Category Archives: Information

General news/information to the CAcert community or about security in general

Successful Root-Re-Sign

On March 12th 2016 CAcert performed the Root Re-Signing at our data center in Ede, NL. After the initial attempt[1] had to be postponed on short notice.

The process followed the procedures that are available in the Wiki[2]/SVN[3] along with the tooling[4] used.

The re-signing was conducted by two CAcert critical administrators, a secure-u access engineer, and supervised by CAcert’s internal auditor.
Its execution has been announced on the cacert-systemlog mailing list[5]. The execution report by the critical team has been published there too[6]. The report of the auditor is published in our Wiki[7].

We want to send special thanks to all who helped in preparing and testing the procedures and tools for the process and thus made this smooth execution possible.

CAcert Inc. board tried to have the part for creation of the needed software to be held in public but was overruled by some of the involved teams.

As the re-signed root certificates are available to CAcert the next steps are to publish them to the public. This will need some time as the software team needs to prepare the code changes[8][9][10] and have them reviewed. Once this is done the publishing of the re-signed root certificates will be announced on the blog and all community members will get informed via e-mail.

[1] https://blog.cacert.org/2015/12/re-signing-root-certificate/
[2] https://wiki.cacert.org/Roots/Class1ResignProcedure
[3] https://svn.cacert.org/CAcert/SystemAdministration/signer/re-sign-2016/implementation.txt
[4] https://github.com/CAcertOrg/cacert-procedures/tree/root-resign-sha256/rootResignSHA256
[5] https://lists.cacert.org/wws/arc/cacert-systemlog/2016-03/msg00001.html
[6] https://lists.cacert.org/wws/arc/cacert-systemlog/2016-03/msg00002.html
[7] https://wiki.cacert.org/Audit/Results/session2016.1
[8] https://bugs.cacert.org/view.php?id=1305
[9] https://bugs.cacert.org/view.php?id=1254
[10] https://bugs.cacert.org/view.php?id=1194

CAcert at CeBIT 2016

German version below

On the world’s largest computer fair, the CeBIT in Hannover, DE, CAcert should not be missing out. From March 14th through March 18th Assurers and Assurees are meeting each other at 12:00 CET outside Hall 2 in direction of the green. In case of bad weather the assurances take place directly at the glass front of Hall 2 outside under the roofing.

More details can be found in the Wiki.
CeBIT meeting point

Further events with attendance of CAcert — with a booth at OpenSource events — can be reviewed in the CAcert wiki at http://wiki.cacert.org/Events/UpcomingEvents.

[German]
Auf der weltgrößten Computermesse, der CeBIT in Hannover, darf auch CAcert nicht fehlen. Vom 14. bis 18. März treffen sich Assurer und Assurees täglich ab 12 Uhr vor Halle 2 in Richtung der Grünfläche. Bei schlechtem Wetter finden die Assurances direkt an der Glasfront von Halle 2 außen unter der Überdachung statt. Mehr Informationen finden sich im Wiki.

Weitere Veranstaltungen mit CAcert-Beteiligung – mit eigenem Stand auf OpenSource-Veranstaltungen – sind im CAcert-Wiki unter http://wiki.cacert.org/Events/UpcomingEvents einsehbar.

Safer Internet Day 2016

On 2016-02-09 is this year’s Safer Internet Day[1] asking its participants to “Play your part for a better internet!”

The Safer Internet Day was first celebrated in 1999 to strengthen the awareness for security within and on the internet.

CAcert’s share in this effort is providing everybody the means to protect their communication by sending encrypted emails or using free client certificates for authentication.

So take a moment and think about taking part in one of the several events and help to promote email encryption with CAcert S/MIME certificates.

And stay safe on the internet!

[1] https://www.saferinternetday.org/

Re-Signing Root Certificate

On Friday, 29th January 2016, the long-planned re-signing of CAcert’s root certificate will finally take place.

This action has been overdue for quite some time now as several browser and OS vendors have dropped support for MD5-signed certificates or otherwise made such certificates unusable.

The re-signing process [1] has been tested successfully at last FrOSCon in August 2015 [2].

Attendance of the re-signing ceremony will be open to the public and will take place near CAcert’s data center in Ede, NL. As soon as more details become available we’ll provide a wiki page with the exact schedule and location.

UPDATE: Unfortunately the Re-Signing event had to be postponed due to shortage of manpower in the different teams involved in the process. The currently a new date is being searched. As soon as the new date is available it will be announced here.

[1] https://wiki.cacert.org/Roots/Class1ResignProcedure
[2] https://wiki.cacert.org/Audit/Results/session2015.4

Get Audit ready

The new elected CAcert Inc board want to share their mission statement for the current fiscal year.

We want to help CAcert to become the world’s most trusted service provider able to help people around the world

  • to secure their privacy
  • to secure their identity

in the area of digital electronic communications. We all want to lead an operating Certificate Authority providing highly secure certificates for free to the public in which everybody can trust. The next central milestone for the development of our CA is to pass an audit with flying colors.

We will subordinate all of our activities to reach this goal within the next years.

The first serious challenge to take will be the resign of our root certificate within the next 3 months (hopefully on the eve of FOSDEM 2016).

We want to continue with the tasks to prepare the New Root Escrow within the next year.
To secure the existence of CAcert for a long time we want to prepare the move to a hosting country in Europe within the next year.

Today we ask you to have confidence in our plans and personal integrity and hope that all of you will support us in fulfilling these tasks.

Please allow to remember to McDonald’s main maxim:

„All of us is more than one of us“

The new board is composed of
Reinhard Mutz, President CAcert Inc.
Jürgen Bruckner, Vice President CAcert Inc.
Marcus Mängel, Secretary
Stefan Thode, Treasurer
Felix Dörre, Board member
Peter Yuill, Board member

Successful process tests of New Root and Escrow and Class 1 Root resigning

On Sunday at FrOSCon 10 CAcert successfully tested the New Root and Escrow (NRE) process and performed a test run of the long expected Class 1 Resigning.

Members of the software team, the critical admins, the NRE team, and the internal auditor met in a session, which was open to the public, to test these long prepared tasks.

The process started with checking that the needed hardware was running and was setup up according to the process definition. In a first step the defined tasks were then executed manually to proof that the procedures produces the desired results. In a second step the manual tasks were automated where possible and the script was tested and checked according to the process definition.

The results show the expected outcome.

The internal auditor was pleased with the good and professional preparation of the test and the successful outcome. The new root keys created during the NRE test will be used for a test server based on Gigi and Cassiopeia.

Related Information:

ATE Nykobing, Denmark on September 20th 2015

[Danish and German version below]
On Sunday 20th September there will be “A day of Internet Security and CAcert ATE” hosted by ShowIT Media [1].

Agenda

10:00 Welcome
10:15 A Security status on the Internet by Bitdefender
11:00 A Quick Introduction to CAcert
11:20 Time out for lunch
12:15 CAcert Assurance Training Event (ATE)
17:00 Thank you for coming / Safe journey home.

All speeches will be held in English. There will be the possiblity to gether at least 100 Assurance Points.

Place:
ShowIT Media
Slotsbryggen 14 A-D
4800 Nykobing F
Denmark

More information can be found [2], to register: I will attend the ATE Nykobing

[1] https://www.showitmedia.eu/uk_cert.html
[2] https://wiki.cacert.org/Events/2015-09-20-ATE-DK-Nykobing

[Danish version]

Søndag den 20. September afholdes ”En dag med Internet sikkerhed og CAcert ATE” hos ShowIT Media [1].

Program:

10:00 Velkomst
10:15 ”En status på sikkerheden på internettet” af Bitdefender
11:00 En kort præsentation af CAcert
11:20 Frokostpause
12:15 CAcert Assurance Training Event (ATE)
17:00 Tak for I dag / Kom godt hjem

Alle indlæg holdes på Engelsk. Det vil være muligt at samle mindst 100 Assurance point.

Du kan finde mere information på [2] og registrere dig her: Jeg deltager i ATE i Nykøbing

[German version]

Am Sonntag den 20. September veranstaltet die ShowIT Media “Einen Tag der Internetsicherheit und ein CAcert ATE/”A day of Internet Security and CAcert ATE” [1].

Agenda

10:00 Grußwort
10:15 Ein Sicherheitsstatusbericht für das Internet durch Bitdefender
11:00 Eine kurze Dartstellung von CAcert
11:20 Mittagspause
12:15 CAcert Assurance Training Event (ATE)
17:00 Ende der Veranstaltung

Alle Vorträge werden in Englisch gehalten. Es wird die Möglichkeit bestehen mindestens 100 Assurancepunkte zu sammeln.

Weitere Informationen zum Event unter [2], zum Anmelden: Ich nehme ATE in Nykobing teil.

FrOSCon 10 in St. Augustin 22./23. August 2015

For the English version see below.

CAcert wird dieses Jahr zum zehnten Mal mit einem Stand auf der FrOSCon
vertreten sein. Damit gehört CAcert zu den Projekten, die bei allen zehn
Auflagen der FrOSCon dabei waren.

CAcert wird neben dem Stand, an dem wie üblich assured und über CAcert
informiert wird, auch mit einem Projektraum vertreten sein. In diesem
Projektraum wird an aktuellen Softwareentwicklungen bei CAcert gearbeitet,
z.B. Test der Erstellung neuer Roots, Gigi/Cassiopeia dem Redesign der Software.

Wir hoffen, dass wir viele von Euch auf der FrOSCon treffen werden.

Wann?
– Samstag + Sonntag, 22. + 23. August 2015
– Einlass Samstag ab 08:30h und Sonntag ab 09:00h

Ort:
– in der Hochschule Bonn-Rhein-Sieg
– Grantham-Allee 20
– 53757 Sankt Augustin

Tickets
– Der Eintritt ist in diesem Jahr frei!

Mehr Informationen unter wiki.cacert.org/Events/FrOSCon2015

English

CAcert will be present with a booth at the FrOSCon 2015 for the tenth time. Thus CAcert is one of the projects that attended all previous installments.

Apart from the booth CAcert will be present with a project room. In the project room the team will work on the current coding projects like the test of the new root creation and the redesign of the software dubbed Gigi/Cassiopeia.

We hope to meet you at FrOSCon.

When?
– Sat / Sun 22nd/23rd August 2015
– Open Sat from 8:30 and Sun from 09:00

Location:
– Hochschule Bonn-Rhein-Sieg
– Grantham-Allee 20
– 53757 Sankt Augustin

Tickets
– This year the admission is free

For more information see wiki.cacert.org/Events/FrOSCon2015

CAcert fingerprints via DNSSEC

Recently we got several questions about automated installers for our certificates. While the new ca-cacert package in Debian Testing is a nice way for a verified installation it isn’t perfect. One issue is the initial download of the certificates when the source package is built by the maintainer; the second issue is that not everybody is using Debian.

As for a long time there was no way to automate the check of the trust anchor with tools you already have we used cryptography to make it work: DNSSEC. While you can’t directly download the certificates directly from DNS – the information would be to huge and hardly manageable – you still get enough information to bootstrap the verification from DNS. All you need is a way to query and validate TXT RRs from DNS, a way to download files via HTTP and a way to calculate some hashes.

The information about the fingerprints is stored in the DNS zone _fp.cacert.org – the underscore indicates non-host information. For each generation of root certificates a new sub-directory will be created. The current one is “g1”. To list all available certificates of a specific generation you can query the label _certs for that sub-directory given a DNS query for _certs.g1._fp.cacert.org yielding the two names “root class3” as the certificates. Each of those references in turn provides both an URL (“_url”) and a set of fingerprints (_md5, _sha1, _sha256) needed for the verified download of that certificate. To download the current (g1) root certificate you’d thus look for the download URL at _url.root.g1._fp.cacert.org and verify the SHA2-256 fingerprint given at _sha256.root.g1._fp.cacert.org. Fingerprints are always uppercase and without any delimiters.

For further technical details have a look into the Wiki [1]

[1] https://wiki.cacert.org/HowToDocuments/FingerprintsViaDNSSEC