GNU Savannah and HTTPS


Savannah is currently using certificates from StartSSL that should require no special actions by users to validate. We hope we'll be able to use CAcert again in the future. Meanwhile, we leave the rest of this page for informational purposes for anyone wishing to use CAcert now.

CAcert usage (old)

If you have not imported CAcert's root certificate, see the instructions.
Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B
Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33

Why using

You can find the CAcert root certificate from the following locations:

Savannah fingerprints
  MD5 fingerprint:
  SHA-1 fingerprint:
  Public Key Id:
  MD5 fingerprint:
  SHA-1 fingerprint:
  Public Key Id:

Check it yourself!

Check the certificates fingerprints

Get GnuTLS and its certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):

$ certtool --certificate-info --infile
Other information:
        MD5 Fingerprint: XX:XX:XX:...
# shorter version: certtool -i <

Simulate a connection

We'll use gnutls-cli [doc]:

$ gnutls-cli --x509cafile /usr/share/ca-certificates/
Processed 2 CA certificate(s).
Resolving ''...
Connecting to ''...
- Ephemeral Diffie-Hellman parameters
 - Using prime: 1024 bits
 - Secret key: 1021 bits
 - Peer's public key: 1024 bits
- Certificate type: X.509
 - Got a certificate list of 1 certificates.
 - Certificate[0] info:
  - subject `', issuer `O=Root CA,OU=,CN=CA Cert Signing Authority,', RSA key 2048 bits, signed using RSA-SHA, activated `2009-08-25 10:55:26 UTC', expires `2010-02-21 10:55:26 UTC', SHA-1 fingerprint `8dbc5960da8365c1bd2803d2fe0a298db6af853f' <-- verify the fingerprint
- The hostname in the certificate matches ''.
- Peer's certificate is trusted <-- check this line
- Version: TLS1.0
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- Compression: NULL
- Handshake was completed

- Simple Client Mode:

Extract the key from the live server

$ gnutls-cli --print-cert </dev/null >sv.pem

You then can display the certificate as usual:

$ certtool -i < sv.pem

Verify the certificate chain

$ cat sv.pem /usr/share/ca-certificates/ | certtool -e
Issued by: O=Root CA,OU=,CN=CA Cert Signing Authority,
Verifying against certificate[1].
Verification output: Verified.

Certificate[1]: O=Root CA,OU=,CN=CA Cert Signing Authority,
Issued by: O=Root CA,OU=,CN=CA Cert Signing Authority,
Verifying against certificate[2].
Error: Issuer's name: O=CAcert Inc.,OU=,CN=CAcert Class 3 Root
certtool: Issuer's name does not match the next certificate
The first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.

Get your own CAcert certificate

Check this blog post from GnuTLS' maintainer.