functions/Start-DbaDbEncryption.ps1
|
function Start-DbaDbEncryption { <# .SYNOPSIS Combo command that encrypts all instances on a database and backs up all keys and certs .DESCRIPTION Combo command that encrypts all instances on a database and backs up all keys and certs * Ensures a database master key exists in the master database and backs it up * Ensures a database certificate or asymmetric key exists in the master database and backs it up * Creates a database master key in the target database and backs it up * Creates a database certificate or asymmetric key in the target database and backs it up * Creates a database encryption key in the target database and backs it up * Enables database encryption on the target database and backs it up .PARAMETER SqlInstance The target SQL Server instance or instances. .PARAMETER SqlCredential Login to the target instance using alternative credentials. Accepts PowerShell credentials (Get-Credential). Windows Authentication, SQL Server Authentication, Active Directory - Password, and Active Directory - Integrated are all supported. For MFA support, please use Connect-DbaInstance. .PARAMETER Database The database or databases that will be encrypted .PARAMETER ExcludeDatabase The database or databases that will not be encrypted .PARAMETER EncryptorName The name of the encryptor (Certificate or Asymmetric Key) in master that will be used. Tries to find one if one is not specified. In order to encrypt the database encryption key with an asymmetric key, you must use an asymmetric key that resides on an extensible key management provider. .PARAMETER EncryptorType Type of Encryptor - either Asymmetric or Certificate .PARAMETER MasterKeySecurePassword A master service key will be created and backed up if one does not exist MasterKeySecurePassword is the secure string (password) used to create the key This parameter is required even if no master keys are made, as we won't know if master key creation will be required until each server is processed .PARAMETER BackupSecurePassword This command will perform backups of all maskter keys and certificates. Use this parameter to set the backup password .PARAMETER BackupPath The path (accessible by and relative to the SQL Server) where master keys and certificates are backed up .PARAMETER AllUserDatabases Run command against all user databases This was added to emphasize that all user databases will be encrypted .PARAMETER CertificateSubject Optional subject that will be used when creating all certificates .PARAMETER CertificateStartDate Optional start date that will be used when creating all certificates By default, certs will start immediately .PARAMETER CertificateExpirationDate Optional expiration that will be used when creating all certificates By default, certs will last 5 years .PARAMETER CertificateActiveForServiceBrokerDialog Microsoft has not provided a description so we can only assume the cert is active for service broker dialog .PARAMETER InputObject Enables piping from Get-DbaDatabase .PARAMETER WhatIf Shows what would happen if the command were to run. No actions are actually performed. .PARAMETER Confirm Prompts you for confirmation before executing any changing operations within the command. .PARAMETER EnableException By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message. This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables advanced scripting. Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own try/catch. .NOTES Tags: Certificate, Security Author: Chrissy LeMaire (@cl), netnerds.net Website: https://dbatools.io Copyright: (c) 2022 by dbatools, licensed under MIT License: MIT https://opensource.org/licenses/MIT .LINK https://dbatools.io/Start-DbaDbEncryption .EXAMPLE PS C:\> $masterkeypass = (Get-Credential justneedpassword).Password PS C:\> $certbackuppass = (Get-Credential justneedpassword).Password PS C:\> $params = @{ >> SqlInstance = "sql01" >> AllUserDatabases = $true >> MasterKeySecurePassword = $masterkeypass >> BackupSecurePassword = $certbackuppass >> BackupPath = "C:\temp" >> EnableException = $true >> } PS C:\> Start-DbaDbEncryption @params Prompts for two passwords (the username doesn't matter, this is just an easy & secure way to get a secure password) Then encrypts all user databases on sql01, creating master keys and certificates as needed, and backing all of them up to C:\temp, securing them with the password set in $certbackuppass #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = "High")] param ( [DbaInstanceParameter[]]$SqlInstance, [PSCredential]$SqlCredential, [string]$EncryptorName, [ValidateSet("AsymmetricKey", "Certificate")] [string]$EncryptorType = "Certificate", [string[]]$Database, [Parameter(Mandatory)] [string]$BackupPath, [Parameter(Mandatory)] [Security.SecureString]$MasterKeySecurePassword, [string]$CertificateSubject, [datetime]$CertificateStartDate = (Get-Date), [datetime]$CertificateExpirationDate = (Get-Date).AddYears(5), [switch]$CertificateActiveForServiceBrokerDialog, [Parameter(Mandatory)] [Security.SecureString]$BackupSecurePassword, [parameter(ValueFromPipeline)] [Microsoft.SqlServer.Management.Smo.Database[]]$InputObject, [switch]$AllUserDatabases, [switch]$EnableException ) process { if (-not $SqlInstance -and -not $InputObject) { Stop-Function -Message "You must specify either SqlInstance or pipe in an InputObject from Get-DbaDatabase" return } if ($SqlInstance) { if (-not $Database -and -not $ExcludeDatabase -and -not $AllUserDatabases) { Stop-Function -Message "You must specify Database, ExcludeDatabase or AllUserDatabases when using SqlInstance" return } # all does not need to be addressed in the code because it gets all the dbs if $databases is empty $param = @{ SqlInstance = $SqlInstance SqlCredential = $SqlCredential Database = $Database ExcludeDatabase = $ExcludeDatabase } $InputObject += Get-DbaDatabase @param | Where-Object Name -NotIn 'master', 'model', 'tempdb', 'msdb', 'resource' } $PSDefaultParameterValues["Connect-DbaInstance:Verbose"] = $false foreach ($db in $InputObject) { try { # Just in case they use inputobject + exclude if ($db.Name -in $ExcludeDatabase) { continue } $server = $db.Parent # refresh in case we have a stale database $null = $db.Refresh() $null = $server.Refresh() if ($db.EncryptionEnabled) { Write-Message -Level Warning -Message "Database $($db.Name) on $($server.Name) is already encrypted" continue } # before doing anything, see if the master cert is in order if ($EncryptorName) { $mastercert = Get-DbaDbCertificate -SqlInstance $server -Database master | Where-Object Name -eq $EncryptorName } else { $mastercert = Get-DbaDbCertificate -SqlInstance $server -Database master | Where-Object Name -NotMatch "##" } if ($EncryptorName -and -not $mastercert) { Stop-Function -Message "EncryptorName specified but no matching certificate found on $($server.Name)" -Continue } if ($mastercert.Count -gt 1) { Stop-Function -Message "More than one certificate found on $($server.Name), please specify an EncryptorName" -Continue } $stepCounter = 0 Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Processing $($db.Name)" # Ensure a database master key exists in the master database Write-Message -Level Verbose -Message "Ensure a database master key exists in the master database for $($server.Name)" Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Ensure a database master key exists in the master database for $($server.Name)" $masterkey = Get-DbaDbMasterKey -SqlInstance $server -Database master if (-not $masterkey) { Write-Message -Level Verbose -Message "master key not found, creating one" $params = @{ SqlInstance = $server SecurePassword = $MasterKeySecurePassword EnableException = $true } $masterkey = New-DbaServiceMasterKey @params } # Back up master key $params = @{ SqlInstance = $server Database = "master" Path = $BackupPath EnableException = $true SecurePassword = $BackupSecurePassword } $null = $server.Databases["master"].Refresh() Write-Message -Level Verbose -Message "Backing up master key on $($server.Name)" $null = Backup-DbaDbMasterKey @params Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Processing EncryptorType for $($db.Name) on $($server.Name)" if ($EncryptorType -eq "Certificate") { if (-not $mastercert) { Write-Message -Level Verbose -Message "master cert not found, creating one" $params = @{ SqlInstance = $server Database = "master" StartDate = $CertificateStartDate ExpirationDate = $CertificateExpirationDate ActiveForServiceBrokerDialog = $CertificateActiveForServiceBrokerDialog EnableException = $true } if ($CertificateSubject) { $params.Subject = $CertificateSubject } $mastercert = New-DbaDbCertificate @params # Back up certificate $null = $server.Databases["master"].Refresh() $params = @{ SqlInstance = $server Database = "master" Certificate = $mastercert.Name Path = $BackupPath EnableException = $true EncryptionPassword = $BackupSecurePassword } Write-Message -Level Verbose -Message "Backing up master certificate" $null = Backup-DbaDbCertificate @params } else { Write-Message -Level Verbose -Message "master cert found on $($server.Name)" } if (-not $EncryptorName) { Write-Message -Level Verbose -Message "Getting EncryptorName from master cert on $($server.Name)" $EncryptorName = $mastercert.Name } } else { $masterasym = Get-DbaDbAsymmetricKey -SqlInstance $server -Database master if (-not $masterasym) { Write-Message -Level Verbose -Message "Asymmetric key not found, creating one for master on $($server.Name)" $params = @{ SqlInstance = $server Database = "master" EnableException = $true } $masterasym = New-DbaDbAsymmetricKey @params $null = $server.Refresh() $null = $server.Databases["master"].Refresh() } else { Write-Message -Level Verbose -Message "master asymmetric key found on $($server.Name)" } if (-not $EncryptorName) { Write-Message -Level Verbose -Message "Getting EncryptorName from master asymmetric key" $EncryptorName = $masterasym.Name } } Write-Message -Level Verbose -Message "Using EncryptorName '$EncryptorName'" # Create a database master key in the target database Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Creating database master key for $($db.Name) on $($server.Name)" $null = $server.Databases["master"].Refresh() $dbmasterkey = $db | Get-DbaDbMasterKey if (-not $dbmasterkey) { $params = @{ SqlInstance = $server Database = $db.Name SecurePassword = $MasterKeySecurePassword EnableException = $true } Write-Message -Level Verbose -Message "Creating master key in $($db.Name) on $($server.Name)" $dbmasterkey = New-DbaDbMasterKey @params $null = $db.Refresh() } else { Write-Message -Level Verbose -Message "master key found in $($db.Name) on $($server.Name)" } # Back up master key $params = @{ SqlInstance = $server Database = $db.Name Path = $BackupPath EnableException = $true SecurePassword = $BackupSecurePassword } Write-Message -Level Verbose -Message "Backing up master key for $($db.Name) on $($server.Name)" $null = Backup-DbaDbMasterKey @params # Create a database certificate or asymmetric key in the target database Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Creating a database certificate or asymmetric key in $($db.Name) on $($server.Name)" if ($EncryptorType -eq "Certificate") { $dbcert = Get-DbaDbCertificate -SqlInstance $server -Database $db.Name if (-not $dbcert) { Write-Message -Level Verbose -Message "Cert not found for $($db.Name) on $($server.Name), creating one" $params = @{ SqlInstance = $server Database = $db.Name StartDate = $CertificateStartDate ExpirationDate = $CertificateExpirationDate ActiveForServiceBrokerDialog = $CertificateActiveForServiceBrokerDialog EnableException = $true } if ($CertificateSubject) { $params.Subject = $CertificateSubject } $dbcert = New-DbaDbCertificate @params } else { Write-Message -Level Verbose -Message "Cert '$($dbcert.Name)' found in $($db.Name) on $($server.Name)" } # Back up certificate $null = $db.Refresh() $params = @{ SqlInstance = $server Database = $db.Name Certificate = $dbcert.Name Path = $BackupPath EnableException = $true EncryptionPassword = $BackupSecurePassword } Write-Message -Level Verbose -Message "Backing up certificate for $($db.Name) on $($server.Name)" $null = Backup-DbaDbCertificate @params } else { $dbasymkey = Get-DbaDbAsymmetricKey -SqlInstance $server -Database $db.Name if (-not $dbasymkey) { Write-Message -Level Verbose -Message "Asymmetric key not found for $($db.Name) on $($server.Name),creating one" $params = @{ SqlInstance = $server Database = $db.Name EnableException = $true } $dbasymkey = New-DbaDbAsymmetricKey @params $null = $db.Refresh() } } $null = $db.Refresh() # Create a database encryption key in the target database # Enable database encryption on the target database Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Creating database encryption key in $($db.Name) on $($server.Name)" if ($db.HasDatabaseEncryptionKey) { Write-Message -Level Verbose -Message "$($db.Name) on $($db.Parent.Name) already has a database encryption key" } else { Write-Message -Level Verbose -Message "Creating new encryption key for $($db.Name) on $($server.Name) with EncryptorName $EncryptorName" $null = $db | New-DbaDbEncryptionKey -EncryptorName $EncryptorName -EnableException } Write-ProgressHelper -StepNumber ($stepCounter++) -Message "Enabling database encryption in $($db.Name) on $($server.Name)" Write-Message -Level Verbose -Message "Enabling encryption for $($db.Name) on $($server.Name)" $db | Enable-DbaDbEncryption -EncryptorName $EncryptorName } catch { Stop-Function -Message "Failure" -ErrorRecord $_ -Continue } } } } # SIG # Begin signature block # MIIZewYJKoZIhvcNAQcCoIIZbDCCGWgCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB # gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR # AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUKmhdSj6I4++IZzmyIws5WKli # LgOgghSJMIIE/jCCA+agAwIBAgIQDUJK4L46iP9gQCHOFADw3TANBgkqhkiG9w0B # AQsFADByMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYD # VQQLExB3d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFz # c3VyZWQgSUQgVGltZXN0YW1waW5nIENBMB4XDTIxMDEwMTAwMDAwMFoXDTMxMDEw # NjAwMDAwMFowSDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMu # MSAwHgYDVQQDExdEaWdpQ2VydCBUaW1lc3RhbXAgMjAyMTCCASIwDQYJKoZIhvcN # AQEBBQADggEPADCCAQoCggEBAMLmYYRnxYr1DQikRcpja1HXOhFCvQp1dU2UtAxQ # tSYQ/h3Ib5FrDJbnGlxI70Tlv5thzRWRYlq4/2cLnGP9NmqB+in43Stwhd4CGPN4 # bbx9+cdtCT2+anaH6Yq9+IRdHnbJ5MZ2djpT0dHTWjaPxqPhLxs6t2HWc+xObTOK # fF1FLUuxUOZBOjdWhtyTI433UCXoZObd048vV7WHIOsOjizVI9r0TXhG4wODMSlK # XAwxikqMiMX3MFr5FK8VX2xDSQn9JiNT9o1j6BqrW7EdMMKbaYK02/xWVLwfoYer # vnpbCiAvSwnJlaeNsvrWY4tOpXIc7p96AXP4Gdb+DUmEvQECAwEAAaOCAbgwggG0 # MA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQMMAoGCCsG # AQUFBwMIMEEGA1UdIAQ6MDgwNgYJYIZIAYb9bAcBMCkwJwYIKwYBBQUHAgEWG2h0 # dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAfBgNVHSMEGDAWgBT0tuEgHf4prtLk # YaWyoiWyyBc1bjAdBgNVHQ4EFgQUNkSGjqS6sGa+vCgtHUQ23eNqerwwcQYDVR0f # BGowaDAyoDCgLoYsaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJl # ZC10cy5jcmwwMqAwoC6GLGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWFz # c3VyZWQtdHMuY3JsMIGFBggrBgEFBQcBAQR5MHcwJAYIKwYBBQUHMAGGGGh0dHA6 # Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBPBggrBgEFBQcwAoZDaHR0cDovL2NhY2VydHMu # ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRFRpbWVzdGFtcGluZ0NB # LmNydDANBgkqhkiG9w0BAQsFAAOCAQEASBzctemaI7znGucgDo5nRv1CclF0CiNH # o6uS0iXEcFm+FKDlJ4GlTRQVGQd58NEEw4bZO73+RAJmTe1ppA/2uHDPYuj1UUp4 # eTZ6J7fz51Kfk6ftQ55757TdQSKJ+4eiRgNO/PT+t2R3Y18jUmmDgvoaU+2QzI2h # F3MN9PNlOXBL85zWenvaDLw9MtAby/Vh/HUIAHa8gQ74wOFcz8QRcucbZEnYIpp1 # FUL1LTI4gdr0YKK6tFL7XOBhJCVPst/JKahzQ1HavWPWH1ub9y4bTxMd90oNcX6X # t/Q/hOvB46NJofrOp79Wz7pZdmGJX36ntI5nePk2mOHLKNpbh6aKLzCCBRowggQC # oAMCAQICEAMFu4YhsKFjX7/erhIE520wDQYJKoZIhvcNAQELBQAwcjELMAkGA1UE # BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2lj # ZXJ0LmNvbTExMC8GA1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIENvZGUg # U2lnbmluZyBDQTAeFw0yMDA1MTIwMDAwMDBaFw0yMzA2MDgxMjAwMDBaMFcxCzAJ # BgNVBAYTAlVTMREwDwYDVQQIEwhWaXJnaW5pYTEPMA0GA1UEBxMGVmllbm5hMREw # DwYDVQQKEwhkYmF0b29sczERMA8GA1UEAxMIZGJhdG9vbHMwggEiMA0GCSqGSIb3 # DQEBAQUAA4IBDwAwggEKAoIBAQC8v2N7q+O/vggBtpjmteofFo140k73JXQ5sOD6 # QLzjgija+scoYPxTmFSImnqtjfZFWmucAWsDiMVVro/6yGjsXmJJUA7oD5BlMdAK # fuiq4558YBOjjc0Bp3NbY5ZGujdCmsw9lqHRAVil6P1ZpAv3D/TyVVq6AjDsJY+x # rRL9iMc8YpD5tiAj+SsRSuT5qwPuW83ByRHqkaJ5YDJ/R82ZKh69AFNXoJ3xCJR+ # P7+pa8tbdSgRf25w4ZfYPy9InEvsnIRVZMeDjjuGvqr0/Mar73UI79z0NYW80yN/ # 7VzlrvV8RnniHWY2ib9ehZligp5aEqdV2/XFVPV4SKaJs8R9AgMBAAGjggHFMIIB # wTAfBgNVHSMEGDAWgBRaxLl7KgqjpepxA8Bg+S32ZXUOWDAdBgNVHQ4EFgQU8MCg # +7YDgENO+wnX3d96scvjniIwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG # AQUFBwMDMHcGA1UdHwRwMG4wNaAzoDGGL2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv # bS9zaGEyLWFzc3VyZWQtY3MtZzEuY3JsMDWgM6Axhi9odHRwOi8vY3JsNC5kaWdp # Y2VydC5jb20vc2hhMi1hc3N1cmVkLWNzLWcxLmNybDBMBgNVHSAERTBDMDcGCWCG # SAGG/WwDATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20v # Q1BTMAgGBmeBDAEEATCBhAYIKwYBBQUHAQEEeDB2MCQGCCsGAQUFBzABhhhodHRw # Oi8vb2NzcC5kaWdpY2VydC5jb20wTgYIKwYBBQUHMAKGQmh0dHA6Ly9jYWNlcnRz # LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDb2RlU2lnbmluZ0NB # LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCPzflwlQwf1jak # EqymPOc0nBxiY7F4FwcmL7IrTLhub6Pjg4ZYfiC79Akz5aNlqO+TJ0kqglkfnOsc # jfKQzzDwcZthLVZl83igzCLnWMo8Zk/D2d4ZLY9esFwqPNvuuVDrHvgh7H6DJ/zP # Vm5EOK0sljT0UQ6HQEwtouH5S8nrqCGZ8jKM/+DeJlm+rCAGGf7TV85uqsAn5JqD # En/bXE1AlyG1Q5YiXFGS5Sf0qS4Nisw7vRrZ6Qc4NwBty4cAYjzDPDixorWI8+FV # OUWKMdL7tV8i393/XykwsccCstBCp7VnSZN+4vgzjEJQql5uQfysjcW9rrb/qixp # csPTKYRHMIIFMDCCBBigAwIBAgIQBAkYG1/Vu2Z1U0O1b5VQCDANBgkqhkiG9w0B # AQsFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYD # VQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVk # IElEIFJvb3QgQ0EwHhcNMTMxMDIyMTIwMDAwWhcNMjgxMDIyMTIwMDAwWjByMQsw # CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu # ZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQg # Q29kZSBTaWduaW5nIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA # +NOzHH8OEa9ndwfTCzFJGc/Q+0WZsTrbRPV/5aid2zLXcep2nQUut4/6kkPApfmJ # 1DcZ17aq8JyGpdglrA55KDp+6dFn08b7KSfH03sjlOSRI5aQd4L5oYQjZhJUM1B0 # sSgmuyRpwsJS8hRniolF1C2ho+mILCCVrhxKhwjfDPXiTWAYvqrEsq5wMWYzcT6s # cKKrzn/pfMuSoeU7MRzP6vIK5Fe7SrXpdOYr/mzLfnQ5Ng2Q7+S1TqSp6moKq4Tz # rGdOtcT3jNEgJSPrCGQ+UpbB8g8S9MWOD8Gi6CxR93O8vYWxYoNzQYIH5DiLanMg # 0A9kczyen6Yzqf0Z3yWT0QIDAQABo4IBzTCCAckwEgYDVR0TAQH/BAgwBgEB/wIB # ADAOBgNVHQ8BAf8EBAMCAYYwEwYDVR0lBAwwCgYIKwYBBQUHAwMweQYIKwYBBQUH # AQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYI # KwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz # c3VyZWRJRFJvb3RDQS5jcnQwgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9jcmw0 # LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaG # NGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RD # QS5jcmwwTwYDVR0gBEgwRjA4BgpghkgBhv1sAAIEMCowKAYIKwYBBQUHAgEWHGh0 # dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCgYIYIZIAYb9bAMwHQYDVR0OBBYE # FFrEuXsqCqOl6nEDwGD5LfZldQ5YMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6en # IZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQA+7A1aJLPzItEVyCx8JSl2qB1dHC06 # GsTvMGHXfgtg/cM9D8Svi/3vKt8gVTew4fbRknUPUbRupY5a4l4kgU4QpO4/cY5j # DhNLrddfRHnzNhQGivecRk5c/5CxGwcOkRX7uq+1UcKNJK4kxscnKqEpKBo6cSgC # PC6Ro8AlEeKcFEehemhor5unXCBc2XGxDI+7qPjFEmifz0DLQESlE/DmZAwlCEIy # sjaKJAL+L3J+HNdJRZboWR3p+nRka7LrZkPas7CM1ekN3fYBIM6ZMWM9CBoYs4Gb # T8aTEAb8B4H6i9r5gkn3Ym6hU/oSlBiFLpKR6mhsRDKyZqHnGKSaZFHvMIIFMTCC # BBmgAwIBAgIQCqEl1tYyG35B5AXaNpfCFTANBgkqhkiG9w0BAQsFADBlMQswCQYD # VQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGln # aWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0Ew # HhcNMTYwMTA3MTIwMDAwWhcNMzEwMTA3MTIwMDAwWjByMQswCQYDVQQGEwJVUzEV # MBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29t # MTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgVGltZXN0YW1waW5n # IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvdAy7kvNj3/dqbqC # mcU5VChXtiNKxA4HRTNREH3Q+X1NaH7ntqD0jbOI5Je/YyGQmL8TvFfTw+F+CNZq # FAA49y4eO+7MpvYyWf5fZT/gm+vjRkcGGlV+Cyd+wKL1oODeIj8O/36V+/OjuiI+ # GKwR5PCZA207hXwJ0+5dyJoLVOOoCXFr4M8iEA91z3FyTgqt30A6XLdR4aF5FMZN # JCMwXbzsPGBqrC8HzP3w6kfZiFBe/WZuVmEnKYmEUeaC50ZQ/ZQqLKfkdT66mA+E # f58xFNat1fJky3seBdCEGXIX8RcG7z3N1k3vBkL9olMqT4UdxB08r8/arBD13ays # 6Vb/kwIDAQABo4IBzjCCAcowHQYDVR0OBBYEFPS24SAd/imu0uRhpbKiJbLIFzVu # MB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMBIGA1UdEwEB/wQIMAYB # Af8CAQAwDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMHkGCCsG # AQUFBwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t # MEMGCCsGAQUFBzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl # cnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqgOKA2hjRodHRwOi8v # Y3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3JsMDqg # OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS # b290Q0EuY3JsMFAGA1UdIARJMEcwOAYKYIZIAYb9bAACBDAqMCgGCCsGAQUFBwIB # FhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAsGCWCGSAGG/WwHATANBgkq # hkiG9w0BAQsFAAOCAQEAcZUS6VGHVmnN793afKpjerN4zwY3QITvS4S/ys8DAv3F # p8MOIEIsr3fzKx8MIVoqtwU0HWqumfgnoma/Capg33akOpMP+LLR2HwZYuhegiUe # xLoceywh4tZbLBQ1QwRostt1AuByx5jWPGTlH0gQGF+JOGFNYkYkh2OMkVIsrymJ # 5Xgf1gsUpYDXEkdws3XVk4WTfraSZ/tTYYmo9WuWwPRYaQ18yAGxuSh1t5ljhSKM # Ycp5lH5Z/IwP42+1ASa2bKXuh1Eh5Fhgm7oMLSttosR+u8QlK0cCCHxJrhO24XxC # QijGGFbPQTS2Zl22dHv1VjMiLyI2skuiSpXY9aaOUjGCBFwwggRYAgEBMIGGMHIx # CzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3 # dy5kaWdpY2VydC5jb20xMTAvBgNVBAMTKERpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ # RCBDb2RlIFNpZ25pbmcgQ0ECEAMFu4YhsKFjX7/erhIE520wCQYFKw4DAhoFAKB4 # MBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQB # gjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwIwYJKoZIhvcNAQkE # MRYEFNMm5GMfmH4TuXJk6AU2YWEv2cdPMA0GCSqGSIb3DQEBAQUABIIBACpQldtA # aMFtVvADBq8OA5jB1R1GBhiaZ3SVFz80xFi9MkikPPaup7k8flSTAqZWTNxHEJaA # 4kVhUPeen1/vXByS2q/Qp5H/TAReTcqEt1EnBwHvwp8fDXdZ9fVbPhgBJKuWpM3n # YdbdLvs6nc17P3z5tALUyxUU4PRGucIw+ajRG7h2OlkTtPsL92/1uArZfbOHu8CR # DXc/xSZVmZ6z9pZLJMsdREvU7ZDtkeFrUKf1c2AdIlEh2/tbzDYtVb/Oi+0QlDsi # 46RDCIUQdQEVcCIl0nVzwrxyRGpqm1ifkVTk/eGmffnQLxEGRaCdRkWzoiv7CtWH # 0yq2NiHhhzk8oz6hggIwMIICLAYJKoZIhvcNAQkGMYICHTCCAhkCAQEwgYYwcjEL # MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 # LmRpZ2ljZXJ0LmNvbTExMC8GA1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElE # IFRpbWVzdGFtcGluZyBDQQIQDUJK4L46iP9gQCHOFADw3TANBglghkgBZQMEAgEF # AKBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIy # MDExNDE2MTQ0MlowLwYJKoZIhvcNAQkEMSIEIHWgVkNXYkln5BpUKl1lVmtvdwKT # qTpGnnpuF+EN40/CMA0GCSqGSIb3DQEBAQUABIIBAGXFP25ShgR+QuJKMdC58Rck # HWKJ2M56upw07nedQyxp4pAuAGVUKOZn1aZZaDrx4fUXxR4y0ECOaddKzrXQlLN7 # lGMr/+aEYB35E2gfk+OILDlGM+fTvLEMN3WhRI3HPi5AqxCS9dEGJtHli9oJw5AY # 6NQQX/96lMV81RetXrafGgGLRDR4Ucwov2PuRwYpRXJst3F8miCUnteLQI/ho+8S # zOcK/YGLVQGdwHiabtxE4/QkJCFkea34Pp9Jr2r2XlZO1R7a0uSffp9ko06AeqUj # EtMEe61cX0wXQzd26Vu7p5t0jcJMW5zF6T3/tu9uWStiY8qi9GcHk9t1L9ARTFg= # SIG # End signature block |