Monthly Archives: May 2015

Availability of CAcert Root Certificates on Linux Distributions

1 Reply

After the inclusion of CAcert in Debian has been a quite complicated story for the past few years we are glad to announce that there’s a new package in the Debian Sid (unstable) branch: ca-cacert. This package has been created and will be maintained by Dmitry Smirnov. This package became necessary after Debian decided to remove CAcert from its main certificate store provided by the package ca-certificates in early 2014 [1].

Our goal is to promote awareness and education on computer security through the use of encryption, specifically by providing cryptographic certificates. These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the internet. Any application that supports the Transport Layer Security (TLS) or the somewhat older Secure Socket Layer Protocol (SSL) can make use of certificates signed by CAcert, as can any application that uses X.509 certificates, e.g. for encryption or code signing and document signatures.

The re-inclusion – even if just as a supplementary package – allows users of Debian and its many derivatives to securely access and install our certificates. Using this path for installation of our root certificates a major attack vector during installation has been mitigated by providing an additional, verified means to get an authenticated copy of our root certificates. Another possibility to verify our certificates after download has been prepared recently and will be documented soon.

CAcert is still pursuing to become audited and thus available in the default browser and OS trust stores.

We thank all people who were involved in creating and providing this package and hope for a constructive future development. Furthermore we like to thank the maintainers of the openSUSE package who made sure our root certificates have been available for the past years [2]. Also we want to thank all other package maintainers for other OS helping to provide a safe anchor for our certificates[3].

Currently our Wiki editors are working on HowTo documents [4, 5].

[1] https://packages.qa.debian.org/c/ca-cacert.html
[2] https://software.opensuse.org/package/ca-certificates-cacert
[3] https://wiki.cacert.org/InclusionStatus
[4] https://wiki.cacert.org/HowToDocuments/
[5] https://wiki.cacert.org/HowToDocuments/DE

CAcert does NOT allow video assurances

Leave a reply

Recently support received a question if video assurance can be used to replace a face-to-face meeting in an assurance. The short answer is that currently the rules of CAcert do NOT allow video assurances. [1, 2]

One aspect of the face-to-face meeting why you need to meet the assuree in person is such that you can check security features of the presented documents. This check can not be done with video communication like e.g. FaceTime, Google+ Hangout, Jitsi, Skype [3] as verifying documents includes getting a feel for the presented documents as well as checking security features, that are not or not easily transferable with video conferencing.

In case CAcert sees any signs of assurance entries that hint to having been conducted as video assurances these cases will be reviewed (by arbitration) AND removed from the system if they are found to be invalid.

[1] http://wiki.cacert.org/AssuranceHandbook2#Preparing_yourself_for_an_assurance
[2] http://wiki.cacert.org/AssuranceHandbook2#The_meeting
[3] http://en.wikipedia.org/wiki/Videoconferencing