Tag Archives: CA

Natural gas industry accepts CAcert / Gas-Industrie setzt auf CAcert

[German version below]
CAcert is now officially accepted by the Edig@s work group as a trusted
Certificate Authority (CA) for Electronic Data Interchange (EDI). This
acceptance provides the basis to exchange messages securely between
companies utilizing CAcert issued certificates.
Edig@s is the official standard for the grid gas business that covers more than
99% of all western European gas deliveries. It validates the authenticity and
the binding character of the contract.
The open CA CAcert offers free advanced electronic signatures for corporate
and private use. This makes the usage of CAcert certificates interesting also for
small businesses.

Press release for download

[German Version]
Die Arbeitsgruppe Edig@s der europäischen Gasversorger hat CAcert offiziell
als Trusted Certificate Authority (CA) für den Electronic Data Interchange (EDI)
zugelassen. Die Zulassung gilt als Grundlage für die Verwendung von durch
CAcert ausgestellten Signaturen im rechtsgültigen geschäftlichen Verkehr.
Edig@s ist der gültige Standard für das Ferngasgeschäft, über den 99% aller
internationalen Gaslieferungen in Westeuropa abgewickelt werden. Er
garantiert die Authentizität und Verbindlichkeit der getätigten Geschäfte.
Die offene CA CAcert bietet kostenfreie fortgeschrittene Signaturen für
Unternehmen und Privatpersonen an. Das macht die Verwendung von CAcert-
Signaturen auch für kleine Unternehmen interessant.

Pressemitteilung zum Download

CAcert is a strong community / CAcert ist eine starke Gemeinschaft

[German version below]

CAcert is able to celeberate two things: ten years service as Certificate Authority and 250,000 CAcert Communinty members! Each member is able to get client and server certificates for free. This shows: CAcert is a strong community and everyone is able to take part and move CAcert to the future.

This can be achieved: many encouraged members are helping to improve CAcert. Many members are working on developing source code and procesess, in support and many other area to get the best certificate issuer.
You can be a part of the team: just send a mail to support@cacert.org or visit us on an event in your area (http://wiki.cacert.org/Events).


Dieses Jahr kann sich CAcert doppelt freuen: Zehn Jahre laufender Betrieb als Certificate Authority und gleichzeitig das 250.000 Mitglied in der CAcert-Community! Jedes Mitglied kann sich Zertifikate für Server und Clients kostenlos erstellen.

Das bedeutet: CAcert ist eine starke Gemeinschaft, denn jeder kann sich beteiligen und CAcert voranbringen:

Durch Nutzung, durch Verbreitung und durch die Mitarbeit im Team. Und das wirkt: Viele engagierte Teamhelfer sind dabei, CAcert noch besser zu machen. In der Entwicklung, in den Prozessen, im Support und vielen weiteren Bereichen arbeiten Community-Mitglieder daran, CAcert zum besten Zertifikatsaussteller zu entwickeln. Auch Du kannst dabei sein: Schreibe einfach an support@cacert.org oder besuche uns auf der nächsten Open-Source-Messe in Deiner Nähe (http://wiki.cacert.org/Events), z.B. der FrOSCon in Sankt Augustin bei Köln.

The Big Masterplan to become Audit Ready

Back in January 2010 the former Board decided by Board motion m20100117.3 “No new subroots on current root, plan for new root”. In the discussion a date was scheduled by end of Dec 31, 2010. On my 2nd thought, probably nobody did recognize, what that means, CAcert's Big Masterplan To become Audit Ready (01/2010) to finish all the projects from the bottom left corner at beginning of 2010 to the top right corner by end of the year with the “New Roots and Escrow” (New Roots and Escrow) process running. So this article should bring Audits mistery to light.

Policy Group worked on the last few essential Policies (Policies on Policy Group), that are essential for the Audit. One essential requirement for Audit is to Rollout the CAcert Community Agreement to all the members, so they can decide to continue or to leave the Community. To become “CCA Rollout Ready” (CCA rollout), the running Software needs to be updated. This opens the next problem: by starting 2010, there was no Software Update Process defined, nor documented. But we’re on the lucky side, the Software-Assessment-Project started November last year to fulfill this requirement (Software-Assessment-Project). The task was: To get a repository system controlled by Software-Assessment team, a controlled testserver environment and a documentation system. Currently the team tests the transfer of a test patch to the production system. Involved parties: Software-Assessment Project team, Software-Assessment team and the Critical Sysadmins team.

CAcert's Big Masterplan To become Audit Ready (10/2010)
CAcert’s Big Masterplan To become Audit Ready (10/2010)

In the meantime, another issue pop’d up: the “Thawte points removal” with a deadline of Nov 16th, 2010. We’ve allready posted several blog posts on this topic. So also this is related onto the Software-Assessment-Project progress (Software-Assessment-Project).

The next topic is running Assurer Training Events (ATE) (Assurer Training Events). ATE’s are an essential concept in the Audit over Assurance (RA) business area. To scale a worldwide community, the community has to assist Auditors work in doing Co-Audits over Assurers. The question: How to contact groups of Assurers was answered back in 2009 with the ATE concept. The purpose of ATE is twofolded: first to communicate to the Assurers all the new informations and second to do Co-Audits. As Assurers follows the invitations to the ATEs we can expect, that they are more active in the community. So also from 2009 ATE experiences, we’ve got new resources from the community by contacts on ATEs (Get new resources). So this was the plan for 2010 ATE season, to find more people, who can help on the several tasks and projects that needs to be finished, before the new Roots and Escrow project and also the Audit can be (re-)started. E.g.

Helping CAcert

  • we are searching Infrastructure Admins for the Non-Critical Infrastructure systems, all running on Unix. Familiar with system migrations for the big Infrastructure project to separate Non-Critical from the Critical systems (The big Infrastructure Task). This project is running about 2 years, but currently without progress.
  • we are searching for Software Developers (C++, Python, Java) for the New Software project BirdShack (New Software Project BirdShack), that was started last year, after Auditors review of the Software that concludes: „Serious difficulties in maintaining, improving and securing.” and „Cannot form conclusion over software.”, so if the plan to start with the Audit over the old Software fails, we’re close to the 2nd path: BirdShack.
  • we are searching for Audit consultants who can assists in the Audit next step CrowdIt disclosure system (read AGM – Audit Report 2010 – CrowdIt. CrowdIt, as a sort of wordplay on Crowd-Audit). CrowdIt is an emerging disclosure tool (based on the old DRC browser).
  • we are searching people, who can assist us in the funding project (Funding project), that becomes the ground base for the New Roots and Escrow project (New Roots and Escrow) that should be keep tracked by an Auditor, and the re-start of the Audit (Audit over Assurance (RA) 1) and (Audit over Systems (CA) 2).

The New Roots and Escrow Project Relation to Audit

As said before, the New Roots and Escrow Project should be keep tracked by an Auditor. From the experiences back in 2008 on creating New Roots but fail on Roots Escrow, we’re warned to separate the Audit steps of the New Roots and Escrow Project (New Roots and Escrow) and the Audit over Systems (Audit over Systems (CA) 2). Both tasks should be close together.

On the other side, we have to do an Audit over Assurance (Registration Authority, RA) (Audit over Assurance (RA) 1). There is no requirement on bundling the RA Audit and CA Audit as both business areas have their own Policy sets and can be checked separately. This can make our work presumably easier. Easier to get Audit funding for Audit over RA. As Assurance area is closer to be Audit Ready, we can also signal to the Community Audit is back on track. This will probably push the other tasks. With a small budget we probably can double the result by getting new resources, “Hey, there is progress on the overall Audit task” – CAcert is back!