Scep

These scenarios show how to configure the SCEP protocol to retrieve certificates from a PKI server.

../../../../_images/scep.svg

Test SCEP Protocol With Linux PKI

Description

In this scenario, the SCEP protocol is used to retrieve digital certificates (X509) from a Linux PKI server.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 192.168.212.0/22 next-hop 10.215.168.1
set system certificate scep csr CSR cgi-path /scep
set system certificate scep csr CSR cipher aes
set system certificate scep csr CSR digest sha256
set system certificate scep csr CSR distinguished-names CN=MyUserCert
set system certificate scep csr CSR encrypted-password U2FsdGVkX19q+LE1oZoP8dPuZgSOy2yfPjn7AtTpWmE=
set system certificate scep csr CSR port 8080
set system certificate scep csr CSR url 'http://10.215.168.1'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.147 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.147/0.147/0.147/0.000 ms

Step 3: Run the command pki scep show CSR on DUT0 and check whether the output matches the following regular expressions:

ca\s+Valid
usercert\s+Valid
Show output
-------------------------------------------------------------------------------------------------
Certificate  Status           Usage                   NotBefore                  NotAfter
-------------------------------------------------------------------------------------------------
ca           Valid   Encipherment & Signature  Apr 16 09:19:39 2025 GMT  Apr 11 09:19:39 2045 GMT
usercert     Valid   -                         May 19 16:12:09 2026 GMT  May 19 16:12:09 2027 GMT

Step 4: Run the command pki show certificate running://auth/certificates/scep/CSR/ca/ca.der on DUT0 and check whether the output contains the following tokens:

Subject: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
Show output
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:28:60:8a:6f:42:5d:c8:44:f0:10:0d:61:e5:ca:40:11:bc:ea:f2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
        Validity
            Not Before: Apr 16 09:19:39 2025 GMT
            Not After : Apr 11 09:19:39 2045 GMT
        Subject: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:de:b7:3b:d9:9b:e3:d3:57:9b:b0:33:67:c0:40:
                    4f:45:84:ea:c2:35:a6:08:3b:3a:fd:6d:fa:d7:2b:
                    3d:7f:1c:a1:92:15:08:8b:5c:02:ec:6a:66:46:c5:
                    6f:7f:9b:9d:c3:86:e1:97:47:9b:5e:ea:96:5b:bf:
                    68:35:96:4f:6e:64:c6:7d:f6:da:6b:f9:bf:98:b1:
                    32:63:ae:f4:5b:2f:cd:6d:d7:ef:db:01:12:b0:a4:
                    54:95:6e:e8:84:4a:0a:f1:13:83:13:a1:7a:1d:f4:
                    06:3f:e3:53:5d:9f:68:a1:a0:5c:51:05:ba:8c:da:
                    00:11:64:4b:e8:37:c3:70:43:9c:16:dd:46:fb:34:
                    e4:3c:ae:a4:9a:a1:da:cf:a1:f5:93:13:a6:0e:68:
                    51:31:f7:26:63:a3:8b:47:c3:94:e4:34:d2:b0:36:
                    cf:22:e5:81:dd:a4:01:e8:79:08:37:ad:7a:b9:da:
                    24:37:cc:53:f4:51:f8:b5:67:09:15:63:52:60:7f:
                    b0:e2:f0:38:cd:3c:13:42:81:5f:e2:dd:e2:c5:37:
                    f3:ef:05:8c:85:2f:2a:0a:f4:94:2f:70:56:7f:7d:
                    a9:f6:ca:69:0b:a7:40:e1:fa:bc:f0:f4:01:7a:76:
                    55:f4:2a:57:43:8b:f1:87:58:f2:f4:db:23:26:33:
                    f8:4f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
            X509v3 Authority Key Identifier:
                keyid:D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
                DirName:/CN=Teldat-PKI/O=Teldat/L=Madrid/C=ES
                serial:7C:28:60:8A:6F:42:5D:C8:44:F0:10:0D:61:E5:CA:40:11:BC:EA:F2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        5e:0d:47:96:a2:24:38:fa:62:5b:0c:c2:4e:59:23:79:40:1b:
        88:d1:63:11:0b:ce:bc:63:46:cd:70:33:52:75:4b:85:c1:39:
        be:3c:ce:7c:66:53:63:b4:39:07:ec:ef:52:fe:fa:dc:c1:fb:
        e4:51:61:28:58:4f:90:71:83:50:7d:62:a9:16:fa:45:89:08:
        5f:39:43:6a:b1:bb:ad:4e:6f:50:bc:07:4f:1c:5b:07:df:63:
        ec:44:20:48:b6:97:00:e2:9d:8e:42:9e:96:5f:71:7a:43:96:
        de:fd:66:6b:45:85:5d:e4:dc:bf:e9:34:64:4f:3a:7b:33:a0:
        54:80:3b:9a:5b:1f:3f:3f:1c:09:a3:8e:d8:b6:2a:ba:b2:07:
        87:fa:0f:a5:69:41:06:b1:14:6f:09:4f:bb:88:60:87:70:83:
        31:73:ed:2a:03:ca:3c:19:0a:b2:24:61:c6:ce:09:97:ac:6e:
        da:cb:47:88:c5:f5:a7:74:d2:96:e0:cc:c3:b6:b7:f6:64:9f:
        ad:1c:7f:36:fd:39:7c:57:54:a5:e9:8a:82:90:4d:cd:74:99:
        27:4d:f6:62:a6:96:c5:6e:d3:02:ec:c1:4d:5f:46:b6:82:75:
        12:61:d7:a3:d6:70:f6:35:9d:9c:30:06:84:af:b2:cb:a5:a0:
        5e:d3:1d:6c

Step 5: Run the command pki show certificate running://auth/certificates/scep/CSR/user/cert on DUT0 and check whether the output contains the following tokens:

Subject: CN = MyUserCert
Show output
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = Teldat-PKI, O = Teldat, L = Madrid, C = ES
        Validity
            Not Before: May 19 16:12:09 2026 GMT
            Not After : May 19 16:12:09 2027 GMT
        Subject: CN = MyUserCert
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b6:c7:de:e3:89:dd:e3:59:6f:a9:ba:ca:98:06:
                    01:fb:9e:4f:3c:44:cf:3f:84:e8:f6:f8:5e:f2:b0:
                    72:d5:cd:66:d1:cb:50:4e:08:0a:b1:71:4b:d3:e2:
                    f6:de:6d:3f:14:58:84:48:98:9f:ee:7a:33:ed:a1:
                    c8:09:06:e8:b1:ba:90:d6:b4:e1:91:46:fb:66:b4:
                    06:41:3e:cc:7d:91:f7:6c:dc:e5:05:de:13:65:e0:
                    8b:ba:56:99:31:9d:84:95:27:ca:91:3c:bc:07:ff:
                    06:e8:d8:7d:85:3f:15:d8:d3:41:6e:f3:51:26:c5:
                    2b:4a:38:8b:36:e7:3c:94:0d:c8:99:db:40:2a:43:
                    ef:f6:8e:d2:c6:6e:7e:d0:92:d3:ca:b9:4c:ee:6f:
                    44:3c:ac:9f:9d:40:35:35:86:e2:62:6c:03:1f:e2:
                    25:8a:c5:e6:0e:56:15:b4:14:e0:43:64:65:b1:27:
                    1d:42:7a:d5:a7:63:5c:57:49:14:8f:c0:9e:c7:70:
                    d0:3d:d4:ca:cf:38:14:24:7d:d5:33:2f:be:d4:df:
                    96:f4:8c:62:de:4e:f8:33:6b:42:50:cd:dd:04:c2:
                    3c:c0:c3:4d:bd:f7:32:cd:6f:f4:cc:a6:b7:da:cf:
                    0e:bc:ff:79:82:50:cc:9f:67:96:11:19:2a:f5:fc:
                    0f:21
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                07:5A:6E:BD:69:DD:99:99:77:2D:F6:CF:A8:23:FC:22:F3:FE:07:2E
            X509v3 Authority Key Identifier:
                D3:97:2E:56:37:6A:89:77:01:D4:E3:42:0D:EC:E7:10:79:9C:E8:7C
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        31:2c:f9:fd:97:65:61:10:80:19:df:fe:83:8f:90:b9:ff:e9:
        d5:42:67:2a:df:b7:6a:56:fa:fb:68:0a:5d:31:52:b3:2d:a9:
        53:4f:25:68:f2:a8:53:bd:07:5e:c5:3d:fe:43:14:40:2c:92:
        5e:43:12:be:7d:20:5f:d6:6c:c6:e8:21:2c:72:e3:0e:7a:2c:
        e2:ad:b3:7d:dd:ee:15:8c:58:3c:1c:fd:b2:54:88:d6:dc:25:
        e1:25:c8:55:e3:e7:26:7e:d5:ed:4b:1a:67:fd:76:6b:01:fc:
        39:41:34:83:ec:6e:0e:99:4c:f2:05:d5:74:c1:be:56:e1:94:
        0f:fc:2b:fb:e1:c5:6d:19:f8:9d:41:43:3a:51:cc:b3:56:d7:
        c2:11:fe:63:67:76:e1:cd:8e:6b:b8:76:63:21:ce:5c:11:cf:
        a5:24:22:b2:17:1a:09:a2:e9:2a:1d:8d:4a:5e:e1:48:5e:5c:
        04:54:5e:63:68:d3:03:a3:7c:94:2a:d1:1c:d4:5e:46:e5:0e:
        40:14:ac:47:34:85:4e:f9:40:19:00:10:44:11:51:b0:f4:16:
        3d:12:ff:8f:9c:d3:8b:3e:d4:a1:4e:81:a6:8e:49:68:e3:91:
        d9:04:a5:b6:bb:f7:e9:a2:45:91:57:0d:e1:f4:cd:79:36:33:
        5e:cb:0f:10

Test SCEP Protocol With Windows Server PKI

Description

In this scenario, the SCEP protocol is used to retrieve digital certificates (X509) from a Windows PKI server.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 192.168.212.0/22 next-hop 10.215.168.1
set system certificate scep csr CSR cgi-path CertSrv/mscep/mscep.dll/pkiclient.exe
set system certificate scep csr CSR distinguished-names CN=MyUserCert
set system certificate scep csr CSR encrypted-password U2FsdGVkX1/d4y/wSgFMwyJ2BZR0iorooVZGPBITi5DXHj9uFh7hTjxRbpu0IcJ+R8nMNedcfO+tC9MOSo9b7A==
set system certificate scep csr CSR url 'http://192.168.213.25/'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.402 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.402/0.402/0.402/0.000 ms

Step 3: Ping the IP address 192.168.213.25 from DUT0:

admin@DUT0$ ping 192.168.213.25 count 1 size 56 timeout 1
Show output
PING 192.168.213.25 (192.168.213.25) 56(84) bytes of data.
64 bytes from 192.168.213.25: icmp_seq=1 ttl=126 time=0.506 ms

--- 192.168.213.25 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.506/0.506/0.506/0.000 ms

Step 4: Run the command pki scep show CSR on DUT0 and check whether the output matches the following regular expressions:

ca\s+Valid
usercert\s+Valid
Show output
-------------------------------------------------------------------------------------
Certificate  Status     Usage             NotBefore                  NotAfter
-------------------------------------------------------------------------------------
ca           Valid   Signature     Jan  9 09:34:41 2026 GMT  Jan  9 09:44:41 2056 GMT
ra           Valid   Encipherment  Jan  9 09:37:26 2026 GMT  Jan  9 09:37:26 2028 GMT
ra-2         Valid   Signature     Jan  9 09:37:25 2026 GMT  Jan  9 09:37:25 2028 GMT
usercert     Valid   -             May 19 15:41:06 2026 GMT  May 19 15:51:06 2028 GMT

Step 5: Run the command pki show certificate running://auth/certificates/scep/CSR/ca/ca.der on DUT0 and check whether the output contains the following tokens:

Subject: DC = com, DC = scep, CN = scep-TELDATPKI-CA
Show output
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:aa:77:9e:fd:8d:47:8d:42:5f:96:57:64:8a:da:d1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: DC = com, DC = scep, CN = scep-TELDATPKI-CA
        Validity
            Not Before: Jan  9 09:34:41 2026 GMT
            Not After : Jan  9 09:44:41 2056 GMT
        Subject: DC = com, DC = scep, CN = scep-TELDATPKI-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:be:22:9c:cd:53:99:06:1b:31:57:cd:72:1b:d7:
                    5d:99:b4:e2:e1:88:80:d4:40:53:49:be:ff:e0:5b:
                    8b:41:8c:96:e8:99:cd:19:ab:98:4c:99:77:ad:01:
                    fc:51:cf:ea:d8:43:fc:5b:d2:dd:b5:05:04:ae:01:
                    28:e9:53:5d:bb:d2:65:71:d9:69:3c:04:4d:6b:6e:
                    8b:95:92:e4:e7:84:57:90:b3:5e:1f:76:34:7f:15:
                    e2:fb:c0:78:bb:ec:a5:be:2f:33:9e:98:06:f1:4c:
                    1f:cc:ee:85:c2:f1:8f:3c:23:52:a2:94:af:0e:b8:
                    d2:e3:0c:b7:07:49:b9:91:87:3e:76:89:61:f0:88:
                    4c:2f:da:6b:b9:75:93:6e:e4:e2:f1:19:48:00:f7:
                    af:1b:70:19:15:2b:30:b3:78:24:dc:14:c4:e8:a0:
                    61:f9:68:09:7d:e9:3e:6f:e0:a3:44:d5:43:f8:78:
                    aa:5f:a8:7a:3a:7c:2c:4e:21:69:24:be:2f:cb:57:
                    bd:60:e8:b9:a5:3b:ad:0c:7b:d9:8d:82:3e:13:96:
                    8b:59:5a:2b:ec:b6:63:33:21:69:a5:30:b6:bb:84:
                    e9:80:8d:db:3c:94:f7:52:05:76:6a:ed:d6:03:24:
                    d8:97:46:a4:15:41:4d:17:98:7d:20:64:ac:fb:e9:
                    30:1d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.20.2:
                ...C.A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                18:DA:43:2C:11:47:FC:1A:DA:19:D4:6C:8B:2D:58:AA:75:ED:17:94
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        3b:f8:53:b9:17:78:98:fa:4a:63:a8:5b:57:bc:f6:67:d8:47:
        48:8a:22:2f:d8:39:22:44:c9:f8:aa:fd:e8:81:13:c4:5f:9b:
        b2:72:0a:35:b1:0c:64:ff:ff:89:05:f0:d7:2a:e4:5f:da:6b:
        7b:90:88:5e:6c:77:e5:17:83:19:43:10:35:f8:b5:e3:b8:b5:
        16:c1:79:5e:cc:71:00:91:6a:aa:b7:7e:e8:35:99:b3:74:c1:
        b7:d9:93:8c:6b:4e:64:5a:0a:aa:09:ce:00:d6:f2:f0:f6:87:
        ec:cd:dc:d0:07:d5:cb:6d:7f:34:72:80:7b:8c:71:f3:d8:f6:
        a4:38:45:0e:19:79:bd:07:d6:91:a0:4f:4f:2e:55:f1:ca:f7:
        f3:b1:94:33:7b:f0:76:2b:10:d6:9b:49:ef:96:83:f3:f5:2e:
        b3:c4:48:13:2f:19:f3:18:7f:4c:7a:09:79:3b:52:94:d9:86:
        65:58:32:34:ba:89:6e:54:99:ab:12:7b:f5:3d:61:f3:39:22:
        08:ef:7b:77:ba:95:7e:8e:ca:51:4d:80:45:2b:43:d8:b1:37:
        fb:0c:69:7a:c8:5c:dc:4c:16:5f:a1:09:5c:d6:85:ed:93:76:
        fa:56:67:fe:fc:97:3c:8d:f8:3c:39:d7:31:07:e6:69:42:3d:
        3d:d2:86:1e

Step 6: Run the command pki show certificate running://auth/certificates/scep/CSR/user/cert on DUT0 and check whether the output contains the following tokens:

Subject: CN = MyUserCert
Show output
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:00:00:1a:a6:6c:c9:1a:21:05:5d:cd:cb:00:00:00:00:1a:a6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: DC = com, DC = scep, CN = scep-TELDATPKI-CA
        Validity
            Not Before: May 19 15:41:06 2026 GMT
            Not After : May 19 15:51:06 2028 GMT
        Subject: CN = MyUserCert
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a8:a3:39:e1:48:c1:38:f5:4a:f4:92:ae:cc:ee:
                    7a:63:50:4b:c4:b2:c1:e9:e4:58:4b:07:30:e0:e0:
                    5f:50:d0:50:7f:b1:1f:09:cf:68:18:e4:bc:85:e5:
                    ed:25:97:8f:4a:3b:c4:a3:7b:e8:cb:30:dc:97:88:
                    8d:67:03:9b:1d:ce:d2:13:f8:06:4a:3b:e4:ad:03:
                    45:c5:6a:39:5c:0b:cc:b6:b7:10:83:03:3c:06:3b:
                    ac:fb:39:77:a4:db:5b:0d:6a:11:13:70:0f:3f:78:
                    2d:be:63:57:70:62:40:54:54:d2:b9:96:17:47:d6:
                    d0:ac:02:4a:dc:14:4e:42:70:7d:f0:c7:16:12:f1:
                    0a:9f:1b:35:cf:c8:fa:f4:43:d7:e4:ab:f5:f3:ea:
                    d1:31:52:6f:d9:04:85:0f:01:cf:d2:13:55:33:06:
                    a6:10:ae:fa:29:eb:ae:ff:6f:cf:e3:45:05:10:c5:
                    15:53:b0:85:2e:b1:19:87:cc:22:fe:2e:1d:2c:d1:
                    86:fd:e9:c5:94:c7:00:fe:84:bc:6d:da:e0:9a:f2:
                    68:d6:28:3f:10:9b:16:e1:b8:2d:64:ef:1d:70:f6:
                    a2:ac:0f:9a:d8:a2:00:0c:7b:d4:54:69:45:f7:36:
                    24:22:27:0b:fc:24:6d:e3:29:d7:d6:5f:d7:c6:be:
                    8e:5f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2D:78:E4:4F:4C:99:10:5B:3D:43:C4:F2:21:F7:A0:61:FF:00:FE:80
            X509v3 Authority Key Identifier:
                18:DA:43:2C:11:47:FC:1A:DA:19:D4:6C:8B:2D:58:AA:75:ED:17:94
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://192.168.213.25/CertEnroll/scep-TELDATPKI-CA.crl
            Authority Information Access:
                CA Issuers - URI:ldap:///CN=scep-TELDATPKI-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=scep,DC=com?cACertificate?base?objectClass=certificationAuthority
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Data Encipherment
            1.3.6.1.4.1.311.21.7:
                0..&+.....7.....3......./...(...f<...[...]..d...
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.20.1, Microsoft Encrypted File System, Code Signing, Any Extended Key Usage, TLS Web Server Authentication, Signing KDC Response, TLS Web Client Authentication, 1.3.6.1.4.1.311.21.5, 1.3.6.1.4.1.311.20.2.1, 1.3.6.1.5.5.8.2.2
            1.3.6.1.4.1.311.21.10:
                0y0...+.....7..0..
+.....7
..0
..+.......0...U.%.0
..+.......0...+......0
..+.......0...+.....7..0..
+.....7...0
..+.......
            S/MIME Capabilities:
                050...*.H..
......0...*.H..
......0...+....0
..*.H..
..
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        88:37:31:89:3c:ca:19:66:fd:2b:c5:58:fe:db:62:c4:62:73:
        91:3a:80:ee:58:53:53:6d:38:fe:48:5d:a9:97:64:5b:68:3e:
        84:1a:05:b7:73:7b:ea:e4:cf:17:7f:4b:a8:49:f6:1d:f6:31:
        ee:bf:b3:68:d9:6b:c3:01:2d:24:5d:66:d3:ca:e3:2f:9f:ba:
        b2:10:97:09:54:92:ad:5b:e5:d7:a7:5f:d6:e9:8f:ff:ca:b1:
        4d:d1:e2:40:ad:02:37:c9:dc:81:a1:48:c9:34:11:0b:4a:47:
        c6:b8:15:47:ab:70:d7:81:e4:fc:45:ab:42:7d:c1:b8:51:86:
        23:d2:aa:f6:b3:ab:09:26:07:53:26:6f:be:7e:15:c7:a6:13:
        0e:62:ea:eb:c8:89:fd:cf:31:1d:c5:6c:bf:26:ee:5f:ca:f2:
        17:74:fc:69:53:8c:f4:39:3a:c8:f4:30:84:68:3c:98:47:33:
        b8:ef:f1:bd:b2:4b:ab:bd:46:18:80:49:59:53:b8:15:7c:e3:
        1e:e7:25:62:29:3a:93:62:27:0e:34:6a:3f:fd:d2:e9:95:01:
        16:69:b4:c6:11:80:10:45:44:c9:b6:a3:48:78:90:37:63:ac:
        66:6b:db:56:55:5b:81:af:22:93:65:ee:c1:fd:5c:de:9e:84:
        63:3c:92:38