,OU=T-Systems Trust Center,CN=T-TeleSec GlobalRoot Class 2
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
+KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
+BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
+YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1
+OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
+aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
+ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd
+AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC
+FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi
+1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq
+jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ
+wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/
+WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy
+NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC
+uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw
+IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6
+g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
+9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP
+BSeOE6Fuwg==
+-----END CERTIFICATE-----
+Subject: C=US,ST=New Jersey,L=Jersey City,O=The USERTRUST Network,CN=USERTrust ECC Certification Authority
+-----BEGIN CERTIFICATE-----
+MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAx
+MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
+Ck5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUg
+VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlm
+aWNhdGlvbiBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqflo
+I+d61SRvU8Za2EurxtW20eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinng
+o4N+LZfQYcTxmdwlkWOrfzCjtHDix6EznPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0G
+A1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBBHU6+4WMB
+zzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbW
+RNZu9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg=
+-----END CERTIFICATE-----
+Subject: C=US,ST=New Jersey,L=Jersey City,O=The USERTRUST Network,CN=USERTrust RSA Certification Authority
+-----BEGIN CERTIFICATE-----
+MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
+MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
+BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
+aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
+3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
+tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
+Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
+VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
+79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
+c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
+Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
+c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
+UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
+Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
+BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
+Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
+VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
+ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
+8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
+iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
+Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
+XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
+qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
+VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
+L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
+jjxDah2nGN59PRbxYvnKkKj9
+-----END CERTIFICATE-----
diff --git a/docs/src/.vuepress/public/download/dsf_bpe_1_9_0.tar.gz b/docs/src/.vuepress/public/download/dsf_bpe_1_9_0.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..00fc1fad71f875ee73151c76c8272ed447765b2b
GIT binary patch
literal 1654
zcmV-+28sC}iwFP!000001MOSgQ`<NY=b67^hkIx{LlQfV3Fn8K3B+787fPB0?rUy5
zj;$m*Y|EA9P;UCi-^%&GI0+#XD5d(nm|Cmd_3mo5TBU=SRCb;i8lqmWXHP`&nf<Ms
zTHUN`HO;K;Xu4(?<_?%ot(Zib2$uuwaK^-4beqP%Qw-4mKJzXKFL^ACSwhO!Veq&z
zq=OG?OMag}O+(WQ{x|9e`VMH1tHx^l;QpTwo=_H9@Wv<~zS&I(pHPn^)-He>$MOL{
zLw7_h7>zw%rmW(-!cE35r_pH0-H=={ep$gdvh?!LWi6Y*iL|P)fJLRDOM{e??0rH!
zPDC<g3s3@o-~{wjN(U|mUhF0bGV}AJDQdKK!13HLjeK{R0Cjh~fRac!9^rxxspkrm
zK*9|qPR!{<J}=4j1ITY{GGRd)lHBKtYcvxKXf)RpO~O*{;mdL*<_s;LEJo0RBZ4-p
zuvkd@E)j6z`VNbNYYPNV$^E1RY_wj&&EN(up6iXtdOkP9B$`mpq7dyiH$(p~3+$9L
zq&p%!pwaAo)4p(;y%XoCV>`_w=e*mt;9q~>S(uf?2t(>qU{xyqKuTCWrQP~?-a2aZ
zY^T%c^?pC=Hl34J+eXEB8dYY&SGg<ZiaPY{?j~NVB6Jm-<HqUvhi2nG?AFC~p6$u|
z7V>Pj><@kC*zWdQC#~Z~zsPXoI=BZ*r_*g+$mehNpZ8+FW({pA>P|y#yBcRI`~>~8
z<{2b0@#ydx#F&7L0!VoPY?%GqV;n;*W|5Ei4NzZ@x`IrMgfG}EeG7W{0-c-%UlzGz
zA>u^FYcebg=Cd;6BR8V|xdPK|8TZ=Ca7=kYv5@&vuRQlo_w3m2^&I<;<Mw&eZh~My
zK6^px6PP6glC0FLIMaeJ3pzlxd@^y;7_&KP1OdBh(?opHF@fJ!$@TrYoSEIImtWN|
z!JWVz1SHu<BQ11-I7mk{0<0}kNtS)~?v!^#gxoW7d2!%k1u{!CK8f+q1QT0+n~*d8
z!L9vho)#?KymQkT6E_fJOi144oTETe3;y0aK5dqI@9lPbZy)yJkwX)iQ?H?P4vQ3#
ztw<>OfN5v%pBV!h2@D7~ut3-5))zD+EJeQN{0)XGr>G#957`c8pI4Im?Q*I`vsVH-
zsN5vS%7So<q}w^`^?&W!y$5H^1p}Gntb*B!G|eLm=Gpu1D7a^(u$!Y>Nik(Gq(NrW
zO&?TD=WAydlm5EIeJ6wEG(WAn)@1C}yw+y-`=!YHGF_3=x6Hv0m6WqiK4fOWVtwlZ
z`a4HfSLQR#6LbTz^Z)d`r`KyseSj6`f8#)_KJ)oMX2B&D{#v?Mdj4Bf>rdDPn)ZKg
zo%?H5qk32W$HZ4JtN-&#apV6Uo*_MfMN^XuX+&kc_DC_Yz5i>bt}FjP2X6d-;RY$`
z5%KtmV0-^ptA<+t&w?BOcd($sbJbJr|J(UrGYsYb=RmHn_+%A8=6`b=|4S(UKL@1$
z=V!5}l965VnC2Guf4aObd|Cc~rSXyX|GKus*UFF%uGQ{X|24DV{{u<(vhM$0Df(Jd
zbB;QO)97@Z=HcR&;@mX2({WAnO8fc%P<XM(um7&yXr9_-@%fP#!ix2uf9i&IQ0)KI
z>gxXgS#UbNak`>n3?mW|?h4|=P0x0BWvd)YzW^s53rXZ7c}Sx&7*+7bE_Xdac(PmU
zk*}JeAFP<MwEHY(uAjQQ+wlFYwVc3^@$A;_sAJDA?cl994w-KO#^63qV^@&{(w$bd
zs#V|NH?HoXOTow42;@dGF)-vTgl4JVJ@54aCBAQTTgMG}+dTR3ZUwtyPkRmP8C40X
zP-!=U0Ra+u{5nRb+=uTiqn$`aGsiC8O5=DN<f5Uen0_T4Ld3+43j64YkWGr0q{vQQ
zb4`tM`^Q95kAOxvs8{!m>i(gze^`4ra~Kn2^iEEZWFJt4L>hFiaso8U?qw4<#IJF$
zAx)&rshIgS(YIbj-!BUF-||v_1Q{FaKePDzFVoP>7nc8DDYE*nt$#e%j~YEgR)C>?
zfSZ7>MNTSfz*yCQuNf=Oe~-EJGi+S{M)CYtGqk!||IdNq`A?nuek{y>_4%a#2VndD
zzgE=`UReK6K|w)5K|w)5K|w)5K|w)5K|w)5K|w)5K|w)5LE#1Ce>9uz<p59s0NTV+
AMgRZ+

literal 0
HcmV?d00001

diff --git a/docs/src/.vuepress/public/download/dsf_fhir_1_9_0.tar.gz b/docs/src/.vuepress/public/download/dsf_fhir_1_9_0.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..efeb42c65630fbf27ac8bfac2170dd87ea3e0bd8
GIT binary patch
literal 2050
zcmV+d2>tgTiwFP!000001MOP-bK=Mm_Rsz+x;Cjgy9$AXBm}CuRAD18RPf^fZ<4#Z
zs7BHV6bp?`681We|2;k8VZah#$Ls9v&bPY-l1AM<{h0n{7Jm{XwWBW!8DSVk{)yQB
z%)cwTZ0Lrp$+~tVE3&Q_N1%UUyK>CZj3fX@31iu=ar>VCPT}+Td(6F~iR7|r%u-r?
zoQ7|zg9o^wJ&XJD(`eL{t@vw-UOxi)O|2-wcOL(Hnxp}XO!z^qHh(xyX>uR9G&PR_
z;)H#E<X-@SDH&4}#uGQG2CU|hjHDBi1ku<}$do>?<gUgu$)3NXR9jU!e=(uly_pFt
zl6(?`vxMgNW0qv;TsD9NO5Lc+_(w6DGX7oN*EH3{fBAJv-Gr{cl%}EW(j*J~z$F>A
z{UD^(m`+Ov+|kGVgWL%TqRnA6x(^Z-O=*-ZwU2%_!I~v3rnNJggh8~p-yMx^hW5}J
ze6j}iRr}JiZ>|R;6TH-~X3S$%mW)Xh{F7wp^ePtIYI*?eo15jEy&Drq94{UWhkg6p
z8jN}uz4P|SvM+jl%Y<4oi)ss})b{vdTf(2Mza1i_z+u~x&b#g2)giJ9{2I}WXU<wk
zeROk1BQL+<(HOs`HfHB)0Cx&r;K$1n^MI6mmS3J@hrw^Nz#+IM#w1Nqnz#ORhSgH~
zz>aA$B@yO~?a`2C1tM@3wi^a~$eO1%va@&ymRWGW2+%8rZ(4HC!r7Fr%{zOH(WOoh
zEiFaguvy~b&1x-V<JDbs<Cvl&Yb?%kFRz}ypkg}KC%ZGeurIp3f!#T?ZwGx7{^2>U
ziM=QrW3+w?&05WKat$Rf^?N_v_RiWvEVuS>_?PQJrzj<N1@xI2Sc&_D6~(_;jy1S!
zUs+cpyJPjO(OxSL%AXBQ=lvcRzgC%BQupTC9&z@~p!aF9bQ~nQBu8JMW~Y~4n&}Jm
ze}K_-=Ni(Ox`F=)>#H#Y9!f(&G+7Pauy(OFUk^UEuX;bXN4@JSyVt=9pzV17Q@ekQ
zRu-=ECF-*Y1)hvBOG02iUI!_lKH&O*_u@Ua<SCz5%p}X=l-EgFqnVdaxgEo9Thf&}
zexFSpbYqmwEuwIqyIDGaax;(=LiRutaJlte>#uM!pkw;kgunknBwv<Vzy3?9H~;g;
z)0ILVrHru<B+19+nI>}`k~F~;`$t@~xpGMgBHki?+?lEe#AVdIy*$HQy29S;YpSNn
zYTc)X;rPDOQtH016UX;7%_Gg0PaB%2>N>$^O;7d}&23TFX*!<cx9YCpQ{8X1bVs4C
z>}tA7wR*kjs4bnUD(+P3RBNa$8D;reOI1DHFzSj&b-78Jnpbc5B~DLRNWo<|-|;M&
zXJE#Fgy>ixE^@GxU-JOm_TWAs@IW2ON!SDC1tu;Gtl<bbLl1nsm<tVD;7dnZ!Q7#M
ztbWE<;JIv)<s`(T_dC5fxb9o$*H;(4k0$*4_>eZuZ#V=u5Ifqo=WtP;v(dDd>$|Dw
zI~((ak}#XN6YAbAC1yC(gkL_KUv{Kn*Xs8_RNzBAwu3aG#Crtk7FH{LzM6vM0WW|L
zzb+(T?qPY6&;&(Jmr{c%Wiu44FYn+|lLTlX=&xv%%lS#1l{{~n_XPW8;MAVlTx~V*
z1^x5pdN}%sx$x@Fw-UfxmAU1&?J=D*6IOlrd19>R!GV10cx_x6i=E5hSKO}$aNb=+
z_Ap^v)OR<VJxt^l1I`Pgz$3-N$|AT;LrUM?CM$bs#!g8)*vXupmynHOp{1++VO{=E
zp#_xWg*4)|n%2CtUNp;flz(58j`_~}|D3jOtW<A*8kisQ%+GriLwj}(SaANQ8V&88
z&;Mc;-UXRgI_?`i|H<ROOyn=5g9ljG^%tD~)|G}L&VSzn8}T1l?arlD%|5^FOnHE{
z^7G$1miu=7H}r-$|9uZ!GLLUY9)fHFV;WK1iBJ!o`rUCM@c`*h$c=GVi5&}vPlKom
zY8{Z_B*aBxogQy9j-oe|M!_59%wi>?T*mQn+w=1NoaWo2)m}QG{Ggl8&$QvholKc$
z0w!ezUuO@I2|T{0rpU@EPP&X*aubI6wj9<T=L&f<pF&3(4Q_E?hPu1$LGQc`C!LF{
z(`N!VxnPM{d^;ZpC%7wIf0BZOEP~Q#aYg_n^708(fPQwvnTH$f{Q9&4Eauxk5<=i(
zSd)BLU&@?!vEULT7feUOp>Q(8xVgz=j5%~#9*l+2rBSFaqEJi=xgGN(i5JFTKTRtU
zy)i|XMCg53o97GYA6Ia}4bAIqb(ed`-J=)NKFH>?#7IUgdorPd={;rl{4^m!78kQ9
zPXH9hH?MQ2Z2lJ?w*$A3_)yg<no&{YRz*?dWz1MM*^F{p0W>1zE?pX(;ubnTok+<P
z=R+Q0mU69gMa$ja|9g28*n^G!U%1x)?>Y+lza}^IC;q2z|NpP98R}Qo|G!a;<c@6j
zm7i{vv-VK6J5774G>`-+a%9hR727e<^#}Pa(m>!V#CH8}khV9{vA6!!#`f<&G~;XI
z|KBL``oHKZ1DpT+0L%ZD7yXSW`tJlq^<TaPd!3H`{eNr!UzcS=6ZQWdcvk;6Dv!O2
zvG1s%nyF$z_@=S^+0K{z4RC(`Z|tc5=fD5e<o7=R|4!>)KtMo1KtMo1KtMo1KtMo1
gKtMo1KtMo1KtMo1KtMo1;P;LH0&1C|B>+$W0J4P}-~a#s

literal 0
HcmV?d00001


From a994ca98d175ff91937b0dc6798e0dff5de5cf5b Mon Sep 17 00:00:00 2001
From: Hauke Hund <hauke.hund@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 17:04:17 +0200
Subject: [PATCH 5/6] typo fix

---
 docs/src/operations/v1.9.0/root-certificates.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/src/operations/v1.9.0/root-certificates.md b/docs/src/operations/v1.9.0/root-certificates.md
index 7218cb1d0..7566cad60 100644
--- a/docs/src/operations/v1.9.0/root-certificates.md
+++ b/docs/src/operations/v1.9.0/root-certificates.md
@@ -187,7 +187,7 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
     Info: https://crt.sh/?caid=207671
     X509 Certificate: https://crt.sh/?id=4442848518
     Not after: Mar 15 09:17:38 2036 GMT
-* Root CA: **HHARICA Client RSA Root CA 2021**
+* Root CA: **HARICA Client RSA Root CA 2021**
   Info: https://crt.sh/?caid=202188
   X509 Certificate: https://crt.sh/?id=4147049674
   Not after: Feb 13 10:58:45 2045 GMT

From 03626a99c3cc164f56f1334196e3dcaa0ad451e9 Mon Sep 17 00:00:00 2001
From: Hauke Hund <hauke.hund@hs-heilbronn.de>
Date: Tue, 21 Oct 2025 17:19:00 +0200
Subject: [PATCH 6/6] restructured CA list, removed redundancies, indentation
 cleanup

---
 .../operations/v1.9.0/root-certificates.md    | 200 ++++++++----------
 1 file changed, 93 insertions(+), 107 deletions(-)

diff --git a/docs/src/operations/v1.9.0/root-certificates.md b/docs/src/operations/v1.9.0/root-certificates.md
index 7566cad60..074dc0e4c 100644
--- a/docs/src/operations/v1.9.0/root-certificates.md
+++ b/docs/src/operations/v1.9.0/root-certificates.md
@@ -63,146 +63,132 @@ Use the following environment variable to configure non default .pem files or ov
 ## List of Default Trusted Certificate Authorities
 If not mentioned explicitly, issuing CAs listed will sign X.509 certificates with [Extended Key Usage](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12) entries `TLS WWW server authentication` and `TLS WWW client authentication`.
 
-### CAs Trusted by Common Web Browsers and Operating Systems
-
 * Root CA: **HARICA TLS ECC Root CA 2021**
   Info: https://crt.sh/?caid=202185
   X509 Certificate: https://crt.sh/?id=4147045948
   Not after: Feb 13 11:01:09 2045 GMT
-    * Issuing CA: **GEANT TLS ECC 1**
-      Info: https://crt.sh/?caid=390050
-      X509 Certificate: https://crt.sh/?id=16099180990
-      Not after: Dec 31 11:14:20 2039 GMT
-    * Issuing CA: **HARICA OV TLS ECC**
-      Info: https://crt.sh/?caid=207661
-      X509 Certificate: https://crt.sh/?id=4442848530
-      Not after: Mar 15 09:33:51 2036 GMT
+  * Issuing CA: **GEANT TLS ECC 1**
+    Info: https://crt.sh/?caid=390050
+    X509 Certificate: https://crt.sh/?id=16099180990
+    Not after: Dec 31 11:14:20 2039 GMT
+  * Issuing CA: **HARICA OV TLS ECC**
+    Info: https://crt.sh/?caid=207661
+    X509 Certificate: https://crt.sh/?id=4442848530
+    Not after: Mar 15 09:33:51 2036 GMT
 * Root CA: **HARICA TLS RSA Root CA 2021**
   Info: https://crt.sh/?caid=202184
   X509 Certificate: https://crt.sh/?id=4147041876
   Not after: Feb 13 10:55:37 2045 GMT
-    * Issuing CA: **GEANT TLS RSA 1**
-      Info: https://crt.sh/?caid=390054
-      X509 Certificate: https://crt.sh/?id=16099180997
-      Not after: Dec 31 11:14:59 2039 GMT
-    * Issuing CA: **HARICA OV TLS RSA**
-      Info: https://crt.sh/?caid=207660
-      X509 Certificate: https://crt.sh/?id=4442848529
-      Not after: Mar 15 09:34:16 2036 GMT
+  * Issuing CA: **GEANT TLS RSA 1**
+    Info: https://crt.sh/?caid=390054
+    X509 Certificate: https://crt.sh/?id=16099180997
+    Not after: Dec 31 11:14:59 2039 GMT
+  * Issuing CA: **HARICA OV TLS RSA**
+    Info: https://crt.sh/?caid=207660
+    X509 Certificate: https://crt.sh/?id=4442848529
+    Not after: Mar 15 09:34:16 2036 GMT
 * Root CA: **HARICA Client ECC Root CA 2021**
   Info: https://crt.sh/?caid=202189
   X509 Certificate: https://crt.sh/?id=4147052292
   Not after: Feb 13 11:03:33 2045 GMT
-    * Issuing CA: **GEANT S/MIME ECC 1** [client/smime certificates only]
-      Info: https://crt.sh/?caid=390048
-      X509 Certificate: https://crt.sh/?id=16099180988
-      Not after: Dec 31 11:11:39 2039 GMT
-    * Issuing CA: **HARICA S/MIME ECC** [client/smime certificates only]
-      Info: https://crt.sh/?caid=207659
-      X509 Certificate: https://crt.sh/?id=4442848523
-      Not after: Mar 15 09:36:57 2036 GMT
+  * Issuing CA: **GEANT S/MIME ECC 1** [client/smime certificates only]
+    Info: https://crt.sh/?caid=390048
+    X509 Certificate: https://crt.sh/?id=16099180988
+    Not after: Dec 31 11:11:39 2039 GMT
+  * Issuing CA: **HARICA S/MIME ECC** [client/smime certificates only]
+    Info: https://crt.sh/?caid=207659
+    X509 Certificate: https://crt.sh/?id=4442848523
+    Not after: Mar 15 09:36:57 2036 GMT
+  * Issuing CA: **HARICA Client Authentication ECC** [client certificates only]
+    Info: https://crt.sh/?caid=207671
+    X509 Certificate: https://crt.sh/?id=4442848518
+    Not after: Mar 15 09:17:38 2036 GMT
 * Root CA: **HARICA Client RSA Root CA 2021**
   Info: https://crt.sh/?caid=202188
   X509 Certificate: https://crt.sh/?id=4147049674
   Not after: Feb 13 10:58:45 2045 GMT
-    * Issuing CA: **GEANT S/MIME RSA 1** [client/smime certificates only]
-      Info: https://crt.sh/?caid=390049
-      X509 Certificate: https://crt.sh/?id=16099180989
-      Not after: Dec 31 11:13:07 2039 GMT
-    * Issuing CA: **HARICA S/MIME RSA** [client/smime certificates only]
-      Info: https://crt.sh/?caid=207658
-      X509 Certificate: https://crt.sh/?id=4442848517
-      Not after: Mar 15 09:37:37 2036 GMT
+  * Issuing CA: **GEANT S/MIME RSA 1** [client/smime certificates only]
+    Info: https://crt.sh/?caid=390049
+    X509 Certificate: https://crt.sh/?id=16099180989
+    Not after: Dec 31 11:13:07 2039 GMT
+  * Issuing CA: **HARICA S/MIME RSA** [client/smime certificates only]
+    Info: https://crt.sh/?caid=207658
+    X509 Certificate: https://crt.sh/?id=4442848517
+    Not after: Mar 15 09:37:37 2036 GMT
+  * Issuing CA: **HARICA Client Authentication RSA** [client certificates only]
+    Info: https://crt.sh/?caid=207670
+    X509 Certificate: https://crt.sh/?id=4442848531
+    Not after: Mar 15 09:19:36 2036 GMT
 * Root CA: **T-TeleSec GlobalRoot Class 2** [will be removed in a future release, incl. derived CAs]
   Info: https://crt.sh/?caid=6068
   X509 Certificate: https://crt.sh/?id=8733622
   Not after: Oct 1 23:59:59 2033 GMT
-    * Intermediate Root CA: **DFN-Verein Certification Authority 2**
-      Info: https://crt.sh/?caid=22818
-      X509 Certificate: https://crt.sh/?id=23908438
-      Not after: Feb 22 23:59:59 2031 GMT
-      * Issuing CA: **DFN-Verein Global Issuing CA** [existing, still valid client certificates, no new certificates]
-        Info: https://crt.sh/?caid=23770
-        X509 Certificate: https://crt.sh/?id=25484751
-        Not after: Feb 22 23:59:59 2031 GMT
-      * Issuing CA: **Fraunhofer User CA - G02** [existing, still valid client certificates, no new certificates]
-        Info: https://crt.sh/?caid=23772
-        X509 Certificate: https://crt.sh/?id=25484789
-        Not after: Feb 22 23:59:59 2031 GMT
+  * Intermediate Root CA: **DFN-Verein Certification Authority 2**
+    Info: https://crt.sh/?caid=22818
+    X509 Certificate: https://crt.sh/?id=23908438
+    Not after: Feb 22 23:59:59 2031 GMT
+   * Issuing CA: **DFN-Verein Global Issuing CA** [existing, still valid client certificates, no new certificates]
+     Info: https://crt.sh/?caid=23770
+     X509 Certificate: https://crt.sh/?id=25484751
+     Not after: Feb 22 23:59:59 2031 GMT
+   * Issuing CA: **Fraunhofer User CA - G02** [existing, still valid client certificates, no new certificates]
+     Info: https://crt.sh/?caid=23772
+     X509 Certificate: https://crt.sh/?id=25484789
+     Not after: Feb 22 23:59:59 2031 GMT
 * Root CA: **D-TRUST Root Class 3 CA 2 2009**
   Info: https://crt.sh/?caid=712
   X509 Certificate: https://crt.sh/?id=133226
   Not after: Nov 5 08:35:58 2029 GMT
-    * Issuing CA: **D-TRUST SSL Class 3 CA 1 2009** [server certificates via TMF e.V.]
-      Info: https://crt.sh/?caid=713
-      X509 Certificate: https://crt.sh/?id=133227
-      Not after: Nov 5 08:35:58 2029 GMT
+   * Issuing CA: **D-TRUST SSL Class 3 CA 1 2009** [server certificates via TMF e.V.]
+     Info: https://crt.sh/?caid=713
+     X509 Certificate: https://crt.sh/?id=133227
+     Not after: Nov 5 08:35:58 2029 GMT
 * Root CA: **USERTrust ECC Certification Authority** [will be removed in a future release, incl. derived CAs]
   Info: https://crt.sh/?caid=1390
   X509 Certificate: https://crt.sh/?id=2841410
   Not after: Jan 18 23:59:59 2038 GMT
-    * Issuing CA: **Sectigo ECC Organization Validation Secure Server CA**
-      Info: https://crt.sh/?caid=105483
-      X509 Certificate: https://crt.sh/?id=924467859
-      Not after: Dec 31 23:59:59 2030 GMT
-    * Issuing CA: **GEANT OV ECC CA 4**
-      Info: https://crt.sh/?caid=160140
-      X509 Certificate: https://crt.sh/?id=2475254970
-    * Issuing CA: **GEANT Personal ECC CA 4** [client/smime certificates only]
-      Info: https://crt.sh/?caid=160136
-      X509 Certificate: https://crt.sh/?id=2475254903
-      Not after: May 1 23:59:59 2033 GMT
-    * Issuing CA: **GEANT eScience Personal ECC CA 4** [client/smime certificates only]
-      Info: https://crt.sh/?caid=160138
-      X509 Certificate: https://crt.sh/?id=2475254888
-      Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **Sectigo ECC Organization Validation Secure Server CA**
+    Info: https://crt.sh/?caid=105483
+    X509 Certificate: https://crt.sh/?id=924467859
+    Not after: Dec 31 23:59:59 2030 GMT
+  * Issuing CA: **GEANT OV ECC CA 4**
+    Info: https://crt.sh/?caid=160140
+    X509 Certificate: https://crt.sh/?id=2475254970
+  * Issuing CA: **GEANT Personal ECC CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160136
+    X509 Certificate: https://crt.sh/?id=2475254903
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT eScience Personal ECC CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160138
+    X509 Certificate: https://crt.sh/?id=2475254888
+    Not after: May 1 23:59:59 2033 GMT
 * Root CA: **USERTrust RSA Certification Authority** [will be removed in a future release, incl. derived CAs]
   Info: https://crt.sh/?caid=1167
   X509 Certificate: https://crt.sh/?id=1199354
   Not after: Jan 18 23:59:59 2038 GMT
-    * Issuing CA: **Sectigo RSA Organization Validation Secure Server CA**
-      Info: https://crt.sh/?caid=105487
-      X509 Certificate: https://crt.sh/?id=924467857
-      Not after: Dec 31 23:59:59 2030 GMT
-    * Issuing CA: **GEANT OV RSA CA 4**
-      Info: https://crt.sh/?caid=160137
-      X509 Certificate: https://crt.sh/?id=2475254782
-      Not after: May 1 23:59:59 2033 GMT
-    * Issuing CA: **GEANT Personal CA 4** [client/smime certificates only]
-      Info: https://crt.sh/?caid=160144
-      X509 Certificate: https://crt.sh/?id=2475255043
-      Not after: May 1 23:59:59 2033 GMT
-    * Issuing CA: **GEANT eScience Personal CA 4** [client/smime certificates only]
-      Info: https://crt.sh/?caid=160134
-      X509 Certificate: https://crt.sh/?id=2475253350
-      Not after: May 1 23:59:59 2033 GMT
-
-### Other CAs
-
-* Root CA: **HARICA Client ECC Root CA 2021**
-  Info: https://crt.sh/?caid=202189
-  X509 Certificate: https://crt.sh/?id=4147052292
-  Not after: Feb 13 11:03:33 2045 GMT
-  * Issuing CA: **HARICA Client Authentication ECC** [client certificates only]
-    Info: https://crt.sh/?caid=207671
-    X509 Certificate: https://crt.sh/?id=4442848518
-    Not after: Mar 15 09:17:38 2036 GMT
-* Root CA: **HARICA Client RSA Root CA 2021**
-  Info: https://crt.sh/?caid=202188
-  X509 Certificate: https://crt.sh/?id=4147049674
-  Not after: Feb 13 10:58:45 2045 GMT
-  * Issuing CA: **HARICA Client Authentication RSA** [client certificates only]
-    Info: https://crt.sh/?caid=207670
-    X509 Certificate: https://crt.sh/?id=4442848531
-    Not after: Mar 15 09:19:36 2036 GMT
-
+  * Issuing CA: **Sectigo RSA Organization Validation Secure Server CA**
+    Info: https://crt.sh/?caid=105487
+    X509 Certificate: https://crt.sh/?id=924467857
+    Not after: Dec 31 23:59:59 2030 GMT
+  * Issuing CA: **GEANT OV RSA CA 4**
+    Info: https://crt.sh/?caid=160137
+    X509 Certificate: https://crt.sh/?id=2475254782
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT Personal CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160144
+    X509 Certificate: https://crt.sh/?id=2475255043
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT eScience Personal CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160134
+    X509 Certificate: https://crt.sh/?id=2475253350
+    Not after: May 1 23:59:59 2033 GMT
 * Root CA: **D-TRUST Limited Basic Root CA 1 2019**
   X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_Root_CA_1_2019.crt
   Not after: Jun 19 08:15:51 2034 GMT
-    * Issuing CA: **D-TRUST Limited Basic CA 1-2 2019** [client certificates via TMF e.V.]
-      X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-2_2019.crt
-      Not after: Jun 19 08:15:51 2034 GMT
-    * Issuing CA: **D-TRUST Limited Basic CA 1-3 2019** [client certificates via TMF e.V.]
-      X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-3_2019.crt
-      Not after: Jun 19 08:15:51 2034 GMT
+  * Issuing CA: **D-TRUST Limited Basic CA 1-2 2019** [client certificates via TMF e.V.]
+    X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-2_2019.crt
+    Not after: Jun 19 08:15:51 2034 GMT
+  * Issuing CA: **D-TRUST Limited Basic CA 1-3 2019** [client certificates via TMF e.V.]
+    X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-3_2019.crt
+    Not after: Jun 19 08:15:51 2034 GMT