Category Archives: Information

General news/information to the CAcert community or about security in general

Partially restricted operation / most services available

Leave a reply

As a result of a chain of technical failures of old equipment already scheduled for replacement, there are currently certain limitations in the services provided to members of the CAcert community. We regret this terribly.

  • bugs.cacert.org ?Bug management: normal operation
  • community.cacert.org ?Service hub: normal operation
  • irc.cacert.org ?IRC: normal operation
  • secure.cacert.org ?reduced service
  • selfservice.cacert.org ?password reset: normal operation
  • webmail.cacert.org ?webmail: normal operation
  • wiki.cacert.org ?wiki/help centre: normal operation
  • www.cacert.org ?main page: reduced service

Mid september, we discovered that a partition contained a corrupt file system. A
subsequent hardware test showed that one of the hard drives was reporting hardware errors. In order to be able to continue using the system, we have moved this partition to a second drive.

Since the end of september the system no longer responds. We suspect that other partitions are defective. Neither web access nor SSH access work, so the only way to find the error can only be analysed in more detail by a visit to our data centre.
In order to still be able to offer as many services as possible to the CAcert community until the repair, we redirected the connections for www.cacert.org and secure.cacert.org in the incoming firewall to the second system. As a result of ongoing hardware renewal, however, this fall-back level is not quite complete: There is no working signer and no up-to-date copy of the CAcert database attached to this system.

That is, why the main page can be used as a start for informing our users about the blog for now, while certificate issuing and WoT access has to be postponed until our technical volunteers have made the several-hour trip to the data centre for troubleshooting. As they are doing this in their spare time and at their own expense, we are very grateful to these volunteers that they will probably be able to do this in mid-October.

If you would like to know what you can do yourself to ensure that such interruptions occur less frequently and are resolved more quickly, read this!

DEUTSCH: Infolge einer kaskadierten technischen Störung sind zur Zeit leider nicht alle Dienstleistungen übers Netz abrufbar. Alle Fernwartschritte haben unsere technischen Freiwilligen bereits unternommen. Bis zu einen Vororteinsatz im Rechenzentrum im Ausland voraussichtlich Mitte Oktober ist der Zugriff auf den Signer und die Datenbank nicht möglich. Wir bedauern dies sehr. Was Sie tun können, um solche Ausfallzeiten künftig zu verringern, lesen Sie hier!

FRANÇAIS: Suite à une panne technique en cascade, tous les services ne sont malheureusement pas accessibles en ligne pour le moment. Toutes les démarches de télémaintenance ont déjà été effectuées par nos volontaires techniques. L’accès au Signer et à la base de données est impossible jusqu’à une intervention sur place dans le centre de calcul à l’étranger, probablement mi-octobre. Nous le regrettons vivement. Vous pouvez lire ici ce que vous pouvez faire pour réduire ces temps d’arrêt à l’avenir!

PORTUGUÊS: Devido a uma falha técnica em cascata, infelizmente nem todos os serviços estão disponíveis pela rede no momento. Todas as medidas de manutenção remota já foram tomadas por nossos voluntários técnicos. O acesso ao signatário e ao banco de dados não será possível até uma visita no local ao centro de dados no exterior, provavelmente em meados de outubro. Lamentamos muito o ocorrido. Leia aqui o que você pode fazer para reduzir esses períodos de inatividade no futuro!

ESPAÑOL: Debido a un fallo técnico en cascada, lamentablemente no todos los servicios están disponibles actualmente a través de la red. Nuestros voluntarios técnicos ya han tomado todas las medidas de mantenimiento a distancia. El acceso al firmante y a la base de datos no será posible hasta una visita in situ al centro de datos en el extranjero, probablemente a mediados de octubre. Lo lamentamos mucho. Lea aquí lo que puede hacer para reducir estos tiempos de inactividad en el futuro.

Certificate renewing is pending (update & help)

Leave a reply

Some of our community members (users) get a problem while they try to renew an existing certificate. The issue is: Certificate renewal is pending for days/weeks.

First of all, CAcert is not a service provider or a company, but a community. We are all in the same boat. We can only achieve our goals together, with your the cooperation of all of us (of all users=members).

One of our volunteer support engineers, a retired gentleman somewhere in Bohemia, wrote, after he watererd the flowers in the garden:
1. Many users use CAcert without any assurance. Until now, their CSRs were signed by Class 1 Root (–> serial # 1xxxxx) and their CSRs/renewals are stuck in a queue now.
2. These users know absolutely nothing about existence Class 1 & Class 3 Roots, as they don’t remember installing root(s), and when creating a new cert, they cannot see the choice Class 1/3, because with <50 assurance points (trust points) it isn’t displayed.
3. Many users do not know about the existence of Wiki, bugs, blog, CATS… websites. Our education possibly fails in this direction.

And from Alsace, a baker who is also CAcert volunteer writes after putting the children to bed: There is a lot of information and many tutorials are at the FAQ at https://wiki.cacert.org How to create a certificate can be found at: https://wiki.cacert.org/HowTo/ClientCertCreate/

Another help message was sent by a CAcert volunteer who works as a bus driver from his mobile phone during the short break at the terminus: To get assurance points, the easyest way is to meet with two (or three) experienced assurers who can then credit you with the assurance (trust) points you need (you need 50 and get 10-35 per assurer). When you are on cacert.org in your account, go to the Web Of Trust: https://www.cacert.org/wot.php?id=12 (here you can enter your town and search for assurers in the area) or: https://www.cacert.org/wot.php?id=1 (here you can click through to choose from about 6000 assurers worldwide).

Thank you very much to all our active community members who helps here and there and gives other community members a hand. Even very little help is helpfull. If e.g. each of the 6000 assurers from the assurer directory helps with something small for 10 minutes per month, that is already 1000 hours of work. That would solve (almost) all problems. Here is how you too can give your CAcert community a hand: https://wiki.cacert.org/engagement

And another volunteer from Sweden points out, that the issue will not go away till the interface is fixed, which is a work that has been started, but not finished. Furthermore, renewing old incorrectly signed certificates will never work again, as we have said we will not fix the broken code for that, as no certificates should ever have been signed that way. We can’t continue signing them incorrectly.

Entdecke ennet dem Rhein CAcerts neuer Quell’

Leave a reply

Wenn die Sommerhitze unerträglich wird, dann ist es höchste Zeit, sich an den Gestaden des Rheins etwas zu erfrischen. Und was liegt näher, als darauf ennet dem kühlen Nass seine Schritte nach St. Augustin zu lenken, wo die Freiwilligen von CAcert an der FrOScon etwas absolut Neues persönlich vorstellen?

Une révolution s’annonce le 14 juillet

Leave a reply

A l’occasion de ce 14 juillet, CAcert a l’honneur d’annoncer par cette voie une nouveauté à tous les membres français et francophones de la communauté CAcert. Nos bénévoles se feront un plaisir de vous le montrer et de vous l’expliquer personnellement: Juste de l’autre côté du Rhin, près de Cologne-Bonn, à la FrOScon.

Critical servers upgrade project

Leave a reply

As a faulty connection cable between www.cacert.org and the signer made it necessary to travel to the datacenter this weekend instead of the planned schedule later this year we were able to finish this part earlier than expected: We finalized on the last steps of moving CAcert to a more modem hardware and software on critical servers.

This project was started “somehow” in May 2020 when the signer power board broke just before the Corona-Lockdown took place. The old signer was replaced by the same model at this visit. Since then we had several outages, which were mainly caused by broken hardware, sometimes noticed by our members, sometimes only visible in our internal monitoring.

Today the last of the old servers (our signer) was powered down as it was replaced by two modern machines using a more recent debian release, but keeping the old signer-coding.

The complete hardware-replacement-project reduced the power consumption of all CAcert-servers for more than 60%.

But that’s not all: We have plans to put our signer-environment to a new software written in Go, but here we need YOUR help in testing and reviewing the code. Feel free to contact support@cacert.org to get in touch to our experts.

Screenshot of the CAcert browser client certificate web application

Lowering the barriers of entry

Leave a reply

In the coming few months we will start running some services with Let’s Encrypt server certificates. We decided to go this route to make it easier for people to join our community or contribute to our work.

A nice side effect of this move will be that we can provide these services https encrypted and redirect all unencrypted http URLs to their https counterparts.

We will continue to use our own server certificates for our CA systems and other services that are only relevant after joining our community.

We also will continue to provide our community with client and server certificates. All our services that support or require client certificates will still use those issued by our CA.

We recently implemented a web application to make it easier to get started with client certificates. The application provides a friendly and completely client side interface to generate key pairs and signing requests in your browser.

Upcoming changes during pentecost

1 Reply

+++ Update +++ www.cacert.org is now running on a new server, first tests were successful. Still some finetuning needs to be done afterwards +++ update +++

During the long weekend around pentecost (“Pfingsten” as it is called here in Germany) we’re planning the next step in replacing some hardware at the datacenter.

The main reason for the visit at the datacenter on monday is it to plug the serial connection between our webserver and signer to the new machine.

As our main website will move to a new server, which was installed in the datacenter during the last visit, there will be an interruption of service while doing the final copy and reconfiguration of the firewall (hopefully not longer than one hour).

While we’re at the datacenter we’re adding two SSD-drives to infra02. During the activation of the host system on these SSDs the services running on infra02 (like blog, wiki etc.) will not be accessible and/or slower than usual.

After all services are moved (remotely/afterwards) from the HDDs to SSDs everything should be active again … and most likely faster.

At a later visit (planned in July) the old sun1-server and old infra02-HDDs will be removed from the rack.

The final step for hardware-upgrade/replacement in the critical environment will be a replacement of the old signer machine(s) by new servers and HSM-modules. For this step software- as well as development team need some assistance in reviewing and testing especially the coding (written in Go). Feel free to contact us via support@.c.o, mailing-lists or using comments to this blog-entry.

Last chance, hurry up, catch your review!

Leave a reply

Dear friend of #CAcert, here comes the last #bugs that needs a #review. We are so glad, that you are willing to #help you #community and review only one of them during the #spring #offensive.

https://bugs.cacert.org/view.php?id=1310
https://bugs.cacert.org/view.php?id=1129
https://bugs.cacert.org/view.php?id=1302
https://bugs.cacert.org/view.php?id=875
https://bugs.cacert.org/view.php?id=1304

We published all ready 12 bugs for review earlyer today in this channel. Maybe, you find a more conviniant one there?