improve security, add sequence diagrams and flows (#1)

.github/workflows/golangci-lint.yml

@@ -1,8 +1,13 @@
 name: golangci-lint
 on:
   push:
+    branches:
+      - main
     paths:
       - '**.go'
+    tags-ignore:
+      - '**'
+
   pull_request:
     paths:
       - '**.go'

README.md

@@ -12,6 +12,34 @@ are **allowed** to communicate with the server.
 
 This is a super basic approach to ssl reverse pinning approach.
 
+## Client-Server SSL Reverse Pinning Flow
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant Server
+
+    Client->>Server: Initiates connection (Hello)
+    Server->>Client: Requests client certificate
+    Client->>Server: Sends client certificate
+    Server->>Server: Verifies client certificate
+    alt Certificate valid
+        Server->>Client: Connection accepted (Handshake)
+    else Certificate invalid
+        Server->>Client: Connection rejected (Terminate)
+    end
+```
+
+## Certificate Validation Process
+
+```mermaid
+flowchart TD
+    A[Client Sends Certificate] --> B{Is the Certificate Valid?}
+    B -- Yes --> C[Allow Access]
+    B -- No --> D[Terminate Connection]
+    C --> E[Proceed with Encrypted Communication]
+```
+
 ---
 
 ## Requirements
@@ -39,23 +67,42 @@ You can create your own keys and certificates!
 
 ```bash
 # CA certificate
-openssl req -new -newkey rsa:2048 -nodes -x509 -days 365 -keyout certs/client/client-ca-key.pem -out certs/client/client-ca.pem -config ca_openssl.cnf
+openssl req -new -newkey rsa:4096 -nodes -x509 -days 365 \
+    -keyout certs/client/client-ca-key.pem \
+    -out certs/client/client-ca.pem \
+    -config ca_openssl.cnf
 
 # Server Key and CSR
-openssl req -new -newkey rsa:2048 -nodes -keyout certs/server/server-key.pem -out certs/server/server-cert.csr -config openssl.cnf
+openssl req -new -newkey rsa:4096 -nodes \
+    -keyout certs/server/server-key.pem \
+    -out certs/server/server-cert.csr \
+    -config openssl.cnf
 
 # Sign the Server CSR with CA
-openssl x509 -req -in certs/server/server-cert.csr -CA certs/client/client-ca.pem -CAkey certs/client/client-ca-key.pem -CAcreateserial -out certs/server/server-cert.pem -days 365 -extensions req_ext -extfile openssl.cnf
-# Certificate request self-signature ok
-# subject=C=TR, ST=Istanbul, L=Istanbul, O=Bilus, OU=Development, CN=localhost
+openssl x509 -req -in \
+    certs/server/server-cert.csr \
+    -CA certs/client/client-ca.pem \
+    -CAkey certs/client/client-ca-key.pem \
+    -CAcreateserial -out certs/server/server-cert.pem \
+    -days 365 \
+    -extensions req_ext -extfile openssl.cnf
+
 
 # Client Key and CSR
-openssl req -new -newkey rsa:2048 -nodes -keyout certs/client/client-key.pem -out certs/client/client-cert.csr -config openssl.cnf
+openssl req -new -newkey rsa:4096 -nodes \
+    -keyout certs/client/client-key.pem \
+    -out certs/client/client-cert.csr \
+    -config openssl.cnf
+
 
 # Sign the Client CSR with CA
-openssl x509 -req -in certs/client/client-cert.csr -CA certs/client/client-ca.pem -CAkey certs/client/client-ca-key.pem -CAcreateserial -out certs/client/client-cert-signed.pem -days 365 -extensions req_ext -extfile openssl.cnf
-# Certificate request self-signature ok
-# subject=C=TR, ST=Istanbul, L=Istanbul, O=Bilus, OU=Development, CN=localhost
+openssl x509 -req \
+    -in certs/client/client-cert.csr \
+    -CA certs/client/client-ca.pem \
+    -CAkey certs/client/client-ca-key.pem \
+    -CAcreateserial -out certs/client/client-cert-signed.pem \
+    -days 365 \
+    -extensions req_ext -extfile openssl.cnf
 ```
 
 Now check your certificate:

certs/client/client-ca-key.pem

@@ -1,28 +1,52 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDQxCZcwVEHCBHc
-FNOzzaAQDSggT1uE0R0s84mqRt/L4FVtMqMgL94Jyg0AFUmvyfWoW3Yff++KnmqR
-BkSQ6N0LJJdZtYUaPSHnOy0HH/RspuAABdX5ZdMMQheezKEUDth2eqp3izYUXtmP
-nVBza8cYlx3FWpj7JF+WZmzKKf/93EgpSN3I0hqHMn9PGqMnaP6qGu9PlFYKOwFy
-OSH9o0o63mQEN7Txs3vJNp315aAkWA4LXNf3vchgeTPltEXc0Q0KjhtcG6SDdnwX
-vax/q1DwD+MOMcqDMemlo6MFBcZgDqFpc+5hkww4X/T2JL8wXILlIWb0nDAkIOxV
-I9Pe4HTzAgMBAAECggEAW+Dn7UybR5fynESCQ5DM0COqNEYYxiRuTblFLi6REh5C
-GpP9nQ3UD8Tf4dh8nKQqvJS8MPLSTtSXnAoBJTGHDv9kqPOth7W99RFjKM6UeTkc
-PoZS/Lcmoi94S8hNYBGEjOhBm+klvONdpsoafSHC9vyS+qd7ypPgicW8PWEsq+F5
-f7DOQ2qDxT+/BCkchJnd9ubgP9vVfciBqCKzG4pcX2A+8X6YIkzVa2aCu2jIrzZ7
-aU12LCFfJ+gx0xCmVVCN008Jb4sVVjTclvuFm0m+dY1wXqrj6YRI4Ucqt0NHca9z
-kyE30/Blzkj+R4rti9+hzzFqv/Rulu86h2gVcNeJOQKBgQD9NdyMvcH7SHd0a8Q5
-Yq1xVVt3cP5fhJ5V8NDi+ZZhetIP8dZ2ZEXxfaYFPGun2Vh9Gn0Y2hJ2ufPoRgpN
-D5fn4kuC49rXhpyj4Q0pQTyJfOn8YZegMlyyJ4GMLfJ5OU4VKL8qnKDd0BT870Oy
-qj09BbHA2qBvU9sE6QTIWGv/bQKBgQDTEPDW0JnjViqmvHYMfPOxv/VJ7DNFi4zA
-hG4+chYfc/zB+OSkf7uqgvwkOT7beUrKYIfYzjx+xZCGhSXxeH9VGswJfu6PZacY
-crAU122HpiqGpdPp9rnFECDLHkaa64akEd8H5/wrK6yNLVytR/250RmXVogJYur+
-4AFJTyap3wKBgQCQzgel+TMBKG0gCC08gCEeSik3wkfGikoebcyXsRJ+BsYw1iXG
-qQuS0j9qiSYr5FEFomteFgAvI6LH954Wec9ujeyPGw1g6huUYLStHiCno+cQLSOQ
-OpzmSU99wh0DlHECCr5geRhKIaCPEanOeCrzRdlkp+LOJ89+HGBezqpcdQKBgGG6
-YVmFwwthVWRYtOw5Wvj9ocy1olPcNrLZXtZpKtcrdGg4H14Pisx709XN783djoTA
-R4Zaj+Y/AhlXQ2dYXNUCEGGBNWKONd17FQ7BZQS/KsentsSJKiEVw6lo/lYzIeeM
-ItHdV4SBt2azD0tonxHPwOKy/VAjTh3viIjyLjvPAoGAETSoRgZFl+/rpvbUc4ft
-+LWEQVxbSQ/XW/9+fRGkcAIJq7Lyk0u35fg5mlCCYbTNmwWugWKWCF3h+56Fljjl
-gsRs53QjIMtc+0LvJrGlt6DjSNd2YUE9N6zean6e9dq2Fzs8jdshhTWJnCPHbRk8
-lAD0yswUJDaMbMin48Ey+Vo=
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQDBNtTtAnz/YpeF
+NP8QmrxO6NMTM9vzEA9oOOjjeaYEkEoPHZDLebGTP6/4b4bJ0KHdIXNnI+69E8Wi
+lrjxHgbCuUBRS4BLVddc9IfL2F7EuFZjEE5vfqKv5ia44CxNGVhd/eC1VpRq1f0w
+0uRUCI/7GYtR4kZ/v1oSIBjyYn1gsJN0yRrdNy7aFvGJzeCLmhbZ0s0E2mw/DzqL
+B+rdW+tO5ZijvYoNCPBVx2mokFEt2Vq0v5qiiA1uxObXnzSh7WGjKSsbPd60Ry70
+MveJre7TDeOU5QqXfMp7PTmgnlMr+/M4M+EP9+kQnXb62me+NFXehvvOmHdrGHu6
+x0a4o77IIDN3WDnjL9TskibHtBJzyIZ42wMhF7PyryesvxP1iivKviDfeNYfB+xM
+K+379G67EQdr/XED0OwGk726gcE3yeBrPz0dL5NSGMXNY1KNNbRedW+W9qNhxMAl
+6H8wyYbzuz0/EoHwxbMHL6KLRXJWboliokBVaN+KVbNKKI0PaAzj0PYXaIDQ7WbS
+9VbsZ1p4LBYE2R99WugAuqbXue3FbeLqj2tgA64cbcOfDmxpilMYW2N8ncctz0jW
+ICkxYlQDKFaTez1ScPePQa9ZwCR+CYrenoKuNRPUrTqITVYomI7/6ma/uIP0eTAH
+go4b/UvMu+d+gBLrlNarBd0UYgglBQIDAQABAoIB/wS6yllpT8gj1OcHdiXg1v99
+5r3m7XtsHGvoK+1llXeYMsBwPRskaAEywRv+a7SnIoJpYEeumX7UMEaXae+OIfGR
+QgHMggIi5Jout4qsSce6MuuxWFxRRcxd1eooGzHH9ZUCGW0BoH5SWEa3jYn4iY2+
+I2aqibnsKGprTah/JxsUru3GhwP0VdvvxOjN3Rev4SOWBW7DpcCQFlY/213UFWX7
+J8Fi4mSifgxoTLZcJ1xNSx5UxZZoJJazsq6lnXED+Cyw92470TfLuXynOjTPQF63
+CWOswC85Z1UUbt07aVZU9rBHYaFo1o/39XouiShjDoPbdLTvSsnc4KH2HLQB+Muv
+Kpzww7GxT82KD5PPlJpgWtdYnBFwdlKfgp6v5GbwOOeIaCxx/D0tMy3dk7mIjeWo
+ZhOtCc/LlhEftMblSuQqkkO7gUN9HwU9Ja0wsKxWCAqTPrfYLGp017vYCvHC+vVR
+s3RNGxbtrqlCmW6PmJ3hsZBDkDuKBCfdDOnzkAAr40TUNo9utRNGQE+nSOhdYBqm
+DCZwZDThUe8e12dw/HRn1N5mKCnSPSlK63Vu/dyiOXEYQRQlX9AIPBJ8JZsp5CvV
+c92refXDb/LAEIl2SN5wca2XcqNsNw2MWORdl5qVOYs+Dobliu79F8fyNxBM1v/t
+iR/qUlXtHknjzEkf8VkCggEBAPlMtKYuDVWEoqikWxpy157T8Tl1p62ZN47VFQun
+pt/NrkRaS0ZEmFFulXeI3dY/qxTLypsQ5iBnWImc6TQufsn+H/EM9yWtT7/+zYe8
+BTTCVEoRX9pFIUglgpNizKe52yJgNyJVnIe74UDb6E75D+s72PYribTmXXPFoyAW
+n69PcbHukDARf7yxHyQptpuDBoVnracmZ6vitFCNYs53ZRTzYh8Ob28DhEG0rHG2
+7jWdIpcS/bV2Ln9Lzt88ZqkrycbgPNWFpCtYhViyVbc0koA2SMjIURpWnIiyL6up
+PBR5tlS/WurMgbmgtZnWPEoyz14cvGk95IihyuafUeFaDqMCggEBAMZoO5p0ooAz
+4FaQuKY8//esXWDWbIV2J01F8a7YUt0duYsDl4M5qPOKan+3N5AP278gV4aFYyBD
+gLFbVqzHACC6578XzGyP2Ge3ZHV1/ApKHPbSO6DLcwJh2PwyqAmkywCnpc5l5ef3
+kn9eHGpvS4GE4o5ijlKpC6s1Yt83CDUgkMHOxrhleBBOzX+j54RczUPk29UKSTow
+SsI/8YnRxXNe4Q//J/ErTrZdMG8ToGxsEZTRlK+vSJTdh9B8Is2wVPONf/GbOkMB
+91rYxat1dtD4pLgTAxMcLAaRmBuCmRtss8al7Cd3k4KQjvPFFugPdoPWOo9+hRee
+ewXqVf+FADcCggEBALl8Cdiu4Prk4YUqLCKEmcsxlAQVdvmhywV5otv2FCHmTafL
+qsAQX2gPKCQ08CDtZCPn8MnpC9/GJMjWt2g8w9cUPb3C0Mv2pCSMt20rRpBXmhE1
+1iR3VOjyB7ITS4Prs5BjGAJywjD3aAQy2iiQBPkXoTifcijnUVbHELTaQFtWd5hU
+kHFDQ9An1Ky6YIRaO2rclgaMe4wW8+QPHhnSGaI556KFwgFOE4Qzoi5FVf0L+eV/
+msb9tGDADZ5ouVVbIBjZVEnl0hzyEtzIayARfILqYMMKz9UR5guK0A8frnTpjfCG
+I2YZXNe5LATWsirenQ0/witngnbqMiXfGjPaJpMCggEAfcnrr/suY3WAT6GlT8/w
+wMfI0/JeDydft4AWwDFqJ8IGtnnqf0n5MZ6Z8qroUS+ctEn+88xxkiz51HgCNbxc
++mNFNkQSWOnB28/LoyTQTH28a0fSghk6q1H5zbsYCjUudxXS605zOmQdvx6diWVS
+S6VCNd+KOCHwwfUw4C/1xikFXbqJBrNeMYikhL4XtDVZ9ieMsD67OmcPnqQHsMcM
+Fh8bNZchbad1We0vHd0lolfJtb5CNDg/HhJtXuK09g9LbLZTXYx6na0Lc89nU1M/
+pzFczU9Qbbc4ulloRFjCVT7Po6viUwtevDKGT0qvQSU8kE0sB3nBS74wZQmyyDM8
+dQKCAQBj9OZVK8qLtwhK6KHgfij/p3f360wmBa/J8UQ5kLsKeAybsS0035mRwDVI
+g7/ZIQQga3S24wuzbE2eQDFDsbn64URNzRSRqLPJu16G+Ql/e+akT1QGqUUPqGKf
+QWBrnN1V34y/SG8BSbPNJJ/9lAaI6MoCQMWx8RcR9B6d6LrbMTaw3hdQNtTdBhEO
+b5lS9lHE9eaeUiZRraMZQcn1k7BcYbgmfDsl4weBJ1g3AL95cX3i9xzLj9KyvJ88
+jbcEFRnSI4e9Md8PASezIrJRatmDjhYaBis4ENqq3mb8emw2rxijUjyWhmL63ose
+3BzyQd4cKYT/hSbUtbdtjJJs9odz
 -----END PRIVATE KEY-----

certs/client/client-ca.pem

@@ -1,23 +1,34 @@
 -----BEGIN CERTIFICATE-----
-MIID0DCCArigAwIBAgIUe7H7byPTCe+9ShnHm+MyyMMPGzkwDQYJKoZIhvcNAQEL
+MIIF0DCCA7igAwIBAgIUK2B3iqwwclLvYKAwjNbVB/0nwQcwDQYJKoZIhvcNAQEL
 BQAwcTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQHDAhJ
 c3RhbmJ1bDEOMAwGA1UECgwFQmlsdXMxFDASBgNVBAsMC0RldmVsb3BtZW50MRYw
-FAYDVQQDDA1CaWx1cyBSb290IENBMB4XDTI0MDkyODE3MzQyNVoXDTI1MDkyODE3
-MzQyNVowcTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQH
+FAYDVQQDDA1CaWx1cyBSb290IENBMB4XDTI0MTAwMTE2NTcyMFoXDTI1MTAwMTE2
+NTcyMFowcTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQH
 DAhJc3RhbmJ1bDEOMAwGA1UECgwFQmlsdXMxFDASBgNVBAsMC0RldmVsb3BtZW50
-MRYwFAYDVQQDDA1CaWx1cyBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEA0MQmXMFRBwgR3BTTs82gEA0oIE9bhNEdLPOJqkbfy+BVbTKjIC/e
-CcoNABVJr8n1qFt2H3/vip5qkQZEkOjdCySXWbWFGj0h5zstBx/0bKbgAAXV+WXT
-DEIXnsyhFA7Ydnqqd4s2FF7Zj51Qc2vHGJcdxVqY+yRflmZsyin//dxIKUjdyNIa
-hzJ/TxqjJ2j+qhrvT5RWCjsBcjkh/aNKOt5kBDe08bN7yTad9eWgJFgOC1zX973I
-YHkz5bRF3NENCo4bXBukg3Z8F72sf6tQ8A/jDjHKgzHppaOjBQXGYA6haXPuYZMM
-OF/09iS/MFyC5SFm9JwwJCDsVSPT3uB08wIDAQABo2AwXjAdBgNVHQ4EFgQUJqsh
-G3BhzYsElqqE9wrVm2vuCJgwHwYDVR0jBBgwFoAUJqshG3BhzYsElqqE9wrVm2vu
-CJgwDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQAD
-ggEBAFlygk+9dvG9G73DuUEyYWr9mH9iyh5WsVjB3RSkjWa4gtUGbeZurjRP9YTH
-NmAfM7uBF7cbz8AsePdcroABtZ/Gr7/aaODcZtM3JlUR7GJqrvn+S3Z23COy90XM
-QpLkFT1EaYgaLJNDbrdbKB3WN1alTd71gvUVmzABcv4qDOuMFOARndZHXmHS1OE4
-BFNlo7z/sfHkmXc4mR0/PI51eSJbrP+d7aOLWDDD4ooruGYFiy6/EMA6BC6WWgPJ
-F/ogYKRVYCXDUBRwpiKNAvIrKt7uhKp/poy6Xs9W5dK2dK5bObOJd4lJbEdLzYDB
-sISaqW7f7+dXT5uzxN2oS0B8lxc=
+MRYwFAYDVQQDDA1CaWx1cyBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEAwTbU7QJ8/2KXhTT/EJq8TujTEzPb8xAPaDjo43mmBJBKDx2Qy3mx
+kz+v+G+GydCh3SFzZyPuvRPFopa48R4GwrlAUUuAS1XXXPSHy9hexLhWYxBOb36i
+r+YmuOAsTRlYXf3gtVaUatX9MNLkVAiP+xmLUeJGf79aEiAY8mJ9YLCTdMka3Tcu
+2hbxic3gi5oW2dLNBNpsPw86iwfq3VvrTuWYo72KDQjwVcdpqJBRLdlatL+aoogN
+bsTm1580oe1hoykrGz3etEcu9DL3ia3u0w3jlOUKl3zKez05oJ5TK/vzODPhD/fp
+EJ12+tpnvjRV3ob7zph3axh7usdGuKO+yCAzd1g54y/U7JImx7QSc8iGeNsDIRez
+8q8nrL8T9Yoryr4g33jWHwfsTCvt+/RuuxEHa/1xA9DsBpO9uoHBN8ngaz89HS+T
+UhjFzWNSjTW0XnVvlvajYcTAJeh/MMmG87s9PxKB8MWzBy+ii0VyVm6JYqJAVWjf
+ilWzSiiND2gM49D2F2iA0O1m0vVW7GdaeCwWBNkffVroALqm17ntxW3i6o9rYAOu
+HG3Dnw5saYpTGFtjfJ3HLc9I1iApMWJUAyhWk3s9UnD3j0GvWcAkfgmK3p6CrjUT
+1K06iE1WKJiO/+pmv7iD9HkwB4KOG/1LzLvnfoAS65TWqwXdFGIIJQUCAwEAAaNg
+MF4wHQYDVR0OBBYEFLGhVge9WaV0qrb/EIfKqz13+LOeMB8GA1UdIwQYMBaAFLGh
+Vge9WaV0qrb/EIfKqz13+LOeMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
+MA0GCSqGSIb3DQEBCwUAA4ICAQCiswhYEgOWOIEJwMpmkq1WjkRlcg7IHFJOQfoc
+t46aFhRhEZH9S257WAAe7RZWSjZeMZiHRgWtYiPYHUuGX/kXq4N89mDVqYn4D1te
+QAd7cchFRX4e+yqz9mdB6YgKW/XWoaeoqvvg+cgm8AVN/LtFK704lXLFEpdNdlzI
+PPhE9BI6TkmUgLE9kIBbXSto4KLQSqUvKlQc2NgM95qqK5P+9knhuhL8oksmvxvW
+elK2tnOT3849vP/LdNXZhOWOBMw00VT31GyBG90M0oEjxGHhtPcEd7lXM73f8o6v
+Udnr6EB5/4wLTgE5lUx/UmwE5qKwJ6jzhycFI2yvIKdDAv4D6uxBPQWQTPBhIc0D
+IS6W5ZxxBoM16By4ijMy0hIYwO6lultlUeaaUSRLxiMHBBarFMxYU96BQiL7I0lV
+QBenza7bwhsRCN8FP71fBNTsGgHevvbSQpBAja5rBYhWabTQ+0XkhU3c2/opufoM
+wijfGoAIluZ3thWb5pkw5H/mUSmiuTqbg9z7ItE885qWW+B/Y1NLsIjZgXwI4Y9d
+EEpjLaXw4wn6UTR+7DLv37nJOZkV5KaOFqzRKjAiig1eIh85+Gnqon5ZbeSk0s9l
+gqiK4xAnUEctOdH62d6vhH+IoiN30c/+0NVPyldQhqyK9pxDR2dSAYNbjI29G8YS
+qF3+rQ==
 -----END CERTIFICATE-----

certs/client/client-ca.srl

@@ -1 +1 @@
-66464F95ED9D536969401338549FFBD6B5B7B62B
+5F977557CF50B4993C3555918297C0D49AE73507

certs/client/client-cert-signed.pem

@@ -1,23 +1,33 @@
 -----BEGIN CERTIFICATE-----
-MIIDxDCCAqygAwIBAgIUZkZPle2dU2lpQBM4VJ/71rW3tiswDQYJKoZIhvcNAQEL
+MIIFxDCCA6ygAwIBAgIUX5d1V89QtJk8NVWRgpfA1JrnNQcwDQYJKoZIhvcNAQEL
 BQAwcTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQHDAhJ
 c3RhbmJ1bDEOMAwGA1UECgwFQmlsdXMxFDASBgNVBAsMC0RldmVsb3BtZW50MRYw
-FAYDVQQDDA1CaWx1cyBSb290IENBMB4XDTI0MDkyODE3MzY1OVoXDTI1MDkyODE3
-MzY1OVowbTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQH
+FAYDVQQDDA1CaWx1cyBSb290IENBMB4XDTI0MTAwMTE2NTc0NFoXDTI1MTAwMTE2
+NTc0NFowbTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREwDwYDVQQH
 DAhJc3RhbmJ1bDEOMAwGA1UECgwFQmlsdXMxFDASBgNVBAsMC0RldmVsb3BtZW50
-MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDOmWjiXJ3RHaeSzrCniwQyqjQ8+jM/C/Bio7Ql4jFB2zUqhk8uCEvD+NEL
-Ma3p3oRzdi5vvbNT1cLL96BedDJssdeyGkpTfRA0a95qTuwt+RoDPcA3A2MZW1mJ
-oGYyOBY6mvzoa2M7AcjqDGFAjaZBVfSM3F+m5cTSUI4JI+U9WEWmMyQ98wyNsn+J
-oWfhRCjGYb+lVhsZnzykIaq+8cG77mPYduGF50BViIezSglOyoZBtsH4waM926IO
-3El1kaDd61nsJeZ2vsu3XANTd7KC+CXG2ga1wrOG86YnmwXu1B7c6SjtjMYdH7U4
-IwN/apscIvI2/Dbln5Bcpa4O8T5RAgMBAAGjWDBWMBQGA1UdEQQNMAuCCWxvY2Fs
-aG9zdDAdBgNVHQ4EFgQUICWK/FvB2yrYemg6RHUhk037vfEwHwYDVR0jBBgwFoAU
-JqshG3BhzYsElqqE9wrVm2vuCJgwDQYJKoZIhvcNAQELBQADggEBAG+WmWjNwoAU
-lKxuxWqkmfabLqYRZHv4ol/wdb1iUIDj9lEQRpLGoS7wGzEbasvXGlIxTcdagfIE
-BAECFnQHy0XgPA+CiK0txV5rvCUUIfVRMysQIEjoeeSdziAt1nrYjmDttyAuWVdP
-p50GDRXW99d/xmYtlVKqaKNU75jLjmt78z7yJxexiPQvLMphBP8oqypFav4nftmk
-YjVmtCISRqZfG1CqDEyx1OOxEFdQ1wgEQTrAmKTRZb7shpHDJB2XLC+yqfuuRuJr
-Z6Mo0D9kc9zkhj6ANTbfFB+fiWTr8XXusnGuf9FxXYNJkDzCg4cjX0oBAdynAVxJ
-ej/vfmOdsTY=
+MRIwEAYDVQQDDAlsb2NhbGhvc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQC0DkFC7nAF8aChug2A8KVapWMxwCiubZL3EdTOJk/u7R5VXo5IkT2KzrBW
+RrOQSeRiL9X+fCF1c9+67CJjJnllQk7/XFDR68Uj1YZjYLC8PIHtQ4F75ND9PKnA
+/2hLyGXFxVqZ4ZjqkpjsRjdDuItn3ob4sRH2TE/frSRlBDDTqiaWs7tb1IvqQd0E
++Um6Ayr0en/6Uce9bdvvkVv5jWVeZqv5XRzOq4aG23i0Z9XsR0Iylm83n4pQgPNq
+lT30e0jyW05kOAoyNx//wTLoCHwE8Pci6taiSI1JLKhGIVhzmZHL47xfaTVGmCOH
+phQEP5fIL2DZztqfmjsNS97XypS4FVK+Ta4Z2ruIsFmfD3AUWcYmHkKUz5fgDuus
+8OGGwByf4ZHhCj/KGI5X/isHcpGeuBZTUSVfWPeqtskf7/MFptqmgVl+t6fJooTy
+RDwCy8+izeGxGCzXMwHxzJg2Tip9zPNGYMpcSNuxwml83LdxDJOJ6jdDHokn7QPl
+QZiN5q6K2dQ84yV1BXZqTWmX2yr2ZUnNrceTqWlZdng8b1+IgMJke1NAkt7gEA0s
+A24B+pYrDo1K1cSVI40yEfAV3vQAxD22CxfG6vuLLnFlDQ7s5muJacKtJGkBW4gU
+AVU9lh3RMHDni3/UwBfBFucmRpo7afFpYZYKben7Z5bwkHq9DQIDAQABo1gwVjAU
+BgNVHREEDTALgglsb2NhbGhvc3QwHQYDVR0OBBYEFO3gZkDNEahw0AIFDVWiaTwQ
+t33yMB8GA1UdIwQYMBaAFLGhVge9WaV0qrb/EIfKqz13+LOeMA0GCSqGSIb3DQEB
+CwUAA4ICAQCkh/tvK13sKbeE4BAdz29eNrSI8CZw3jWmd52YEIw9nTJDRaiT2j+R
++b6ma/dRr6ZQ7pKj4Ltsiz9F1kDcq+vh+4DYoX+0k1MSwpR4jtCMQrRO9KRaoMXr
+SFPuAa3ifF+GzjmkGjOHCQTqWiaa4tIxi7luiAFvHEB686tqzMYHF76/kjK4mw4E
+Y5bn1GJQOqjPWrEiUYBrCx2Z/hXQdRD2/lmdyOTJgCAJbTmIWq7uEtdqOuXxUtm1
+QviP3FPcneJOY+iEoP5+lgFNZzHxUL5i6bPZSiBdxQNuZ5kld8LyfwUglzmtgAkw
+WDNmRVAsoEwMmkXVXZ904qmTKlsigfrskSHITTRdDW4KwCBJtmVVRNMS3+28wnwN
+q2lIB4RFtYExIVdYvx0fihnRpQaZzHepfM9v/e/CyAcJ/snUXTZ0fOFWPRhp3kfs
++SumX1RGEGUU0eqTYcAWTidS4EhsWuUqAb1LcbxmEdD3J7UbG/78MHj90YojvJhI
+7Gsaw9FMONws0KRB3TWL+AH6bMIFAcpiBE03AROiZSQ9UkDEyGE6Tdc3qEaHvfZZ
+wM2NbJGdAxFCJup4GRgtvggGr27MmRFVfV2dXG8tjYxoMgwk/0OiGFxp/1COUUJC
+SVbIuI4AjhEGA7RJfsZkVkMWxTCjx/ACS75q6wLU96wNyQE43gcxjg==
 -----END CERTIFICATE-----

certs/client/client-cert.csr

@@ -1,18 +1,28 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIIC2TCCAcECAQAwbTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREw
+MIIE2TCCAsECAQAwbTELMAkGA1UEBhMCVFIxETAPBgNVBAgMCElzdGFuYnVsMREw
 DwYDVQQHDAhJc3RhbmJ1bDEOMAwGA1UECgwFQmlsdXMxFDASBgNVBAsMC0RldmVs
-b3BtZW50MRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB
-DwAwggEKAoIBAQDOmWjiXJ3RHaeSzrCniwQyqjQ8+jM/C/Bio7Ql4jFB2zUqhk8u
-CEvD+NELMa3p3oRzdi5vvbNT1cLL96BedDJssdeyGkpTfRA0a95qTuwt+RoDPcA3
-A2MZW1mJoGYyOBY6mvzoa2M7AcjqDGFAjaZBVfSM3F+m5cTSUI4JI+U9WEWmMyQ9
-8wyNsn+JoWfhRCjGYb+lVhsZnzykIaq+8cG77mPYduGF50BViIezSglOyoZBtsH4
-waM926IO3El1kaDd61nsJeZ2vsu3XANTd7KC+CXG2ga1wrOG86YnmwXu1B7c6Sjt
-jMYdH7U4IwN/apscIvI2/Dbln5Bcpa4O8T5RAgMBAAGgJzAlBgkqhkiG9w0BCQ4x
-GDAWMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEAPe2N
-yC9O8jzca/3lYyNqATV3VSFnxXp9sEQLvrk7tVThc4Cbq1nCq88vV3dn9MOEegR3
-l6zEixBxhDfZ+w8qLV0kr0XUnuKbtTfT2LMvIFv1MuFc0QHqTqUuAAUzVyBG3bMr
-L+JPjFz1g6QeHbzrYbq7BlWmnmHL+/zHXadw1gzK9WnGy2YvhHGsqDNtCw3pja2Y
-UEW5z5PwV4bFLIOGKf5PuLwY25+hOiNv2ZUY5pRyj5zi0gMfQn5qB44NRAQUuzZZ
-kR4fBfgC8lTX3Bdfswe1sruy7jrPRyNNL8ZJ5pWxS29LCq5rFCl46ciibypidCuh
-wUh04lWN1pMh8z+BHw==
+b3BtZW50MRIwEAYDVQQDDAlsb2NhbGhvc3QwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQC0DkFC7nAF8aChug2A8KVapWMxwCiubZL3EdTOJk/u7R5VXo5I
+kT2KzrBWRrOQSeRiL9X+fCF1c9+67CJjJnllQk7/XFDR68Uj1YZjYLC8PIHtQ4F7
+5ND9PKnA/2hLyGXFxVqZ4ZjqkpjsRjdDuItn3ob4sRH2TE/frSRlBDDTqiaWs7tb
+1IvqQd0E+Um6Ayr0en/6Uce9bdvvkVv5jWVeZqv5XRzOq4aG23i0Z9XsR0Iylm83
+n4pQgPNqlT30e0jyW05kOAoyNx//wTLoCHwE8Pci6taiSI1JLKhGIVhzmZHL47xf
+aTVGmCOHphQEP5fIL2DZztqfmjsNS97XypS4FVK+Ta4Z2ruIsFmfD3AUWcYmHkKU
+z5fgDuus8OGGwByf4ZHhCj/KGI5X/isHcpGeuBZTUSVfWPeqtskf7/MFptqmgVl+
+t6fJooTyRDwCy8+izeGxGCzXMwHxzJg2Tip9zPNGYMpcSNuxwml83LdxDJOJ6jdD
+Hokn7QPlQZiN5q6K2dQ84yV1BXZqTWmX2yr2ZUnNrceTqWlZdng8b1+IgMJke1NA
+kt7gEA0sA24B+pYrDo1K1cSVI40yEfAV3vQAxD22CxfG6vuLLnFlDQ7s5muJacKt
+JGkBW4gUAVU9lh3RMHDni3/UwBfBFucmRpo7afFpYZYKben7Z5bwkHq9DQIDAQAB
+oCcwJQYJKoZIhvcNAQkOMRgwFjAUBgNVHREEDTALgglsb2NhbGhvc3QwDQYJKoZI
+hvcNAQELBQADggIBAJBpvuAyrc/gYVg+8Ew3nZfm/KG03m8wQRPZdcOdChAw8XoW
+BjdltmcZGUJsRhhVv5yFONeQoP20QXIzlZya+8INNBNuF/jShyyF5w7wraJF5Bnw
+MBbNmg+tW/Ib6aPQXLohMmST3oy30auYh5hegNItIgwmhIAo38VjxlmTZMAKyQVC
+09qnFFEs0RpW0ObkJWc6JGveIsnvvbKm8Pydo7H+OEEZjlQdNxEEmuunhKU9v0Km
+YCFz0SjS1zwu6L7mEAkSB1QuM3II1RbMhgXy4pIxQwVNv78CeR9Hz/GT37P/bCCW
+cT+QTgUX+G7T04Xd7A9sqAE11npj+Hta+5UVu9M3bVdJvZ/FAWaEzlFy7irKr7rU
+lkN03HWV/D8SXnNo8pjP/32qcnyMbavTj8ynueAO3mWFU4kq68+bxkavOzXTRTxV
+Sh7DAfU8/g5JIReQbRVnhnxA5JUlPHGot3yru0m1clC4AwXJtpGgmWHK/HcuXOT9
+0mH6GnPe5sC6DPxaGCC5/NKScKmDTIgK7YAILyZQYNNtb1z+Zq9B8LVaVgOfVNkH
+xUxs+g/Ary/fh/d2D6TPQP468LJBVEEZ88O8ADKn83B1kfjiWdSMA/AG4K8+aUD9
+XDvU4YPAR6+NLUSlZT5GPYjl0wSQXMKrxfYgWo0S8ioCEu3EzEzR4N93FMyo
 -----END CERTIFICATE REQUEST-----