Category Archives: Information

General news/information to the CAcert community or about security in general

New signatures for CAcert-Class 3-Subroot-certificate

3 Replies

New signatures for CAcert-Class 3-Subroot-certificate – Changes for users of CAcert-Certificates
(english version, german see below)

CAcert re-signs its Class 3-certificate with a new SHA256 signature. The formerly used MD5 signature is not seen as fully secure any more by Mozilla and is therefore deprecated. Mozilla is going to drop support for MD5-signed Class 3-subroot and end-entity certificates after 30th June. Users of Mozilla products like Firefox, and Thunderbird may experience errors when these programs try to verify such certificates.

Hence webmasters, as well as users of CAcert’s Class 3-certificates, have to download and install the newly signed certificates from CAcert’s website. The same procedure applies if the Class 3-certificate is used for secure e-mail communication, for code signing, or for document signing.

The procedure in short:
1. Download the new Class 3 PKI Key from http://www.cacert.org/index.php?id=3

2. Either install it directly in your browser, or any other client program you use the certificate for, or save it to the SSL configuration directory of your webserver. For Apache this may be: /etc/apache2/ssl/class3.crt (PEM-Format)

3. Verify the SHA1-fingerprint of the downloaded certificate:
AD:7C:3F:64:FC:44:39:FE:F4:E9:0B:E8:F4:7C:6C:FA:8A:AD:FD:CE
Example Commandline: openssl x509 -fingerprint -noout -in class3.crt
Or look at the fingerprint when importing the certificate into the webbrowser

4. Webmaster now re-create the necessary hash with c_rehash, or the like

By using the safe SHA256-hash CAcert is focussing on securing the internet on a continuing basis. Further information is given on CAcert’s Wiki page.

-+-

Neue Signaturen für CAcert-Class 3-Subroot-Zertifikat – Änderungen für Nutzer von CAcert-Zertifikaten

CAcert signiert sein Class 3-Subroot-Zertifikat neu mit einer SHA256-Signatur. Die bisherige von CAcert genutzte MD5-Signatur wird von Mozilla als nicht mehr ausreichend sicher angesehen. Mozilla wird deshalb MD5-signierte Class 3-Subroot- und End-Zertifikate nach dem 30. Juni nicht mehr unterstützten. Benutzer etwa von Firefox und Thunderbird können nach diesem Tag einen Fehler beim Prüfen MD5-signierter Zertifikate erhalten.

Webmaster wie Webbenutzer müssen daher, wenn sie das Class 3-Subroot-Zertifikat verwenden, dieses neu von der CAcert-Webseite herunterladen und installieren. Gleiches ist erforderlich bei Verwendung der Class 3-Zertifikate für sichere E-Mail-Kommunikation, zur Code-Signierung oder zum Unterzeichnen von Dokumenten.

Der Ablauf in Kurzform:
1. Den neuen Class 3 PKI Key von http://www.cacert.org/index.php?id=3 herunterladen

2. Je nach Anforderung entweder direkt im Browser bzw. anderen, benutzten Programmen installieren oder in das SSL-Konfigurationsverzeichnis des Webservers ablegen. Für Apache zum Beispiel: /etc/apache2/ssl/class3.crt (PEM-Format)

3. Den SHA1-Fingerabdruck des heruntergeladenen Zertifikats prüfen:
AD:7C:3F:64:FC:44:39:FE:F4:E9:0B:E8:F4:7C:6C:FA:8A:AD:FD:CE
Beispiel Kommandozeile: openssl x509 -fingerprint -noout -in class3.crt
Oder im Web-Browser Anzeige des Fingerprints beim Zertifikatsimport

4. Webmaster erzeugen dann den erforderlichen Hash mit c_rehash oder ähnlichen Programmen neu

Durch den nun verwendeten SHA256-Hash investiert CAcert weiter in ein sicheres Internet. Weitere Informationen befinden sich im CAcert-Wiki.

12 May 2011, NLUUG Spring Conference – Open is efficient, Ede – Netherlands

Leave a reply

NLUUG logo
On the 12 May 2011 the NLUUG (Netherlands Unix Users Group) will hold its semiannual conference in De Reehorst, Ede.
The topic is “Open is Efficient”.
CAcert will have a booth there.
Are you interested and willing to help out at the booth please contact me and/or sign up on the CAcert wiki – http://wiki.cacert.org/events/vj2011
Remember Assurers must have passed the Assurer Challenge!
Be sure to enlist as assurer on the event page.
For more information on the conference:
http://www.nluug.nl/activiteiten/events/vj11/index.html

Easter Egg Challenge 2011

Leave a reply

Easter Egg
We’ve just started our this years Easter Egg Challenge … We’ve put a couple of patches on to our testserver CACERT1 for you, our fellow and our new Software testers. We’ve put light to heavy patches to the package so everybody is able to walk thru the testserver web pages and search our Easter Egg’s.
Continue reading →

New procedure for Name Change after Marriage w/ Assurance

1 Reply

To all community member and assurer,

The arbitration and support teams developed a new “Name Change after
Marriage w/ Assurance” procedure though an arbitration case a20110330.1.
The procedure is outlined in
http://wiki.cacert.org/Arbitrations/Training/Lesson12 and
http://wiki.cacert.org/Support/Handbook/PrecedentCases/a20110330.1.
This should speed up the process of a name change after marriage.

All you need to do is (for the user who wants to get a name change after
marriage):

1. Find at least 2 Assurer to do an Assurance
2. Send a list of the assurers that can confirm the name change after
marriage to support

That’s it.

Support than will contact the parties to get further information.

Google on improving certificate security

Leave a reply

Benl writes: Improving SSL certificate security

Friday, April 1, 2011 9:05 AM Posted by Ben Laurie, Google Security Team

In the wake of the recent [incident], there has been a great deal of speculation about how to improve the public key infrastructure, on which the security of the Internet rests. Unfortunately, this isn’t a problem that will be fixed overnight. Luckily, however, [engineers] have long known about these issues and have been devising solutions for some time.

Given the current interest it seems like a good time to talk about two projects in which Google is engaged.

The first is the Google Certificate Catalog. Google’s web crawlers scan the web on a regular basis in order to provide our search and other services. In the process, we also keep a record of all the SSL certificates we see. The Google Certificate Catalog is a database of all of those certificates, published in DNS. So, for example, if you wanted to see what we think of https://www.google.com/’s certificate, you could do this:

[tech details snipped]

The second initiative to discuss is the DANE Working Group at the IETF. DANE stands for DNS-based Authentication of Named Entities. In short, the idea is to allow domain operators to publish information about SSL certificates used on their hosts. It should be possible, using DANE DNS records, to specify particular certificates which are valid, or CAs that are allowed to sign certificates for those hosts. So, once more, if a certificate is seen that isn’t consistent with the DANE records, it should be treated with suspicion. Related to the DANE effort is the individually contributed CAA record, which predates the DANE WG and provides similar functionality.

[caveats snipped]

Improving the public key infrastructure of the web is a big task and one that’s going to require the cooperation of many parties to be widely effective. We hope these projects will help point us in the right direction.

CATS login bug fixed (bug#889)

2 Replies

If you tried to log in to CATS recently with a newly created certificate you probably failed. Especially when using a Class 3 certificate. Now I hope this bug is finally fixed.

Like usual for such bugs it was quite a trivial thing, for details compare CAcert/Education/CATS/login.php in svn with its previous version.

For analysis: certificates affected contained a serial number wich started with a non-digit character after stripping learing zeros. So Class 3 certificates with serial number bigger than 09:ff (issued since about half a year ago) and Class 1 certificates with serial greater than 09:ff:ff (issued since recently) have been affected.

I’m still waiting for the first explicit confirmation of someone now able to log in, but the analysis nicely fits the symtoms and the problem could be reproduced on the test system, so I hope we finally got it.