From 048465890590495e9b55ff86e20ebb1396828d79 Mon Sep 17 00:00:00 2001
From: reebhub <reebreeb@gmail.com>
Date: Wed, 10 Apr 2024 18:29:00 +0300
Subject: [PATCH] document that `Security.WellKnownIssuers.Admin` was added and
 `Security.WellKnownIssuerHashes.Admin` is obsolete

---
 .../security-configuration.markdown           | 250 ++++++++++++++++++
 .../images/export_cluster_certificates.png    | Bin 0 -> 16497 bytes
 .../images/renew_server_certificate.png       | Bin 0 -> 13201 bytes
 .../images/upload-client-certificate.png      | Bin 0 -> 6806 bytes
 ...cluster-certificate-renewal-issue.markdown | 158 +++++++++++
 5 files changed, 408 insertions(+)
 create mode 100644 Documentation/5.2/Raven.Documentation.Pages/server/configuration/security-configuration.markdown
 create mode 100644 Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/export_cluster_certificates.png
 create mode 100644 Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/renew_server_certificate.png
 create mode 100644 Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/upload-client-certificate.png
 create mode 100644 Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/solve-cluster-certificate-renewal-issue.markdown

diff --git a/Documentation/5.2/Raven.Documentation.Pages/server/configuration/security-configuration.markdown b/Documentation/5.2/Raven.Documentation.Pages/server/configuration/security-configuration.markdown
new file mode 100644
index 0000000000..dc6c88cfea
--- /dev/null
+++ b/Documentation/5.2/Raven.Documentation.Pages/server/configuration/security-configuration.markdown
@@ -0,0 +1,250 @@
+# Configuration: Security
+
+The following configuration values allow you to control the desired level of security in a RavenDB server. For a more detailed explanation, please visit the [Security Section](../security/overview).
+
+{PANEL:Security.Certificate.Path}
+
+The path to .pfx certificate file. If specified, RavenDB will use HTTPS/SSL for all network activities.   
+Certificate setting priority order:   
+1. Path   
+2. Executable   
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Password}
+
+The (optional) password of the .pfx certificate file.
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Exec}
+
+Deprecated in 4.2 and replaced with [Security.Certificate.Load.Exec](../../server/configuration/security-configuration#security.certificate.load.exec), see below.
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Exec.Arguments}
+
+Deprecated in 4.2 and replaced with [Security.Certificate.Load.Exec.Arguments](../../server/configuration/security-configuration#security.certificate.load.exec.arguments), see below.
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Load.Exec}
+
+A command or executable that provides the .pfx cluster certificate when invoked by RavenDB. If specified, RavenDB will use HTTPS/SSL for all network activities. 
+The `Security.Certificate.Path` setting takes precedence over this executable.  
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Renew.Exec}
+
+A command or executable that handles automatic cluster certificate renewals and passes the renewed .pfx certificate to the rest of the cluster. The 
+[leader node](../../server/clustering/rachis/cluster-topology#leader) will invoke this executable once every hour and if a new certificate is received, it 
+will be sent to the other nodes. The executable specified in `Security.Certificate.Change.Exec` will then be used to persist the certificate across the cluster.  
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Change.Exec}
+
+A command or executable that replaces the old cluster certificate with the renewed cluster certificate. After `Security.Certificate.Change.Exec` distibutes the 
+new certificate, this executable persists it locally at each follower node.
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Load.Exec.Arguments}
+
+The command line arguments for the 'Security.Certificate.Load.Exec' command or executable.  
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Renew.Exec.Arguments}
+
+The command line arguments for the 'Security.Certificate.Renew.Exec' command or executable.  
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Change.Exec.Arguments}
+
+The command line arguments for the 'Security.Certificate.Change.Exec' command or executable.  
+
+- **Type**: `string`  
+- **Default**: `null`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.Exec.TimeoutInSec}
+
+The number of seconds to wait for the certificate executables to exit.  
+Applies to: `Security.Certificate.Load.Exec`, `Security.Certificate.Renew.Exec`, and `Security.Certificate.Change.Exec`.  
+
+- **Type**: `int`  
+- **Default**: `30`  
+- **Scope**: Server-wide only  
+
+{PANEL/}
+
+{PANEL:Security.Certificate.LetsEncrypt.Email}
+
+The E-mail address associated with the Let's Encrypt certificate. Used for renewal requests.
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.MasterKey.Path}
+
+The path of the (256-bit) Master Key. If specified, RavenDB will use this key to protect secrets.
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.MasterKey.Exec}
+
+A command or executable to run which will provide a (256-bit) Master Key, If specified, RavenDB will use this key to protect secrets.
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.MasterKey.Exec.Arguments}
+
+The command line arguments for the 'Security.MasterKey.Exec' command or executable. 
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.MasterKey.Exec.TimeoutInSec}
+
+The number of seconds to wait for the Master Key executable to exit.
+
+- **Type**: `int`
+- **Default**: `30`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.UnsecuredAccessAllowed}
+
+If authentication is disabled, set the address range type for which server access is unsecured (`None | Local | PrivateNetwork | PublicNetwork`).
+
+- **Type**: `flags`
+- **Default**: `Local`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.DoNotConsiderMemoryLockFailureAsCatastrophicError}
+
+Determines whether RavenDB will consider memory lock error to be catastrophic. This is used with encrypted databases to ensure that temporary buffers are never written to disk and are locked to memory. Setting this to true is not recommended and should be done only after a proper security analysis has been performed.
+
+- **Type**: `bool`
+- **Default**: `false`
+- **Scope**: Server-wide or per database
+
+{WARNING Use with caution. /}
+
+{PANEL/}
+
+{PANEL:Security.DisableHttpsRedirection}
+
+Disable automatic redirection when listening to HTTPS. By default, when using port 443, RavenDB redirects all incoming HTTP traffic on port 80 to HTTPS on port 443.
+
+- **Type**: `bool`
+- **Default**: `false`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.AuditLog.FolderPath}
+
+The path to a folder where RavenDB will store the access audit logs.
+
+- **Type**: `string`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.AuditLog.RetentionTimeInHours}
+
+How far back we should retain audit log entries.
+
+- **Type**: `int`
+- **Default**: `365 * 24`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.WellKnownCertificates.Admin}
+
+Allow to specify well known certificate thumbprints that will be trusted by the server as cluster admins.
+
+- **Type**: `strings seperated by ;`
+- **Example**: `297430d6d2ce259772e4eccf97863a4dfe6b048c;e6a3b45b062d509b3382282d196efe97d5956ccb`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.WellKnownIssuers.Admin}
+
+Provide a well-known issuer **certificate in base 64 format** or a certificate **file path**,  
+that will be used to validate a new client certificate when the issuer's certificate has changed.  
+
+- **Type**: `string[]`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
+
+{PANEL:Security.TlsCipherSuites}
+
+{DANGER: For experts, use with caution}
+Defines a list of supported TLS Cipher Suites. Values must be semicolon separated.
+{DANGER/}
+
+- **Type**: `TlsCipherSuite[]`
+- **Example**: `TLS_RSA_WITH_RC4_128_MD5;TLS_RSA_WITH_RC4_128_SHA`
+- **Default**: `null`
+- **Scope**: Server-wide only
+
+{PANEL/}
diff --git a/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/export_cluster_certificates.png b/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/export_cluster_certificates.png
new file mode 100644
index 0000000000000000000000000000000000000000..c30b07a6fa4512af2a19652b2486d46899e13b5c
GIT binary patch
literal 16497
zcmZX+WmubCvj&<F+^s;NI7Nz6io3UkVlB{O!5vC*3+}~AafcQuP@JG4xLa{|cb6b1
zefPJ&{ho9F<VvpVd1kGdHEY()n)^<;+B-!&Y)WhZ0D$*eNlpU*0G1=a!!gm3pJr47
zh5!H^;I*9edw1YL2BM6*+i~k6ri2q_`dSa{e+<=wFQZ_C+O-JPnre;T<kP6*(w05P
zS>5bwZ5DX0p6|`A^65`a(&f*uHMVhSvFzOemCj!$L?l@g^R7>14ZaFSPx-#){?$<2
z_^ZKdXuxAAU03qiKze58;qGqck;N~Ip&e0t8sXi26Nz%(@_F9R=hLZGF*oooDG%K7
z^PT8f;9JAr*(r}#NslUZeQjnC-WE7T;Z6>4fMH~Jxe$-?ZI-y6N})=j9qxFyl!_BB
z7@Y^CL(t_HuC3oRAh=0|{2}*i5-U*x5oT^F@hVOru9jDg7F4r0!@vVdlLw1afS3(j
zPWYD2=LK0*8`o60>7zs!o$ZCp0ek*R6C$mDI8oB{eyBE%PUs%?xm?sYjB&i+lr#B~
zHj8-}GS>uYk9t?zYvbW=SYp_)@mp_J$)PlJ-f?dHQOrl$Cw(SwH+XGMw;;ZGSI9xv
zt|dQ?%>U^$2g+V6MWKG(+L$<8K(U|PgYZ`>bvM+WmFT5k)Y054H_~M$dxbW<x5{ZX
zv^h=U&_zl<yHjZIm>2{PEKXSTiAASD9$eZ{!ukTeyw_)nBej`T5R_c$QN8tBF1g60
z^MsE}RdHJCo--GgpOz*7`EB(>9*iy!3HRhdpVjNw5W@rDXuf58vFdgtT`1)jF{VoI
zu#y~;FR(hkaXI<YaVhC}0lH&EcwhZHb;@zy_Ndy~3B&Y&RZR<H5slf*p$WT1rx?41
z9suAVQf>LcDDL$kNL-%TPKkkgEX`Jz+@-*(UFdm1Oni*+NKj1AmCa$Hkf5C23y1U8
zidQVRu|W1&nR1Q<FWbQ!)ftbC3cb)`U<n4phdtD{P|T7&w2V_PY2{cA2EPDeRP4*V
zI{#!AburI@B-wyp!B}V<n1m5=0QB)0+fc5fZC?GB$9D(I7dMs9NzZQIHD1JpD&6bp
zvrOYzHQ7$$lRCTN-c4->u6tR5045k&SG~@Kk$v1VWKtxEfg}PmHA(ug>k}E;cvYi;
z5{K5RQ9Nkx5YgvWfqphQv7uAh`}fRC!#?#ZlUCMgH(XH*>t&8sucE3k2jJ#JNJoR$
z;nYFqaqPe59&_no$C3|<KOg^8H=|!kW?$E6-o}g?bJ)a!LJ<xn-jumlvmmuA8N-1o
zGm4tk@60z1E^8lU9c!SDQ+Is&(Jj*K&@X`*pjS?dD2tUCs>M}nU7WTDa$t#7$N3kC
zgt$MoWTcf`97g5fU~CHmC3|NrGw+%}p6oc@@wX2ECP8t(TmpXTq6+lN9}F82$$r3X
z!c;$B9`5fH!!}?xW_m}1Yj$E^3j!0$3${rGFmJZrPUt2ud}69FIcCnW7ZY@Nc^gn8
zI4cFtv#PJNI|X7;gaTB{YKo1iLf>v1+MA#YCAQ3~KG6+&tUEB;@3_Q3@V21n>`%pp
zsy<cNR$p?No8<rV-)(h<noQnAozAE1_NN}K&?+mP^!cMDYRH(Uo?LgNKCz3X_5soY
zr_53`7`{r|%%ZtvZv^q4Kgv5ESyF+BqvFQ3o;t2LCeqq5@i>ao6I>CAhF&?HMp5FF
zaFjofDq7F7jUeA$mNGF@YfP<0FQ*B6UrNHUz)+qa3BA#AT4y{QsaFfOP<!ny)f7*G
z75Bq3Nb<3_qi_aa-{7ICLv@3Q=k!kR+5N*U>pdCvX}r|raDv||M7|=FH4sN4a=_hS
z+5t8BlzjbaIMbBMEal0ZTvo8_nWYvj`I1>yz_8-67e^e6a*jqLj-9<V`?EX=kmab8
z5())%{LLxsJFF*W>R-lK<66FT6o~37@Q{j?D#Yeyb&tCYs2_x&su-{BX>9O;Cs6Um
z0`aiEN`D<8ldM_a>qXNIP@M49SCP&gsoW7F1~*leWu#4|-2Lj5fX+!;oD;nt#3&N8
zYQOwR4ULwZP25p4AEbqGIFL_L&$8bA0RLE7XMAxwh6k;$S&0taN;sc)c48O5Vmv;s
z4WM=pgm;riVQgcZitm|-Wu1b3E?Bv4I55bmU;150{jkme?~wVA1~=5%#V1b%n>t>m
z;I$vuV0>|HZ!5rjWqMPQi1_y&Snccs)VgPtv3>`t@y_<mVUFrDE`O5xmrt4-r{ZMY
zba=~{WdAD!X5&oMGS3R2pYnqLFWSBw?UV2KHkQcYRU1=^gyY(h`Cou>M}n<&N$jXV
zHxxYoH^UUmja)Mc-mDRd!hZ$0ZJC<V@Y*PUZ(ItvC!I#kyK?79xN`NEQNFBXRZHCQ
ze=Uo1&g`VzT$hvtI`03)Rpw9imMN+OEd1!!lvYH^{(}tVG+%)YYIZicb|!SRp#SqV
z9+FbM>H(Hb5=zjkC=La%<l}@xhR*<o5AuMK7VmIwP)llvdOVhR$ZGF?q(b~y6&-lA
zl=B^FsZ4s9D=Sy-)wuQ45It@>Su-}U`=vjI&J%b6cF?j8^bFfMYdD@unmaFB1w5%I
zG${k38_%J}6NB@W&-$a7X#IUVPWj^lOiJ`UmX0NcAC%lQMB6mj#va(Xp{4zhgH!>(
zr*NcB$p(jCc!yaWG}q%Je*jB_+w_F}qR_0WB=f1OkSFB?So%X+UkTnWeZH!fKUCb1
zLzyCv6hO-9i8)95x(AJDETWSJENV|m-tm3xZEohQ1{DR~56}AraSSV(C)l4O&SdXv
z<e$9tkp518zZ<Q))Ua}$8@H{>@fHyPeL2&8Kx|j=;djM@xL~g5s!XEvb+C{3P278o
z3&)bT8H`%-T9H~^!7AM|^mhew@0Qx}R0iJeoCWF}q}C$itAI}V1o{Qx*z5Go`lvSY
z!~By*KMHaSW(Dc<$r*j2%ziDeO|ugpOI3lW;0<@nQ?{auQfjw59bG>wBa8l-!169v
zY0>xkBQzp3baeR$W6^p}n;~e5mfE{xQ3%H~lk5<INIn<w>x?_jy|~L=*Iy0g>6B8Z
zPCFq?vt0+vh-J_*W6kUFwfm<r^1c<kFW0JPU)cd(A`N@lNt#RSNJ_z#?rn$_N677q
z+nL^h*B9Y|eeszdw=JJO2|jqxgC;bww-+umfTjuLD8uQ)I}UR#76?5h4r>$6Lv1mQ
z40z*LTh3X`Qo{+2NlH46i*ax6J$jBfb2__YBT$HLQYE?rMz=v06@PkKWSIkAs^O8n
z7YG)@k!B5#4waH{DcB`h-H5>=;soFptX)?#$%{P$%WxFEv$r6g%5^`p;xm9?f#(y;
zV-C2gqjuZuIBeSOjH$sSVGY$P2u6SIYW8B5jI!ZiPhQT+?gCQb`RgdqO^kykb%hF^
zD;=CqGC^t>5jG{*;sZ(sBKLBjQn4$&g8xcfhw_zhiIQa<;faq3O>N3H8_^R0X!J)B
z?+1JvRbtDG(78CA&#(7e-B2iqL~?Ae4T3g=0Pq{|aHcNpK_{DZp^X#iAKA2O{Wh8v
zT5AVu-CpvdrtdLbN+JS74|ntVn7DmU)EW1<J!p;?t%tp#HGAemnqkm|K?gn8;pQHR
zB`@ENplULDom+3;x7t+WvdS!usasl@S#|v^Ilui1NZ{C?*JLQJq)|OgD^?VA3qU;I
zsEJV@o&}8FTDHfv(9!-}tD>Tb3*WMSV~Jyz$7dC3=A;V@BP`-!wO)GD_%?gx^QcrT
zEY9pTtx|bmZ4oQcTzpN^OdPezM!3nWK_d6%k?olE)OkAaGI~zLv9I)GIIH;pVm%rw
z?Tv1dEl?Pm{LWbTh%?;rvP(a{=d7sVI3$<Mmh(q0&GXBODAtH`vemzVImcj?ZlyqM
zg;N3$DkRuUz0;4+KyX3a;|%cx%40fxbgn498&p1j66ye)MHTj(<0%gH2gw=EbQ{{o
zbte-LlEI!ynx(Z2tk_*Wu&buL5KUglRW^Er0H?jC=1HCzls`_p&BvJ28IUau2sS(o
z@D0WMl{%<CzU7Qzvyrr73V9l0XgxKE%UEvMn8tk<?zNr5e%Sc9MZ2K7gve<;P6=Ib
z#49HuXizk~%|V<<-sK?-r+(KJ&_Jfe5nE7B2Hrw9n*RxPB!7%Bi!R2#+!nd24C8}+
z&r-cu0~1muN~j;N&D_ptIdUmv#>ZHwZ2rbJ=CA!k3TFtOJA=l23)FJMh6Pn<&<8YQ
zg68>yjcD4VjD+FIcY3aZvZPLD!J3ER&4#Y9yrXy_XjP}A$-HM|>tkvED0lH;;A}RH
zaRb&4Ptf?SmGJ$0q%@Rrx5vBsw)Z(0vp&8}d$60SqeeI16Bwd(ukmmc!JduSb~>DE
z0n5zu{6zQrggAe7Ws->zB>F>zfCnIpVl0|mUFDNn37AEBv+~qLx&7#6HC5jjWK+WM
z6k?}Fz`GFSDBNZVp$%EGnL1YnT%OHA7YJY{Xl_{%zoUIOQxT(f&-Z=32E|X*(JEpj
zHn^G=PK7BHC<Ymt9RT@&0QDW5qXDi{em_pz3f2D_%?bv<k-0s*%8VS-wqc=hHnxro
zKNuvZF};B;!)`JIp7j?qCJKBe_Ruli><`%9Et$h}ky*S>l??L@vo@xTl&WlMeW$eK
z$$oE2X9Ioll7@Vzm$`anY-(O5mH8g2Bene&Rw03R;_Nroq7YZd?24VvSDPS5t{Uxi
z@r_Ai;V%tB3ch$g`H0V2OaK2RBJq!N#~L*WQ0{Km!rTn6I!rr)q9v0LV*);KVVT(Y
zS=BXPMEgdEfaBC@W|dbTikCzPI31uEX#=XY?mdK`Wgf(nAI{;CcK#wocK`uAj8QII
zFBFRLPyvOJ!Xq8#qj;nXGy`m1qYGsbEY-SgUz28PX)WT*{_Z4u84+Ci8px-2k`upo
zW`O&bc5Y`shx08rJJ{SVKUsY`u0<UBnyC+m57%Z%jOR)|hl?rUEcXKP!JvzPI*b+a
z+%nrg%Z%k4JAf@fV95jO8?2g3fNT$+S{$_}J6$0#QF=sHWA=T>*iG3%cm)yTJW0W`
zXJf9_HwJ%0i=dHSG*9YM=*rdXD{(5n`&E`h8`V>*RzP8lq3hH{<kO>v4Kp_larVHS
zu2DhA>f*$3KPfKcft}VribNSm%GqW+iziPUjo~H7&t$NA49N3#q+(!J&#L?g@TYD+
zA0VLDNF#y&f|y9aYl*h2k4Cs4XX?rMrgr0mFQjcX+@)v!$tC{lD}Of_I@q^a*H42G
zijdsP^xR2B9M;$z)>}xVHE$Cc9iQl51y%rX;$r;XLb|#Aa^-bEUs01}1CQ1m$*9#K
zwNEZ8oC#;d{$O7Q=%Zr0MEl|=DTa86k12v@C4lp}M_(HG3sYfEVJaYQ(Dav}4%GQO
z*jHX2L%;jo+Qx^@P!lGSocCcoecd#!y1pM%?FUxm)G3<zRE>LswK1Cmh&J=cDHgrD
z7k-c{@fiAG$0Vt`{LvaOF#4|I1zU4H5ws?jcu!`ZFzC!trkI#xN4n&JfOlQ}u3vzT
zJ5>^{D3qH6&W0a;#pz96YCPUgW<1V9nKK2L4B@qZ{Q-unUM_;CAo~<lW8*16M1eUq
z3_Hrqom!K;Ef@8u<oQYAf0>QwDLNO_?3R4=xw3zI!U#O0GamcMlX11keF8Q5w7nwg
ze-_?sbHXW?iQm0O%77(2o5p~jkriYxr6|zF*%oLkv{!q%c+z4-vh%qKUyTFDkJx*g
z{tpnmZ0Pzh8{U7t$<%DR+AqH6dgX44xq;ERgGRDK<!k#XTVB%T**_uiJO?v;#%e^j
z3t8!pRe>m!ll13YM5o%SO6FRe1q~O!_)4KD&Bg25U-^bw?pa7WE;S?Lm5REWA~5a!
z^?uVAQ-1!I@xKWWIVbkD!-=hMZ0Cezi!Yy{L0X?$<YUiL@9>3hQt0WgJ(pMaSk9LO
zXXi%`<rj}&NyizLi=ks=8kNZg=L34T96Ow6sXt~LjihelH4RK5Mq>WD)OjZmwL>6`
ziSrd-&InwCdI8PF0I)a7OlVtS+8ZQMcu6H?g7PTf|6@mI0)K%k=p$^uPq}Z>W$@Sw
zDVZDIc1D|e*=Bdp8SKLfN6*<|X#E?GJ#B!gIjqXM7A*j+=m2ZGbV2xM>fi6;$fuWZ
zuTrGC0F(00kORp1CBeeQV~T{}<K+~YBSnb?A9~2&!|7FyT@rrVR#Nj-B;n~qzy+_k
z8EUr+f7{rdM8aEjoG`YZt%-jeUzzGC5lh}=K$!m+c}6k_t8<~i6}6n_5qaNhH|yYD
zb@p|mA1Z^jJn-W_Rmc6AO0UlNsclc04I3o7igDm>V^1U)gABWiQjB=h7+`RR+J@Nm
zwa;NddVD5OR-*uOtrcp!jn?`(kCjdxC>cd~2VG8!(X%cuw=hd^_BqPrO&7YP{+<Rt
ze{klq$UC^PnaJIJ1|mV^?Hr!~>eyq3dr8UHVIMr6^NisCy+jZmWhQ=J9(sCwU;c|X
z%@ssN^!1Z-4ozZ=cTx@8WM2Q}L-+`qR8j5Cktxdz7t~;!<i}`C>+gXA<0lp~_LY)>
zjS)SSm%Oxch9AIGdm}L18yDSUuWivqE>@O_pK}!}lZwlXN*02z5*{K1qN;ADKV3wb
zfRg29UxtSy0+;9mewjNZMG6lW2M2LGX3;VdMW{!is1mcXO@9K@8*&6Ppa3}vMX{Qo
zY5Svu{?5#vbk;<Ed}Y6r?pnuQ`e91-p7zjE);5X#3UsJiD~T?FSPx%_LyPVb`<Rwu
zmo~268^)Jy&-c{=!A;zwSC~B^4du<hhNE}V(8@t~3*Ikdz13<PT^A^jB?)>tqhhg}
zdkv1o<PNeb-dxkzrgLbp8H#B=VG1$eS#@J>gT3RvghUj!f7eQv8Ee}>BkDIHLS3jS
z@NDC!+yJgb1^mh>oRvD*;(2oL0;G)TPSm5Jmp9BB02lH0iUj2Gy)4wMZzx;8dQW?1
zbbeM!@k%f{0Sl;gkVI&=;z(2B*w_XObMLj_L?)JYxbTN8#7xU<xA({}uiD>$??9SS
zL0(TP!pe?i3BiqK;l*8j3aEg&1gaoBa+KQ``~R3pWl*AcG!}jZbYZ4Ay6rqP4ZfY1
zAcnMTT>iKW72^cd#$xX8MpLz(wNKkGqMzdZ>^&;-S@V|PBCpK=PS$cQWjXdir(pr&
zCf&7?1+FUOK=XhF)z(@_+`Y!%DGUe0`aAJux(mKsyRiklS0$GH)tv=$`|}EXlk`kO
zE+K)QPI_aP6B;_#n^Qb|vPAS|zn-inxOP7CH^Al!cOa5qnsRrIZgr{Zw)2eR5VWY3
z!PO#I%N-zf``w!aik!nZcfrE#cJ-N=(~?r7$-=0@;-)JC8BgE%-FMyZ8~Uz6T<0V<
z13P2<|L*BqXYzXTuLsv%)V=~A$Vj+C-U~)>sm!2NoQz<Oc_g{6SK*S%`hJzuhxKA~
zpF3w&V&o)A`4KLUsouSlkPGi-m+6`N4wP$6fU={c)r7X(D?WserMEJd9PLJ(3oxH$
zl+ex&Aef}+11nCW{0wMbk^4Nkdy0@nSflt!BO+a}e1A&F`Kq^c!IT9hdb19e(Qc60
zm%HD>LlnXbkxbwzg#J&>9IrRN^NiE`AecU3^wCL5j?uQ7hkHd7#Ws>5_5tCb<Wp)_
zsy}AtH_@?c_^@z)-*VUJwS-iY=Bs~T=#dM~{j>Th>Su_Q{a`|$R#ya!0H78Atl`G0
zHkQ|Ka5789X9f$*yV@tWJ9T*PdzsaO*fJDF4xcEDj{gicb#W4?7L{#-QJo(-70vmM
zb#Utb+y%pLAuSgNSmf*Ed!_og3Hfw?XLvQ{TN!f$b~MS3IeszoJ-1e5Kv@XEmOjaS
zznzo_*xRDEdritQcx!EG0uL;~<t6EZVE(+2l|&ec!Ka<SUZ3fILhr0~<m5UdD77=!
z6(*zkj7%Co+q7KyA@om#pB9MRpBv-zk_<tx3ohPD-u`?F#x?k?&CdOXgzYRe%HP!l
zECye`eIY#%R7opibw4r;DFi9E_5;j~7v7Z&s@7-C0!vW;^*%OFUGh0g3y(_40E+;6
zSByV0e+pYki-3rX{#U{_pxnzAdo=TEh9cP#mmj#Fxvvl>I}lWr)n;}7CkA4LRqi$K
zFMCyoJd|^hcO(Mnv(f$qLyg@XTWD9)@!WNaCudDw>rTTfE-uTT@p(O8{-111AP+&A
zC?1%3-Y$6V^rnJg8I7kOh(7gX{#hcuEB_t6wPa_z+`_Hdj7jzr_%g#wzmMluMDE?Z
zBgA0LiZ`USw*KX}cp5%5AQM1hZkZ^-f*nzqJedG`!&iSTKqHj{{#$hlWyVWcvAdT1
zNXY@SM<Ijz(6i@vaff2}&mUjIV!$?tr6jwvgt@RssbOu9j<IA68il+edU>?ll77(8
z>2GEVQ9uc4aO+XqCR<NUrF0?M_j8SB)>z*@373xLh}Etu?VXWvq@(iyQVo~-%L4S#
z=NS-X&*6uzZZyct<oprb)r>AFDnIHVOb$7tV5<)K2;f8lP}$#jQ^p>UHX8M2uIHB>
zYy%Y0WokEvTYkKc!_5PlwpPF*yB{nwY(&8|+>C8$DbcU%JSSvp-R(6-Gm9G{Cq$*6
zbJ}wh`8+I+R*co%iEfoq%H)p8?JBmpq4}mljFo+YW$0(v+x3k|+7QuuHS!otN9;)3
z<qL(8KBuwWo{{Krn9y@dKm#m+ENA^9t_*9w=|Km5oO3ppd|!DKM>4dpL&W<2{o5%Q
zgITAvfhAKx`+7Su+QdP-3)q>!=9-B(hw;<<mtAi2+WcCp_2Y)~wYE89=3xSWftI?J
z0>UF#T0K%Y?7E@xycxPM)w$(cC;2KTBWonpVQX!U3=p^%!BGB(KbMfcVL4Kldr0ru
z6x4OzQLi~ks(LdTz4fG+979^05HK3Y0J<R!n-;FeENBwisIFPrGusLik%D7d=Gd`%
z^Gb$UvuYwYmJs2GLlzG%KeO(rcWt|^16*A5b;Gk?mp(44NdSdzDS`#VS|l){<q^FS
z_!wD<-UTrku6v9+q?#A(<Fc?ek*D4xne+DhPWb4Vs!2rom?ZFPm0;+{bLvdP6Y6o<
zTAH(Bm3~LG4ZAv(1ePnR8}6k`0<fWHd-K5IH?bOr1`8F_Eyl{tshb-Ye}F8#sf<)W
zX2DB}!k;@k&*;@y7Y~4mt+K7byGm`;4CMBr5xJzsJp`+vTaLVw8{|VjMK%&^iqt#e
zEwR%Q3{PEUZ*aMi4Q2Zx8^~=5UT_}kuw3DxbRqKf3eKsj>v;`L=2BvkvvQg&Eyiv>
zf1SxhaNh`AMg<rsTU?w~zko-3@8*i$9oLH9jcCv3jFHdhs6sp-<Ravw^?>~+S9g0>
zyM8h=>}4%065V@;I}cS}(E0u{SS7_H_ZY_Xl|%hj%lFJ0={X<Y-t%|Exrr0`@*s}J
zH3F2B1wswENtx{LYJu*S^s7t3bylOTqQ1MTt`=qTIP!5DjEEwil5`3@b^Vm=FLCF9
z@F_|8gc)IB%Qpx4<dksqAk>+sP)cTx`gynaG_&MEv@zYM-&6~SFu%!2#*J+GwB0sW
z9B|OyK>34NrAlXeZX*;;OsVW$d|z&ddk>($aR5vY^#N_YM6uQ?Q3+A&i>Wn1xbP8K
z9ShhrEWDiI(fe=$I-k%yWsYvo>X0LdVh0Qv3xo6-JZ7hGjXUa+Hv9=DK#^(7!ji)A
ze}S1ts*lA_dMe{HE1@2OPN5JY;<-YHjYzo;Vbef~x8$x)fa7gd)mm(@65(%PB9~@4
zIp}q(0k8O0%$C{hIc7%4L!^hX=*KkU)X?JUs0|xi(SB|AvK?<BEz0;3j>q}f3l{;h
zHxOkjYCtXBNtOw!LR%e&yL5AkB{U5G5)U54?L98mFR>>G?{i>?25F1n8#AJLR?82o
zIWtM2jL2lG*_ujlHmr(bQx+esM^i;HtsDQ4&SnqO;u>n*jHj}{XF52lJ3uMnmm8~+
zGAAE@y(JLNL!xWTLSlM?tX;i1pq2Wt;cavipK7A4jh_NaO9c=4NebVt^TfxQ&7mPd
z0|kAGEh9o2-7+b;cpn>u@9rTH?hfG=#?xdISJU>JCZh(6`Q?Ua(<`d#sFxbaGU>GN
zhyEdzt1sSGYh@j}YU9@qBPWlLF(0F<Vop3`3cr*fK4n4Uj?>gR7-USGiUCwDFNbPv
z{f+v}_~ui3gZIruvEvf7i066!vWkGC--!<@?=)E+yA^=~)x2wRM3?~CDT9=A8qP4S
zd`by5gLuZ&EcrA<NOe}h1W>z9((p8_JJp-e{+Y3XLG-b(O=P7}ZcnKussJaP^)}lo
zpUU3JrhTQKl9lf}zAo`;rPK*@=PsjhAQVOEm`$1O^sG#8$tjI>Kn;E7GqM5dZrT$q
zf6~`UU@Pq(xe+_^MoCU8#CtBumC)0mE)Xxt^-m;y6hnGn$QhLTp#DI|H$ahe%^i1F
zy<6H@-f+L3sObh1M!NH6`=Vmn_si}VFB`=s+xE^ZgvwU`y$mGb{@q3m8pSP+LvBy#
zGkd<M--CmtWa?C)kKBOE>n-lO0xsVrAAM&DJlER$#j6GKtVW*J@88JfxF8JJvMYE2
zI0$uI=>exv7Tz%)|07gP!UOiHdO8&6wEbfjN2)BJ3CX;*i(?-=o|2a+yYg4{2UB-1
zB}SPEeC>;&k+u_dTAIHXZT}YwAc(_y{avtnXJTr8O@w+Ex3>CH9#yAT`;VKB`F;U;
z#lsfV&^b2K8`JJ}tvL+QbSgYf+gEa{As5~!c&o$i=Y#2M^4fvnok+0Ks<AGy!W@?u
z2j&R9GawAD@Fkr~O+5<$L{9;#2wzF)h-E#3vdM(Gop}icFN;T`B%u<X${URZ;H`F|
z3T=|)GRr5+lAbw9n{PR;Y#=DXm_Ie1Qi9Ruav%ieY`60Y)7>HzOgrwG_#5uD&`Y#4
zLwv78Q8b!O_R4OD8{tLQh8w@N`eFK(qoZHk#V$|4=72~|WBuUX(=rr47gCkD$Nkw!
zM!#25`?Cb|_2CTM#822vHP%^U$mJs_y)*R&^0u)m@XUC4s>u%M!Zz+;dW4$92Cx``
z7eYqD6uo@Mzr<*&IVyklkhgw^rXbjhC8uKoR5v<Gp*i!lGFg~eyK8p{cdDB~Y<bh!
z%XRi0oW88+mxf$~V7L43C0>BCqnkZpIyLL<Zhs~a7gbl@ShF3cZ+(><oEOv+IY%XA
zri3C;jrlcj(-EH&7IT0O=)vUAm_xx2#>DN&q)Y2Ng=G@J*Uxwi3y!u-L-*bAc+S;x
zIA<X%Z(rG0Hr-v55+%3VTy#Rq)F{5`i=$EmPAe}@pn&z3Z(tCGT$qh?&=F~C4cP&!
zI{=@nudIHn-J!)@yi$*Q<RoR`(q;!^X#_vuyJdVRHn(QP=a=wG3w`8y)>_3P;q#*3
zWbAiEX@Z0mwg1MLZ<g0Z)b*)i6R;H-tIq@kt7|sjj-nsEU0A&Kk@0)lglixh(8FhU
zzy_D1;HqQEOj!?(`c{aV6QikX)Q6c#o-=aB#(<B;{h7OpR=S`O!PMs15V0`$c7!R7
zM|_$nI8lxl^EdYqC-nZ8FP1EJ83y%+$HNED9XV(mG(3YOD{kkGUuA}F*OcY<YyN_L
z!@<F^E@vEmcUq=D8m6P6Gk`)0<?fp|fkPy0o99z51agmeCHA;LUB!KwcP#uJ12P6%
zfhqeum6nH$&S3$}kNMm=Nib!L8_5BPvB&&JMEMOOlG}xli1S4T3`%(RZiBPWzSx38
zk8IR|8t6Ku?zQ=fANa~E$*bK6U_;6W(&3gGnN}1JsR0fc$W$b$ZHl0K0(nS!X(Er+
zRz@)zMNx1cq89TBle`oih$hPK8~}TPBPn<!cS1gZkt_iCSk^pnx?FBN8`|{1=l4`h
zi-g8!dkPEax_sP>&YR|$wl_ZaOKJ)*iIMY?N{b{{6EHwm+thgbf#~Xf1Rs>#YVvAj
zG!&9S3<gx()5%OK1YZ0wf&ce$bRP8OQ^_>#V0J{PJIT$jvMy!lrthyt5g7mf4yFy7
z)&M4QZ&m25pno=HSBUW+{1Iy{G7NCN4G=x=1vXtwV2tun;fC=eJE-X8qsBQOQBr^$
z0NaBOHVfJ_|0w_8Cd)vm>nad>=|xbt^du|(Fc8C{ktR7tL|}gV*JB!|UMycpWu$Lo
zCt0qT=T}aqUTvq4oyKBOdulS>A1$}J!B|yA;>}7%Kb1?0E7Q@TF=RHR7uzD^*u$&d
zEsLaK0yFq?6j)DAbGP>dx`SVV{6=VA#Mk5{8+=qi-6h*NwfZo<<g_<0F{+InlpIr9
z8tlr`82voU!>`pi$y8GGC|Qp*UMmzmYrEn*nT$%U6wOTjh+s}eF0K0<l}}tBH!!8Z
zB~^xhW%q?%;!+pxSN~2F4lEVIKdjI6c%<u+mvaE<MmV|q+9vrQf@BRc2@2Z3sRfk3
z?=JzCFg58`%kW~AmIQW8M3&l;NO_3MiGN(r*+U_EuCy%>StOzVXa$uJIoL+0Ya{9l
zgH3Lg2<sJz&|t)E*0w*CnyLcS_CZE55`t2o2i)`}%b*4^xt=7TPR;_QRBY00VE1-N
zfYu_}WjyuHvlhx)T6TAd8|^Fyz)K;DXCZv(WVk%clo}m4xs<_i;cO8e#A4iUq<^GF
zcUErWrzWs<q(;Bx-Ef;!lozjGP=CftORo0OmDD+cKiNS{N~qc+O;Z^4g@IO3A)#}5
zygl}pv~JMXp$nI80dvSjx8_oary^GN-TZg%YPPm^*?7O;2Me_=vt`~<mR?B)L(Lg)
z+z#*e__XZb1t2y=$tsbv)yMPQQii}yc>$H0ny^YfqA?kLw)jYLl67Uho#aBrshoVm
zihUmOF2K+JkfWl~YD1eUGS$i708Y|FAx^~&B4wvE7L;Vbk4iQfFtV2^QAk3^u{Q}(
za&`AJlUO-0dH62)WIhp<wy+<>`|~Fii6JdbOs%Hy&pYQ5*ekz5{iYD&=gApok(LNd
z9%g1tJZ3r+8af(f!nA0#*dL;vTIL}5DnCstPHirYmTwQ^;q96SUly6YkfNfxx}Lm`
zOKZ?wg&v_1*YPO+#>+Pjq;`kwhQ9St^8!NMl7e}z9)3aRY7W(cRiL})d9ZDQ)YG*C
zn`5F$N2_7GKye*{X(=AYw2xF&KGHYc4tPkUS|of^0{s@7huMIR^}LCZ<OM!DvkcvP
zcN(k@I}{T+(Q(Pf`ro?)ZBU2HzvF2H<#2c!$PMR7?KfrU4Or0ze@y7@{4~W94Xjq6
zI*EEy{`2lG3Ww|JqmuRo0yBE{aE@t36~g)b$z5peXSJY*WpDy4et0#NE`?h25{Gt$
z_Y(IvK#C)V;mwD{bF?dyGZ@hJaMdhs@QxuZ=ejlq@Rs1g5qsy)y9O%lRT(gy<At%T
zrt4=KEIZkh1Wa7{SUK{7waa;CxXc_O>K|3N17wbKk3Q-zlmsW1i=mFBGqHM4rhwZZ
zfx=-czW`m=b-SflK#lbaWm7n%24d_kE(QpKgyHse2gjF%lK9*aQo3UE##G66FmBe}
z*B(U@LM>Qe<ehH7?RYz7zx`AHUUCg$XLqlQxrn>ub9s>^Xv;&hAfWMRApTGyFkD`i
zT^OAVquddRIx34?`QoD)u7;(RM=dBaqdh14zS~IAb=YH$z)u{u$7Rs6!IkMdi*wyg
z<I?iDT(GtUi^1D?H@9DHS^PJW^#{ww1WRIjlfVV$H;I==V8iF<TdQ}?-hLS(M?=l;
z9FCg~hBAD{OEcWZGdwozPP#@q-;&SYYx?aEu)oK!TXI&F)F4i?w^BRoJX7Uj`QnKR
zf24LZf1XD+Lon@ImaYovsttv$?=+tW1527IxZd3j<gXw+>j8+Ku|q3?t-URyzcL=M
zpqFt43nZdt^-kK0&W65>m=hEFSE00VZIhSLlAytvqdNANgpVcj^4QzB0N2MG!6c03
zUu8p$PPq=5&Z@qM#KzMDeK*NWP`8B>NM;S=_GEshw~H)6eTfo|OV%DLPmB0mgtVb*
zCKAx6_c_MyF*v3ccEkC2pHg+|G2K0+Frq?vu$~PhN;jxJ{j&8uAo$A_9{l~>$|hr*
zGIg;`g>V*d0JSy-#ZKT=O#e?5j>QUNe&>FDt5ob<wmht0c8n-=ow|Mk2RuhLPsg(x
zpYO@}2hR0`qaA{tL8X;<<60?0dr=R<j(yVNAM2liy=mp=lc@5rPkC#H=eYaUdAQfn
zbiJ!x7Zqi%2Q*YO`f97K@-7eRx9-o>7AChXjC5OBMqDY`bGXyI%Uxw=1{g$Fvhpj0
z$x_MuQwRldDsC+J9&s_iESPjyG<wV32Z}&k<G^eqKk14H2DIG7{KBT#pPo1Mxq5^{
zIw7I>z}JbseWe)-ofe<@^e5litzH<-GBzGsB_FPitRkMm;ci9ZHY`JpFO3?Mr)fL0
zHqgL90y)&V&z?^7)K=RtW-{jEd}x&M#S(30o^-QWZG`a(Zw#e}7ImK;J`=^5BS!Se
zas+U}Q>TCzXKUkv2es%tB-_2Hvv-sGP#?5%cWnZ<P4y-vo)pV&%XUQy8L_;c0@e_^
zpPd{LOl|Uss&oy7et@l>(=XD|7oROpkQu$078!U!;F`-jP!JzhS|JX6F&e!ce`q&;
z!P4@B3SEih2DKdU9m~>^5tL9KH#azx!^#2twd~Y0+>Og^vkwCf1l4^E8<dQ{DWC=5
zp!6TPJFT4L^6f;D>j7TI<=?h{*F@DP<bc={>u^ub@Dhp`;D3*6eJ;mkvU?%n=SmJI
z%pnSrD3(=xvM!0mYA1OcG8cn@J)8jIM_$8>HGST@4niCBf%t9jfLSPT>+I2o=xm$g
zCo?#6$%YD<H#!sD$g91Pc&zH1(iw+)0EHL6<4I@LVf$V5<@iT8bc6Hh>qG>0M6Y2T
z-rYmG*YbC=h+8*$KO+&1MMv@uC{yMeut)vvp(M5hwgr|9Ai=X43%s%Y+Ru>#-Xo|{
zQh%>TJI%o;B{ED~tUymvt3H*L&2rCh8U@n9;&(S`?ISf)%DN6K88_@DU(4w{ql7Dm
zr3Fvly-e}-L@C#_=e$dPnwK=S<ZKAJcm+MNIBwrmt&?2mRtOSZz0R}1Zw&FF_ls4<
z`sA9PfYx32`RwSf36n!?Dv}|idl-0fHf%ONPEj0>V~XFU|2W4D<a|<OguwJxZFp(1
z6O7|PE*&vv7>F^$FxQPXd!+iOs|0fFZ>jwv&302W#4^n<E{6YRuy^cOR6LHQiIhaT
z04RVynE+vs+|UIjW1X9#*g<SAb$tP@tKSjFDLD2xkRy@;yFN)<$VS51=_>?TfClj!
z(s?0qazB#2camydPA&S7MzzHL{GIIiv%C6mj>lE@#zWkP*iZSgb9ri2t{%F94hA>T
z$Q&C>93^Dm*Nl9LOpcy_Cla!uX}hmelJxV&$$Om-AAHUczH2q6up=43a1~yryROOe
z=kqDxhvRv^sM|wRW0w34c&YxZ@z5Am2cUIK-Ku*1EZVW90@mv<e~?}JFSpYMFw$Qi
z_nr%CwD{h}Ecl{VWYdbPo|u@wXxY;WvtU_a09M&)XO(F|{-rWEQ0qyVrfLI1RP5?k
z;uw((63}++Y|;yuR0-Sb4|QfQ_;|<6ZsYNY5KL)4JC^qCdqxHq39t|u<sB7x9JEHl
z0~^8}sKMo^7=|x?=+?g^TrBr~V`W8RkHaC)$3-ygfQY|{0uE#+KhRBi^RgHspT}~J
z0g^q6!#;k-0}npz2+-`BJw;**x0q(DA`G;0(m$Y3DCgXm?eCaT!*01bA+NjTNEyg{
ze*`}Z6gn}{zM5y&Wg3gj2&GJ*(vHE$5$JOMbfWFwrDzYiB{<a}?I!;~deB1#`w`5M
zgKOT{vqhdrYF62>zM5u5^oF1jPmhAsmP8`Zm2_7s>vNW48r@&eU8ua|%0^!C(&u5l
zi49L*4gEIrTIaWe4pk^4)f@lQa;uN={{W&eywQ;$k)i*Jg30jOnEPzyMK_TEHnwy!
z7T@dj(;nqA%CAc%^*cigIL-m+-;2&XD?*&GFFW{dcwtAwy0kYUIUE6?*%&(p!yYuc
zQG9$l;L<1R*i0#oyQg<7yBL^V0wXWR7HM51uP4&W;CPYcY&Wki2EY8l1v`<KeF&o~
z!5b4N(0k>_OTYPc(k2c+7C=A2u*3Mu@ZAjs$rfuSCHPGTZx-1dwi=<vFML9eAa0B@
zQZFF%g=O=xlb=#~pbD4;q!a{0k^UK7IV{t%EKDi#NBc7js+!Ljn@fA@%0Z>mfOHTf
zH=rD;@I5Ne?LGCJ!7LJTvBX-*Dff}JO9uX`P-)!76H5zCdNVeP=lo`MoN<OUj}(#)
z(w*u(tq|D8#04t2bZ~-%M71NUL-mg>dO{^4H<%1f#y_D_T)lJvRb?fS-(}Cm%_;a)
zrI-GbGL7~-kM_T~F2e%5HHs1}9vq6HW+9s$?Z@?kkXvR71{5qFB?b)R!lS#u@`^^!
zh5Q{relDx{ebS7QOmS`rrhw3*^Vdkp1o<r{-EXSinWQJjPJeh$?o_7R&R+TnUXv7%
zyuFtK2Rbnprp<~hWA679xX!PHLKjv-VXOEVuw{IoQ~5?s!Rdc`FZ<+vudobMuB{@X
z<%Q|W?{40aIx{cRtF#leC_27dE%QeqoY?wOzRF7z*J1I#iTZy!fm<GPma{y?G0Q}A
z-)wCvLEuln1LxxUWORSIcu-wLGN@cw9I#Fg-`8&6Tcaj|_WPL)NW!OH$PrG4?Bw<c
z02(dO7<dT(Fn!|}SIj+R4CG(vTw)@H*Hs5PtZ#5TqHd#>k2n&3{KYO$rZH|K!!Z>6
z#V7(FkWH5?m+8;wConl!0Gz3qh9qtdTb<x4XSMH1sa4dHm=*)_1S!v0>$gK!$BWPR
za{Yhq*#M^HpZGt8=acXT!XGY{DExwV+KrUyFW<tevj^8jrDTy8DVcu4@gkmNy|^_h
zg8;-h@{aph8)-AHI@tm|Fhbi84>oqu479aGVPk0f<4}bwWwh&DFUW5KKp$=efVrQ-
zZEr{NV_9gBa9<?bWM7{vdG@vizx*Zn!pb!R24Ft`Yq|r)oM^zAXkg@C8zb2rM6@KM
z>_FEx7iPz8+AoOPS_4V7ldM6dXbwjr;I`wp7Fs1eTdBQ|J=~5-hU-DJl3V!RcW)2j
zx8&^>{nSG8St@SJ-|yx<tjA`$y?KUtk7*CZR&P&l;2DbZ7>7;$KFa_fiFFD0Wm#ki
zy)t%(jhue1vBj~DxUT?UznBXa-jh$X;&LnN>%2(q%_F_P%!1N^+Cwoi37rQb+mvMd
z=!tmT1f>8jU|AzYlLQmw@q?%TTDClx%zw73wu^TJx4ey?p=m%pa9a9n7sUX;5(zor
zaK{CAfR=SOSrqhs_7oHPJb`q0ABU;Xe;Tj$R3GC&RExunNzo;(%?a~%I(U9!jz#P^
z4M{tj)1I|5bW5fFW_0Ipi_{EpoaG7CX1fj8kp(4(UvYFop7j3$?Z>@6?0K53u+Hr?
zLKXf{<N38i!eddDjiCqpiC38uWdz9!(rKg6!G|Li2gLrN^`4X;ZhCS2Le7u|tVmU$
zs-+%VqJn<F^|zxrq<22twn`OFX-rRvGu*X&L*awpR>cQMLv|Z+o`D|Fu<)bIj+QbE
zrooS1VR70|3<!}<)DV`kvEX}bgH9oDL}_d!GWsZin_EE`w{pe{pbVt+8$|Yp(W3n~
zfCGWpi(Kop-XA0a`X8+vNSZ8fM*y{ts55l)rNdMJ*BNS{-v@ey$3H8Ke10j9-S{Y}
zcH+~61d*4rsOZi4u&<mC;-vTeVs`hB)V0A$z>>7&l<Ol&-wEI)E1(3m;#m1>KIsbW
z-pN_QaTzs${}wR*SNna6<G1mI{D~DR*(f?E!~Q~MtVt^Vg*c4d-X3eL?`SFEmsxaF
zL5&w4Prz<KcmyHhmne#6g!d;Ra0qQcik<lQAVL2z2t$GP@_BXN@{3lR9zeUVVA;Ks
zh$`**QTnvx7(oNIndJ}PWp3IdkS!J9@|AXwPPztatYdO(Kh62fYi@{K9nre&o{<A2
zIf?czH?~^Hl(zQtD2H`+Rrh-I%Z~AWpwibGdR+(;M-lPksL!Mf!N$hhfUh-G*eS33
z)8reOOB?at=d*jE0XFHi&}JA>D`o}ctVt_o1mw#$BkOMh0*x>c$6jT`P3R>4W&q9A
zPdb^VU#6vI#;}|Wu6}H^df3try`W2wl!LwAvwsmEt)hJy0l=l}%H<U=RpRy}g&Mjj
z0>1op*Uz}Pz)#>j3~g$IGmPX<-hA&4de7_V82uT!D(ki;*C0ANyx)PEVeXj{?~0#w
zZ-3P?eTVb1%LUp|Prv#nQmFDvNAA}O&gwA6gfa%GwZ|Wfx{;p%0{`<6swmfa*CKsu
z$KmyEK=PXfK=eT=p58bK8SE>>)b4^%^>|>`fQ@Q7V<YNd)eg2Iz`byc<K4Ap)@b4z
zTq&ps7>a0d`KSpgTex0uoH9Y>YHm)?C+l?LyZEC>WVuqRAey*%%x^d_Pws=3oW;!a
z`6u}+Yx0#QV2BKJ5Cqw;ME8%}p|fWCE}gtuL1zh|r2h^3$~t{pcYWAT%1~Fc77gO~
zn8H9Q<(Np<w#Fe@J(z^G5r0o3vX=)I47bP;6Ox=&%`KaYl4|LkJp@W^y?*>6S$T`&
zVxk)~2y83yK>@dA#k#eZ%FbDvRekxE^*)QpJJK%k0aZu+(I{=^{P#J~M(_sGXLm4L
zzxKP^z!kINMUVG;^s&g>KyF{cdD}h15MD`+0Rl|yu+L-{t!z>#ns#&eI=2A>1&!uR
zD6IB+VKVi>&a_17_?m9PPSt+9KesO&FZBZpW({25aSaHg#>hYj4Q*A4r;#n7Z5)Z7
zJyc&Sq2I!`swLXDFK*&4a(*Ky*aIU)9VGJ$8Y<qQM@@H?>^nmG4kqF(idu}*Tv`G%
zQWi=MntVtO_x6He7=FNxSwCe(tIGw|##GwG6%5Lb;_@hC{uML>aY+(Ee4f+?Bi$wv
z)m*kd&M?w>4^5_T;S~MDovPol4&<p)@JNMCYrTv@b_7mx?nv2MPdIY3J$2-g5>!2Y
zz>@%EbHD6Z=A7??8zLl(B+eijKEQ5SYErz75xZl}x1w)qjXoXMY`bl@4;=mkDEs5)
zR(ACa1bIDevvaw1gkmq}3Yg|fu*c?rt)$T%fpI3rT)UdNue-4so(Cz@S}fIHhu6x`
z*kg#YkZ<;#Kbs+kLL#`a#eUkHaNQ_uwK_TZGWk24GLoFg)ED6<#z0#%1aD)Ky01>s
z(Iw41`s2VwEp^SgOF2UW_LI!jRt-na8QY~1a7?f_6`cZ4m0jwWSB4xD<eoePH;sfB
zPxX$Q#0ZhN_>#3MmV1sM9A&O)9RukfL9sh)tD@g~3$6v`E%%(6y)D`0-*a|OLNBUy
zX<N@(s@p*v3L)#mG9GOYyu)x}LNi_Gr}I~iEoy=oGMu!VIa{VIg7de%BdR(Eb-Y%(
zuA_o5PH%5_-E#_xG4s(WZ;nCp7FRncfFkr`k`KtxyVf#04QKlwM2|XL$=0IbBH*2-
zDzeoUK-lLjbSQ5aNgl37D4N{%Lgl#?(b$r@rPb|G$lUzw=kA^7D5+#~vyOA9JdPal
zk(k1%zXCaxr=;~oIM3)ExD&d^n6@>uq#BWl_&jEi2-C9<Pe)_c1*cENV22EF%-o91
zjO#BE_HHQF1_IN+&lHuyA=6HIrM-(Xq!J@O88?}TTm+I`lgS8gfDfJCTEuRKazP6J
z@@H5o_92dQ^_x{6kmMhmSwIMP8HG@TUmmx|KX~e5E~!b0z<qv`Y*!U3Bn)l^Z+u0%
z=`WsDVzAS0i}IP45AOJHtACgluBMes_7hycUjNb7_bc&1pRwwaI!Hw}0RDl`9baaK
z@AEU*Yz;ZwA+!7UfoLBNQgr{prgu0%RxM!EFbA8dY9!yYwl$#i9|SdnsCQhAM7kmE
z<bOsm*9=24N!FG)pAMMgyaXltTbE~7vUSWv_=gwYI3Zz203_eU?}F~nFa0oC64I(E
zy1E`-wMKg+z~{fT9C9{vt)x~9%fA{eIUZ*|t|N~tigk)@N4XD;%ho&pe(zA|%eh-R
z@*I}^4>ndl!hgc-`04ClY%H>Dy9PUe|5<NYlJAgdUBuMg1K`(X%-Q|1q3<345ba-s
z{xc)+i!bwNw%zU4y^cjs2n|8gkf-GT%VS#nhsSh8PM`WKqdYnRXlwXjUgoNzi)s$0
z;+XzNye1an#XY7rM{SSRXD%+CrwrwswaL#p?4RDZl6(H>6k+><M9Wktf12l0E<#iL
z-7XX3X!QEifv{YF?a4rOIaB)ZUK28|_jWRLGQ`hMTH<h|7VU>0U|k-xAN}tfXGj@H
z?#&{8WD*A*VH<x$?b23HydfeZA_gQ<**g=@Zk=^LiFiebBDWUNew~r^7E#0zKr#Mw
zm@yfR>ez##iuUyO?9{a^CUJ(~zIYB`o=wS7Xp3Fp8}KbReP$*fjb@jSTiUdL(q_fb
ziHHtGWKn^&zx}zSYBk32hI(wwFMvRlfY$DL_W20Yh>_0-jUQE}B2QX|q<k9x4~)x&
zf30jWlR$i}Jp2V_2|&TZuhlvI7R=B89B%wR3GR-@P>k#S3{C@15$9zv>HcsNf9sSm
zRID#35N!EhbN)v_1QK4}j069i8mp)-R+&N!CKAB~gH0IW*QCr)`J)0$2Mx*Js~-Pr
zpbI)aUHQ?SMP@uQ+Jp`(=sSSPSon-{%5Oz!CJ<3*ghbNZ_SsJh@B@Xo4ZD2uq9U?D
z2{RxzGL!N;2*&r8u=yV<)FrMmmMwD+yR(=WL2gkkCbz8<07V(cnDmEHZqA00lv%6m
ztOXb|otdh$LR>IF@F`n>*yh37<uWholeAsj8zT3q8yrUV@nP!jawNS8$@iB2@u88h
zQIQ>?Jusk+C_A#5ic+DcoJPl~{R@I@2tR!wG21)4^g*&#{@&grspSkWNvbZ5&0({?
zFy!_uM8|pIg^o-K`{~SlhPwU!CH1D$8o|6MfWD4&`2Uv)nRPVE2WU45B+#v=s{iwX
zX&1NFoZv|<FWp}mQm=H>W?u4m@TS$JNM6n%`H%lF`@*WN$yXsHOg3fGb^ZTesrp>z
z{WhyDOMm0Wf0%&L1J>lff6}^ag3kQ^83##Z!?nf5{erv(`OBIoDU*&!`dbS8mF~<f
zYJ&WG0J^{b3xHG<SyFew|C!8R?>V9T;r<cToM`$HqkzDT^hu2pKk`|?Yx#F_zh%Gy
F{||<C%BBDS

literal 0
HcmV?d00001

diff --git a/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/renew_server_certificate.png b/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/renew_server_certificate.png
new file mode 100644
index 0000000000000000000000000000000000000000..e26270f2a30c85e0f874ade9a8e9500a804a4d18
GIT binary patch
literal 13201
zcmeHucT|&E*Dul(0TGcVRk~6V2pt3!1eGR=K&U~Qbm<^X1Yr<CK_P%ZKonGZ=solj
zAWDZ&q=X(yfItZ42506SXTJM>^Y>lru60&c@+9Y+eRey0|MpJQJzY)uvzN}2k&)5g
zxvhSmjEo|Q^d5GGn)I3~=tKIzOLj;7hJoKHY}#QV*I?DuVWB{a(M{nCkKMe!wMJN5
zTXMXT+=Kk)a*9!;OjmnOT_Xl?dXVx}G*|K?zM2u^i<OM>ieDve+%}#OQ8ji@`}D!Y
zqq5jFV30b~RLfz}o1gWe<3P^Sp%j@FTRVJu-R^41l#1#q$kWcQ?i$K|$YiQ)s5_51
zzpwCRKOg2qqv}jX0sP0vpfhmL^bJfyUqO>Io^K?hL;QWnQ+Ih;`{iXJ4%#YQ6Wqp|
z7&!j%3k0GYw2^Om`h6o^f(UU?E2@~jJoFUXvtLK3!jgPgRA}WL2pRQ1#<J8i#Og+T
zR<*{QqO1Jhr=4PhP?xM+dc>Rg;cv^4mJWSN2Mp_^6XN6e=Yp54$U<pu$2@EKO}CDb
zYc)LW*A26iLu1K33+is{SyB9RuV<%hGv3Q<K=?ketN)MfOz3!lr#`WWyt*yPNA-6u
zev3IpDMZc`O7r)}WE3&LX9&uV8rPR);~V`oYJQ~y0@-K34&ehbCjC<&-_B5+(Z23T
zDWH*+9U^^}XV&@`IzwGaWH2V3(f;MxPd+~mC(*zwLw>&^j;<Fp_IC>VQDh|Yq7dP~
zisXcc8f@1g<oEe`B`?VwX6f&-@ihM;d@pM<(j0Y2(=X3XM1P(CgcV;H-&DugJW2m9
z@i$VEf~n7w$fFecryfZ+k!W~x=~UGB&r3WpP3?PZzsN0vgLLK-9{%#|r=t8R%K;aG
zu&q}<e^XDyHs~3NJU*b+KXfXCkwn9@fit&XY3Lk3zNpgH{wt3sNN4`v`2NwApZ!5d
zaPZrM)(1J5#08Z&)5MTgH*uGZap5++=hk~j@;=>PbZT^yk$bkBOL{sj!;hDl@eseo
z?7*yEyZ?+BWvleZzCaE-=aF(vp=nm!9$_fQ_I|KceZT}yCSqKq2JMTSJQa)%I1kXm
zo}Tk?Dl~J#LY?x1Jj%*URh-@8>#ntY&vn=IKb*wN5{k++3sP`nQkG8QU5)|KV)+iq
za$TKxYmfY$q`;()N>h_!>!mDV%4_eSZ=Ez8nl1Y5<~``_Twp}XP=(B0J;3gz;a-h)
zM%7t+lJs5aw4YZFC`VxKxf9SjQ(Q#YJgD2ZkjT%Jq=}yDY)O9!I|?>J?{)>ooEyx<
z^J^Fc4^`{+mR58*VX-(Xty?ISs`2^&UJAV9#<XPvuUiWIi_SxJCx4e@Ba;9rQ&j<b
z$C3Ps+DTzpId|Od+099Qw{m=E*^uwtEWQmf^t5i?{dHb>g}wi{Kn?Bm`#i{coUaKH
zQ-Z(w=C$1ntkt%7J#e!ukl;IvOKxF3TGR8Gogem?eLakM!PrxTZ*vCK3+t?&`NQm-
zNLudcchmb3)%+cP37<}-Dl(6oB9jGP7h$`DNik?4s3{TS7~py1mCD4Vm>$E!Z+SaC
zJ{76XU!F{nD3t4rh=;p8c1zeDqop#XvyfB~8NN%EJ$Btb*V>fRWyRSenK!18L)p?Q
z&~(n4(oW(`0848F;p+K!!!|pwEs-&RV7FOfk5O=goBJ2{V8Qimt|Oxu22N?DWd|Q|
zgyj#Fp(c5!D1?~T!H_QG>&7U6N0{9Hd`7#>DjpwZSG6=aH1s@!!zX>W+;>-iE&tfJ
z!_#S*RcQo4XBUD5dq+s67SmBV=6Ftfr|pISj9mGEkwJwQRJjy?T4AUI<Ye`{^GN|1
z$CY9U)rvqLNz*ldSYC=C^l5D`T{d&lj{5Kf&MW{Ln9_dCMJTP4NfxZrQ*pwAp6@K-
zbwl#O1vL)}Qfw=BFLo&nmzUTNn}i6ijeeiNV&RT<oMmGBW{bN1;up*Y9hgNUYA`w=
zG@6+ABQPL0aOA19sY)&q%oD#m=BrtfYIy!@og6ZNP!^5TC0Y=GfUvEHs~j9d803D|
z7JN}W>X2ow4DV{~%TcfhrN@eY(0X<V%IS&*G$UOwV%@N{8s*W5>{zasJ{49<v^kbh
z62dY_O}AiiqhM<)i~5h-c0~i*&|wS`P=Fq7d>;}&czp1%cFq80&zEPoXW8}$?xWJ}
zjPb7epk?6}EO^{29@29(4AzK2zPn`)=yA7fdy?!7PHDBiDiP!-Y@>x7v5F|^QsvA6
z{pmjYTTdKk@|g(w87eLN5v+F&rsuYw%Y_=R@>qmdlP*=Ognwb(9Ul$%s_hBfeP+N~
zGU7CRfwI}lU>gg~&DWfBT(JUoChl>|xK{^G08l~>&Tgs#!zKY+tP`uf_8dHK<Vx%X
z^6v$xPj)u@+(ly0F6IjBP&I!)--4$~Q$DDhUtPTXakBm><y>}E(31L0PJSH@?8*~l
zhjaBWuX{Kti3(B?$|b}vyfC|6Q-mjU$KXmC!<JvSjtAovzH=qlsfAYYuG^xXv;~i{
zDr<eQy=S$GEPABA?n@rv7B@Ur1828bm=dqbUmnZ+>b@)je0Y%>C0M_Kbn?)Gf80(3
z90}xJrH*;ljgNWLXPb3&9GG3?;|Bo77<+1&Jmfu^-yI|XKS-wQbocjCT1Wt)A%fql
zGHO3L9O0_X+)=L7!;|pTZirz5V<`BuUT)=_pZ7$hOA-Ca{h%#-;`Z$_)ogBQDrOn%
zgotdc_H4lYBMSX$^WY;B^{Pw~5=V772d5fi{l~NK-JmFy-imcOkbN$J)-iAKfg}@3
zcFZr`Wkvf(7W_h#GSMU1NnBXjdq{5!u9N;-!2`)p?Gs}53#BvgYA5p%#e@jtaBl~T
zC$<J7v(;t}wUpz9SiX6HfAmRki|>=4#y1RrB}vv2KN994b+v)1(*mOM-6AiL{Xx=e
zEH>u*t6Z2Q-o2+RKjx*D%?i3P;mU;1#Uu^+RzQPflW0<LKl^nM2OEuqYQKa1_5tW+
zUAV75EmfwHA-f*m+V<1Bp&qg2W2-<Cf9R%VBzpXa0afwQ>&6hndHNIPJm4lY=pMGq
zJRv{vXm3du3sWd~@%)Yuu-|@1wu_y=Wtm1hU~8NoRpv{nb^l?9{|zsx_oqZ(YKZP{
z$CSx(i{39N&sABjpZE<NQfFv^AF=mmtI_t7xnNWtuQV_uSEtxGES_KVXjKz3Hj4c4
zV~lqTYd$Yt>N-ENpSzDOX=Y4%*aQ&s9js?sxy=8NyriD%>(v=!X#%);vGQ!8vqIk4
z!h3m`VX7H1)ok*Ix02G4cDw<!g@j@N#vSQtKAx~C%?CvG50vt68eayAZbcx(267&n
zdDMOl{vq#t5<DP2f{F~uw>lT}IvUsU$2~pYdV7Mh=K^rV)8{&&-`9ya%S-!|UEvM4
zhI&MN(959L99x1=4xDXTrr&2v{q73ZIqjqIjNUy3$-XN*u0nZtKUQwbbvbF|?Yk+C
zfpvl`zFSzg8t0UbcUx4Hnx#~GmxR=b#bNQvHX;a_1_?{6YOCafo#~!|W4dh72VAOv
zjyqcidBmYFC2nlxUFkd6^NFJ4zR&YlhG^s_=9{jb|M-dgfj#Z9fYCPeT7yI42>!eZ
zt9RoC@Y~_9ft7*Ok0eq)<tc<Ygxkd1aq8{R+1av(DSyJB3u+49RB06&q5SFhAtr2W
z^@xM|T3jb9?zFi(eoFN%ET};>j(x1gEwqa8EHEy*(;kz{&w8u(&}DjefnPN)q`Qz9
zdNAB`*yGXr8)BdWVd4(4=b8u>;eMJA9G7|+(_F`EAIa%5B_5y^B5`yzZl-r-6?Qf;
z=n-_VdO_;2?;)}6p}B@>!cf~P6aPd%?pw8#-{ln)p|-W%3%n5wcA0vhKVRdiZ(09w
zuw5yYz56M7zp5(XvzhFa;shV6Ob)7?V`_`q_xTOGfP|e*TMS`#B6t`dn^{Xo4_ie!
zOHjU*%fnw(VX{>eO<E9S`uu70-5G8EJ#B?mQ065lQ*GR1ZFP^!I@e%melta9du5#?
zDSeX^IZ7c=l3=dt*EOA3;?uLH5L!|!;_wJkNe(&>EkO0<bkMm>Rv^p{k`JoX?<GcQ
zhpc`WH&ch$xk-A1^ft@yLh#32T5?YQFak^Vp@j9$g?kK|3AbrP#f2@7@A}xIeA-}l
zil5JW9GTg($&MGkO>79R@Q-^FytOqs=dT_T1Bm4IoH~<lvbNG3qXF3$gadpR?<E4<
z@JHrd&4!~St$#%HC#pY(hmp-xL&|;5_<Y4Nv|q~|AvgU!_0guFXl71opPM?!QQf~m
zxNcKlonMjM{cR|Sw)=E!=kXD%Ti5Z@lCR;>0tHA2=v%QvpFg3ZKZ6Q+YzOovWJxrS
zOF&KWpo^LPU3l2z^>>5#`6l1X3uvWoG(^<}t@m;Sdho8H#ZC>~BjWhNK=A%dSC>R|
z&}|i20CE#)>%yHzCT`kWE$N4JsVfbvdT6kOHfZ37qTj>8-{dX#o3aM+iQU}09q$uR
z=@En{00MYL5YF*&Ur=?|25{ShPr4ivD3m^{H)?Ql+S+{U8a~cQQO=dI3exrW+P{^1
zgyMI#?PF()MU;Y|A;&zE@vSbld|Ny=pV}8B)s%L{fjgsJE~<%z=ThH<eBDtJ8m`z8
zmI$d?s*x(zvQe`hMq75M92UO`G5HWs`9k~plJjR`c&nj8|D<ipr<V-JcNlh)<AZR?
zV7o7{)e+bF{6%Puqb=#IeJ{J}M>HGIi<WD%h3>E`G+R4%#7r?uQ`?ec@7(u^uYG$1
zq4#gu?Twx@WjW4ArV-Glhq%6pQD2Qgl{I4eq{@UH5DT|F3`7RuQfStv-k^^`NhT7)
zDLk|)JS8CbTjs50IU*qrgpI^FIu*|`fqb&>H*67f18M@tpNbqG=$I=RNcti@VYkg0
zTfEgSWTAqZ`o0I2tK>0_6jr+_oZ~nN?15Eu(g5JBZSk@3`Q(sy$m4xtpHuZ^YYLj~
z^u$hlgR)N>rQNX{;yzIYEHmZcg>>afKw|S}pt}2&&{y&vfS04fMlnG1Gj<d!FID79
z3=g&EBJhR;`L5v)$>!UHukRC44KMt%IHlaWgT#z|YK;oYx#JUjj9EBb>+41XiT7dc
z1~>9x;HvRSmLO!wdxXK|Jv%Mc?=wwqadlvOUts7Lf3r8kW6|^e`W(mH*1`?SirN8%
z?7ZLfz8O!mtL6lVux?(x?R&d&yF8Yw=`P>+adeI@KQOXru8dW(K;;a{hnWC2RJH%m
zdIpNRvvs}0?K6FKg)<F@L}#Hb)gv{_nfv{8$!d_^PPt)Jr{dv*9a{RfqwVpcJvf79
zuiFKFspL+xfXu_+v!@A|U<6iW#LiH9nG<oI?j)f@_yNCxfp}c1O;zQqTXulW*5QcS
zlPuTk>Z0-Al1~Ji)VEiNRWS*-gMM!?)*9@bBu8oI4v%N=maNUZd2f{GwZ8PhGoHT^
zZ3vd_%q_DJqInDExO#FIJ_1y|%+w8$3hR8#Jag%<ERHmz?M>*tmYw<r*_r!WFAz4=
zpy#}l&kxHu;+lp=e*I+z6GdJ0-CgIou_!G{JAE@;JWP@^f5|J$J@)0VIW2^RZBY+W
zkY9O{q9)g=-}^PUMj$AG-)azM0q!Rm_Wfk->$Xy~{2uS(;z)_vpIQ21_w{x1t@s1{
z{P2v5>ID~$r<r=-^qZ=<cpg!C|7fufwA1u|gB+||uO}z11m@j@oYOaR3_hRK3MOUM
z33t4#!{um*X_`Yt4EVp0nb2tx-?gh*_ruXrp@en~m0NvR0GY?9QyK#oWe8hU4a{G5
zYDDCC_6rVt9)zg&*e9)9?C#uBNed<gZS&Wk?VJ@DX2`kFRxrZ+CnF&#Y>NWRU8qmw
zo_i!VGL8lEhE^>RajHjz8r<>ZBA?XMUIi{BWZRlRRB8S6@;)i&2a?N$Ck0))@YlIX
zw}DNDnR)~$akiLeEEpI%I^}GmTJjTC_y<H__wp3w{08Mh3r)8->BjyEZ~=Si!n0yl
zK{$p#m^0gc5=l8|7_?QX-I+YEOfudp6kZ~2g=(RC8#E_@DB>9jg!(C`D%<%>)I#y6
z6s5du{!k;x!B50M7;c^1Yqy~aG6Mnw=)QenYtW@qX%zlF#XmtWKuO&ek{x6eOr2zD
zY>JY<e*pvr|AE-Fw5q?PwG*><Ym?ehNPD@tV(^10@Mok)LW$HNmqNcJ+!*tp4N=@6
z&7AH2zpPP(@RD1U_Z8{ncz&81a-IFj4l{al#rV%<N_tL?c}Fwm_3_`VhKx?S3Gwl4
zH>yHK{OtyZ4cWr`m4%P}Zss{}!vwTPM!CJ4j`w)}6yZ-SCHr-#?!G?iGLYTY(dJ!L
zm-YTthQOD4zXC1yPjH^wlmb85N8;e0<4>ID3Rl&S5RH<*Op&xO1phDCi-1OsotxKL
z*sSNT+VJjQ;I+G&5__=kV!uo|#g=sKUva1}qa0~X3wxZuoSfJ8Um&l(INBq7Y1&_=
zkWt&c{ulZlc{$=WayArHBLB2(l8N8`7x?d^*WB}C_MYdzOnDYM`frdNTUtup_bY+1
zsQ)3V{{@o!FQQ_*4GG>FLWlFn{>LNz=M9i95B64<&y%D>D+?z77fhIpPJ|+DJ1br7
z|D&nDo5ue;Xexx7Jqfx~p%X%-$FI_>Qm^IO;F~kfcv#+%KcERR=7|C2%*8ytNDayG
zrEa?onH1zWm!1ff2;?oa+~ZKd%~E(M(Tme#lcb)kP(<1+4G?krC_rabG<0qpr5Zn*
zquVh<;X7R-xdR@*&Y8&X#`%^?U8uG|rVxD&$$$!ktkCBx-3=~GR}g>g`o3Mx3CqzJ
zrf_21kHbSH8I!i)v&O}Z*Q#m@<8HQbAtxWoPZuZKLoC*e6#<2owF1JH{x^KY>_F$E
zPh-9q8P1KjGR$@K`BZWZpWQE~0{h{p{O1!I;*0<m@x!RvXC0hImO8fe_>SFPXmr=}
zZ^|LsYpHiRzNPQsDSuB*mTVx(l=GG<08K3oca(Xc7XHxIzS+%qNVm?Z$jD~tM%_`7
z*h2ewl@>gZ_qP=Ufj8A+wyE4^b3jm`s#chh=2A|L-D@%Pjm?y8K<XQMe|to_+!Ax&
z=5#PFWqzV{Y0D1jWx=wwH(nL*rN<>pkhX#!F4_fcgr|y)@ace}E6&#o)O}99Q{T5C
zgq6-u%p0D)qg>20s8Mhr69_JPi!|CoyQ${Sc-%@KZ4jKD%{bV=_QOSy%~+ydXJ<4|
zXNg`SN=3vpec1VUz^WJn80#`~a~^DE?E<^@OAOEB?;cuQ=q-NRYVPB9F%Y`YJT~?2
zvaNORr2Y46$qTvu4aotIW^ef8#nW6Y;<Bm`%0i}N-u+rw+vbF+0KAE~Wur=Oc4M7o
zrBHEZLyp#3B%=Ibpu?VGu*jU+*3;?mK%*+1ErX{aXphL9oI7&#?=ix)y->+5O^1nu
zf!WyPRTI>MsI=6Hn7S?$al<=#ai=;Bx0f8Rh`@-Cr~6y1J;5L=FoXiQwIlKVaf)<U
zbq)lnd-P<-3ljNt!*i+bN1qtr!E*GYN%KAF$?p2ts(4xXS4w62EmkIppVM7B_XS*e
z-0nlGYr6?g8*|>8<%U7^kDJHZ+p*61?G!|#`Brn(5SsHu+-$NGvzLJ-cWb|Go>PQ;
zinuLGthxsGyZ$26u(p2lPIIE1NTjX8%I76Q<#VI+&GOMP;ZdOVMP`%}w>CwxrS-II
zJFZQb$<iuoT9L&;4azlD6gc_YGQ3i!N~bb|(PQ(4sdYQE0=NiV%;~OB!cls)Hap1b
z6R(hUXtGQ}l=*gwZGT6E50CeYjd10yAwh*;KYQTb8)=-Uc-7Vh(PJ(D0bH=uz1*_b
z@NqjN<0du*{b@0}W8r(<z1ni&hUD5r^tIjwot!6yk1fa}bdqRAH_1>bwAxCZ+xuUd
zJtDy@xyXxQqevG9sMkEx<W>3C2XBbAixhP{)<lPc9p}ZBq5**W-lKzhI`4yf7A!`9
zR`0J>vRJyDofv}U%Cir^)px_o)uIxGCDEd$Hz;#e`;@(Zpj+i?v9);(p0C9uU<o8&
zV8H2I?RTelk)ID4Y15o$8)oq3I6tK9puV6ZaIz6^Qh$|bGzM>pwOuldc)cuw3{Jz3
z5k4U7-oTow4ph3;A(=5dVl@XW%aYbv;S)u4H})l7N1tAORu~1k7{$Pycnh?bHb9&F
zdKKXpSok!=1O}^pQ$G7tS!w7pK*G(rE~uEQ{8{KU2*^$Dx%TW}V<KLE0tQRqvQmp%
zHIloEi77hu^&_9|4N>WHFV5ZRyS+##n!dvINsKkAAk0BiSZk)I%Pd`(;r1tS$3&xk
zK%0I%>~pGYP>-pDpN=Vq&&2%AE6I&wQ2@N=X-gsHmg!oTOG-x@H2ym?rntx3;}+jK
zY7WK|F@)(y+|`8dFuhsqOms)Ac>#UW)t&bWmae|AhIfR@yr*d^yi4`jC4ODL%LBq|
ze%43scmP_(->~=KAaAuRh_!ys9wuh~4ZKiE=TL7J+)orZoQe?LyaCQp!I`E8KURZ5
zKUg+x%V>i&!Ob-XzBn~Ds9yiPXsju+f=}!8%-|UZzr(4yoR6vQf$pO^V-LNJrYmcV
zx?EH&$VtMg+YGJU?xOKO=oFrd4QPh$k3f&alnJ$BOLRnzM#zI+ukXi0dabi*&g*_6
z@V>@Gsv2n2!1Bfwj`YGulZOhZTavX5M#>A#tu7_puN8`SUvO(trb-1YKM9^nQhvc1
zNvsNax!G=eCEI*Ev@O%tGfb*Cn`A#1yXI5GPznAttLHIsv&EK0r}581v)S30LPz7#
z3?mC;2V(Q5J?5U7Mi^uKOler5pQ+nR1T_mT$kFQ?++m%SSl@e`S`fx5ccGxs!=duH
z>;acz9-OiJ(wd<88pqk<+8affJF~ewzG9PEeoeY+m2Q1&hP^gEy!3^~_T@wH1w2h`
zZaxyZ>THBX79BXjd1PjkY|)MUxW&ePkMS73g`>OJ`L0JwHtC!3wvpLeZ(pTA_xYlc
zn-?(RI#Wk5wB;;q5cArC?HT{qTkA7Ri#5Ee<rF#Yk5lWJ7G4wgA~Ee<0RYkU0+=B!
zC?BksNk+z`ebNi?Hs_nhbZ~1|_*cd2$ko-H&7rc)3aw?<fRM_7u@+W|61rtYw{=HV
zHl-KS6d|{`cE%gJ3?J69&C85e9O=4DBa=4YjEurw6V3&3tSt;f+pMuHlhK)$xFW*g
zw~JY{@Yzor#j%yH=e9f#3XzjH?v-XCot#k{)la6N{PmOE3|Q8+_tLMpW)BqC%($C?
z)AiSQMwEZ_MSUq+wXGLv$)U3gO!4%td>BGKEp15%%4|0ea$L4DHNq^Ik0`Gvs=ar!
zEKG){Nay9xz{6Kf0zS%mm2V$?Um?GoydWu`9yQ-rE8SaU-+@UGmnG$zx7pb^LLH>a
zmuSG!X?Qib?SoNVhT~~R+q{I_{O+<D@3eIJR}R17sQFYDUd@W)Hv-x0M~X(gW;OVn
z)dM+SP)mK@bD>C<zEAMiLC4tb@0kUAo3i^lEOfQUCCVH%m@2r;a>{1t`{^hZd8>F{
z;2d5F%39mPAX&!hRu3+5_v<#lV1h#qaN){FU0{Vr!2kiImA6LTxMf_B$8m&h5oS>E
zMW%Tgght6KZUSCAy727u_WMqws)^<U-)-|ZJarNcssp>=(^nKN9HYNUgkh%$!=fH*
z_9$e9Xdev{GrHxFz0iD&T(83^^3vrjEgr}5G#^mOZu`T%Ll<}p7W(#rDl_==9Srs|
zYsGrcrPJuN6AYT!3}tkO8702F?W<J649+P<p`e1L`KY(oU`H^z>^Z!6m4xa-m(nY&
z?kH}LyDF%e2|lYSJQrD*nt%a`;`Y%z9h?0ou++p)JY4TyD6!f!&*~+Jp$mF_AEO3_
zmW~~BH}*Zyf({9LYO@;$Lc^M`6I#lpryWa&Cl|mRMwj`JUC_uuq6i&p>7CwliME)o
zNxe(3+z^?<*qz631b?)CEOeNgK_wWud<dfSg=Mc&yPw{y3LI5_%vtZ2;V^p8(r)gb
zyETJr85(^lE`~sCu(9!nE+wAkiqmY^edk>1TN9{6x}^Ha{3FF&7N2hj#@L)SE}qs=
zx?;u8xK`uU73+OIbgXF3-`Bkb-KR`NAMaprHpVn%UA`9{XWf5(f&Phc?31b1*-Lt&
z@GXt;7e=NvL2r#>W^2VF+H2mS=fBJJN=z`i@W=}Z1L^^KF4*{^A!`q_!kP*{b9>bY
zSzY#XDCXH10!<<Pu6d<IFsS}+e}z@nf$v6|#e$+~HO%*$)KJ;1fjsv{>f~FB<A#NI
zwflI7(fPiS%GMBShgmD|5#cnho7*1dg&wuQ>{`$hZOcW1T#N1pMr=k91&`cqd&;Q-
zc;wv_zfW)C;C=y%Wx`NBbuJ4z4(>uk(KyEY=49h8mo10UzLX3sF}h*{4tfx2@BLgV
zsU5p=S@;~C+$Zng?>-cu#E}~1`fiDRFhBD<P0Kf$JsDpMBINn>xUPw6>NWuECu;;2
zdh5T1AqH@j#Jn1;j2jivx5PG?tJ!*@DF@%V^7?80VvAjlr~X7z&XNKxL9Tl#fP(x6
zYZ`zCMpP)hb>Gl!rBVgo9u({xn5pVLH6=IX+ZD3umsUGBEZ{%qw@h&qNyEk#9?D4D
z?N7iL@Xx=8*xyy8S&#@8*uPfPzWXi&Z`F*8TGYuM>)2y#aMb^hP`z?6-xjbDE><O&
zpPl(ibi49YGzX3FK%lVVHMh$#v$ql0fhP`XkV}P+l3AcwPsIdx-^bfs&EftGyD|+{
zSw@0MVZan00bq%TI^d{ySd;6f_<AT)BS&a7ruVQsJ7!MTe|c5V|1c-=s(sTCss|Z6
z%ac3`hp$%}`ik6LWtU_eDa-5TD#U(w6AGq(P#TbWe07TO$!S@bes-N6S=Va^t=qHp
z3!dQft$fJH!O#I(C?VDyhKr>&2<+ovQXvk()sw=uyLNL7A%*Su{#jD^gN@%4yi>y#
zlIkO;`VKnSZl$<lVx$=cE~mS?joWj2*YLnX$6sru;G2bys$TyDt3&1X@wvbNrPH=P
zo3f>KLB})-`{k_7w&a9vLJ9L!qxJy|bH^o__%Q-omRfx1G(rk`(xGe9M3=%ey+D&&
zQ(lU!G}^wZr?K&4mu*DKweE+!DDOdk7E^uNJI)$l<1kvk+CFdYGP~T@qT80emI^SM
zL(P3B=g3ic&3<OOt9DO5jcfD~6RCt!27!c=dq%G+S{&eQ!PdF$7T1D-OJvLM_j=o5
zKRT4Im8+$-G0XC0-*~Bx^#}J(lG)R_T|LTRdefc{5sC?y#f|P5iX^1^(wkn?Bl915
z^3ccTB}UPIIow~#yjXek0<x4dyIT~#japsMy7^xIhqKw(DZrIT(S-(OYv(D+S_=;8
zIf<jv#^KrQ8}x_n)3st4H_CGdZ_FPgx^jnnIwTL+4d@ALpW6$7&duqa6Hs;>H?=|Q
zky5l8x6b;P;NF`GWy+(`0^?iiRtl>-%=KrG=QlwaQ`)tIT%%sV41~pur?}d8OF@4+
zBq%S4UqW2Ze)8zH7i488WT$o<TxP;ITbFdK?Kcmi?W{{4K@bdF;>Pq)-X)o|mWo-0
z^{5teX3I<Uu{>u9_f)drBOclK4eyA_)A$s)he@cT(txdh%#3(`jk1<|%5<H}XcrYU
zN|+ny<-a<h;rBk$ouRrx6JO_bmxZ;Wqhftr!dH320B`(TFNFKuivZs)EVgD2->Qb|
z)<Qu8PlKk#avAFKS4Jl{e>4rkZIe}{WUC`X{4?+-TTXqSAFI0T-%*;bj9J!LQAMWP
zemJP#2#)PN?JmwO4<j`y^m#8`^D|D=ZAFbfEkG{Uy&CR@c75E6w!IgWf?L_=1hap|
zN##9#=a;qXM3+;rL3cs5JV~8eLm0S|AA93PitKjlaZLlp{Q}qZbm5|z5qz!K3SA3&
z9qCctg8h=^*6HrKDn43~U$GEr1rcX|LSed&WMJTqcQIZ6kagYOou2)-hA{tmEJODe
zbe}H!kP0TD5cIM6Zd6&V{q1PQ-x2W)xswe`^mjkJ(bl+3!MLn>DnL}=9;C31z0&0d
zOMMPt>7Es#o^ufD8R%xYj-v0cvTW|Ht6}iUCM2yk;rWZ|wi@Z&&__y1FK!I&s>BaZ
z`DvvSzB7&Pn%Ix%j>E=bCon3onC_J>guJKaW`Ct|7?rWH6Sb>#Vlt6!llo8m8%RgO
z`<y0<1+TSS{0odcfnE^rNZ4-b{q}R#($D4DF)5VPL;0q{2g_*4g}}SqUjqI_c|Cq&
zlkC^7k{WdGTV}i)b$l0d9ULrgh(+n|zbqBbDS1}7!TfXW>*l1*1ZO@JY*xBHb(5yN
zQ^xzn`n~=nhc~WWX0jn`o7q9njq9b`rufOvyCr@$w~=a|biCJV$(Gt#vYZX}JJ-b`
z**_KD4)9Up+2fu%DGngENtB8)vXZIRA%=IbVzjYBT^7T=&6NdF2dMj;%^RoO???Ut
z?IKpCfYjukw+hA&Ok61&0D$9x-mi5BP6QmOLkhz>JCh++2rIm3cQ|=?;8f*)IE;J5
z^W6JQ(RgjMm31Oz8?a09u0*7Mx<hO~aajT!bnH;IslP{RL&0Y0Zn>XZI7&U(Gq2e_
z4GvN${~irJ=9P0jlBiI^syV|tcdua@BS~`UM<E_l%>#m=G{}#V-XGwMp<n3ziy7A$
zT!*iSyqvtDcq%L$TgchZfY0zrw!2ZxV#_gb6c%n7jnjE>X>!OAVnGNk<go~JZy5JG
zKB}kg4XjmBiM1{7K-U)v^4#kQS0-n&sMI?V5QJ2S%tUmznB;&PgebG4viw8+`5E)W
zervhWq^tOBHs#pi!uc!_q{yM-OPsDp%B0b)(5j<pA_n;yk6dn+#!u>op_>K?xz#wq
zr2GNt^GRXoiaVB!tVbu1X6Ph4TN<KU<B5_)NDQT&(CskHmx8!*<o(0d4-yrF`c~+B
zkw~`*?Ik_ioodxJ%{L{puwzBlb<`L4S?Q+O8>!I5JQQv%@yM`!OQ|YeqL5yrqFI`(
z))zr68x^39aPJ6c@NwfCmwy)$kNe?bp$Tb2K5huyELe39?eV~5Y0gdXD9=Dg(kD2T
z@7`nS<=%2Hotr4pL&gA8+o0VU%X!OCfa|%$Eg^FGZZ(Nmq81XJ-C5mU&Y!I#;&7TV
zNoOpjGNKvi(^^0hOBy>{GNLr*F*LcAn=+fx&sAU~yyOu)DV7Ne9@D?HX68N`Pu1y5
z=lt}j3V9o%=)PoUU!oh%oGcL|e|SL95taa5=4wTj+`AE31{w*Q+<Pl<zD=?)Y%Ju>
z#_Z$Q?!9j-%9yRDFN_*&v>vbQ=#GCu(6weBPPIN{?iFk7p|WL(JUf_I(Emi@98`}<
zh&5I`DseM~-H1meH54l>4z+uWuGH}eOF60vrksDWf)@(9W43qp1XAz%NjZ7GLn!za
zz_t6Z`;mOsW85Q3^Pv$XE93KC7LbUN<V!{(l(Y`LRGW4)C2xWgv&*92J9rbs6KOM$
zp{`vLvtnn2F1zUvGGTr~jViP6G~KL4fz8l^@RI0EV^1rC(orV^PQ_w}bsgr&d9zL_
zw6dAV8SnYcRXb3$!!27$T^%`=m*T|)_y;K#xGkZh#lEN1OyND6+T}(o2zsV_dI;M?
zh!1?Eb%IEKegv^0@0b113dN|i$Jnu!V7^=viyN#w`v}!@p4u&625B6F5S2aB4~7fE
ztK_{v2@(ZY<K&0o<OcS}T8ZlZ?kS(vXK2g0pch!ffr$3tl?m=y0Wu*;z)x<!eO#zN
zKZ;gNZ7e0;3T3ail10mb-rSO8qwW6sL`8==R>Sz{2cxLAR${xOMGZ~22+Cx49_bpO
zM^cYn#gEd?V|MQbHqUfNIP26@+KC3=1-BoK@KD>OgvQZy2T~V#lz;1)RA3y_f$VEs
zNu?4y(|x;iA6Wi;RUfk4!*q5iPwa(sKw9If4U_ALOqG@9=rk;%l=PZJP0Y7tuPv-4
z1GS$8y}rs9hRM-4AGiVO^*(D)l@*jN6>ZudbR6t22jhxaS#l)@J&gb{CFy!Oj#%{J
z%A>Zvt#3X;XKc1%&ykm~o9?dgH(7<8@RKbyl<};#Tn$^pE!4~AJ%YMYz=GW_9FwIx
zLiM4yM@+-rpofjxEp%`tOZqC6MWy->$CS^RgRLY2ZLpa#nA`bCDswfRRi`U1(i>EE
z^*3{6{m9-NRLr+p@gaDaYK%ine5XU{0uVVDlyF8{&XldzMi`bLHgGGAGCS>-7auAI
zI#Hp~p~6+$-9A670iPRsu_6F$#=z(I4Fq<R617T_UBm>M<<+L65YF`~3@$w?_!lP*
zgoHHR4|U))gWD{20fMgrmfLgsN82{WRvHq0cftlV0+&E<_T3$K?M60|ZwW7Mrz)+r
ze62b1^}yf?F|9TNRc9bo2yM*_WEZBzZQ9HrwtHIF%ML@pZB2D910opIifc>W&jXdV
zOV00#fK#Z5vS5w%+z$vd)rFSy_f=lUM8QHsc^{S}m2~OUA<0X!0Tv*p0u6QQrlE!6
ztqWjJ^CeRobMqln6RYa5wVKe5&*D#RPL#R83OAB3*fW(o!A<P%70|3Nvy>N+QCz0T
zVoj3fljgJTxc-)F5By3r&t~Xp2n+Vw?d0Jx)sLFOzjrl}QD?s=)nD0Oa=2D6)h}%T
zj!u~I=SVXAS%R~>_iHWc#F_u6Kf7O%T&;@D{BLdPq5J>R;eH`YaYxg;h`IdN(%2t+
z{r9$W2NO+*2y0gKNjUMJaS!%yl{<r+qtEBcn+*S&L%R05PU@`xOE<mF${9M$BQM6k
zRSB2>wOM_6fM>ALaO9^a{4*#q`L`;e16OFK*(-^^6@0G;{bc-qXGWBM+J2Ve$XU~0
z`{}hs|7#CEgg2BB<2G@1s`ADEECz-q+y5}F=(<i`VhZU+dCLH0n>2o97wLUT6QUY?
zMFcaK9r34f{GlbG)1;8cOx28n0{GLAe)&3y`R6GT34c2qDNG{$|KK1*MN%I$#r|!a
R^j90QJGXSz3vNQ5{~tc}Hkbea

literal 0
HcmV?d00001

diff --git a/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/upload-client-certificate.png b/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/images/upload-client-certificate.png
new file mode 100644
index 0000000000000000000000000000000000000000..da88edd677be4ef765470122556a0d2a973366cc
GIT binary patch
literal 6806
zcmbt(XH-*N&~8Erogkoef}%(#6e-eCKqS=AYbXIJ0hA(04^2dh2pFUzhF+yh2}Mvq
z1OkGINE1YwC_S_<yx;wE*Si1ik8{>O`<y*{X4al(o|%(qY^cjb&rJ^i0GRad-8BUO
zfN=8IgBC=-C(Pm)003@#y}O!b!NASDQ(yDJ?7<@=c{+K5!Fi0;vj)?}GQC96LHbw)
z9$yjtv_gyTZVWOqd(<zTIb60_OU0{TWqCHtH=fRC*h}ea$1ub{n3mx5?7fzG_wGG9
z)}h)jo(^AjMn>8WzK4DZkBm^f?f)fPmOQZ&Hu`vl_qeJx;+NX?K)5jzBpACF%F@!*
z^q9i;J5AFT<xHfdnc&k_!}ykM;Koy*_OCHdH(kaUAh?KOC=%(=luZ|OSK)J=v(;1#
z7}1Ty$iTR;9VIw@QEd{SF9T?ED{Aou|HVRnGdkkOHLha`F*wL;3ipg}+(5RB(`;{^
za>kbn%LtG6cmeNtLL1av-=T0LUWBsI6R_+N5fYQLVEygP;1X6J>c7jfF`Li~xAeMZ
z{BZ11yS(Fv-jr1=KBkuz=4c!LA?HDk@+YvJRdVSfS*CvO$`{RUW#RXuJt|`AT}9Xb
z)Bm<AX0&(l<)3-mj_|)U!NYsDXL<B?6Fe<Lq9e|m0}-~|uv%E}m1(+Ap?NK|hI5lu
zj%R)P5}K?n$NKjlfx1`bfuQnx>UL3=rhShT`Wk7;p0EYL{`8K_r#kf!m$rK%Pq|iV
z!|3l2<$D?OfnH8K(MAi4iv<fOKNUB=w_ZA1ZqcurJOnKr0mz=))EwV=m-grzCB6mH
zH+|sSbCf8!{c>E%>SV&?Eq4{zXS8Q*OK|(_yF}~3s&Z?%Q<_tHS?ZnBA02~rb3zHf
zBOwV)AA<II5)f`LGOccyJE~5`UFb@QPl-HtJS3PG=|x7qW5lbY9E92Nb72N1k%lBC
z*Osi62RzIi`v_0Bv2x$_>vofChPlK?8~)`1lKks2@&Psc0%%mmCU0(%8IQy5o<Sbt
zZ|#5&-3;K#CBNTJR&nWj6TE(>q=AGnlPCmdcI4e@=K}G*#;yp`{^M=LSuk6feUngU
z@Rbki-;hM9<R3IM?rb9X;qF-;%xL9k=wDsy;PV5^g@4JF+kZcadpjiGzO1}b8M@G)
ze0|L<h6qfI#j3?SRTPHOy4{aW7M=re_est+1|t$sQ>Z2d%7<Ox2Fvtac!NrDB<YLL
zaE_1d&UE61;q>?dhgM(8nV4UF$ivj%FY7|*^c43JkipxE%<YanN8!?EN#SjsY*gZ%
zO_sn*o&2`9Vbmqp6gdcx<sm5_0jjho1_b_>-S9@+49h;R?=!w^J-eg{*08YMU)#k?
z#!}unu?+f#V<!(;n>*GNe^x3xt=csN;;-Ll>ywiJn9*Pj=kioD+J}6uV44Gyafx1z
zM;fP(fI97E>Os6rDj84y(bjx<ejScA4Os^1;Bk{qXtVVecRc(j6AiqYBw0X6y6u6g
zTFmCMOZs=p`@^WJF~fAYv;+#Pcg{py)@Y!7ZdQm<^UaIpsuwT(!gE7(NOrLQN9~;T
zN?k=Zzrr$|GJAiq<sivO$ye>cEl;A>hR(j#)DuX}(hY$3&9<+N*@Un0>{1@Js3gjL
z*35|X9Nw<V_Z}+zpYTM)0WbC1;y0A5x4AVjqoEOgrt9Y+mjO<W*%Nttznb;VV0|7H
z_FjF3idLW+T3^@f$aI<8mg;FE;T=7Xh^$m?jU%t43Qs3U2RnN$6^>OkO3{`7bOPo;
z5X6xxc2SjD$vnyhPf4+-CblO?a2}-ZvIH<Ji4<k$MbQ5jK{H2qw3=?%RgYUr58^&X
z$sj!`lBiH80cI4Vx2+)^k+(bwg>qJG0JCjiDlDt~M@gsJ=s3^|>im}+uYRL7dIvKE
zNsAjLxzF%R6b>e{|9G<}csRLd%GIv!(T7T_eDbAsV<cs}IP--tlg4kAsBZ}uE_(e8
z$#9%Z{qi0q^~?7HsUDQx1U{WdoSFciQ`OS0jYAc~mCXcfIhB@QpCmf1q4zhcY#wK(
zy;-v)cx$|Q#r>R*zCo_LUK{uYXG9t1(7}(L_Zor%GHa7PKDHNL+e}BLB1G3-%G<0e
zbtAKbVJUrYL&A47rqgbJKa<uMm+$5T+qq3Vgx!Sf6MsVOZP3}2#838JzA|!wj%e^l
z`1odG>EZnlZH;FPu8abVU^*zHDv+B}j?RcthMwC_sC+uQMwLTR(p$QYIqTQALiVb*
zmD|y!Q9)Fe9O$pi{%>SM13m|Wv1(~ZzLGD!3SA?s(lYxdg+XXV4zJXDvARJriatC_
z#M=w{dH$6)F*;b$s#Rg?Jvz2Rsv4?&cnmbV2D>~-$+C-Bi!z!N(|A*)1^7AhQ)_0o
zG?F*^Q>Ejbnb5i{UM%b374%=Iphl3>8qgX@jO+3c{BgeicaCKaCu*D97xEHYKPMFP
zJNXMDfF{3vJtcUF1*Qbflq^tUw|Z>D;LCT)DEWT9(jkf(Jv)2{__Js7;dSNCJq-(5
zm~`wdZ`TlD!Wcr70k%~5i{PAj6SWi=;!ii@y_2Bnsli3zSub!I>8u-o*US6%bDi^q
zcI7-CSdO0)@5|OyiJJqxSGQ*F(hB@T(5)j{JKkE>4SfsSp_YoyVW5(`m9_kA=LrdB
zb}a<(7UB8tTc<@uiP}vNZSI&-2(JOrAbTQSrbn)M&KPn}nK59t>tzu2z_*{en@I!W
z|BhIUlc>vuA>{LlIaA{Sl*s$-1<iyYSk*AOv7NrY2mGerK%Fn*Qg?dIjEFl_3ZTpJ
zA{Ox=K#(IV?2ac_`41IbYD@GF&N|l2X@N|xN|-kPo31#%Rc^;@`qp?tI#2P}Gv$M~
z^tW7W=<jJ~&s>^qEEoLU<+5hMk|qO%sK<vYaLk{?QCoEwWmW>8evkBLF#H);ZV^ir
zU{c2&O84DPpcQ%xfCKb-gz%T^yo7A(g|D{O4O$iw9Gon9V>?Jww<1*EiovJVD9#ac
z)EOOkH(BN)Rgk9$*`+Ss1|Yn$KD5c*#YD#HmYd*i0i6V0EZV9Z{{CyZW*qPto)hbt
zEl_w(o9jcbnL4a@zpUv#O)Rr<eexBZd?rIKs#r-*`zbXV>%TSC{>fzuHje`{%ij%b
z%y@5(_^Zg0){9H`TbaqBcblE6EtRP^yBox=uMu)7s(7bGoxIm!p|_Xi+GGa^xzWoa
zF!m64eJ49XO4rTFM*XQNIB}O$K$c4R%6CmJ)U<%+%Hu@D70FMJ5hAn(){h`%j=Tr!
zMaWk9^tlFDV^@ePP%<x&`1bg##*Y|}kMU!i%W6TphrWeoY0u7Z5jiZ_g9TFWA4F-$
z^6#nSvGGfoeWIov!`z?eXOp{e1t-jszvzs4U9U+LA%@p8!0D0>CQ@rI#+NY9ZkL$$
z@s%&EMUMcP+DB`gY;w#Umb`62H=T64iZoJ_c2;b>T_)vo9lvS+Q$hr2>J_XUXr9+A
zwU$k5C!<aWCv6#4z`U;Ks}XYG*IMB`-#FWQGJkQBNdk%hA3MWcZcUg!4BR*_aiatD
z9Qaxyr1o2=JgBwJ;xUgPN|NVWb8#t$D1kFXM336%!NCt9%AXZ*S(}L&n4CFb{T8*_
zx$7UFGo>OPMp&FiQarNDO-*PMhvN(m>R&f-0N~@Lt0dn7@nHp)5lR{JEx}f~)XVSM
zFMagiU&sMTa<9)U$51V;?wJFp5#0vN@V`I9WEf~}?h$@X{DS(oLLB_XwpJ51B0Vp+
zZ*ztD2{YVe?dCSmFRTU$w~n5;{Fj^8=LP+T{ld5I%)GB=BQz)X?J|)nG8l&j9edu2
z>>2*XQbKx<&aLBjbokoOM!NMeFPu&A7>|t>>Yho;e)C_mdJDnCV)f(Qf3|O5sgE5J
z2L1?M0Jat8$#gQvVeI@7FrG7=@e_L(;27lrWm4r!30)i!kXYL*(&;KkkfDK}Jt-(m
z&Oi>Y^^V^%AUnCdVPbt}<u_!b<wozWq@Ch{2rQf(B^%i>JT}jxdkuoS;Fk;=s!$nO
z8h5qCX1MM_o#+yeo~T;XY4cr-{Fzzfi%h2`Vmz68l+xf=O!U6HXF|L-S{UILFA~jM
zm2gSqH?o|fV9?f1?=kPOL|=x}5Oi6@R}}ukEmk`Eckkvo<&Rcy#R4TctOI00LM?56
zNUKe?zKHk5+?xG?G97W?3(cpPS!=q_a2CnZeGxe{*aO7EzN(egV)C&-_<vdw362Sb
zSx&hrfThIO#M7X-sQz0Qa>?}i((JCkR3~#&dsFA`?HL2Df(4tT!pc~K8DC45v>zmj
znpyJokIepoWcI&o{gmi=x#a45&Z^I$vR9#R=Q|iIeJeJN6#iUP1k1b8rMCHTt($GH
zZWqco_p&!oiB(QvLzJU%a`aiqL%d^_lUmTR*vNUD!dA>~m;iIh;-SA((Bz7a00eB)
z^n=*(teO?RVN(`^lY4b%r!9E7KfEuT?O(LJO~L1*EDB~d!^qkqlBc%BSRM*Nji*&Z
z%!^J(+ww55GoGC+eS$7`M|iy6tA0dD#F=eyl^reMA4IwRS9XXT0myYjrqfV#rYR!R
zmipmQQ;XbUuNg(=v@wsTz1*wUZpfkSpF9ult8E7it5Z4dEhd<LE;8l9icqtPeIUS}
zW%9o)wWP<8G%o5G>w4&eZ#4AV(WO){muLd7#;03MKD+)^Fb3MJ`(k`GwOx}nQRP&k
zm3XZ6%?}E+@gjX0Q|@HhlSAE>P^L0?{+dFUj5`L)ey{4<y1sUnO9vzD&RWKtG7{6^
z=`_;-zD{;#{-q(aO8mT8_upuAY3Jvxnsga^O4OYD4LEaPKhok$EiG)>tl;dNf-G(S
zbBQxFysebu%w%q%VD2A3<2kX`X;}UIskxEXR9{*Z|Mi#qr*l`4+_`Hz3@1#dhze)u
z=8&sX6V>4D;P6$s=SH7<H5@l-?oDVchN)yR;s-49kFq300eFX*vn16qL8o?*!|x{y
zg!achIrg>-%cFrGMDSbUj7FdD3or-|qr~BM)`3NgvQTIs_mlUR>)Hq0oH~4nVuZ!-
z_x=WdMZLf6wA_AL_vn<R(L0#KM*fV|MuF*$*EDTo(D{9zN_hy{JV$rxt1Nxx6XqR@
zU*S<eTOcN=cl{5eh&hR%JhroM@nD@BZLd2Q!}OslXWsy)NReb3t6X@{FV5&5G|6a8
zy*&Z{!HKP?Ub^{wLdxM1*30ENA4SHD1=Hw*DnFw0knn2!&7qvA8gz}`n;$GNFe|26
z2FA0sV)78v+*BKF8I*@UJtoZ`?HdN44GKd2eyRrh+ZPSV6?#^%$mwBsf1^cF^TNR;
zUM`Gjc9{018$KzV&09z4NJ}>CF)wlmiVE1XcfyFKr6m47`~)9+CnU6*PGzu&!><`g
z0q=^Iv9W8gXH2mI&7~K^9{k328kQT{rI-{q`V<$xt&m^FKanW>n=x&eAOee%Xf;4d
zFV~Fb#xKBhDuSkj-kGKK>Bur`D)-NfdkHGb^;b!-jUn;DBA})Zs=is?P&++-m&lt`
z#EltV&D*0ZtYPE3Y=l}ncf=D7!yQ|BIt=q2ua^9^cQQz%CncYf;i60JX7t%h`V!l(
zwb9LxjVOgVE;N7ro{rJs%Z!`zX|C1A6yr6Wi5kz)#yv6=T%%&cy3yjJ+2!q_d37yb
z;-W1Epav03>e@DoW`lg)BkJo_$wFn9bN>de_3%-oRdMvl>9#efKG2J8mO{MYn^RPt
z{4CtSb5Pwbbi0&zosdXstj=rJ*1A+Mcr@Egm*(D22nK=1ZuLujR21gf=B&&Ca?=pq
zWI-SPaA7~Ufb6a!E7*T;TY(&|fODzt5tSD{Y$iBO&o~7yHTC9Yf#SOOML5dSI{+J0
zm%Mc}6J=mFTBD#^Fbmfzckquu2NvghhlT%897jxH=C;Bce&_QIm&af{k23WI1UGIJ
z{zYY+j@OWqD2$2e?|jRXvEtw?YTTqR&lX!ov&(Ap_z8Bq{|vFYJHVD%u+2*bYn%84
z`2f#ur2Rq)SHL4)xs(_p;04eZJMjQQqiu_g0uK33*Z||4DxzFpQCHFLYToEU3^j(T
ze^f=@B<g9#p+1@W=t1|)-T~o-sjd#5Z}`-S-2*haVOt@)JT3Sv_kmeH_cvyrm;?(x
z4`2iKFB&03&_Iof%jF!5Lc;U}vH1m$I+5vKGf_yzA&kHNfMOC<3lNC29bI=-9hU**
zb&;US8%bb0I(16w2`P4sR;IS0%w;EG*0DqR*ZV8Yf;AV0Ry7F2rQNKih|+S~{qpqh
zxBncTwaCBhGRiL?CnR!zWtplx$dl`y+Ab8~M_^+4!%Ke`tR`I6v95)m;vLE`tY4y-
z?6h_*wCvi_*3|aC8db9VWb<msl2e5b<E~E82JQFf-VhTWRQH=R^T7-APHYKD1MSKT
zor_>qKmPET#$ncy<O=nBk=CIej@F_2ijIn~BYXUlNP;8w7M?z8Qn8(p)4g4fJ&!_L
z?lk4AUMG&88k-ldD>WE8o!zAU^0BynMm1HontNtr+3?R-$5GDLP|8e{*^E^|xXo{@
za33GcT9e8200P3JOck|A`Wjs#qAM2s%|}VcP_6Xb-gs!P`HK*u&`2e!Sf0^!`+e16
z?r+C1*io{zzaeEYmN8yL49}k7L9OW-BNvWzLZc79w|qDxx3QdF)59FkzEM5TQ=$I1
zcN645A3mfZ26`~n5r5%4k?m>Rj=FKJx;eh6%_rWkDJ<$@nhwj`KSl3c(;^?1N`6LS
z{xwh?YtXCV$iqhhZ&~hDF?-$Nv+(ETyl8)svq!i9H3UJ<JW6S%v?ZRR*J|F&n@Rsi
z7|0m|Try92@fnRNeRTg?o&2QJt-<L3#LB?F(U@)nFC<Wk#A#GuuPwHF-MK7F?!;Xz
z`2XJ0!!x>ZVSW%Q{~|2Z-5n)NZxN)z?D3yp$X04*mRx#nrxSiB@4{v#tP^L+q0yUJ
zaFsRfvp@6;VB80qw+HsuZFNp=Ed(u`j6P2Om!aqV6vZal9fWU?sGpmYnL||AAMd21
z9udhJ<7IjSm`=7i@X&}y^v&mR`tvyTD=LAE@Kb4(<MB=vffS~QaRn;RPghxN-Edd_
zN~?QU9ww{5-w5B3GS<1eM`!hFY3Xs?Oq!h3MfeI~JkwrF>0^PDI<X#!b@kB>H!uVe
zQkfpUx=VnbkU@v0><Q__KU;0@c}x$`!$!k^7XCIr!^XV8A_be{`b+|#q4x55*Z5Xm
z(oh-;ZaUcjhs*G<jxRCwA-$WlQDWtB&GGxT`>y|mDBEUsl%#3x;YK|%esyP()8eXf
zf5@XS*sD@?7uDQP8h_|^Jbre{SCh<|6g(NWd}ke$wptw@5C>4<yEbpa5>dfiGzZbE
zY_rp?om2PT$)MD>UvXi*<`Y7(h!Mc#?5kp9hA5HzCqq$26f&j}WE^c&LhIaYYy)KU
zBo`I=h_^a$eV?^n-NesTDhNCrN(V^)`gyQm(8jH}pG!jFmco7cfkLHxWy!@p@cfQ}
z_nN|-uT_c-N*oDs1_KV`G`k9@oK`y5q83{KpFP`Z>T0|*iGP_R-1nGjZcMD;f@Z;U
zSAGG@fnN0*H|qL&w0f?gzk)U1BK)>Pd#W?J+rDb(QB{LdBl+UuO|>V5sxs=Bs79jq
z6FY|ZyO}2pT_H94Knb*KfFuG!!B#)M8y%}Gk+kBEy4y{OO7ea<D1*M?@y29=D!({|
zU|f0uhMv&yWp_5H_YYas5a!7M7Net4?LS5QIZ^q0iceWfTqx7gJxm(Z;+G2*4?Dwr
z>V`;Zr?go1R$A^WDn%|8$ul4bwoJ``=f(E+u;Bi$SP!aFT13T{4(SQhb$Nn(W+4pe
zIH36@`%ExUpYUK{a5rf-f$$1f;QfB$6S>8W!GiF@#-9U5fRwLI(>oIL2w*qs6t*%S
zfHT7B-qWxx_HhTX`Pj=~bmnK5&3#RdTH3sF>3aJNHX7b;W@nm))ctC-Q2y)6onon_
ztFgx-qF??*zW&m5=`?GTaq1T#p@wdR{ciZKP8Kum8~H1a{1=B-7dj<y4QB#Op&W_3
zerA9!h#L702*4@(r6Vyp(UdmULZ)yb=<-AVWIM-^p@bW4-U3mLbyt9fR|VGuLij?H
znVbtgGMm1l3=6HH!f=}>Vpr|6#jApdH;(1ek{)mB`uJqMZ2z+KhnwGjO%B^?G0c7U
zS3r((2S(F}4xsr&{J0Dykl<0Fqi1cx((-#xQ<jPU<Jf_sHs8v3KcRJ%;6w_ZUpx>t
zqa{A$5I<v_3^J+H(~%!@U)UqZIFyN3D+tro8_4z6Fe)|bM(X<SCgb;V1zvBCbDB}X
z;tck)?ToTW$gt^$=L3T&vbV9`sqmd~MNEY7ulx&b)G@{L%+v|79&WlJgv`>dG}W-G
z2IESL$O}kYjy9a8-B19(897^}?Jxy$O2cv}9j4H3cAXc;B?Msud@!JN3*wHk=%e{x
zWQ{5KzmZk=YR$W5_TU95O6_nGKR0``zG)=V(8iW|6u0oVECURM<@{M8qx6lTcQ0iA
z7w4kQ<8c)k+>1{<bwmE&z{=vKd)2~A{2Hc<L4qfet~!TV>;LdxR1UbO;`1BNb*{MU
zU`0hE6y@t_7*~E6r9=$4%B}@sQ3F9|F)`xZ+UTILVU~MSrg!XoH-()c*uJ~jHO@$a
zpJ(m`&?9X?5UaKb^+s<_bXM{otzjYQ&x6p*@UZ+9h1bqVOxD#jtE*pAw5q;Z31j%j
npsF9Co8_B(qjI<uC(`+3*64kV4BavLe-l7Y+wg9U76Sc0SGMO#

literal 0
HcmV?d00001

diff --git a/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/solve-cluster-certificate-renewal-issue.markdown b/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/solve-cluster-certificate-renewal-issue.markdown
new file mode 100644
index 0000000000..08ff5efd60
--- /dev/null
+++ b/Documentation/5.2/Raven.Documentation.Pages/server/security/authentication/solve-cluster-certificate-renewal-issue.markdown
@@ -0,0 +1,158 @@
+# Let's Encrypt: Solve Certificate Renewal Issue
+
+* If you have External Replication or ETL to another cluster, or if you use 
+  your own Let's Encrypt certificates as client certificates, the next certificate 
+  renewal may cause permission issues that need to be handled manually.  
+
+* Find [whether this issue is relevant for you](../../../server/security/authentication/solve-cluster-certificate-renewal-issue#current-situation) 
+  and if so, [how to handle it](../../../server/security/authentication/solve-cluster-certificate-renewal-issue#solutions).  
+
+* **In this page**:  
+   * [Errors Relevant To This Issue](../../../server/security/authentication/solve-cluster-certificate-renewal-issue#errors-relevant-to-this-issue)  
+   * [Background And Current Situation](../../../server/security/authentication/solve-cluster-certificate-renewal-issue#background-and-current-situation)  
+   * [Solutions](../../../server/security/authentication/solve-cluster-certificate-renewal-issue#solutions)  
+
+## Errors Relevant To This Issue  
+
+If your current cluster certificate is operative, you will encounter 
+the errors we discuss here only when an attempt is made to renew the certificate.  
+
+When the cluster certificate is renewed, authentication errors will appear 
+as **Studio alerts** and/or **responses to client requests**.  
+
+* The errors will also appear in the logs.  
+  ```
+  Raven.Server.Documents.ETL.Providers.Raven.RavenEtl, Failed to load transformed data for 'ETL Script', EXCEPTION: Raven.Client.Exceptions.Security.AuthorizationException: Forbidden access to db1@https://a.some.one.ravendb.cloud,  does not have permission to access it or is unknown. Method: GET, Request: https://a.some.one.ravendb.cloud/topology?name=db1&first-topology-update  
+  {"Type":"InvalidAuth","Message":"The supplied client certificate 'CN=\*.some.one.ravendb.cloud(Thumbprint: A632C1DBD145B2102CB70D254B7EC1C813444766)' is unknown to the server but has a known Public Key Pinning Hash. Will not use it to authenticate because the issuer is unknown. To fix this, the admin can register the pinning hash of the \*issuer\* certificate: 'jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=' in the 'Security.WellKnownIssuerHashes.Admin' configuration entry."}  
+  ```
+
+    The Audit Log will contain the following entry:  
+    ```
+    Information, AuthenticateCertificate, Audit, Connection from  with certificate 'CN=*.some.one.ravendb.cloud (A632C1DBD145B2102CB70D254B7EC1C813444766)' which is not registered in the cluster.  
+    Tried to allow the connection implicitly based on the client certificate's Public Key Pinning Hash but the client certificate was signed by an unknown issuer - closing the connection.  
+    To fix this, the admin can register the pinning hash of the *issuer* certificate: 'jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=' in the 'Security.WellKnownIssuerHashes.Admin' configuration entry.  
+    Alternatively, the admin can register the actual certificate ( 'A632C1DBD145B2102CB70D254B7EC1C813444766') explicitly in the cluster.
+    ```
+
+{PANEL: Background and Current Situation}
+
+### Background
+
+* **Original Problem**  
+  RavenDB versions preceding 4.2 presented the following administration problem when 
+  ETL or External Replication was defined between two secured RavenDB clusters:  
+  The destination cluster trusts (explicitly) the source cluster's certificate.  
+  Once the source cluster renewes its certificate, the destination cluster would 
+  no longer trust it because the thumbprint has changed.  
+  To solve this, the admin had to access the destination cluster and manually specify 
+  that it can trust the new source certificate.  
+
+* **Original Solution**  
+  To solve this problem, we introduced [Implicit Trust](../../../server/security/authentication/certificate-renewal-and-rotation#implicit-trust-by-public-key-pinning-hash) 
+  by using the certificate's **Public Key Pinning Hash**.  
+  Now, if the source cluster renews its certificate **by using the same private key and 
+  issuer**, the new certificate will have the same Public Key Pinning Hash, and the 
+  destination cluster will be able to trust the new certificate.  
+  It will also be registered (implicitly) for future connections.  
+
+* **What you gain**  
+  Using this feature means that you can drastically reduce the amount of work 
+  an admin has to perform in a multi-cluster topology and gain a system that 
+  is set-up once and just keeps working, **as long as you keep using the same 
+  private key and issuer**.  
+
+---
+
+### Current Situation
+
+In September 2020, Let's Encrypt changed their certificate issuer to support full ECDSA 
+certificate chains. You can [read about it here](https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html).  
+
+As a result, RavenDB users that use the Public Key Pinning Hash solution need to 
+take a few manual steps.  
+
+This is relevant for you -  
+
+1. If you use RavenDB ETL or perform External Replication between two 
+   RavenDB clusters.  
+     * If you use RavenDB Cloud where certificates are renewed automatically.  
+     * If you used our Setup Wizard with Let's Encrypt, and certificates are 
+       renewed automatically.  
+     * If you used your own Let's Encrypt **cluster** certificate, and you 
+       renew it yourself with the same private key.  
+2. If you created your own Let's Encrypt **client** certificates, and you renew 
+   them using the same private key.  
+
+{PANEL/}
+
+{PANEL: Solutions}
+
+### Solution 1:
+
+{WARNING: }
+**Note**: The `Security.WellKnownIssuerHashes.Admin` configuration option discussed below 
+is **obsolete** starting RavenDB version `5.2`.  
+If your RavenDB version is `5.2` or higher, use the [Security.WellKnownIssuers.Admin](../../../server/configuration/security-configuration#security.wellknownissuers.admin) 
+configuration option instead.  
+{WARNING/}
+
+
+Register the pinning hash of the old issuer in the destination cluster. In settings.json, 
+on every node of the destination cluster add the following:  
+
+{CODE-BLOCK:JSON}
+"Security.WellKnownIssuerHashes.Admin" = "jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0="
+{CODE-BLOCK/}
+
+The hash in the example is the Public Key Pinning Hash of the Let's Encrypt X3 intermediate 
+certificate authority which was previously used to sign Let's Encrypt certificates.  
+
+This solution is stronger, it ensures a smooth transparent transition when the source cluster 
+certificate will renew itself and the issuer will actually change. The advantage here is that 
+there is no downtime.  
+
+The disadvantage is that an admin needs to access the machines themselves. They need to edit 
+the settings.json file on all nodes and restart the RavenDB service (node-by-node for no downtime).  
+
+---
+
+###Solution 2:
+
+1. In the case of ETL or External Replication, go to the source cluster and renew the Let's Encrypt 
+   cluster certificate. Then export it and register it in the destination cluster.  
+
+     * Click `Renew` on the server certificate in one of the nodes of the source cluster.  
+       ![Figure 1. Renew Server Certificate](images/renew_server_certificate.png)
+     * Export the new cluster certificate:  
+       ![Figure 2. Export Cluster Certificate](images/export_cluster_certificates.png)
+     * Use the destination cluster's Studio to upload the exported pfx file as a client certificate.  
+       ![Figure 3. Upload Client Certificat](images/upload-client-certificate.png)
+
+
+2. In case you are using your own Let's Encrypt client certificates, simply renew them 
+   (on your own) and re-register them in the certificate view in the Studio ([Upload client 
+   certificate](../../../studio/database/tasks/import-data/import-from-ravendb#step-#1:-prepare-servers-for-the-import-process-(secure-4.x-servers-only))).  
+
+This solution is easier and doesn't require access to the machines themselves, just an admin 
+certificate. The disadvantage is a short downtime in the service, because you must renew the 
+certificate first and only then you may export it and upload to the destination cluster.  
+This can cause some delay in the ETL or Replication service.  
+
+{PANEL/}
+
+## Related articles
+
+### Security 
+
+- [Overview](../../../server/security/overview)  
+- [Certificate Management](../../../server/security/authentication/certificate-management)  
+- [Common Errors and FAQ](../../../server/security/common-errors-and-faq)  
+- [Implicit Trust by Public Key Pinning Hash](../../../server/security/authentication/certificate-renewal-and-rotation#implicit-trust-by-public-key-pinning-hash)  
+
+### Client API
+
+- [Setting up Authentication and Authorization](../../../client-api/setting-up-authentication-and-authorization)  
+
+### Installation
+
+- [Secure Setup with a Let's Encrypt Certificate](../../../start/installation/setup-wizard#secure-setup-with-a-let)