<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"IBM Plex Sans";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="mso-fareast-language:FR">De :</span></b><span style="mso-fareast-language:FR"> Pierre DUPONT
<br>
<b>Envoy� :</b> jeudi 5 septembre 2019 16:55<br>
<b>� :</b> 'stunnel-users@stunnel.org' <stunnel-users@stunnel.org><br>
<b>Cc :</b> _sav.bibli <sav.bibli@nedap.fr>; Philippe ANQUETIN <philippe.anquetin@nedap.fr><br>
<b>Objet :</b> using sTunnel with Chrome<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Good day to all. So far, I can’t succeed to use Chrome with sTunnel.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I use these versions<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">sTunnel : 5.55 (downloaded today…)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chrome is 76.0.3809 132<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FR"><img width="302" height="245" id="_x0000_i1025" src="cid:image002.png@01D5640A.99D102C0"></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Here is my configuration for sTunnel :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2019<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Some options used here may be inadequate for your particular configuration<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; This sample file does *not* represent stunnel.conf defaults<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Please consult the manual for detailed description of available options<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; * Global options *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Debugging stuff (may be useful for troubleshooting)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;debug = info<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;output = stunnel.log<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Enable FIPS 140-2 mode if needed for compliance<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;fips = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Microsoft CryptoAPI engine allows for authentication with private keys<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; stored in the Windows certificate store<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Each section using this feature also needs the "engineId = capi" option<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engine = capi<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; You also need to disable TLS 1.2 or later, because the CryptoAPI engine<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; currently does not support PSS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;sslVersionMax = TLSv1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; The pkcs11 engine allows for authentication with cryptographic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; keys isolated in a hardware or software token<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; MODULE_PATH specifies the path to the pkcs11 module shared library,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; e.g. softhsm2.dll or opensc-pkcs11.so<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Each section using this feature also needs the "engineId = pkcs11" option<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engine = pkcs11<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engineCtrl = MODULE_PATH:softhsm2.dll<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engineCtrl = PIN:1234<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; * Service defaults may also be specified in individual service sections *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Enable support for the insecure SSLv3 protocol<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;options = -NO_SSLv3<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; These options provide additional security at some performance degradation<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;options = SINGLE_ECDH_USE<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;options = SINGLE_DH_USE<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; * Include all configuration file fragments from the specified folder *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;include = conf.d<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; **************************************************************************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; * Service definitions (at least one service has to be defined) *<o:p></o:p></span></p>
<p class="MsoNormal">; **************************************************************************<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">; ***************************************** Example TLS client mode services<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[gmail-pop3]<o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">client = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">accept = 127.0.0.1:110<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">connect = pop.gmail.com:995<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">verifyChain = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">CAfile = ca-certs.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">checkHost = pop.gmail.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">OCSPaia = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[gmail-imap]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">client = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">accept = 127.0.0.1:143<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">connect = imap.gmail.com:993<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">verifyChain = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">CAfile = ca-certs.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">checkHost = imap.gmail.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">OCSPaia = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[gmail-smtp]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">client = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">accept = 127.0.0.1:25<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">connect = smtp.gmail.com:465<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">verifyChain = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">CAfile = ca-certs.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">checkHost = smtp.gmail.com<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">OCSPaia = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Encrypted HTTP proxy authenticated with a client certificate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; located in the Windows certificate store<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[example-proxy]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;client = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 127.0.0.1:8080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;connect = example.com:8443<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engineId = capi<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Encrypted HTTP proxy authenticated with a client certificate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; located in a cryptographic token<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[example-pkcs11]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;client = yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 127.0.0.1:8080<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;connect = example.com:8443<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;engineId = pkcs11<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;cert = pkcs11:token=MyToken;object=MyCert<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;key = pkcs11:token=MyToken;object=MyKey<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; ***************************************** Example TLS server mode services<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[pop3s]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 995<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;connect = 110<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;cert = stunnel.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[imaps]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 993<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;connect = 143<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;cert = stunnel.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Either only expose this service to trusted networks, or require<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; authentication when relaying emails originated from loopback.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Otherwise the following configuration creates an open relay.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[ssmtp]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 465<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;connect = 25<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;cert = stunnel.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; TLS front-end to a web server<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[https]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">accept = 443<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">connect = 81<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">cert = stunnel.pem</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Microsoft implementations do not use TLS close-notify alert and thus they<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; are vulnerable to truncation attacks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">TIMEOUTclose = 0</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Remote cmd.exe protected with PSK-authenticated TLS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; Create "secrets.txt" containing IDENTITY:KEY pairs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;[cmd]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;accept = 1337<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;exec = c:\windows\system32\cmd.exe<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;execArgs = cmd.exe<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">;PSKsecrets = secrets.txt<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">; vim:ft=dosini<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The 81 connect port is used by our local webservice :
<a href="http://localhost:81/nedaprfidwebservice.asmx">http://localhost:81/nedaprfidwebservice.asmx</a> which runs OK<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FR"><img border="0" width="583" height="276" id="Image_x0020_3" src="cid:image007.png@01D5640A.99D102C0"></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The problem is when I try to import the certificate. It looks OK giving these informations<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FR"><img border="0" width="385" height="322" id="Image_x0020_4" src="cid:image008.png@01D5640A.99D102C0"></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FR"><img border="0" width="388" height="367" id="Image_x0020_5" src="cid:image016.png@01D5640A.99D102C0"></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">However, I cannot connect on https<br>
</span><span style="mso-fareast-language:FR"><img border="0" width="490" height="431" id="Image_x0020_6" src="cid:image017.png@01D5640A.99D102C0"></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I tried several things found browsing the list, like building a certificate with<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">No result so the only solution I see now is to call you for some help…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">With kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">Cordiales salutations de<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">Pierre Dupont<o:p></o:p></span></b></p>
<p class="MsoNormal"><i><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">Support S.A.V. & D�veloppement Biblioth�ques<o:p></o:p></span></i></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">Courriel S.A.V. :
<a href="mailto:sav.bibli@nedap.fr">sav.bibli@nedap.fr</a></span></b><u><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR"><o:p></o:p></span></u></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">T�l�phone :
</span></b><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR"> 06 13 99 69 38 - 01.61.03.03 18<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">8/10 Chemin d’Andr�sy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"IBM Plex Sans";color:#023B4F;mso-fareast-language:FR">95610 Eragny sur Oise<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Arial",sans-serif;color:gray;mso-fareast-language:FR"><img border="0" width="200" height="38" id="Image_x0020_2" src="cid:image018.jpg@01D5640A.99D102C0" alt="NEDAP LOGO - INLINE - RGB"></span><span style="mso-fareast-language:FR"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>