GNU Savannah and HTTPS

Certificate

If you have not imported CAcert's root certificate, see the instructions.
Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B
Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33

Why using CAcert.org?

You can find the CAcert root certificate from the following locations:

Savannah fingerprints

savannah.gnu.org:
	MD5 fingerprint: 75:D3:AF:91:80:F2:9F:E3:D2:71:3A:16:D7:87:EB:AD
	SHA-1 fingerprint: 8D:BC:59:60:DA:83:65:C1:BD:28:03:D2:FE:0A:29:8D:B6:AF:85:3F
	Public Key Id: 06:0F:24:8F:BF:01:EC:E8:7C:23:65:82:35:C7:98:D9:5F:C2:11:E7

savannah.nongnu.org:
	MD5 fingerprint: 1A:73:F4:4A:31:4F:24:1C:4A:E4:15:C6:D5:B6:41:05
	SHA-1 fingerprint: 67:80:97:E3:53:5D:AA:10:BD:6D:A8:C9:AF:31:DE:BB:AA:82:DA:DD
	Public Key Id: 52:8B:42:B7:FA:F5:92:23:88:C2:C4:70:A3:A8:E6:35:D4:32:5A:1E
    

Check by yourself!

Check the certificates fingerprints


Get GnuTLS and its certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):


$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
        MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem

Simulate a connection

We'll use gnutls-cli [doc]:

$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org
Processed 2 CA certificate(s).
Resolving 'savannah.gnu.org'...
Connecting to '199.232.41.3:443'...
- Ephemeral Diffie-Hellman parameters
 - Using prime: 1024 bits
 - Secret key: 1021 bits
 - Peer's public key: 1024 bits
- Certificate type: X.509
 - Got a certificate list of 1 certificates.
 - Certificate[0] info:
  - subject `CN=savannah.gnu.org', issuer `O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org', RSA key 2048 bits, signed using RSA-SHA, activated `2009-08-25 10:55:26 UTC', expires `2010-02-21 10:55:26 UTC', SHA-1 fingerprint `8dbc5960da8365c1bd2803d2fe0a298db6af853f' <-- verify the fingerprint
- The hostname in the certificate matches 'savannah.gnu.org'.
- Peer's certificate is trusted <-- check this line
- Version: TLS1.0
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

- Simple Client Mode:
[...]

Extract the key from the live server

$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem

You then can display the certificate as usual:

$ certtool -i < sv.pem

Verify the certificate chain

$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e
Certificate[0]: CN=savannah.gnu.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[1].
Verification output: Verified.

Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[2].
Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root
certtool: Issuer's name does not match the next certificate
The first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.