<div dir="ltr">We are getting a number of hits for this with Xerox printers connecting out to "<span class=""><span class=""><span class=""><span class=""><span class="">layer7</span>-<span class="">prod</span></span>.<span class="">idns</span></span>.<span class="">xerox</span></span>.<span class="">com".  Looking at the reference URL in the signature we are trying to figure out if there is a match here.  The cert does match what the signature is looking for, but the reference url does not mention anything about ssl connections or certs.  Could there be another reference url that was used to write this rule?   </span></span><div><br></div><div>Line 88 of the cert paste is the matching line that rule is triggering one.  No other IOC's have been seen that match the reference url.</div><div><br></div><div>Rule:</div><div>alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLACKLIST Win.Backdoor.Upatre SSL Cert inbound"; flow:to_client,established; content:"|55 04 08|"; content:"|0A|Some-State1!0"; within:14; distance:1; metadata:policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,<a href="http://www.virustotal.com/en/file/8f98fce6c20dbbe8a156e5a5b671066ccd0db240140e81d69d1a7205457605cb/analysis/">www.virustotal.com/en/file/8f98fce6c20dbbe8a156e5a5b671066ccd0db240140e81d69d1a7205457605cb/analysis/</a>; classtype:trojan-activity; sid:32124; rev:1;)<br clear="all"><div><br></div><div><br></div><div>Cert:</div><div><li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">openssl s_client -connect <a href="http://13.13.56.126:443">13.13.56.126:443</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">CONNECTED(00000003)</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">depth=2 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">verify error:num=19:self signed certificate in certificate chain</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">verify return:0</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Certificate chain</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none"> 0
 s:/C=US/postalCode=06850/ST=Connecticut/L=Norwalk/street=45 Glover 
Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued through Xerox
 Corporation E-PKI Manager/OU=Unified 
Communications/CN=<a href="http://gateway.websrvs.xerox.com">gateway.websrvs.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO High-Assurance Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none"> 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO High-Assurance Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none"> 2 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Server certificate</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">-----BEGIN CERTIFICATE-----</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">MIIMEjCCCvqgAwIBAgIQUkZPlDqIksH99dsBjAAKqDANBgkqhkiG9w0BAQUFADCB</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">iTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxLzAtBgNV</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">BAMTJkNPTU9ETyBIaWdoLUFzc3VyYW5jZSBTZWN1cmUgU2VydmVyIENBMB4XDTE0</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">MDUwOTAwMDAwMFoXDTE1MDUwOTIzNTk1OVowggEXMQswCQYDVQQGEwJVUzEOMAwG</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">A1UEERMFMDY4NTAxFDASBgNVBAgTC0Nvbm5lY3RpY3V0MRAwDgYDVQQHEwdOb3J3</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">YWxrMRkwFwYDVQQJExA0NSBHbG92ZXIgQXZlbnVlMRowGAYDVQQKExFYZXJveCBD</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">b3Jwb3JhdGlvbjEbMBkGA1UECxMSV29ybGQgSGVhZHF1YXJ0ZXJzMTcwNQYDVQQL</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Ey5Jc3N1ZWQgdGhyb3VnaCBYZXJveCBDb3Jwb3JhdGlvbiBFLVBLSSBNYW5hZ2Vy</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">MR8wHQYDVQQLExZVbmlmaWVkIENvbW11bmljYXRpb25zMSIwIAYDVQQDExlnYXRl</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">d2F5LndlYnNydnMueGVyb3guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">CgKCAQEA55X7kBDiOXYuZzoUGiWUv6MLdWDQv1jUPjh+9nP1EEPcmaiTviZGzDjR</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">sSBcaZ7s/dAHpuaGk6cYq/yj4T0x65ctfaxXawTXeAtb+5c89vzur2K8hLdl14Xc</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">bjxVHWD0eybuNPdyGuOGURaGuuA0IWSQlWI7eGvMqZyE6Jks76DMXsZ/VAg/ewtZ</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">AqYLnFVXB8kxCY7xaChun65xDEzVrpV87zJgHX+TTupal0rhIsS1/2dxj6qFVLrV</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">xal5Ba9OKKzCX4EZNlD1IYctjcXZyf1oOXPbdLWJLRsuKTAZ+pViLLINF6Wcs8zv</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">4BbwKiviO3aTVyR/QJ5Z5Oq2JHi7BwIDAQABo4IH4zCCB98wHwYDVR0jBBgwFoAU</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">P9W10NZEeVBKF6ObjErcuLAiZGswHQYDVR0OBBYEFJBATBPDLWyHubszz5WAS7YC</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">8/NwMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsG</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">AQUFBwMBBggrBgEFBQcDAjBQBgNVHSAESTBHMDsGDCsGAQQBsjEBAgEDBDArMCkG</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">CCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwB</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">AgIwTwYDVR0fBEgwRjBEoEKgQIY+aHR0cDovL2NybC5jb21vZG9jYS5jb20vQ09N</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">T0RPSGlnaC1Bc3N1cmFuY2VTZWN1cmVTZXJ2ZXJDQS5jcmwwgYAGCCsGAQUFBwEB</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">BHQwcjBKBggrBgEFBQcwAoY+aHR0cDovL2NydC5jb21vZG9jYS5jb20vQ09NT0RP</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">SGlnaC1Bc3N1cmFuY2VTZWN1cmVTZXJ2ZXJDQS5jcnQwJAYIKwYBBQUHMAGGGGh0</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTCCBjgGA1UdEQSCBi8wggYrghlnYXRld2F5</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">LndlYnNydnMueGVyb3guY29tgiBnYXRlc3RhZ2UtdGVzdC53ZWJzcnZzLnhlcm94</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">LmNvbYIbZ2F0ZXN0YWdlLndlYnNydnMueGVyb3guY29tgh1nYXRlc3RhZ2UwMS53</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">ZWJzcnZzLnhlcm94LmNvbYIdZ2F0ZXN0YWdlMDIud2Vic3J2cy54ZXJveC5jb22C</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">HWdhdGVzdGFnZTAzLndlYnNydnMueGVyb3guY29tgh1nYXRlc3RhZ2UwNC53ZWJz</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cnZzLnhlcm94LmNvbYIdZ2F0ZXN0YWdlMDUud2Vic3J2cy54ZXJveC5jb22CHWdh</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dGVzdGFnZTA2LndlYnNydnMueGVyb3guY29tgh1nYXRlc3RhZ2UwNy53ZWJzcnZz</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Lnhlcm94LmNvbYIdZ2F0ZXN0YWdlMDgud2Vic3J2cy54ZXJveC5jb22CHWdhdGVz</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dGFnZTA5LndlYnNydnMueGVyb3guY29tgh1nYXRlc3RhZ2UxMC53ZWJzcnZzLnhl</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cm94LmNvbYIeZ2F0ZXdheS10ZXN0LndlYnNydnMueGVyb3guY29tghtnYXRld2F5</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">MDEud2Vic3J2cy54ZXJveC5jb22CG2dhdGV3YXkwMi53ZWJzcnZzLnhlcm94LmNv</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">bYIbZ2F0ZXdheTAzLndlYnNydnMueGVyb3guY29tghtnYXRld2F5MDQud2Vic3J2</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cy54ZXJveC5jb22CG2dhdGV3YXkwNS53ZWJzcnZzLnhlcm94LmNvbYIbZ2F0ZXdh</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">eTA2LndlYnNydnMueGVyb3guY29tghtnYXRld2F5MDcud2Vic3J2cy54ZXJveC5j</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">b22CG2dhdGV3YXkwOC53ZWJzcnZzLnhlcm94LmNvbYIbZ2F0ZXdheTA5LndlYnNy</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dnMueGVyb3guY29tghtnYXRld2F5MTAud2Vic3J2cy54ZXJveC5jb22CIG1kdC1z</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dGFnZS10ZXN0LnN1cHBvcnQueGVyb3guY29tghttZHQtc3RhZ2Uuc3VwcG9ydC54</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">ZXJveC5jb22CGm1kdC10ZXN0LnN1cHBvcnQueGVyb3guY29tghVtZHQuc3VwcG9y</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">dC54ZXJveC5jb22CG3JlbXNlcnYwMC5zdXBwb3J0Lnhlcm94LmNvbYIbcmVtc2Vy</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">djAxLnN1cHBvcnQueGVyb3guY29tghtyZW1zZXJ2MDIuc3VwcG9ydC54ZXJveC5j</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">b22CG3JlbXNlcnYwMy5zdXBwb3J0Lnhlcm94LmNvbYIbcmVtc2VydjA0LnN1cHBv</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cnQueGVyb3guY29tghtyZW1zZXJ2MDUuc3VwcG9ydC54ZXJveC5jb22CG3JlbXNl</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cnYwNi5zdXBwb3J0Lnhlcm94LmNvbYIbcmVtc2VydjA3LnN1cHBvcnQueGVyb3gu</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Y29tghtyZW1zZXJ2MDguc3VwcG9ydC54ZXJveC5jb22CG3JlbXNlcnYwOS5zdXBw</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">b3J0Lnhlcm94LmNvbYIbcmVtc2VydjEwLnN1cHBvcnQueGVyb3guY29tghtyZW1z</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">ZXJ2MTEuc3VwcG9ydC54ZXJveC5jb22CG3JlbXNlcnYxMi5zdXBwb3J0Lnhlcm94</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">LmNvbYIbcmVtc2VydjEzLnN1cHBvcnQueGVyb3guY29tghtyZW1zZXJ2MTQuc3Vw</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cG9ydC54ZXJveC5jb22CG3JlbXNlcnYxNS5zdXBwb3J0Lnhlcm94LmNvbYIbcmVt</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">c2VydjE2LnN1cHBvcnQueGVyb3guY29tghtyZW1zZXJ2MTcuc3VwcG9ydC54ZXJv</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">eC5jb22CG3JlbXNlcnYxOC5zdXBwb3J0Lnhlcm94LmNvbYIbcmVtc2VydjE5LnN1</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cHBvcnQueGVyb3guY29tgiBzdXMtc3RhZ2UtdGVzdC5zdXBwb3J0Lnhlcm94LmNv</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">bYIbc3VzLXN0YWdlLnN1cHBvcnQueGVyb3guY29tghpzdXMtdGVzdC5zdXBwb3J0</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Lnhlcm94LmNvbYIVc3VzLnN1cHBvcnQueGVyb3guY29tght3d3cucGF3cy5leHRl</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">cm5hbC54ZXJveC5jb22CEnd3dy5wYXdzLnhlcm94LmNvbTANBgkqhkiG9w0BAQUF</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">AAOCAQEAqm/9jwwwtyzUdPlVIDiLQa6808++cNoA3EOOGJR4FibpY22hmBHrWpY0</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Ls1RUbcDPWn8wLNl/pS820LFdIX7I231+tr9YxMYVx9DdqhrAeBWy8VB+7+LvgOI</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">FK5OE93aq+LJhqhK0wJb0a2jIbUtm8klvFR+efr6kHWAone+XoMcPHX00tjwpG/+</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">jadBIHCg/bzNq1z5dsBbtmY/AkewIAex276RR2KoVIIUD8ejIlf1wV5Lt7YXPmf6</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/WHnWjHmVQF1wYaqAPhc8X8FGgmZCcCksTIWJmBNMXurHfuljjYPFKfYNFmdE3u7</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">FlP+5YmXqVYEYcrt99+I1zhoWsfzIQ==</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">-----END CERTIFICATE-----</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">subject=/C=US/postalCode=06850/ST=Connecticut/L=Norwalk/street=45
 Glover Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued 
through Xerox Corporation E-PKI Manager/OU=Unified 
Communications/CN=<a href="http://gateway.websrvs.xerox.com">gateway.websrvs.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO High-Assurance Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Acceptable client certificate CA names</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/ST=Illinois/L=Chicago/O=BigMachines Inc. /OU=Operations/CN=<a href="http://bigmachines.self.xerox.com">bigmachines.self.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=MobilePro-VQ</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=DigiCert Inc/OU=<a href="http://www.digicert.com/CN=DigiCert">www.digicert.com/CN=DigiCert</a> Global Root CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=GeoTrust, Inc./CN=RapidSSL CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/CN=<a href="http://layer7-prod.idns.xerox.com">layer7-prod.idns.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/O=Entrust.net/OU=<a href="http://www.entrust.net/CPS_2048">www.entrust.net/CPS_2048</a>
 incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net 
Limited/CN=Entrust.net Certification Authority (2048)</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com,
 Inc./OU=<a href="http://certs.godaddy.com/repository//CN=Go">http://certs.godaddy.com/repository//CN=Go</a> Daddy Secure 
Certificate Authority - G2</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=VeriSign,
 Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For 
authorized use only/CN=VeriSign Class 3 Public Primary Certification 
Authority - G5</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=Entrust.net/OU=<a href="http://www.entrust.net/CPS">www.entrust.net/CPS</a>
 incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net 
Limited/CN=Entrust.net Secure Server Certification Authority</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=Entrust,
 Inc./OU=<a href="http://www.entrust.net/rpa">www.entrust.net/rpa</a> is incorporated by reference/OU=(c) 2009 
Entrust, Inc./CN=Entrust Certification Authority - L1C</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO High-Assurance Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=VeriSign,
 Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For 
authorized use only/CN=VeriSign Class 1 Public Primary Certification 
Authority - G3</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/CN=USERTrust Legacy Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=Xerox Corp./CN=Xerox Web Services CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=thawte,
 Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For 
authorized use only/CN=thawte Primary Root CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=Thawte, Inc./CN=Thawte SSL CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/ST=LOUISIANA/L=HAMMOND/O=BARRISTER
 GLOBAL SERVICES NETWORK, INC./OU=CLEARVIEW/OU=Terms of use at 
<a href="http://www.verisign.com/rpa">www.verisign.com/rpa</a> (c)05/CN=<a href="http://PARTNERS.GLOBALSERVNET.COM">PARTNERS.GLOBALSERVNET.COM</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/postalCode=06856-4505/ST=Connecticut/L=Norwalk/street=45
 Glover Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued 
through Xerox Corporation E-PKI Manager/OU=InstantSSL/CN=<a href="http://xyzzy.xerox.com">xyzzy.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/postalCode=06856-4505/ST=Connecticut/L=Norwalk/street=45
 Glover Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued 
through Xerox Corporation E-PKI Manager/OU=PremiumSSL 
Wildcard/CN=*.<a href="http://services.xerox.com">services.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/postalCode=06856-4505/ST=Connecticut/L=Norwalk/street=45
 Glover Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued 
through Xerox Corporation E-PKI 
Manager/OU=InstantSSL/CN=<a href="http://infocareprod.eur.xerox.com">infocareprod.eur.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=VeriSign,
 Inc./OU=VeriSign Trust Network/OU=Terms of use at 
<a href="https://www.verisign.com/rpa">https://www.verisign.com/rpa</a> (c)10/CN=VeriSign Class 3 International 
Server CA - G3</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/O=Symantec
 Corporation/OU=Symantec Trust Network/OU=Persona Not 
Validated/CN=Symantec Class 1 Individual Subscriber CA - G4</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">/C=US/postalCode=06850/ST=Connecticut/L=Norwalk/street=45
 Glover Avenue/O=Xerox Corporation/OU=World Headquarters/OU=Issued 
through Xerox Corporation E-PKI Manager/OU=Unified 
Communications/CN=<a href="http://gateway.websrvs.xerox.com">gateway.websrvs.xerox.com</a></div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">SSL handshake has read 11302 bytes and written 567 bytes</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Server public key is 2048 bit</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Secure Renegotiation IS supported</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Compression: NONE</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">Expansion: NONE</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">SSL-Session:</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Protocol  : TLSv1.1</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Cipher    : DHE-RSA-AES256-SHA</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Session-ID: 5437C7EAED1FB9A47597AB4A3E9E953125EC90075253412053534C4A20202020</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Session-ID-ctx:</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Master-Key: E850153DA8C022FFFACA1459CBFF820B98369F907FF5D7409305B1AF75CB2F13966A4B7859989FBB7A9B0B16960E809C</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Key-Arg   : None</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    PSK identity: None</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    PSK identity hint: None</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    SRP username: None</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Start Time: 1412941720</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Timeout   : 300 (sec)</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">    Verify return code: 19 (self signed certificate in certificate chain)</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">---</div></li>
<li style="vertical-align:top"><div style="font-stretch:normal;font-size:1em;line-height:1.2em;font-family:monospace;margin:0px;padding:0px;vertical-align:top;background:none">closed</div></li></div>-- <br>Registered Linux User # 379282
</div></div>