#1603 Hotfix MPI Connection Problem (#1617)

.talismanrc

@@ -1,9 +1,50 @@
 fileignoreconfig:
+- filename: app/va/mpi/mpi.py
+  checksum: d339cb418dcc278a42848c8307a9af271713c22a2691d595ebe779f3492bd978
+- filename: certs/VA-Internal-S2-ICA1-v1.cer
+  checksum: 286a7e438a844585e7d9653e17b1488a51867201d58400d324ea733678bdd92c
+- filename: certs/VA-Internal-S2-ICA10.cer
+  checksum: 207f80ceb7f76aefa88e4ba45674093dd8029df372f03a9b5d2b8fdf11c1f167
+- filename: certs/VA-Internal-S2-ICA12.cer
+  checksum: 489a015ee0ab38eaefd8f311f511df8489deca9aae4b0e6ca338f8bd2ff2f6d3
+- filename: certs/VA-Internal-S2-ICA13.cer
+  checksum: 52f517028038900a4a37b5232dda9972fcbf752f9763f16b4a2324866f7bdcd5
+- filename: certs/VA-Internal-S2-ICA14.cer
+  checksum: 9c3a935f9da7a0d6b1625b87834fa79c69c35b589cf4fd16b354867bd7c6f3aa
+- filename: certs/VA-Internal-S2-ICA15.cer
+  checksum: 0e7830ac6a0e3e1f6df3eb69dc3fece78e4c1a3092a2be7dcde33620200199d2
+- filename: certs/VA-Internal-S2-ICA16.cer
+  checksum: ea1dced1923ccb7246ec0e716720ce38f123b4efe879ab25f5036bc272a32e9f
+- filename: certs/VA-Internal-S2-ICA17.cer
+  checksum: 537f0486dc874faa86dfb4733167efbfbdcbaca9f8173f32f89316ce445f2d90
+- filename: certs/VA-Internal-S2-ICA18.cer
+  checksum: bedd1ac0f71844c68fba8798f88193bb0149725ab0337dee82292f3dcf11c989
+- filename: certs/VA-Internal-S2-ICA19.cer
+  checksum: 1c155d9d46baf3ae81a530f7ac66693afcad52ef31f8dc14eb0695ace51c9e0f
+- filename: certs/VA-Internal-S2-ICA2-v1.cer
+  checksum: 04748b31daa16fd4f75f38b13f00445b331ff0f380c985d6d6edfeaee92d956b
+- filename: certs/VA-Internal-S2-ICA20.cer
+  checksum: a8421fb7665aa58ced4b83ec26d8eeadb56058cf15048c2c81c22b07418d203d
+- filename: certs/VA-Internal-S2-ICA21.cer
+  checksum: fdfc26d44c7d6688f79b09ed3e22379e88c60fbfa891294f55cb2d7c2bbaf067
+- filename: certs/VA-Internal-S2-ICA3-v1.cer
+  checksum: 3db3c65e54219e10ae5ea675acf6a4679e879f864e49371f8209a358d788f606
+- filename: certs/VA-Internal-S2-ICA5.cer
+  checksum: 5ff6ad67daca90b034db642b1bf5bb7839a59e401403a59f29080cb96087d6ad
+- filename: certs/VA-Internal-S2-ICA6.cer
+  checksum: df2629b8c6e9bf64fec0261d1fc2e047fc5e22fb9bcb020c31f6d9dc0dd39e54
+- filename: certs/VA-Internal-S2-ICA7.cer
+  checksum: 89358e208a28fb4869f08773befd00b02963aafdd22057cb74a22ec53ae00068
+- filename: certs/VA-Internal-S2-ICA8.cer
+  checksum: 38a7c4c11ced82618867ad61af05c764add68dbd2c59c8c1515ee075dac2a5ae
+- filename: certs/VA-Internal-S2-ICA9.cer
+  checksum: 17557e726e93fb1983ec1dc340865d64fc039c8ec7113c12ade4b6c8f0c80758
 - filename: documents/postman/internal_api_developers/development.postman_environment.json
   checksum: ca23e82ce6045c668de609cd48ee5bff986250c06198a262aebbd80e25c1ce65
 - filename: documents/postman/internal_api_developers/performance.postman_environment.json
   checksum: a39e7244c02137f4c76df6fec596dbafeb3ba05796faa410e67ca6afff1f4099
 - filename: documents/postman/internal_api_developers/staging.postman_environment.json
   checksum: a6b9dbff04ca357fed37bb800544195355555c5b5bc5f14e30965121403e5907
 - filename: documents/postman/staging-simplified.postman_environment.json
-  checksum: d69f7b3dfd46f9d8fe17c1ec8429fa1a90cd8acea452e2de2f0936f1c0013474
+  checksum: d69f7b3dfd46f9d8fe17c1ec8429fa1a90cd8acea452e2de2f0936f1c0013474
+version: "1.0"

app/va/mpi/mpi.py

@@ -1,4 +1,6 @@
 import requests
+from requests.adapters import HTTPAdapter
+from requests.packages.urllib3.util.ssl_ import create_urllib3_context
 from time import monotonic
 from http.client import responses
 from functools import reduce
@@ -29,6 +31,39 @@
 
 exception_substring = {NoSuchIdentifierException: 'no_such_identifier'}
 
+# This is the openssl cipher string, containing all ciphers.
+CIPHERS = 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:\
+    ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:\
+    DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:\
+    ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:\
+    ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:\
+    ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:\
+    RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:\
+    PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:\
+    PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:\
+    SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:\
+    RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:\
+    ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:\
+    RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:\
+    PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA'
+
+
+# create a custom HTTPAdapter to connect to MPI using an expanded cipher list
+class MPIAdapter(HTTPAdapter):
+    """
+    A TransportAdapter that uses an expanded cipher list in Requests.
+    """
+
+    def init_poolmanager(self, *args, **kwargs):
+        context = create_urllib3_context(ciphers=CIPHERS)
+        kwargs['ssl_context'] = context
+        return super(MPIAdapter, self).init_poolmanager(*args, **kwargs)
+
+    def proxy_manager_for(self, *args, **kwargs):
+        context = create_urllib3_context(ciphers=CIPHERS)
+        kwargs['ssl_context'] = context
+        return super(MPIAdapter, self).proxy_manager_for(*args, **kwargs)
+
 
 def _get_nested_value_from_response_body(
     response_body,
@@ -58,6 +93,7 @@ def init_app(
         self.ssl_cert_path = ssl_cert_path
         self.ssl_key_path = ssl_key_path
         self.statsd_client = statsd_client
+        self.mpi_adapter = MPIAdapter()
 
     def get_va_profile_id(
         self,
@@ -94,13 +130,18 @@ def _make_request(
         self.logger.info('Querying MPI with %s for notification %s', fhir_identifier, notification_id)
         start_time = monotonic()
         try:
-            response = requests.get(
-                f'{self.base_url}/psim_webservice/fhir/Patient/{fhir_identifier}',
-                params={'-sender': self.SYSTEM_IDENTIFIER},
-                cert=(self.ssl_cert_path, self.ssl_key_path),
-                timeout=(3.05, 2),
-            )
-            response.raise_for_status()
+            # Need to make the request with an expanded list of ciphers to make sure we can connect to MPI in Prod
+            with requests.session() as s:
+                s.mount(self.base_url, adapter=self.mpi_adapter)
+
+                response = s.get(
+                    f'{self.base_url}/psim_webservice/fhir/Patient/{fhir_identifier}',
+                    params={'-sender': self.SYSTEM_IDENTIFIER},
+                    cert=(self.ssl_cert_path, self.ssl_key_path),
+                    timeout=(3.05, 2),
+                )
+
+                response.raise_for_status()
         except requests.HTTPError as e:
             self.statsd_client.incr(f'clients.mpi.error.{e.response.status_code}')
             message = f'MPI returned {str(e)} while querying for notification {notification_id}'

certs/VA-Internal-S2-ICA1-v1.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEoDCCA4igAwIBAgITFAAAAARskyEu6lBaeQAAAAAABDANBgkqhkiG9w0BAQsF
+ADBKMRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHzAd
+BgNVBAMTFlZBLUludGVybmFsLVMyLVJDQTEtdjEwHhcNMTYxMDI3MTY0MTA3WhcN
+MjYxMDI1MTY0MTA3WjBKMRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPy
+LGQBGRYCdmExHzAdBgNVBAMTFlZBLUludGVybmFsLVMyLUlDQTEtdjEwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4bY+wR9CKBb6rxoRajhPAFJIPdwHe
+bp3Kzy5CxlPmQMk6ANqX3WWqM/qSebBHCNYvdqSgXMSdVXu0loCIhqBLvccwmxdc
+4rJD6Vydh3WEv74LayMIIrzl06QLcj+6GnVmWm5/+FbEF9SynICY2RhmO8roLp1o
+UnaNiC3Pruy97ZLHN/OE8Z7FMWIHHB/GQHwX/1P05p0yv/8WsojctrW8S3d56VlH
+u4W4ilKZMoTxDR2JFpn6q22J4DjVG8ouOSyJQmXMFR+HcmVPAaJbAF1L0w0BOrlF
+3W9w4RFo/PWdEm+SopGiTFeMMaPXG377FlEhWuX/I0yXtQT9zXt4rTTVAgMBAAGj
+ggF9MIIBeTAQBgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQUG23f6z3l4g3vFrHQ
+3l9YGlbL5OwwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIgcjDM4H58AaBpZ8N
+hOCBCIXCqksGg+96htu7FwIBZAIBEjALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgw
+BgEB/wIBADAfBgNVHSMEGDAWgBQBLYthZhuM0ODTTD5O7FsZsBHGYTBJBgNVHR8E
+QjBAMD6gPKA6hjhodHRwOi8vY3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRl
+cm5hbC1TMi1SQ0ExLXYxLmNybDB7BggrBgEFBQcBAQRvMG0wRwYIKwYBBQUHMAKG
+O2h0dHA6Ly9haWEucGtpLnZhLmdvdi9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMy
+LVJDQTEtdjEuY2VyMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5wa2kudmEuZ292
+MA0GCSqGSIb3DQEBCwUAA4IBAQCA/ZQYzX1u6rB0xITkVY5K8zPAjosvD6ynkr0B
+uCH+qOj3edjVQENg1JRVK89HqBQNMspbTUsZz2TEVKNH5xWtY0jp6vJm1DYDUqSu
+bEMe3CeJpkeD9S8JZV/P4P9swPkK2ZiptOlskqqnmcK7ZrJbevb4GPvQ+wCUf2r8
+t3ybYK5B1fyuX4L+h/GVdQWInS3Nt8hvyDyMeW7y7rC+6I0IJRLlaO9OtbbNZfIn
+VR6NHQUatOvdb9HVwJKvPvpeF0PYtScUXus+mZrV6RXKtYrFEbUX9jcrVlq2ML2H
+A92Pm2HzYILqvw/D2WQOCqZSKfpYr7jgekcGMBriisBlBq4D
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA10.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEkzCCA3ugAwIBAgIHPQAAAAANPDANBgkqhkiG9w0BAQsFADBKMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHzAdBgNVBAMTFlZBLUlu
+dGVybmFsLVMyLVJDQTEtdjEwHhcNMjEwNzIxMTg1MDUyWhcNMzEwNzE5MTg1MDUy
+WjBIMRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAb
+BgNVBAMTFFZBLUludGVybmFsLVMyLUlDQTEwMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEApJeqzFXJz0AEJM4KQEKW/av+knTElyaxfyBf3kQ7BvXGnYeE
+veFOWoWV3BWFuDHXFheUF79+MZVZKnNbcTcnS7bfNvVZCPsFIdwDv2t7B4XCqWgn
+Hka+W5GUwrLLguFn0VeF6DIHqVaicgx/mBy65wuS3O1WOs+QEnDTV5XPbATzIgPp
+CQ54KVg6asyquAT7I2ZbI/br2MimCYOv+RYWyb8EtG8jXkAJ91Ga+BYjINz89nAl
+uL5UOxJH/pW0IRpW06/e2zbGyl+JfUgiRmhirlZhM28gm+DoyRJkc6MSIDjAfc1J
+Rwp1STOznF4GDkHUkTB1b/AuEyOM4wJa7cXBiwIDAQABo4IBfjCCAXowEAYJKwYB
+BAGCNxUBBAMCAQAwHQYDVR0OBBYEFEsQGoGm9iZyh8hFkZqla0QFbJWYMD0GCSsG
+AQQBgjcVBwQwMC4GJisGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBoOvgVCB
+1bMdAgFkAgEoMAsGA1UdDwQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB8GA1Ud
+IwQYMBaAFAEti2FmG4zQ4NNMPk7sWxmwEcZhMEkGA1UdHwRCMEAwPqA8oDqGOGh0
+dHA6Ly9jcmwucGtpLnZhLmdvdi9wa2kvY3JsL1ZBLUludGVybmFsLVMyLVJDQTEt
+djEuY3JsMHsGCCsGAQUFBwEBBG8wbTBHBggrBgEFBQcwAoY7aHR0cDovL2FpYS5w
+a2kudmEuZ292L3BraS9haWEvVkEvVkEtSW50ZXJuYWwtUzItUkNBMS12MS5jZXIw
+IgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnBraS52YS5nb3YwDQYJKoZIhvcNAQEL
+BQADggEBAI8XCnG+nnbSzrETYRp6qLM3CKYWVwYAGKi0HOqb/GDudBLq4a69ctM1
+w0Wju1IR7x8s+3NUYvrDA095Cn4QGyMT0HMvzwCPGgKWltiX3NiVjmasPSXgJGCX
+3o5jCAFBtT3z55/J3RaNLA+9aUC5hZ29C2QaxF0WQC1t7b6DROLJ5yzpbxtMtaC5
+DHjHnSCR0756aSBlThKH/dUgZc3QOQGjOOefs0MnfKU46deAYhVWzFNJBUV4gjN5
+LGGzFQOt6KfNsDROvCjwrssiJYweiZ2fhve2lz13rt2R4LrJm/e3uxmJPDsOUCmf
+BYuKaS5tBNwMXqDoAX/QPUuW09QmBbY=
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA12.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiDCCA3CgAwIBAgIHPQAAAAAAJTANBgkqhkiG9w0BAQsFADBHMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHDAaBgNVBAMTE1ZBLUlu
+dGVybmFsLVMyLVJDQTIwHhcNMjIxMTA3MTYzMDMzWhcNMzIxMTA0MTYzMDMzWjBI
+MRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAbBgNV
+BAMTFFZBLUludGVybmFsLVMyLUlDQTEyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAuWBupH9bqVOIwqYksBRd7999hyKNvDQXhXehLbWZis+rqz6IGaoT
+yOeifzKJ/keqWqQW8A0SBjnkXK/ZmYE90hw7E/i6Bcd+3fF/dBQfIIRPK7Plx8P6
++dHxFBBsiR2wv2qBsobmrew5t9mqOoD+yACKI2uJ93/IMDZ3ETfggPK6z6YfO+le
+GsrjX7HPQ+8j4ckgFXTVUiKbf282nihr+NfeB+SbD46IaBTHaLvwN4eF+cVj+O7M
+10QE0Qh1WB+h2wJZtuAfbPBhm2LUBzlYFlhx3tALPYTb129CR+XdDA2NiY0bLCMr
+epCRirnTU3zxNhGZiFtyx5RRp/UlsZBODQIDAQABo4IBdjCCAXIwEAYJKwYBBAGC
+NxUBBAMCAQAwHQYDVR0OBBYEFK8FYQii1NYs4oGBY4Pxf6uKWvbZMDsGCSsGAQQB
+gjcVBwQuMCwGJCsGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBt+XIuz9MQIB
+ZAIBRDALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAW
+gBS4j6+QffCCfNHfSoyW2l9B9uWBEjBGBgNVHR8EPzA9MDugOaA3hjVodHRwOi8v
+Y3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRlcm5hbC1TMi1SQ0EyLmNybDB4
+BggrBgEFBQcBAQRsMGowRAYIKwYBBQUHMAKGOGh0dHA6Ly9haWEucGtpLnZhLmdv
+di9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMyLVJDQTIuY2VyMCIGCCsGAQUFBzAB
+hhZodHRwOi8vb2NzcC5wa2kudmEuZ292MA0GCSqGSIb3DQEBCwUAA4IBAQAk4I4a
+GwEcWCTJ2tHZbF40rvzpq3mJl/vLE059kOpeKs4FTg2DlYtk/U5GSHIN8AH0G697
+H0F6yVIfx3MEApqR/jjw1W0KXT+tttzuoLEMKy+imBXyqDw0zzc/uaSy0GtCWOey
+tKvPBcofxDBuuyOTM8kljNb/x9Hga9RftGaZSDf9hmATToARoa1l40G1N68QSfJi
+knwGVjEICHMYUOkQPf4RXtbVu41+jChPGRqWP58zMjKNM8eglIdBbEL9tgyGwF4o
+P9baH0NkgJI1vT6HueSY83QOv1L7hF3wfegG+Xvo5nTI9CtUd0lPCnQM00L6PPDJ
+T65ZMTFDVEXqjCr2
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA13.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiDCCA3CgAwIBAgIHPQAAAAAALDANBgkqhkiG9w0BAQsFADBHMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHDAaBgNVBAMTE1ZBLUlu
+dGVybmFsLVMyLVJDQTIwHhcNMjIxMTA3MTg0NTAxWhcNMzIxMTA0MTg0NTAxWjBI
+MRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAbBgNV
+BAMTFFZBLUludGVybmFsLVMyLUlDQTEzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqKtSt7FJgnM4UWALBNShD6aBwtEDObFB6B+ttStKLB9qrvfjTOrj
+cFsjWvzygZivIwcn3DJHNF6+njQbwg4SibyfgU6fOWpoXlDsCeIuXz1oEsGyWwoY
+ebKjVENukVXbodtGdUgak50rScaZs+1Z34m4KkiXu+/a+rFC2zbvoRF95zt2Ir0q
+Sp2RbxWSThGJ5S2VnxmYq+LFUyhgpfN1kDcB8M4jnjbfxNvbv6j55laoXlCZQKuH
+48zhDPGsqcqoC1ko5WGkA+K4o3L6/MBiadeZCzy1uu/wNfZofB4hHjsETsiFNrtf
+4oq3jImcY2q+8Bto5NEydNwod1vSPHgCWQIDAQABo4IBdjCCAXIwEAYJKwYBBAGC
+NxUBBAMCAQAwHQYDVR0OBBYEFD96n9kkkj0VUKUZQli+8XOagTC4MDsGCSsGAQQB
+gjcVBwQuMCwGJCsGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBt+XIuz9MQIB
+ZAIBRDALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAW
+gBS4j6+QffCCfNHfSoyW2l9B9uWBEjBGBgNVHR8EPzA9MDugOaA3hjVodHRwOi8v
+Y3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRlcm5hbC1TMi1SQ0EyLmNybDB4
+BggrBgEFBQcBAQRsMGowRAYIKwYBBQUHMAKGOGh0dHA6Ly9haWEucGtpLnZhLmdv
+di9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMyLVJDQTIuY2VyMCIGCCsGAQUFBzAB
+hhZodHRwOi8vb2NzcC5wa2kudmEuZ292MA0GCSqGSIb3DQEBCwUAA4IBAQBgY+lh
+HNQWoqI4AhtYYIxaMMiTYyXbIWx/M6sB299FYY2CSk3a5ApY/DXXIu21+UsualbV
+Nih+tRLMDaJ/o0CRd31l7nAAVNWd5bDRQrkrBkimSQ+rdIFcT2Zx4ULLI2Vttj37
+ep2RMgIA1O3Zee5u5SmqR2+GXwkYJQq4t0/QutF4lAOt9N5eJpsqCJUCTtfbvQpL
+k+GqK3eqA427kXBEceaG6PE4JVBAjr4tG7gCHXVplSzyOe8GDIxdOrmBwQVDADTx
+ebARE6Zak+ELwvLIPbRRLo4yX4CKSwaPhnEcELpxTuYfIaHQ579Th/bNwblUq4Ty
+T66U0/5BTJyh0NKI
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA14.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiDCCA3CgAwIBAgIHPQAAAAAAJjANBgkqhkiG9w0BAQsFADBHMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHDAaBgNVBAMTE1ZBLUlu
+dGVybmFsLVMyLVJDQTIwHhcNMjIxMTA3MTY0MDU2WhcNMzIxMTA0MTY0MDU2WjBI
+MRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAbBgNV
+BAMTFFZBLUludGVybmFsLVMyLUlDQTE0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAzkTkVJmvdl6gMI4DFfX/d3dixnRIKkr0NG+cI9H3gyJuOflj4TAJ
+iFs9Ofhpk/J+/1C/QxtbtIRPoLx+dzvCCWeh48baccrKamyBs6+4LCQTJvXo9ADd
+K/Zgu0aE2jkBNK47qN9aXAeQUrm29TwSYx0iHu2YfByWvFzLj2euB3MzC847RXt7
+SvrW6vluYrvwDdfIQJqfCIS5EVKQZ8JnSrfzJ6OsRrK4bN12dSa+KrDc3lAsviE0
+i4bTwOOMej7BfgR22ejGvlci0oJc3Q6v5XER9G+019I4EzrH6oTk6bTub2jxb3ZT
+MUPRlJ54ljyMD9vD8BngDFxhTTlK6lXN6QIDAQABo4IBdjCCAXIwEAYJKwYBBAGC
+NxUBBAMCAQAwHQYDVR0OBBYEFHurC+7x7Wj608sId2jkNFpUpdloMDsGCSsGAQQB
+gjcVBwQuMCwGJCsGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBt+XIuz9MQIB
+ZAIBRDALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAW
+gBS4j6+QffCCfNHfSoyW2l9B9uWBEjBGBgNVHR8EPzA9MDugOaA3hjVodHRwOi8v
+Y3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRlcm5hbC1TMi1SQ0EyLmNybDB4
+BggrBgEFBQcBAQRsMGowRAYIKwYBBQUHMAKGOGh0dHA6Ly9haWEucGtpLnZhLmdv
+di9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMyLVJDQTIuY2VyMCIGCCsGAQUFBzAB
+hhZodHRwOi8vb2NzcC5wa2kudmEuZ292MA0GCSqGSIb3DQEBCwUAA4IBAQCfI0Ss
+lp37jX4mqRQG4lbFJHOqhO6zE4tUMbu51JaCBX8FJvd9WobCO1InFJIGKDB062gF
+RlL6Vcea2SX4Purx+4CpE0cR0QSvAASHOYWhZzAxCLRsgFlzg5vfhSyjDwg4jxgJ
+6AfMT/1KyojPX5hU6P/sKC3Pm8TLB0aQBfMnerVP3Cqenhpq5/I55XWxVm8nUqsk
+HWufE8bRuvqQn6+ZApYk4DCmqn7ipt4qpyNGJuzeFWnPeyNLhqVEfRutRQHCwDfq
+wut81TG/nAYxAz9vhYMeCGEIPEW1qPg45PwdTv2662VN7bUEwjWJf7uIVeblTP35
+n3knU2ONSOEqsvKK
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA15.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiDCCA3CgAwIBAgIHPQAAAAAAKDANBgkqhkiG9w0BAQsFADBHMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHDAaBgNVBAMTE1ZBLUlu
+dGVybmFsLVMyLVJDQTIwHhcNMjIxMTA3MTcwNDM2WhcNMzIxMTA0MTcwNDM2WjBI
+MRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAbBgNV
+BAMTFFZBLUludGVybmFsLVMyLUlDQTE1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAqtrwF1Ws3d2CagztJ/aDoCdvY3KWcy6+fYfQemvlAbz0FDll79gg
+H7cNT248kcj+PqCqS70eEpWEn0WtmtPbF+FRviYINKR7an7Z1ua9dulUBXU7G8te
+w1mAQDy0agggDmmPHgOj1lHCB+X0hH7WeAugLxW2vjNmC5dmBgUHtdYU667/rYcy
+f7wF9jvDEFwP8P4/CLtjIN5k+scKqzt5ncfnDRp9D19GPhxSW/kCkvSglXYt8fIB
+VYXdmtDfKkTXY6cIhVlvc3a8ywNAZCMvWDVfCF912Zcjn1zftUmEyxxVB1WPCYO1
+N9juZpLVjhSudFFUeTL6R64pVko/dSWAawIDAQABo4IBdjCCAXIwEAYJKwYBBAGC
+NxUBBAMCAQAwHQYDVR0OBBYEFHkhKtOP219NAu3GQRryL/Fhx2R9MDsGCSsGAQQB
+gjcVBwQuMCwGJCsGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBt+XIuz9MQIB
+ZAIBRDALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAW
+gBS4j6+QffCCfNHfSoyW2l9B9uWBEjBGBgNVHR8EPzA9MDugOaA3hjVodHRwOi8v
+Y3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRlcm5hbC1TMi1SQ0EyLmNybDB4
+BggrBgEFBQcBAQRsMGowRAYIKwYBBQUHMAKGOGh0dHA6Ly9haWEucGtpLnZhLmdv
+di9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMyLVJDQTIuY2VyMCIGCCsGAQUFBzAB
+hhZodHRwOi8vb2NzcC5wa2kudmEuZ292MA0GCSqGSIb3DQEBCwUAA4IBAQDMyiJC
+kcYZ+srbbb2AT05ve3+/ZoZdNoUGYOtntw26o+J1MOW3tYf7ms/TeYCRYKNDHb90
+I8PO2HYM8cqN8wr8y4uh76yXmjcgjXNe3qJMHuA0x1tjJGSy7goYz37pJfm10sET
+YX/Ub130Zie9pwbge98XKRuZOA/f3RvmCRBhuNt+9So4a0GCfTdLxMhcACTXUwPf
+HAep+nhAP3QG1KgnhtxN4O1tFpXpnTkptjG2g6Lt0j9oZ3V8YRBfH5Bdq8g9C1jU
+8EaPfA4Mmrc/Utcuinh0WAAG1NyE6vHIsmQqFnUcSnK8RpWZ7b5LezaTBWoYKdEv
+GHjFOaDKUIdW7d4k
+-----END CERTIFICATE-----

certs/VA-Internal-S2-ICA16.cer

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEiDCCA3CgAwIBAgIHPQAAAAAAKTANBgkqhkiG9w0BAQsFADBHMRMwEQYKCZIm
+iZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHDAaBgNVBAMTE1ZBLUlu
+dGVybmFsLVMyLVJDQTIwHhcNMjIxMTA3MTcwNjQwWhcNMzIxMTA0MTcwNjQwWjBI
+MRMwEQYKCZImiZPyLGQBGRYDZ292MRIwEAYKCZImiZPyLGQBGRYCdmExHTAbBgNV
+BAMTFFZBLUludGVybmFsLVMyLUlDQTE2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEA0HGnxq16dqhAe6HY3+4A9lCP0MompOiFGZTC+uoKNr1pBP6GXt7u
+w6nY5n/la3iYPr1gGhsmBqczIT8/5+cY2M8EKJy6onWoo6fyOx0ugWMt8ws115Ug
+l6ezbvFIrcs+M3xZ6Pf5/34O3GxAHSmpqhz/WbMp+1d2wTuU1IlDZAU30qmCf85P
+3mmUWpcrgIGoBrQkFzlubf3vLmkyBQx/AzqJUsJODOk5dDrhh+fbLmBwbQ//Mj+C
+qn5hCo/XC22RtxOJNssPYpBFYlPG68LMnAQsvQyC9HEXk4YfQ2liSfKp3ewsC66f
+z3cOsXBbyPjYbGqdhzTzJqTDdLadk2rO7wIDAQABo4IBdjCCAXIwEAYJKwYBBAGC
+NxUBBAMCAQAwHQYDVR0OBBYEFP5/zce4dEkJ5tyrWCLlJraqjekaMDsGCSsGAQQB
+gjcVBwQuMCwGJCsGAQQBgjcVCIHIwzOB+fAGgaWfDYTggQiFwqpLBt+XIuz9MQIB
+ZAIBRDALBgNVHQ8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAW
+gBS4j6+QffCCfNHfSoyW2l9B9uWBEjBGBgNVHR8EPzA9MDugOaA3hjVodHRwOi8v
+Y3JsLnBraS52YS5nb3YvcGtpL2NybC9WQS1JbnRlcm5hbC1TMi1SQ0EyLmNybDB4
+BggrBgEFBQcBAQRsMGowRAYIKwYBBQUHMAKGOGh0dHA6Ly9haWEucGtpLnZhLmdv
+di9wa2kvYWlhL1ZBL1ZBLUludGVybmFsLVMyLVJDQTIuY2VyMCIGCCsGAQUFBzAB
+hhZodHRwOi8vb2NzcC5wa2kudmEuZ292MA0GCSqGSIb3DQEBCwUAA4IBAQDGLnrN
+rIWBxG0gLRVxca+NUcbm7cUTPS4durBzieRGyWSokhBi+dQ7qHKNpNaDs4upR+P8
+MtPN/WT8Ry0B1QhPhwdlE8BrjgWM88vgzhSq/jqMf25y0bo3OmKwsE7E55bB6/zC
+7vXr9l4GgCSJRmevT4o7BZNhwMfv/XkmhAueyszS8COiBul2CCyHYyc0hYuV1jr3
+OfW8nvHtval5cISQxQW3/o0tN6n2BRrJ0wjwTKcHhPMo4qLyh3U1dNU1BQYBS/7g
+0txaf6wHfrovuFrScMJWiZn9XuXMZglu6D+Ecz1qdi9OvFY3fAvO2FTtGq1X3Fa1
+GqiO7kj0M0LMGT8N
+-----END CERTIFICATE-----