Category Archives: Information

General news/information to the CAcert community or about security in general

Updates for blog and bugs

We just updated some of our servers to the latest updates:

https://blog.cacert.org/ to the latest WordPress-release.

https://bugs.cacert.org/ to the latest mantis-release.

Furthermore the client certificate login on https://bugs.cacert.org was activated by today for Class-3 certificates. To login you have to enter your username or email-adress of your mantis-account.

Trying to login to https://bugs.cacert.org/ using an unknown email-adress will NOT create a new account: You have to create an account first using the email-adress, which is listed in your client certificate. If you already have an account at https://bugs.cacert.org/ you may change the email-adress of your account to the first email-adress in your client-certificate.

If the certificate-authentication fails (no matter, if you use no client certificate, an expired one or a certificate, which does not match your email-adress) you can use the normal “classic” username/password-credentials to login.

If you try to use a Class-1-client certificate, you currently will may probably receive an error-message like “ERR_BAD_SSL_CLIENT_AUTH_CERT”. In this case please login without a client certificate or create a Class-3-certificate.

In case you face any issues don’t hesitate to contact us for help.

Kind regards,

dirk astrath (CAcert blog admin/CAcert software assessor)

Certificate Login for CAcert wiki

Within the last days I ran some tests using the certificate login for https://wiki.cacert.org/.

This evening I activated this function on our wiki server.

Trying to login to https://wiki.cacert.org/ using an unknown email-adress will NOT create a new account: You have to create an account first using the email-adress, which is listed in your client certificate.

If the certificate-authentication fails (no matter, if you use no client certifcate, an expired one or a certificate, which does not match your email-adress) you can use the normal “classic” username/password-credentials to login.

While installing the client certificate login for CAcert wiki I updated the root-certificate there to the resigned one.

Kind regards,

Dirk Astrath (CAcert wiki admin)

Bugs updated

Within the last days we ran some tests and updated the CAcert Bugtracker https://bugs.caccert.org/ .

It’s now running with the latest version of Mantis, which now has a responsive design. You may now read, add and comment bugreports even from your Smartphone or Tablet.

Two additional changes were done while updating to Mantis 2.4.0:

(1) The certficate chain of https://bugs.cacert.org was updated to the resigned roots.

(2) You may now login using your Mantis username or your email-adress.

This change is needed for the next update, which will be activated in some days:

You may then login to Mantis using a valid CAcert certificate. We’ll give you an update as soon as the tests are finished and the plugin is activated.

Kind regards,

Dirk Astrath (CAcert Software Assessor)

CAcert 2017

February brought the start of the exhibition season for CAcert with our presence at FOSDEM – one of the biggest Europe-wide developer conferences in Brussels, Belgium. Of course we performed our well-known assurances, which is very popular at such events, with which CAcert safeguards its certificates by checking users’ ID documents. This allows us to offer a safe and trustworthy certificate authority to our users. Of particular note was that interested people were seeking more detailed information about security – questions such as what it actually means, and why are we not yet in the trust stores of many of the web browsers. It’s true that Let’s encrypt is trusted by the popular browsers, but if you take a close look at the certificate of a site protected with a Let’s encrypt certificate, you will find out that it does not contain any information about the owner. This means it is impossible to verify the identity of the site and therefore it is basically uncertain to which site the browser is actually connected to. CAcert allows the site owner to publish identification information in the certificate after the assurance – for private users as well as for companies. This way, CAcert offers a clear mutual trust, which makes it worth importing the CAcert-Root-certificate from www.cacert.org.

But there’s more: CAcert offers client certificates as well and signs GPG/PGP keys. Anyone who always wanted to sign his emails and encrypt them if needed, can do this easily with CAcert. Most email clients supports S/MIME certificates or PGP. By this means the authenticity of the sender is verified, and the receipient can verify the name of the certificate owner. Also attachments like PDF can be signed this way and protect the document against later changes.

CAcert is supported by an Australian non-profit association, the operation of the server is safeguarded by the German incorporated society secure-u. This structure has advantages, but the Australian society is possible only as long as CAcert has at least three Australian residents as members of the board. In 2017 we want to bring the association behind the web of trust to Europe. This limits the resources of many of the active members, because the handover must be done under appropriate rules. Anyone who wants to support CAcert can find more details at recent blog post “Prosit 2017” or can send an e-mail to support@cacert.org

For a secure 2017!
Your CAcert

Two members of CAcert Inc. honored for loyal services

In a few hours, the year 2016 will be over. So, the secretary of the new elected committee of CAcert Inc., the infrastructure partner of the CAcert comunity, had just enough time, to show his gratitude to two members of the association who were active in the association for exactly five years. That is the reasons, why he handed over them a (virtual) golden watch as sign of thank you.

Kevin Dawson from New South Wales, the home of CAcert, became Public Officer in 2011 and remained in this function until 2016. As public officer, he dealed with the New South Welsh government and was contact person for the Office of Fair Trade and CAcert’s bank. Furthermore, Kevin Dawson, had a seat in the committee from 2011 to 2013 and in the transition committee in summer 2016. We sincerely thank Kevin for his excellent work, which he has done silently at the other end of the world, but always exactly and well, and regret that he is now concentrating on new things.

The second gold watch for five year loyal services to CAcert Inc. was handed over to Dirk Astrath from Germany, the country with the most community-members. He startet – at the same time as Kevin as Public Officer – as assessor in the committee. Later he hold the functions of secretary, vice president and president with exception of winter 2015/2016. If everything goes well with the “move” of CAcert Inc. Dirk will have been the last president of the Australian association.

CAcert @ OpenRheinRuhr, Oberhausen, DE

Die OpenRheinRuhr in Oberhausen öffnet am Wochenende 5./6. November wieder ihre Tore für freie Software. Die Veranstaltung im Rheinischen Industriemuseum ist perfekt erreichbar direkt am Hauptbahnhof in Oberhausen.

CAcert ist natürlich dabei und informiert vor Ort über Risiken im Internet und Möglichkeiten, die Sicherheit deutlich zu erhöhen. Jeder Interessierte kann sich am Stand von CAcert über kostenfreien Zertifikate, darunter SSL-Serverzertifikate und Client-Zertifikate für sichere E-Mail-Kommunikation informieren. Dazu gibt es wieder spannende Gespräche über die Aktivitäten von CAcert und die Ausblicke für die Zukunft. Aktive Mitglieder sind gerne gesehen, Fragen werden sehr gerne beantwortet.

English:

On the week-end November, 5th and 6th, the OpenRheinRuhr in Oberhausen open its doors. It is an ideal platform to get informed about free software – and of course CAcert will attend. The fair takes place in the Rheinisches Industriemuseum directly located at the central station of Oberhausen.

CAcert informs about risks on the internet and shows opportunities to increase safety considerably. Who wants to get informed about free certificates, e.g. SSL-Server certificates, or client certificates for secure e-mail communication is invited to meet CAcert staff for discussion on CAcerts’ OpenRheinRuhr booth. Additionally we are expecting exciting talks about the activities of CAcert and future prospects. Active members are welcome, questions will be answered gladly.

CAcert @ FrOSCon 11

FrOSCon open its doors on August, 20th + 21st, and of course, CAcert is present!

On the annual FrOSCon event CAcert is present, willing to assure members and to have nice talks to the public. We are very pleased to take part in an event targeted on free software and open source. FrOSCon takes place at Hochschule Bonn-Rhein-Sieg in Sankt Augustin, near Cologne (Köln). We’re happy to welcome you there and enjoy nice talks about securing yourself on the Internet.

Statement of direction given by SGM

Dear members,

there were some mails which were referencing the direction of the new board. This is interesting as the new board so far did not give any statement. Also no new board member either at the SGM nor later did such a statement. Even while it is assumed by many, that I am close to the new board or some of its members, I do not have a clear view what the new board will do.

Abstimmung

CC BY NC SA HDZimmermann

However, there WAS a direction given last Saturday. It was given by the statement of direction given by SGMof CAcert Inc with the voice of the SGM. The new board is bound to respect this statement.

The statement of the SGM is:
“The membership is disheartened by the recently elected committee and its persistent disrespect for properly established arbitration, policies and  procedures. It is resolved, that the committee as constituted no longer enjoys the confidence of the members, and each committee member is removed from their position. We stopped short to resolve, that CAcert Inc has been placed into an unacceptable breach of our CAcert Community Agreement, is no longer acting in the interests of the community, and is therefore no longer a suitable vehicle for the community’s property and role as executive.

And instead resolve,
* that CAcert Inc’s actions were the sole responsibility of the committee members.
* that CAcert Inc with a duly formed committee that respects and abides by the rulings of arbitration enjoys our confidence in the future,
* and that the liabilities of CAcert Inc during the period of troubles should remain strictly limited under our DRP as if arbitration was not suspended.

The new committee is to create a detailed and fully transparent, uncensored report of the old committee’s activities since the AGM to which all members of the community may contribute. This report is to be presented to a general meeting for ratification.”

As the one who was selected to do the minutes, I so far can verify the counting of the votes for any part of this statement. I give a CARS that the votes counted by the vote-bot match those of 3 logs of the irc-channel and the proxy-votes were done according to a list created by the former secretary. With the exception of the “we stopped short”-motion, all these parts were given with a clear or even overwhelming majority:

“disheartend sentence”: 28 : 8 : 3
“board removed”: 22 : 14 : 4
“unacceptable breach”: 15 : 16 : 9
“responsibility of old board”: 29 : 11 : 0
“report”: 38 : 0 : 3
[aye : naye : abstain]

41 members-votes were present during those decisions.

Kind regards,
Eva Stöwe, CARS

New board elected

Abstimmung

CC BY NC SA HDZimmermann

On April, 9th, 2016, the members of CAcert Inc held an SGM, in which a new board has been elected. The membership felt disheartened by the formerly elected committee and its persistent disrespect for properly established arbitration policies and procedures. This was carried by a motion which shows the importance of being a member of the association.

The full agenda points of the SGM can be found on https://wiki.cacert.org/SGM/20160409?action=recall&rev=13. You may note some placeholders in other topics as later revisions which corrected these items included further agenda items which could not be moved on for the reason of notification of the members in time.

After counting proxies for the votes, the european board members of the prior board resigned. 5 new members were then accepted, including one who got expelled by the old board end of February 2016 because he stood up for an independent arbitration which he wrote in the members mailing list. The old committee was removed and a new committee was elected. The new board members are: Ben Ball (AU), Piers Lauders (AU), Kevin Dawson (AU), Ian Grigg, Gero Treuner, Dirk Astrath, and Mathias Subik. The new committee was also instructed to create a report of the activities of the former board since the AGM. All members of the community may contribute.

On 2016-04-16 at 12:00 UTC (noon) the first meeting of the new commitee will take place in the IRC channel #board-meeting on the CAcert IRC network. Everybody is welcome to participate, please find the agenda on https://wiki.cacert.org/Brain/CAcertInc/Committee/MeetingAgendasAndMinutes/2016-04-16.