Tag Archives: english

What will the Post look like in ten years?

Roberto Cirillo has been CEO of Swiss Post for just under two years. Before that, he was a McKinsey consultant, CEO of the British hospital group Optegra and head of the activities of the service company Sodexo in France. Cirillo took up his post with the aim of stopping the downward trend. In the past five years, the Post’s turnover has fallen by around CHF 1 milliard. The volume of letters is decreasing rapidly, the post offices are less and less frequented.

In an interview with the NZZ, he said: “Today, we make more than 90% of our turnover in the logistics sector with business customers. Especially in e-commerce and goods logistics. Of the CHF 3 milliard we plan to invest in the next four years, the majority will go into logistics and communication services. The reason why the Post was created over 170 years ago was not to transport letters. It was the secrecy of letters. It was about transmitting information securely, reliably and trustworthily. That’s what we want to do more of in the digital world as well.” (22.02.2021)

Merry CAcertmas!

Dear friends and members of the CAcert community. Are you curious and want to know what is wrapped in the package under the tree? This year, Father Christmas has packed something really nice.

As always with CAcert, you can unwrap it faster and enjoy it more quickly if you help out a little. Translate a little. Or do a little programming. Or test a few new functions. Or like this. To do so, you find further information on the web or write to our secretary.

Unspectacular General Assembly 2021

The General Assembly of 2021 will go down as the shortest meeting in the history of CAcert. After only one and a half hours, President Brian McCullough was able to close the last agenda item. Kim N from Sweden is a new member of the committee.

Furthermore, the integration of CAcert in OpenIDConnect could be announced, thanks to a cooperation with RIPE NCC for this project.

Signature server back in operation

Retour en fonctionnement du serveur de signature

Le serveur responsable de signer à la demande les certificats émis par CAcert dispose de deux disques durs, en redondance l’un de l’autre. Lorsqu’un dysfonctionnement se produit, aucune maintenance à distance n’est possible, car la machine n’est intentionnellement pas branchée au réseau. Seul un câble série permet d’échanger requêtes et réponses avec le reste de notre infrastructure. Aucune connexion n’est possible par ce moyen.

Or, depuis le 2 Août, nous observions la mise en attente de toutes les demandes de signature de certificats. L’équipe des infrastructures critiques est donc intervenue sur site ce 21 Août. Un problème dans le traitement d’un des certificats était la cause du blocage. Ce problème est résolu, mais reste à diagnostiquer avec précision. Il s’agit d’une série d’incidents que nous n’avions jamais vus auparavant.

Compte tenu des deux autres incidents intervenus plus tôt cette année, liés au système de fichiers de notre serveur de signature, nous devions accroitre sa résilience. Aussi, ce 21 août, l’équipe des infrastructures critiques a installé dans le rack un second serveur de signature, comme secours passif du premier. La présence de liens série dédiés vers chaque machine permettra à l’avenir de basculer très rapidement sur le second serveur de signature, en cas de nouveau problème. Dans tous les cas, les deux serveurs restent comme auparavant isolés du réseau.

Nous prions nos membres de nous excuser pour ces dysfonctionnements, et encourageons ceux résidant en Hollande où dans sa proche périphérie, à envisager de s’associer au travail de notre équipe des infrastructures critiques, ce qui augmenterait notre capacité d’intervention rapide.

Simultanément, nous espérons que l’intervention d’hier marque la fin de cette longue et exceptionnelle série.

English version

The server responsible for signing certificates issued by CAcert on demand has two hard disks, redundant to each other. When a malfunction occurs, no remote maintenance is possible, as the machine is intentionally not connected to the network. Only a serial cable is used to exchange requests and responses with the rest of our infrastructure. No connection is possible by this means.

However, since the 2nd of August, we have been seeing all certificate signing requests being put on hold. The Critical Infrastructure team therefore intervened on site on the 21st of August. A problem in the processing of one of the certificates was the cause of the blockage. This problem has been solved, but remains to be precisely diagnosed. This is a series of failures that we have never seen before.

In light of the two other incidents earlier this year related to the file system of our signature server, we needed to increase its resilience. So on 21 August, the Critical Infrastructure team installed a second signature server in the rack as a passive backup to the first. The presence of dedicated serial links to each machine will make it possible in future to switch very quickly to the second signature server in the event of a new problem. In any case, the two servers remain isolated from the network as before.

We apologise to our members for the inconvenience, and encourage those living in or near the Netherlands to consider working with our Critical Infrastructure team, which would increase our ability to respond quickly.

At the same time, we hope that yesterday’s intervention marks the end of this long and exceptional series.

Backlog in the delivery of certificates

Unfortunately, there has been a backlog in the delivery of renewed and new certificates in Signer. The Critical Team cannot solve this remotely. A visit to the data centre is planned for next Monday. The stuck certificates should then be delivered. We are sorry that there has been a disruption again.

Im Signer ist es leider zu einem Stau der Auslieferung erneuerter und neuer Zertifikate gekommen. Das Critical Team kann dies nicht per Fernwartung lösen. Ein Besuch des Rechenzentrums ist am kommenden Montag geplant. Die feststeckenden Zertifikate sollten anschliessend ausgeliefert werden. Es tut uns Leid, dass es erneut zu einer Störung gekommen ist.

Expanded support

Heat, floods, hurricanes and other unplannable events quickly lead to delays. We are proud that, despite everything, the handover of the keys to support went smoothly yesterday and the new volunteers now have access to the relevant systems to assist the existing team.

On the allegorical picture you can see Joost handing over the access rights to Aleš, Matthias and David. Also present: Critical Admin, President and Secretary.

Deutsch: Support verstärkt

Hitze, Hochwasser, Hurrikane und andere unplanbare Ereignisse führen schnell zu Verzögerungen. Wir sind stolz darauf, dass trotz allem die Schlüsselübergabe beim Support gestern geklappt hat und die neuen freiwilligen Mitarbeiter ab sofort Zugang zu den relevanten Systemen haben, um das bestehende Team zu unterstützen.

Auf dem allegorischen Bild seht ihr Joost, der Aleš, Matthias und David die Zugriffsrechte überreicht. Mit von der Partie: Critical Admin, Präsident und Sekretär.

New signer proves itself in use

EN: Signer is running again

DE: Signer ist wieder in Betrieb

FR: Signataire fonctionne à nouveau

ES: Firmante vuelve a funcionar

IT: Firmatario è di nuovo in funzione

The signer has been running again since yesterday, Friday, around 13:00 CEST. We then (while we were doing other work) watched the processing for about another hour… Around 0:30 CEST all outstanding certificate requests (~3000) were processed.

Things didn’t quite go as planned in June. As soon as something cannot be done remotely – there is no remote access to critical systems for security reasons – someone who is authorised to do so has to go the data centre in the Netherlands. Despite Corona, quarantine, floods, overtime at the company and whatever else comes up. That’s maybe two hours. Then two hours home again and in between the actual work. During the opening hours of the data centre, in your free time and paying for your own train ticket or petrol. It’s not always easy to reconcile all that. On Friday afternoon, however, the time had come and the Signer has now been running smoothly again for over a day.

As can be seen from the Critical Team’s plan published yesterday, preliminary work is already underway to make the system redundant throughout and even more robust, so that failures should no longer be noticed by users, because no one is interested in such failures! We are very sorry that you had to wait so long. At the same time, we thank the small core team who have sacrificed nights and weekends over the last five weeks to get the technology back up and running for the CAcert community!

Protect yourself and your computer!

Français | Deutsch | English

Protégez-vous et protégez votre ordinateur!

Un certificat de CAcert protège contre les dangers sur Internet. En choisissant CAcert, vous avez fait un bon choix, car ici, vous n’espérez pas simplement que le prestataire le fera déjà bien, mais en tant que membre de la communauté CAcert, vous avez toutes les possibilités: Vérifiez notre travail – ou mieux encore: coopérez vous-même, car à qui pouvez-vous faire confiance plus qu’à vous-même et à vos plus proches collaborateurs!

Malheureusement, il existe des dangers contre lesquels vous ne pouvez pas vous protéger avec nos certificats. Les inondations, par exemple, ou les virus corona. Au rez-de-chaussée du siège de CAcert Inc. à Genève, en face de la gare des Eaux Vives, se trouve un grand centre de tests et de vaccination. Ici, vous pouvez obtenir immédiatement une protection X.509 et Covid-19.

Pour que les assurances redeviennent plus faciles et que nous puissions nous rencontrer à nouveau en personne lors d’une conférence prochainement: Protégez-vous avec un masque, gardez distance et respectez l’hygiène. Et: Faites-vous vacciner! Les deux, CAcert et Covid-19 nécessitent deux rendez-vous.*

*avec des assureurs expérimentés avec au moins 25 points, sinon cela peut être plus. La protection Covid se déploie 10 jours après la deuxième vaccination.

Schützen Sie sich und Ihren Computer!

Ein Zertifikat von CAcert schützt vor Gefahren im Internet. Mit der Wahl von CAcert haben Sie eine gute Wahl getroffen, denn hier hoffen Sie nicht einfach, dass der Anbieter es hoffentlich schon gut macht, sondern Sie haben als Mitglied der CAcert-Gemeinschaft alle Möglichkeiten: Überprüfen Sie unsere Arbeit – oder noch besser: arbeiten Sie selber mit, denn wem kann man mehr vertrauen, als sich selbst und seinen engsten Mitarbeitern!

Leider gibt es Gefahren, gegen die man sich mit unseren Zertifikaten nicht schützen kann. Überschwemmungen zum Beispiel oder Coronaviren. Im Erdgeschoss des Hauptsitzes des Trägervereins CAcert Inc. in Genf befindet sich ein grosses Test- und Impfzentrum. Hier bekommen Sie gleich beides X.509 und Covid-19-Schutz.

Damit Assurances wieder einfacher werden und wir uns demnächst wieder an einer Konferenz persönlich treffen können: Schützen Sie sich mit Maske, Abstand und Hygiene. Und: Lassen Sie sich impfen! Sowohl bei CAcert als auch bei Covid-19 braucht es zwei Termine.*

*mit erfahrenen Assurern mit mindestens 25 Punkten, sonst können es mehr sein. Covid-Schutz entfaltet sich 10 Tage nach der zweiten Impfung.

Protect yourself and your computer!

A certificate from CAcert protects you from dangers on the Internet. By choosing CAcert you have made a good choice, because here you are not simply hoping that the provider will already do it well, but as a member of the CAcert community you have all the options: Check our work – or even better: work with us yourself, because who can you trust more than yourself and your closest colleagues!

Unfortunately, there are dangers against which you cannot protect yourself with our certificates. Floods, for example, or corona viruses. On the ground floor of the headquarters of CAcert Inc. in Geneva there is a large testing and vaccination centre. Here you can get both X.509 and Covid-19 protection at once.

So that assurances become easier again and we can meet again in person at a conference soon: Protect yourself with mask, distance and hygiene. And: get vaccinated! Both CAcert and Covid-19 require two appointments.*

*with experienced assurers with at least 25 points, otherwise it may be more. Covid protection unfolds 10 days after the second vaccination.

Work on new signer in full swing

We recently reported here about a signer malfunction in our data centre in the Netherlands. Usually, our systems are redundant for such cases. This spring, the second disk was removed for repair due to an other malfunction that could not be resolved remotely. A small team of our volunteer engineers is working flat out to rebuild the server locally in Germany.

Then it can be brought to the data centre on the following Friday. If everything goes according to plan by Wednesday, the server in the Netherlands can go online on Friday.

CAcert is run exclusively by volunteers in their spare time. If you would like to help out in one way or another, we recommend subscribing to the relevant mailing lists to get in touch with the current topics and the active players.

Arbeit an neuem Signer läuft auf Hochtouren

Wir haben vor kurzem hier über eine Störung des Signers in unserem Datenzentrum in den Niederlanden berichtet. Üblicherweise sind für solche Fälle unsere Systeme redundant ausgerichtet. In diesem Frühjahr wurde die zweite Platte wegen einer anderen Störung, die sich nur per Fernwartung lösen konnte zur Reparatur entfernt.

Ein kleines Team unserer freiwilligen Ingenieure arbeitet mit Hochdruck daran, den Server lokal in Deutschland nachzubauen. Daraufhin kann er am darauffolgenden Freitag ins Rechenzentrum gebracht werden. Sollte alles bis Mittwoch nach Plan laufen, kann der Server in den Niederlanden am Freitag ins Netz gehen.

CAcert wird ausschliesslich von Freiwilligen in Ihrer Freizeit betrieben. Wenn Sie auf die eine oder andere Art mithelfen möchten, empfehlen wir, die entsprechenden Mailinglisten zu abonnieren, um so mit den aktuellen Themenkreisen und den aktiven Akteuren in Kontakt zu kommen.