From 8657207c26ceb7e7a408d13a20c1b8eee6779773 Mon Sep 17 00:00:00 2001 From: Wouter Kobes Date: Wed, 17 Jun 2026 16:56:56 +0200 Subject: [PATCH] Update toolbox wiki to 2026 releases, initial commit --- README.md | 16 +-- SPF-how-to.md | 26 ++--- .../20210506_TLS-config_NCSC-NL.ods | Bin 8368 -> 0 bytes .../20210506_TLS-config_NCSC-NL.xlsx | Bin 15850 -> 0 bytes .../DNS-records-overview.md | 29 ++--- .../Nginx-webserver-100%-example-config.md | 0 .../STARTTLS-how-to.md | 0 images/logo-internetnl-en.svg | 108 +++++++++++++++++- 8 files changed, 143 insertions(+), 36 deletions(-) delete mode 100644 TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.ods delete mode 100644 TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.xlsx rename {under construction => example-configs}/DNS-records-overview.md (64%) rename {under construction => example-configs}/Nginx-webserver-100%-example-config.md (100%) rename {under construction => example-configs}/STARTTLS-how-to.md (100%) diff --git a/README.md b/README.md index 312c3b0..c536316 100644 --- a/README.md +++ b/README.md @@ -1,18 +1,18 @@ -# Welcome to the [Internet.nl](https://internet.nl) toolbox. +# Welcome to the [Internet.nl](https://internet.nl) toolbox. This GitHub repository contains several how-to's for providing practical information and guidance on implementing secure and modern Internet Standards. The how-to's are maintained by the Dutch Internet Standards Platform (the organization behind [Internet.nl](https://internet.nl)) and are created in cooperation with industry experts and enthusiasts (hosters, vendors, etc). -Feedback and/or contributions are much appreciated and welcome through issues, pull requests or via question@internet.nl. +Feedback and/or contributions are much appreciated and welcome through issues, pull requests or via [question@internet.nl](mailto:question@internet.nl). # Quick access -[DANE how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/DANE-for-SMTP-how-to.md) -[DKIM how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/DKIM-how-to.md) -[SPF how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/SPF-how-to.md) -[DMARC how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/DMARC-how-to.md) -[Parked domain how-to](https://github.com/internetstandards/toolbox-wiki/blob/master/parked-domain-how-to.md) +[DANE how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md) +[DKIM how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/DKIM-how-to.md) +[SPF how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/SPF-how-to.md) +[DMARC how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/DMARC-how-to.md) +[Parked domain how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/parked-domain-how-to.md) # Interesting external sources -[SIDN Hands-on guides](https://www.sidn.nl/en/cyber-security/modern-internet-standards) +[SIDN Hands-on guides](https://www.sidn.nl/en/cyber-security/modern-internet-standards) [The Internet Society's Open Standards Everywhere Project](https://github.com/InternetSociety/ose-documentation) diff --git a/SPF-how-to.md b/SPF-how-to.md index 52e2e84..4923da2 100644 --- a/SPF-how-to.md +++ b/SPF-how-to.md @@ -1,13 +1,13 @@ # SPF how-to -This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on implementing SPF. +This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on implementing SPF. # Table of contents -- [What is SPF?](#what-is-spf-) -- [Why use SPF?](#why-use-spf-) -- [Tips, tricks and notices for implementation](#tips--tricks-and-notices-for-implementation) -- [Outbound e-mail traffic (DNS records)](#outbound-e-mail-traffic--dns-records-) +- [What is SPF?](#what-is-spf) +- [Why use SPF?](#why-use-spf) +- [Tips, tricks and notices for implementation](#tips-tricks-and-notices-for-implementation) +- [Outbound e-mail traffic (DNS records)](#outbound-e-mail-traffic--dns-records) - [Inbound e-mail traffic](#inbound-e-mail-traffic) * [Implementing SPF in Postfix with SpamAssassin](#implementing-spf-in-postfix-with-spamassassin) + [Configuring Postfix](#configuring-postfix) @@ -19,22 +19,22 @@ This how-to is created by the Dutch Internet Standards Platform (the organizatio Table of contents generated with markdown-toc # What is SPF? -SPF is short for "**S**ender **P**olicy **F**ramework" and is described in [RFC 7208](https://tools.ietf.org/html/rfc7208). It offers domain owners that use their domains for sending e-mail, the possibility to use the DNSSEC infrastructure to publish which hosts (mail servers) are authorized to use their domain names in the "MAIL FROM" and "HELO" identities. So basically SPF is a whitelist which lists all servers that are allowed to send e-mail on behalf of a specific domain. The receiving mail server may use the information (a SPF record) published in the DNS zone of a specific mail sending domain. +SPF is short for "**S**ender **P**olicy **F**ramework" and is described in [RFC 7208](https://tools.ietf.org/html/rfc7208). It offers domain owners that use their domains for sending e-mail, the possibility to use the DNS infrastructure to publish which hosts (mail servers) are authorized to use their domain names in the "MAIL FROM" and "HELO" identities. So basically SPF is an allowlist which lists all servers that are allowed to send e-mail on behalf of a specific domain. The receiving mail server may use the information (a SPF record) published in the DNS zone of a specific mail sending domain. # Why use SPF? -Our current e-mail infrastructure was originally designed for any mail sending host to use any DNS domain name it wants. The authenticity of the sending mail server cannot be deterimined, which makes it easy for random third parties to make use of a domain name with possibly a malicious intent. This increases the risk of processing e-mail since the intentions of the sender (host) are uncertain. SPF can help the fight against spam and other kinds of unwanted e-mail be offering a way of authenticating the sending mail server. +Our current e-mail infrastructure was originally designed for any mail sending host to use any DNS domain name it wants. The authenticity of the sending mail server cannot be determined, which makes it easy for random third parties to make use of a domain name with possibly a malicious intent. This increases the risk of processing e-mail since the intentions of the sender (host) are uncertain. SPF can help the fight against spam and other kinds of unwanted e-mail be offering a way of authenticating the sending mail server. # Tips, tricks and notices for implementation -* The sender address shown to the user ("RFC5322.From") is not used when authenticating. SPF uses the invisible "RFC5321.MailFrom" header. Combining SPF with DMARC removes this disadvantage. +* The sender address shown to the user ("RFC5322.From") is not used when authenticating. SPF uses the invisible "RFC5321.MailFrom" header. Combining SPF with DMARC removes this disadvantage. * E-mail forwarding is not supported, since the e-mail is often forwarded by another e-mail server. * SPF does not work between domains that use the same e-mail server. -* Parked domains should be explicitly configured to not use e-mail. For SPF this is done with an empty policy (not mentioning any ip-adresses or hostnames which are allowed to send mail) and a hard fail: "v=spf1 –all". -* When processing incoming mail we advise to favor a DMARC policy over an SPF policy. Do not configure SPF rejection to go into effect early in handling, but take full advantage of the enhancements DMARC is offering. A message might still pass based on DKIM. - * At the same time, be aware that some operaters still allow a hard fail (-all) to go into effect early in handling and skip DMARC operations. +* Parked domains should be explicitly configured to not use e-mail. See the [Parked domain how-to](https://github.com/internetstandards/toolbox-wiki/blob/main/parked-domain-how-to.md). +* When processing incoming mail we advise to favor evaluating the DMARC policy before the SPF policy. Do not configure SPF rejection to go into effect early in handling, but take full advantage of the enhancements DMARC is offering. A message might still pass based on DKIM, even when SPF fails. + * At the same time, be aware that some operators still make a hard fail (-all) to go into effect early in handling and skip DMARC operations. * As stated in [section 5.2 of the RFC](https://tools.ietf.org/html/rfc7208#section-5.2) the _include_ mechanism is not applicable to the _all_ mechanism within the referenced record. This means that an SPF record's default policy is not 'inherited' upon inclusion. When including one or more SPF records from other domains, a default policy (~all or -all) is still required. For fully 'inheriting' another domain's SPF record, consider using the [_redirect_ modifier](https://tools.ietf.org/html/rfc7208#section-6.1). # Outbound e-mail traffic (DNS records) -SPF for outbound e-mail traffic is limited to publishing an SPF policy as a TXT-record in a domain name's DNS zone. This enables other parties to use SPF for validating the authenticity of e-mail servers sending e-mail on behalf of your domain name. +SPF for outbound e-mail traffic is limited to publishing an SPF policy as a TXT-record in a domain name's DNS zone. This enables other parties to use SPF for validating the authenticity of e-mail servers sending e-mail on behalf of your domain name. The example below shows an SPF record with a **hard fail**. > v=spf1 mx ip4:192.168.1.1/32 ip6:fd12:3456:789a:1::/64 a:mail.example.com a:mail2.example.com -all" @@ -44,7 +44,7 @@ Although a soft fail (~all) is recommended in order to prevent false positives, # Inbound e-mail traffic Ideally incoming e-mail is processed by making a **single decision** based on a collective evaluation of all relevant e-mail standards (SPF, DKIM, DMARC). Although this would be the most elegant way of processing incoming e-mail, most e-mail servers process e-mail standards in a sequential order. This should be taken into consideration when configuring your own e-mail environment; depending on a domain owner's preferences it is also possible to implement a "single decision" e-mail environment. -Thereafter, it is [stated in the DMARC RFC](https://tools.ietf.org/html/rfc7489#section-10.1) that some receiver architectures might implement SPF in advance of any DMARC operations. This means that a "-" prefix on a sender's SPF mechanism, such as "-all", could cause that rejection to go into effect early in handling, causing message rejection before any DMARC processing takes place. While operators choosing to use "-all" should be aware of this, we advise to favor a DMARC policy over an SPF policy. As also [stated in the DMARC RFC](https://tools.ietf.org/html/rfc7489#section-6.7), the final diposition of a message is always a matter of local policy. With this in mind we feel that operators should not configure SPF rejection to go into effect early in handling, and thus disregarding DMARC. At the cost of processing the entire message body, we advise to always evaluate all relevant standards before coming to a decision. If SPF fails, DKIM might still pass resulting in a satisfying DMARC evaluation. +Thereafter, it is [stated in the DMARC RFC](https://tools.ietf.org/html/rfc7489#section-10.1) that some receiver architectures might implement SPF in advance of any DMARC operations. This means that a "-" prefix on a sender's SPF mechanism, such as "-all", could cause that rejection to go into effect early in handling, causing message rejection before any DMARC processing takes place. While operators choosing to use "-all" should be aware of this, we advise to favor a DMARC policy over an SPF policy. As also [stated in the DMARC RFC](https://tools.ietf.org/html/rfc7489#section-6.7), the final disposition of a message is always a matter of local policy. With this in mind we feel that operators should not configure SPF rejection to go into effect early in handling, and thus disregarding DMARC. At the cost of processing the entire message body, we advise to always evaluate all relevant standards before coming to a decision. If SPF fails, DKIM might still pass resulting in a satisfying DMARC evaluation. ## Implementing SPF in Postfix with SpamAssassin **Specifics for this setup** diff --git a/TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.ods b/TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.ods deleted file mode 100644 index 33eff0a06eb32a1ea63ab58b215a679627a7e641..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8368 zcmZ{K1ymf(y6xZ)APg4VHMj+L2@u?!VQ_bM1`RT}1q~M5EkJM&4qGcPdgW9PH$&R4i~V8od<`DtCh2*i-nhym9r;@hpW34*wVw+%F0vyFDC&2^y29vr?-jwgnjYCG?N!F3BSeLVI*#048Le3A&zTF9Gm z2rE7HZn;;Mjx7VAuyqssL(t}O!7?&F)}DeS5k0N9HLPiKBA9pM=go<=1}ZGeO}dIt z+24(Li=|ko!rJcs;LG_ zbtk04;A5Bi3jPs8t9oB9jfpj|9JAQo=RUpdu8l@Z8#74>FW!aw0 zgo)KE#CvL{@z}Bgllf^LbH(clo3j}5p2TE90SH(H?U&L2IN;00)JS~%z30Ac^x8jd z@^Q>n@PyUQmOR}?wa!_;qWP*iQHd>Y{7I4X$Y{ONK$-j49t=h92*>G(D*yF{u+V=R zZaeFRZ3tkC2AfF_VqOopI?}Zl0>7b*yQb|_@9tE)y-rBs>Kt^<~gp4pXlreRZ&nXk3ed=_Fh~#OJQd06-X+ini zE80SXnu;{OC`fHTVib#WMd&f^l?IfHgMn3vhRWc{u^uyHJXn?3*nRQ@!YF*|qmWLQmE^91{w{N7r>f~A^D0!uSn{e|=BE*=tcRlKK}+=~v`Hq@Zg z)?P)QbHU?}9IBn#1vWk__**Dfv#;$UVTyNvja2&Ek2;4g!EZzKgEjj^4_PN z)R8yuqK+w`(E-bW%%C* zFQ4u@EweYdQqG?n>2t}4Qll*Rg+4GY`W^4ZX}k_jvX?N-Tlbi^n3f7C6BAw0Tx-KL z>9xOfei-v8t=e4ueK6=U$rQ{>P34UARi_=%Aht6+ z5R>!iis#r%Yhq}qNiUJ{OJy8p`?@+aI4C3~DmP=Wv=5sQAqj%29`vzOWc!ssZ_Qbw z^<6R+O5nkQF!>pOi)qkjL)^xRG@c8wHTy|LLgqF!wAS`{9hk-W2qn^qWKh0XtH}HS znsH$nL0t~H)LjZ2SRaNh+jWbljw`QWZmos#pooVz`cncl^wrkhg1ZRtlDd!N+}I_>KhkJ z*_gltDrd3eU6WPGz*8;abGNi%x^WxnUz%pU^{M&8hvN#pNQX-_*X)POv?U#Ord&T_ z+EO_l@~msC7o#dHCr3gtJw1ur#jsgz4-5}rT*z@VN1KB9qNDpUeR{QIX@R$YgrhTM zZP6+SPfaKE5i)71uO4|Nxf-MS1hAp)0>rPOJNNgy_spsr6g@_p>*1?O-|bujsdby@ zt#i2TN8rLXwecnb6RuDq!Z*e)wscvRNFFwQCEE-|@sffS*0!XJX$Yx!Be8~Z%PtNC z+%1>7z~Rq78P#H)8Oy+^6$#o2n2N8(#IOz|;orBASZoo@g~heH{tz zP>-8`wwr00-Iw@u)w+DtNIb`WN7>T!)B6~dkNff^TkRE1PVo7@QECj)g$pD9+plbn zs0>5ZxCcevKBkmypUT<_ioAqL3dRvFwR2p=NA!udcAA=+=DYFy!>y4QuuE5UJPWf4 z7-Z&&t(@cM>LnTU&UXy83LNfkB!C1c3akAzakj;}H$ti>so%IocHacS3j8L)oItTlR*K|QTZ8~WFgXGM^Y0ZFF3z6+ej~jJW|af`psr1wXas4t2&g^C+(?|+AMnzMFsPBa<&+Ajr{3fMhiqi z`SfU8a)tCO5z4>JiyekreGy)VhMxx>NdKBwQ?tMkO9}nDAmOBMT@@DNqBU|G{Ussf zx3?9!01&g`+$`~Nx0#!+`f`4m>dz5A1(tEn4Y|F%#ddU*%5PvWo$a*EH=u;Cs~5q& zSZwxpe{o8DLC3qpi2EZIv7_z$LlJRcn+Y5)i+A)VNi@>xd>=L*)a0sb>h9JM*oMDl zx19gb!Zmqyiew1iXWA!0detPJzcmv%mXYIkW&HAFXF(8^YT6`}r#fjjQqos%mzSH% zH?;h|Q5~9RBJdGW&3JD~WgEAx*BR#R)SE7={ z$q$8=7MX6)N8q#f)SkWc&q# z|Mjzy-0RVZEv#!*GNco39x9HBH-te*lRQNB?+in?M?#iUmC_H<(vug*vjn&EMUAY!}*G_dZn{tJ#?yuLx^yea~Pdf@Y#@$%frJf6QA6eQy-*3mTDhNXlJDG6cx+$f~8U z(A@HGhcqRUQhUFD_XPIi#+^p)=6?xhPh`DFtw@BgF=Q7og3=yCCw`*|u4TMKD1I{y zIn1I`T{R8janKQGCm;zlYM`WtFRPKo``4!O_qZye$D!#-){ogrKhEy7T7qznQ?muX ziLXU23srR$Po>As*E5XRv;@J*Rs7AZHJ=Hn-WdOYt3LQma~gC_q)U4lh|kq-e$+Cn zo#Q)-2v=DV*>fq2Yf^Elne0>gEX#nBsv7euK>T6N1!Nu3ILA&^_Z?~wVi>`>5H~Dt znTuaxkpx7uLd%r@g9zy%!?Bb^x@h;+<=Jc93Y8`sUhwLlwJUb;POLubb7OiyOP(C0 zmyJiCw#FKpd=>)(D|}s=Z6y}DvWjACBUN^a1_Y@;)F~B|YWA6CgN!IBi#7ZOC!{W`wXmdv%9h5%( zSQflrd^IM{*Lj-S@xFn3z}ME0sllW=_$|M+cxTySE-6-$`?uWL)AMUTMC6W-QkAUd_r|bx8t@@rnrE0^`cXaXJ$qCw#41$W_39mz-a|&_w5ONRVP$~%*)cJ z4aS^xf99r%OQ_pq5c)J>I2uMLpkqvn4`E_h^?2`oBy|o?PO77lIeL4MPjX38{fmyx z))XG^tj=KnJeU;JGHs(7a~*Bm?p}fcG7qK!txz(JbUKgl8UTOI9VfcrxYylM4~6{ z-|o3%E$y>#qlaRUF#ZfoaU)-WPQ2_g5aLohclWlu-N9a;FK7bZAO_%ar%VJB_cAI3 zWUPkPv$=#z(D4c(d3~TFd|Xh5_ECv`B9yqG)84){F^s+zKaZj4i^`!%6ve|?ho3(V zpQ?OYSCZ-8mwOb)P}!8>5Z!K0ht}vG7tBT=3im2kDXM?i5&W2}hr95$Cr0j(fzclP zpmVEqXj=`+Sk@pjdDK@^)XC_0l&;Wn0IdNSjdnNfPZd^Jd+^H^f8^WA8##F%JB*kN zQaOA6#K%(IY>2MUY7GRqDxgco08W)X)XUbInzH(YD0; zvbNrs8hq;PBwOGXC}S*e`=-5X2Bmp1t@@=z?5^~~e?{cCt;271{soZ|s*gCYp(;}d z(_JphX#1a6Z>eio&BM~a>c%w?PNi=TTe&&8cM+s#feeTPNBg-SS~KX#kK0-Z+JKHO zKhRYdNf08`pwNw@_ycMA2SS1-)5RXn6{7W>aHMi$ebcIOfoL{6XBa~sQ=dwVGkkq4 z2KkN+;_E2o>tVMOE4vyCULw#0T^_Q$a1 zUf$YQi8Liz1FDIzlAdC5=r5=V(CD`!U^lhQcdh-~*`~;7_8GigZ)#nXxnIg`|F)lF zT;n^+!ePoqHvHdC5i<0pSj6tkT_HB_ivbNJ^kySm`(qKPG!R(a=eIrN z8$1z#(&XEc-C~j)iQU%%cUx$%9mUWJGAIxm0iMdZq{i?Zzc==Qf2jZBAUg~G;m_r^ z=ROe$Kd5!|)KXl$K2SXTwK%QOQiDE1tAL`1iYBy2apxrK5OVeI&G#6NZd1kq))w_2 zqcfA1p=+#%Z#qsuYk71tUpBWgCpVvwXHCdccshz{=ODsX)b*6I3bSA#%ppf+Y>?8C z9!&(Xsf*ObgZS1`&T>hYH)bbe>bqjk6@}0O9>75-(F6zT3}`C>B5FC%&@?z$UTq65 zfE~0Q-1;yxN&C4g>tiv_d0ozc+cB@RiYNNHm|bkfRH8Eveh3#oAQ)b>_I)aLo?B{7 zHpu8Wn7PlJ0Qxn`FHtR4eO;VgBX9#cGG;M{fxjKIIq8v1zy(V4<)f@pK(rt5@QoUB zN>z+WX@yFAuv^jHl&YSyIh=JM5RMPtAM zb;z{v=9m$T`3cZhLlXj+YJbW~6-i0Avx5#s1s%p0`%}$rgD2w(jlub}{*cB`Z)D*F zEuIMAN6_@o9`EBnFpzU_n{W*hloue>Qp*)l#v>oUGoc$XV>=(fX7Gg}EcAWOjf#F{ znaQU?(qH{>BqzawhLw@G1j_m;nT%=%9{@K7X<_l262r_u6E;9<9gS7q!f(e#u zE*3Rkj(2VZ{hf5mQ;$i=)1$q-b9#VQ%X|^J(Mp6mS>mT6&2EWKH?fOB%^KlB&{V3J?z~X z=t|YiBesZrA$bd)_i0)3Rm+E#!FWNeQqx)fyk@K@O>lGE`^Aqm4qV$PYz{g(c3dkc zfA>2!B)ZewOU^}8I)hrU!hkwfe*jrW)VJwtTOW}$nd6YNIvuPE3t8d!C1>0A;>}Lt z^j9TzY3QNlx}fKwT@ogl(3m@nR}~mdslXC_NtQ?md($5#*^;vjt~@;9+A^is?`3X| zHm>nZ8-NjS#-j|$>_$htfqI+D`AaITSb^BF702a<V(|aAcVm^q}aN+Y=Ox;=)lQtgms=YD`nt2LmIh`gpd_n+0 zG3G9cPLmX}L4;hvO(d714v|&-%kjaF_cL>I^K`mcJIu2*HJ}dNLn*Ed_vDn8IAljs z`g3Sa$@KhN`4ED(Bii^df;%C+Av%rYZa!xwH%EMFr+nGpwbo#Q7Fikf4Q!4&nalKm z?U7PonmBJ`9-6*8FfF!-3bdTs;f5_+H~Q|^9p)fsk7^jYySr#^T33LgP)xDyp6Rai z+GnNqq(-(qm8hbH6enHy5kF1ZzVzd4x>%s69EAD|>hyV>XC(Yh?9jXC6K7E)Uh2uv z#Q<|d|B5l5=Y?NeJqkepS5FhGbBYBW`c>DZ80f$t3p(*+i=MBfr`*NpT z7L~E@=`5Zwmf-H;!-&S1XdoC;Rnq_gld`Hr2?d0#ymZPRPE?0p^=RM8f6 zdbG&3=-d&H5mA>%9uPiAiCuN=lL13imuT`^I`g z%x{p0SyL0QR9S@pzi!$*LmRi0ZA7(ykuhQ}rWn_z09QUCZvk1rUfR*zsAnBf8C##U z9*$GrnsGGUC7idH`OIcgDhuD)a}(Z#uLQ2Lw7SjN<_E>9#S~ms5$FqspIgH(iRZ@n z5u&T^=cMm$N*Y#O7&eA;Jr@ov!EYB0KDPSTMOGQkWZcFZKj1pfR!)L4u3mLD z$Glba>R$R$!bUGF;0MH2vNFtGJy}t3w3JQdi*Z?1QCr;7E{kkZ%bf(sjV; zrPgI_r!JT6Jt2lW7Sm)qAJK>8C6Tf4QPTme-hYV6Q@;7Z9pf{xnY9+p= zrB=w+>*7#!IWWC1vQGF;YADuL9cLOu_0rDz;WWWDRA0lmvQiaI=zAoT&aju=7jeekn4ESVb5}DKGz6?)WJsnwy0eLpQyh+2^8Rpk)?*ohqT<=vU4N5X-Q}G zF5bVrp1pt0Fi;+mHOA;kC81S=qd&>uUEBAn<@5(%Q1n&xS<_vnxlUyKq|7e8U}T&P zKUgU$<$kTW1u=xu6~2Ae{Wb8?aE+?GMuX%EBS)6#+Y1K`ddzSY&PFtmnTh4H)nhc6 z2=2Mc{XVTsgsN8KPg!?`aT6dQ)y|KZJV#O02ED;Xtv$t)cxoe7ofjUsx$fKTXEeHkz9otwk5>U`x(hE9(It-@|0Bh2C6DU}*Is7cBv z;D`n{3viEmS|rY;S6H`;`$Y2z8k1pWCLl()*_n|E%vz=Seo}IV z7|M;~e$Rf`{7G?xg#c2Lsx=m@dR<7H>uGgPMRkyVjM>!dbo};qCpExl+Zur@N za!ItDx;|TwD|eCvAse{#YszlG-YXGjWu$6_GbXt9{Poyt&8bcm0yKbh}ry-vj|Bqn{~tkx$dRp^r`NQV#+aoAFbQbgdj3{ z$z>wctbA2EK+%`t=RB6Q{E6krPUpck2WgBVE;Tv)0J)j-QQCxr&lshm)tooGk!7R0 zM)o6NV4-_2#Q=x&SiZeZh9wv}2Voq%zVIV}+SWh3>xz*Mh^WQ)PdL*IP6)nr9ra;* zOv>jAI^PjCxUZM|eMDcMIvC%(- zy2=;#ZY)6*Z^Ij6&2Eryi8cf1mQubXcpkf1`WC8LliG(nEji|jd3bAVx}tpTTiT>=tKK8v0so&Uu|~bj)=~g`@83_%KP64!O`P5mrH+p2oM2)zj`o0MNV6aT~YNt zrxV!O&f3c3Uy^Wjl9W9XHWAWB+v2emqh1)k2n2FM-@cM$j;$nxcjvKbvc5whQW`G<%F$~fS!>=E28jo zSU{u}7q6upgiw-#p<)_*AcP5@x}W@Xvf{L{t%+m?i}8;Bzd#ERn+Di{grp3^k^CRt zmcrg}g@C8E8e-1>_EQKTmsm6)0081h|7Foyd4m5D#N#!;JFjv9yNC`YfTEd2wjy@2 z3a@5})SIP{mL_QgqKwC6-_B82tUNqvat>Tp$e&G|Oq?}#NqC|DMxknMBD6Mu;_4rz zwK_$HoOdUS#7h(CV(hSK-xDHs*KPK&n#|i`7z-`?n9&_kze@YG+{;wn|E+E9Ve-1)_VvOWCPx(|4@tyBhLHw`T`$6m7`X;bTk~8iKw+mJP+Gvv`umGFv@1}iTb9C+v?8}|ncaBn#R;L>PAt0&sD$Io6(Stz zk^XtNhgu7AnQo59K)X;Cn4a22Ewsu#45Jca&9_Ny8|*XJ;7Zv{diEYUyMK&w(br@< z+(lqfu`{9tm4>O;33z<3dNgYMbf+hAc6FM*6`$@Y{_MHE*Ydo6*$Ml%)q#M>{x3)T z?|%mT|K9sQXa8OPj}x!1^bhKPcGv%n(EfY)Z?FA7asO$p{2Q0}*Q@`(jF$fd{^wBq uH!zF*e;AnmN%5Z{{BMe4ioa_P{wtu>l~DdZ2>^idcccCr@cvZ)wEh>E=zb>v diff --git a/TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.xlsx b/TLS-config_spreadsheet/20210506_TLS-config_NCSC-NL.xlsx deleted file mode 100644 index 1ea87cc599d45eb9a5fd9052d86950b919364227..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15850 zcmeIZbweG?vObJkfS|#H6P$%>g1fr~cXto&?(V_eg1ZC>?tz87yX$XdAKB+*@B6+V z;NJOTX3b33v$}h#x}>Y*Bq5gbW=v}QWiM~QXQ09O^fZG4x@xOQmMwEuEdjKfyst3G69V&f%1*N5M_$~OF zWP7kFt^%}Zzzal-mk#v0;!?E$K68dpeUB9;^v)Gsb=4sV2wW59NpT*$e zX?{lyz_&~;NnHxzxQLUd?R>dAnB-NG+S)X!*fepw*UdrH=szBRY=x;6e^z@A&)*K~ z*~-!SRE5JOOvq!AVT>f9tjw%ZUY(Zp|qErO_@~uS9<9T3U50>a{2lS2`2Yn5?ikfAiV;y zp%h3U-+&}m$KJ@&fr0+l`Tr#Kf3bM}$I#2;q-A>nh(V`fPr-w?v&%6k0+KHLVy(nV zUOwVWZ|fuT$ncgsKj5P%;rc_0dbfK${QxfWL>>$h-)yjyhofO|lQy_i1SLP%Il)p> z*e8kDm9O`qI?rCu-lU33xKTQ{M^l$I73WG0t&)mNp9|HXjMJ;)!lM`92fh24>Z{Q& zt-hjvR|!5Vpm{rL->Ova!B2@BdC)41pWdCs-B#y6Jp;Y_zacKF`1!LuR1 zaKhr1zZH@d_-9H8(3=@ZFfd#&IB-`>hJVP3i;ca7zKxB=FU9sRnE?lBH&EOE-A7ye zxH*Vt`cM7a{U<%`;;fAlxY{H5t2A%HDC9RL`q+|gKG^Wa3%2kL(dT0MlRbIzP82<_ z7oGND!I)<%$BV~?-^pzb=?9N=Bh%BYkA5LlRHC14IUA9TfArX^MQe+- zwLu%KF+&v2u!9LAniLJPfgy^}KBB7LE%uk&rJg}D40IT3js0mI_`Nh?FL^Kp5erRYQSYNIAdA={LSAjvz7NJ=+dAi zb`S~->@A2jKpga+ypyjqYz+jUv|;V>RtNZI=zomE4br7D&4gh@!QkJdNCpF^tDx=q zQcR`{T%DBctkRh(z^J$XB0d@37wqh8;;d2^o{6!=jXhj1Va9??1)g~5SLP(qNna&X zl%O`C)E%G_Gxbr;J+|GG8E9UoZq`l=mt!eGvwJ`WXQ}OL=v;0g=c;Hg3C8_Y_S)%Q|MOD9z-18YZq63c6oEmLt@pz)dP8mFh;lw7 zNx}TkCi&0E>FZ5CRp+H|-f~IXS^7Tstz0eFk{t^ptv6Y{b1%wcHbW=AWdb&eVa(Np z<&DSZkPM#_r(C&^&O5kUVLB@D5%9Cub7enuSw}{3F0#v8`C}Q>wlyE_B8@I;(|=*6 zVuT+ERL8I?L+$}sj~yZ))*xvZU}L|9Fwp4*oXtmP=M%o`QD%?ip!V-G@xQA}64c>v z52c}OV~y?Cy_MQA`;dUot7UguEV=VDO#LisG_~nc@nxiJLm2#JSD-HbyClVjQ;|#g zjEG9nb6V^zKDxJ;q^40Yw+zw1q27H>wj-XXL4CXWi^DGgfp6_8ohEmn^!fgdh&gS zv!Ch%ty$}=B<6hgP)MXWlT~YDkiWvTQxo41wtUiBLu=Pkd+qbNX!2xIh;0NxarPPA zj58^*vF0`tAwT0r@=wGMXI4E^*zm5>McZ~^GF{eEAXX=*90(z+jL*RyIr%CCNRo&j zT-L@tRWv0={roP%)SXD$pe_g^I=U3C2a6}a#38~I7#P%lWEgS^Kc5@&=5E57=3t!8 zMu$GHq74lb@4);T=76CpSrwabRw;e|%67JR_g;HKeL)qBdd}`ygm({?#sk4egmllm zU$}AKMRPeT+kjQ>#jHqs0ROcKzvZF~5O(6MXh5aFrplc%Rt3t37v zU@sf(gQ1{_#}b8-zGLR$Cmq~Gk+)AlGl`ZW9c;sqzz*J!s9-9dS?_#uI}mS%veL_+ zP3rSO(4mP7!2cvMB=v1sw!5^9Ka1DH`QdDTzgI_=@FSP!ox@54lhF*2e@Ln7_9D3I z<>AC(cU-5#`~L2*e80}Ma#QE&>U;RAmv^Gup51!b?kbPl`PI;+P3P0*z`(o1Obmj9 zGvZK2m&$eYU5fBr|93BU0M9zyUO3b|n6R#f?~Xb`FlUPp@_3cu(pW1p{Kl4DWtXim z^Zt~XZ}iRF*u#+4J{f!)Rw#pXHquNB4!$%rx8cb=Y)XeC04^fS>q9m1X8U%br4Ipm zU`FvUpzx&a`~pckYe*yL+FJ!f*5^H$Bydd7*O!Q8uu#h+gSIBb^1n_YhZ57j!Q+Rk zUr&Dq$|TEcR(ah06zZwwn-TB|DOv9?Go_caWaboNoF(W87BVDts}>XGsvL(Fau1_& zcrX}gt{A(b=R8pZ1L43Jd#-&DhwjR$8lqCqeSt?9;lFkuDN!luXo5L4mIW`jV1l}9KRI}!oV@Kp(#&{m zwza_>#$uQc6!3S&3U{h^jApM|`VcS$S(D=$UG|+jIMj^CN1(n!E`4}b#rj>hL5DoR zb{eCEOXf$PiI5O1YFal!XDQoP#jNx!dy{?++9&0jMf6SPhS?jv_osDs4F(k|+b1lF zZ=;0dwa--CMk_VJ>iKG< zH<_@LoU0*Xw~dg~5Qc!r2Ro-}HGf+h5B5`$IBbAPW+AtWsfCFH3wK|7EZ-fbi%CBf zTsU7d?y&!4XvL`H1~-;X%yi#4Zej``V31)_u?yj*o)W>-Jq`%RoJHPii@bBS29%+PLIo=>3 zWSa$EmzBQU=&Hw$5--6{-t}?jUtUr8VO-)V?{_h-+rB7{wsBI}er-mpC3zi_l4?FW z5DlXauC*63LH%KZp*6zXgf@vuaNTg>dy{mFgWqz}(_50EyXrRg(YrJ$Yg(u-g&9dX zwysc1YIT*Ys)m|E-d~ww*?hI@O@#$rJu=!Xmt+R>VMl*Jjyw%6bFp~;ArmbtHv?;l z)|wyRrBHRZO&Mp;L1<&24>45Q zhuZipDK_1ZCG>k-)T|6QiN%xWu+{UPG{Pim=}w)C1MPyDEADHBf!o8`4xNgtmU>t~ zO$cS>!$SKon9SEbl1@+gZ3}k5`9<~dRLFNDw$vC@dYX*`m_iL^Yu(DS(=j>inkHoM z$!5YCmIkKJY8QTC z`Ky+RxY`wS=eU{1tA{*;$&3@1QlIQ~d^|9#j{n|U)t!#=odzi}QILU6`llJ?U}|LK z=i3D04iA1IT=U%g(J6!dK-K1vwXT}f=$EBNDn@*s~H5mv49!nL3Ro0Bd%`a7bi=o zWtWGO=NFLv{;PuLwqla(2F-=Q|KFT2{W&Mm-C;cd4B=bI7eQB#__;ttK}B|wCgoj7 z{f9*uU~EbUASMBtVImTC2w$0A)Pe+|dM5(YdS zPmJC)eMcIkjEqF+K#UsZo0>p*vS;jGufBzvDEN|?Pdf|Zp>BYo`*6I8@=|lF3mw>R z3^Mhnv|FC4{#+jw)L)LGJPCQM^E$`GF2)1IIb(D`eHG&z6h6N2(dR#OxyiEdM20G~ z8X3O4f&aT1h>*98Km(cGecWJR*ni=QKltH~u_vT!IsiG)0#_T&U;V@0KC&fIDkN>y z@L;a$e{WSR8Pd)&3vE!36`~U!5chg!q0bNbgd}%~Ms>yy`2?3^C$w?VcnTa{)6^yi zvu_O9sFPHXsQI!ud;e_+`-#Q!1r60j>!8iay)R9pVOoYH zpOuRGD6_M}mAy18R~qgs+4xJp#Lv#W_FB~NvP?FVDfU>^9UKB*l9ij66+?>j6=!%I zCrqogv}kpljS@dv?X`3cm^GN|AHMS4S=E&O5WN4KE#H*8PpN(Rg@aHbziilvUp1%t zZRwL6s%Hqp`)PHSww4*67tO8H;IZ58@!BOXb)!-S<`(f|Z*Nr}_CmSk_@dgUQfh|z za8setqdKimcP~b=stqCilWPO#7Fs8-sl4;-_dy4%WRpaiv)>z^m}k|5WR0|vfxKbK z^BU1UX+N^cE=)S6JxAC%LrX5HUr4^nshI2kOkq@h?(AqwS1UEfmCrQAWyj=|GqDtY zC{3xpSz1Y@2wAJQHu{Oy*23duW4dyPdf$v&ez|*OrT8k}!Mk<9WOi3%vKeY_t!ynO z^NQRMnD&kZxAyemvR!SyDx6Y$yfEJMEP?RA13C$#tPv9YG5fytL{u}o`tae(>`+z# z`Z~BJeLB7u1%n{ylU0iA7iXD|)&iL;q~_YeUuA8IyP)L-Tev*gWk$;pG0tc6a$ zbcbk8axCAdK z?Ap)m$$;EO5)G|M-gx4Hf6?wIqUTDNej|kaqpvd@x>z& z@-4~9wYe*lX|Y~52rcZf=XW7tjNuPHah#hqEO95U#&u`tFq|?ru(>}>Aq131P--Qc z+0bB#xMQPccT1eCx862JsV;fec*-Um=0!@(&t3J#u3)yHzcrEc|$3BchA zhfiPxpnQcu`3i-CD-K5tb54|h7>`n_9~5IkMQVpq%X&U1*20sr@g9>0Cl?|FezclW zk`x}bm*~ik5D$9U+Jt1fQbM3O3`Zapb3QVbM%OG zqf$@PN*O92kw~f0xBcp>jt`TmVu_Se2DP>+SksF48nPQmaD*1W^GX zBY!qP4ndD&SOo%*%5P2(vvA^a8v>6_lxL@Vv1EVs*(;@j&Vn2aog7XP4iZo?y>Dr8 z-!HcZ=(5y+NHHg*r;Vvu$mRyP#nq(Ik0hAjl)+2e@>1zhs_Uv8Kig=dQA|c~<@yg)4+R({#-$5gR@pjLMwS%ucH;BMNcBQX$?Om&7 zVzxG;=yG$eOyNZfDIbHT8%yO z)S?Bxu*-2K9|?2X$s)I}P|ynWoOZWJ_ae<5W!6yu0N@@709!KkvtS4UUyBT=YCqr) zh5DS_I{ZE019zF7&!wRWYi_1L(R!Y0OvJ*mcTA6MiVC_PRlqtx6Ta(;gUNlO&zm&m zOvsoOSt@I=oC2I`KTrDmvg{*=KdH@yA(|Ys{R3kJ1)YH0E zD|mvS*nJ00gJ|H?_Q@d6uJ{jg{1hH>b!o7jOrma++~+7M1jsH>+cr=~q`_^oNvCai z;aVZI#(V_h1Vo*Y#Y^X7mw|->F#IuVEn#${;KrRmv^0p6PmQcMO>|mgx&m4Ky5Uj+&fDedtDY(lBcD6^176;Tbb%H@S++pO`NN?TOGUjcY?#<= z-KBsA+n96?y{(_`BJ8sr@MwaGD<=Eh95aC!abG7L<2NwkNYe0K`NgU~pZTGfqco$y z&SB0F+2_HN4siIi#h%G$xwfU#yI>_z$%dkMbAdv^ z7@vIok&fP?8&iG;zVwpEK@LVN1W=-(Go2gPe;E&-y4Xqqpbo`ugGm;@%iD1~Hgb{Ca zyN)aKcMa|?{Q{IfMd!+&O44xp!oO?Ra&Uv6#~Crg)4Nnc4wY7OBTxmfU2BCpAiBdVz)Dd%PJJIpq#m&Te#-;|NO;yfkXoa2&my zXF;K|h0eu;m2Agm z9Tghr_b`k#<+Lykg_Y>$9~Py0Z(ByohV9$ECO$Slh&C+0y63$<+j8>o56fXQ9?C3xIs)z*1=yU+ez-i(G zLCk45ak?QoR5@Fu%4n|g?EEq~qzXW!A>Q&~pPMc4tn}N5vxw)%@!rj|`^e<6K#A`{ zn8d5sF@j}6`Q<-IuMT$)dto>w;;G3CicJHom2!9QHiOTox5P0M%wgdY!{l_8|euoNtGhKnMq!sJ;ew{=Fwv6UFJr6#aq^Abl!2c)NP9Ydo^82t8z zV+o3D)GfRbTg)znX|O9{IhG}SBAoDu9d01EV%$cgs`U2s3DxgaECk*N^5a30j;S`)3Oz?*`RbZUWl(?D5SiuW@Wj59D8>DBQmT+aPzARI;V1>^Frjc)N zb0`WYy{d(xmfQVU&^Es?YM=2L^2zIV^Z|uK7;>_ofOR%EYCJHeqS}aqbdzenaM|2; ztYjxJW7lGp;8NS~O}4w-=iPAk5i`Hm1d^Wyc z*`%yDp8lq}llu62&8F?qu9tHZ_&TFTJAkX}ESk#VKR+U8S5`u+?&Ozx@{-=nt~cz{ z-Sk8702q3FS}88miIQ3;!AU+!;?|FKNgT@lZpq_hviYrK!0xzkR92HxDkbSrG*5)< zkWgGA5bpJ*{*$I|J_{XsT6mo3T_DYu_uelUCxKt&xW`x_f)s>Zi=667glY&Fig823 zlGnroX^VqYo5@S#GAP)J2Zw%M?&RmFhZ6KkWc3hFu^2pQR1f$iFUE>xDIz`0(wEKn zR_GQ@U@Cp$Q8AIiz?8GB<(Xzk!pQThux>1faf}yS8GlKrg>3Y66V@@5LLgW82*I@x z&@tvFo&=S$0T?2JRCFeD!(D&l?X=0j7%Hfl!;7<8Hpe{W=rHau#v+>|i~WrLwaH}0 zRFiKyZJw}jt(iIPy;XoKz_1Zz2gm&)%-hPt@q>Ji;zP<|w*G6R2{1D#vM}#_M2Iog zAOB8R*cb--Krs8bWgM+N{Ol*;J(w_F%Z+FPj2$t9FF zbe0l--3tGwX5e*Zju`>eq27mdjEL*-l9jcjzHJLhCu!D5L8==#3XEC>OxDYjDxb+Y zQ5PUG-7bRwKFYuw^ z>b;|1{d(37MuTTv7E3Qog|+aw#}E9knc4taM0XA%#PY~$VOcd`;}JZw<>?!T5cB|k zRoDRE>z~zLiriyf+(Q}wZh|c+D=?giIh?{x{GYLHM;wofh^w%R_@Kv^{8qXj z=PG#32~51_5Oo5$3y$BW`#UmyF7@9sOFv=2^^-aPiRe0V!uG0jeW}|74EDY&1|fHu^fS{~ zM?)b8hWN!O#3sYH;tuVF)$kbnV;F@zf~_b&g|MUHOyT!~V#(<&*$n62e=AZ2352~o zuwY=xIH2^be*{S!O!e%I3>6*i&8$rveg%ix)PdGO5fo2`3GWmHQv+C3C&{V4dIHMY zIBeSt7JC~?1U=zOG7>V?WvxZ|@E4EqGZIBIBY96sxnk6MZf=L044kpMtJ!2gj%G<@ z)z>(Bel(Hux>BL4dOF&@@L$a@Njp&W3*B{Cy*4r|3-{O- zB~0!SQ?N5SW}h8h{vjSugUgXPP$f*BpfjvlrJPygHTx5GLf6lM1Xabh4PX1Mh4&t3 zJF=MCCkVt8ZuBNbI)Z0B(k**%+1WYERF66}WgfDLCZt zHV}`QR$gcU{isr&%QML$PG_kg(CAxazD0{1XfAMdim=-Wuo8VujM#Z0nd|9+r*_PUJVG{TRcbN6Cuul| zyMT$K5T_~sC`bsY$7#$(?U+1ZG@zX)ekmqA>eq_WK+&{&rCnaKdYtUhedF*0BTNF5wt+8;mz@(K zGd!GjSow*)mBfw40bisDQNqW*Fn$2)P+g8Wsy1-~y;NB{ogKa`_G1a4|83g}) zb4N$}2}KQ!NJ?!aPytFXFh&bADCQF8F2Sab<8H)(x?TI6fP)AhMfHb0MJ|6d@d7lg zSu;u+?B{^;r5C*GO?dkg-s8!=j|7ZwqOvDU@4UV^IdSIac`&V=8}f9BSv%f^dIM25 zIgo@*#c>I{)AaXNO14UT1+l{Bs0+m)C@{|O7gdc!c$R4csWMWHA({i|1Q{4M$Lg zR$q5>I$M+Ii}bEpQjkQMBZx~DEf}yap0WNjnoV`?^t6pZE^wtU%?+Cx%o4D_`PGgL zB99Wqo%otjF9Vy;{~!q`q^@G(U6gy+Dd!|N0_+cr=bw@aW^oO1(&{8Wm-3Z+7g_*i zX!I=9~rkm9sr2rgW+M!Cd0i;8@C!Zp!LJ%Kgl+c1{;Pabt1veB3Jv zGRzjNOD1t9Hb}y?*@jGF@uWYYd6l5r`5iA*)}*(rsq%#Mgcoe1L;|FI1AmymlMy4V zlLGu4O@tdedjlW8?8j4MlO$$*Bhy3g@g4r7TYAaXY?fdrAPssMN3GXQu8pEjM3`@T z@LR9*iTxQT!5K8aEWAQWt_9;IJ$y=L-l^QtgSfXqFfl)tF zNOj1@lF=K|2$LlyUs2_sfe5P#+q2Q(qU%=C;f9o{@Pj-MiDJ;e@7{;bcW4c7=my8# zB3@llo0*`!O^gcIo2uQ?G6v&|wZK=PAcpepuPPuCQP_j4h!kG>1Kg8n$m}D-J0&oR zXSxYh#$KWS&VW^f8YF`SxlxOtT`Hu1YFkG)OQS#3>=Le)O&Qyj=hO@2hM9-hy_i_8 zg#B#3QLBOrYe{BXdWTa+O@V)?k+&M&?5;E?<#E8|^ z+z;MA{HU$nL;XP6nq!e6FdkP6Wp`&tL!-$Y@h+85LVvjaI5&|fE{!v=jLck+jQ{A+ zcsbm(RwQFYTA!vs&q{Rt_lBr=Vra8>ta?v0zCS)>#{vH~oe$QT< zq>aHs7y4ZowFKV{k3^Kof_3Gc;kSIM@rV#>1>_yVG`C^H1W)EHIYj9wGiedjNGfIy z>~~jjbW{?y$abPTDZb>U=1X}j=xa$iiysR(W9YYQX_|kUe`4#MNQyT7B-rF>pZkT2 zlsz5(T!!@4uV+_GEDAW$_+7_Dq8AabL&VHw;+XPrInIHbxY2E)!p4RhFOG=AQ!GlV zrQ?hC`dn2M1NY8!v6=jO_5C+fa(@*V`S3nFOjJ)))LbJbKhtqWNx?fn*lqAGYhN!0 znxc$oPdiw<{@#LJ`wbjU!Jc{bz9&D z&fDcKsm^Q^2FY;Pivd?d!)DY3F{U)OIk~Ce-Z{6ssnCcRgq(_KX03rfEMF zvv%!xPV~862tuqNejXQ|2y?2M6^$>;`eVu=0=%~70Ths-$N^!D-#$Px^9Ze)*A6*p z$16uqQj;T%=2&;=o73R*IQkiW1=3GMUm0RYxy_H|9C!BGStgS)o7rR34G_^JC z7B%t~-?_s(&Hx{hhU74Yv%rHxE{ZaiZq6>lfSICmF`Rpt5dAu8Kd%wP=31?WDN&AP z#?TcZn2Eb(qvG$=4})!i1W|9lyV(1@1-uaK(fx>2TzUS9^9JH!FyEudF>$ z7(y-jZ89|UHX1WeyDCe?fCb$__u({Pt)ahkmUERVCmfPQhJ>yU&zt$1SC?iggHVMR z?aC>lO~s&l5ym%Cg$i7c*K$_@p$8pKiNj)N38sSyx7ETgi&%FB@HZmP+-6zxbMB{j zsfOoB+YJpZD_WY#-{`nLd6 z{3c#h$?h%k82l#lkMP>io`HT;mc2% zc1!KQzR6PvS*&h^Jb3cB3#njY{w47xl`@E79-LAbRZR5TI z+Jk6@hXmG}yqdc(YTKa;uHgBS7cw{f&~K{hMlgD_ep=R0Q{uU`F|0t)H)r&ADcAFu z)0yE2C}RT<@){?+Y1iK4JQ=kGv|kIz#xHYUo&;NQMzuWFIJMEppdrds^h-p>tRVP9 zWs4?M&xonb7GwCr7Gkdc^eG(;l zjPrK*yg5s&qaMjE5JhWuS1BO_?X0kFtZL`V#Zxmw5l!BsEPbpu9b2Wr!Ru(`Q<}<(M!=SH&i#KPq1JmaYb7W9}Sqg=C-njCejoDY&$d3gO_ zMJgS|I-gbnBT%kRy)<&Ox0X2LRBG1N*~qlwT7#YrqT8}go{Fmqtn297XW@R~8gS~* zF&i6ZaJSZ8d&aN1ABCPWC=t9=&dlh>jGQPwOrvk0=GbrCp2|P}t^Gr0E;W`0`d9!^ zzVnBF*gv+QFoUC!y`qt$0OQ1>%t+;k)@DGe;QJAxz7~y6GBuw z3P%WfgJD8H2D$pqAOPC18EZgkC4Up2+!D^vuLB9IJt#(r@}I)0XKVX^vI?5Ae;yg} zlE3oWgKnYSVf`LcBtAn0@-tFqyn~PV3R6yI5rnHQM5#bD;J0kyIDL6dMj&2I$FAL#ncvSY$;Zd@4qW2X}$SLe24ZU{6;M% z8WW4)#b%NzC5z!B=3|miA}xfu>Q5LYitj_QI*W7ad9f|3s}-Tdfd~upncyG3vrvV) zBN^k-ojl?ys#ZoiSLeej7id9H$$-1Twh-<}08`P*w9!jZSzF98{ePEE-tuZ5H9Z}2GJrZtAXgk|+JWTJ^xW} z_B-K!SKa(4;XKH*`k!lXe#iN}_To<@9MJZ{ZqW$~d|GyF#e+T?M-|tUAM^Jv?KZo;Iz(2G9eh2(LeeO>{XHcN{zXAVDru!Y` z_szpUQ920!7Uhqv#NSbV-}w0xMU3QcQU2Hl`W@x>SofbO>EwT){3Y`JJHqe&`=1E# zbpJs3w>SSg>3No&0yr`6mE8+aLe@o8J6eJ^DN7f9tD1A;G}* fK%oEb(?7MBoFp_zzlogo-internetnl-en \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +