GNU Savannah and HTTPS

Certificates

Fingerprints

savannah.gnu.org:
    MD5 Fingerprint: E2:5B:1B:B0:CF:54:57:36:CB:84:B4:A9:6F:8F:C8:2D
    SHA1 Fingerprint: DD:07:63:DA:D6:E6:EC:34:F1:36:69:C7:BF:82:59:A7:5B:11:54:69
    Public Key ID: 06:0F:24:8F:BF:01:EC:E8:7C:23:65:82:35:C7:98:D9:5F:C2:11:E7

savannah.nongnu.org:
    MD5 Fingerprint: 3D:51:4F:8F:B5:46:77:02:C6:FF:7B:B0:3D:6A:88:A2
    SHA1 Fingerprint: EE:B7:85:57:D4:62:60:90:D5:10:D3:B4:63:EB:D7:9F:C3:AE:41:F9
    Public Key ID: 52:8B:42:B7:FA:F5:92:23:88:C2:C4:70:A3:A8:E6:35:D4:32:5A:1E
    

Check by yourself!

Check the certificates fingerprints

Get GnuTLS and its certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):

$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
        MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem

Simulate a connection

We'll use gnutls-cli [doc]:

$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org
Processed 2 CA certificate(s).
Resolving 'savannah.gnu.org'...
Connecting to '199.232.41.3:443'...
- Ephemeral Diffie-Hellman parameters
 - Using prime: 1032 bits
 - Secret key: 1015 bits
 - Peer's public key: 1032 bits
- Certificate type: X.509
 - Got a certificate list of 1 certificates.

 - Certificate[0] info:
 # The hostname in the certificate matches 'savannah.gnu.org'.
 # valid since: Sat Sep 13 15:30:50 CEST 2008
 # expires at: Thu Mar 12 14:30:50 CET 2009
 # fingerprint: E2:5B:1B:B0:CF:54:57:36:CB:84:B4:A9:6F:8F:C8:2D <-- verify the MD5 fingerprint
 # Subject's DN: CN=savannah.gnu.org
 # Issuer's DN: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org


- Peer's certificate is trusted <-- check this line
[...]

Extract the key from the live server

$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem

You then can display the certificate as usual:

$ certtool -i < sv.pem

Verify the certificate chain

$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e
Certificate[0]: CN=savannah.gnu.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[1].
Verification output: Verified.

Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[2].
Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root
certtool: Issuer's name does not match the next certificate
The first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.