Savannah is currently using certificates from StartSSL that should require no special actions by users to validate. We hope we'll be able to use CAcert again in the future. Meanwhile, we leave the rest of this page for informational purposes for anyone wishing to use CAcert now.
Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33
savannah.gnu.org:
MD5 fingerprint:
b5d537d80b2317887116ff91b0ecdccb
SHA-1 fingerprint:
22e8ba8d6cf8b1f0f5c893d0977a0fa055b0051d
Public Key Id:
060f248fbf01ece87c23658235c798d95fc211e7
savannah.nongnu.org:
MD5 fingerprint:
7bde181919c336af2d8e2b7343743e63
SHA-1 fingerprint:
423fd06b6ae9c021880c3cdf9aedcfee540ff32f
Public Key Id:
528b42b7faf5922388c2c470a3a8e635d4325a1e

Get GnuTLS and its
certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):
$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem
We'll use gnutls-cli [doc]:
$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org Processed 2 CA certificate(s). Resolving 'savannah.gnu.org'... Connecting to '199.232.41.3:443'... - Ephemeral Diffie-Hellman parameters - Using prime: 1024 bits - Secret key: 1021 bits - Peer's public key: 1024 bits - Certificate type: X.509 - Got a certificate list of 1 certificates. - Certificate[0] info: - subject `CN=savannah.gnu.org', issuer `O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org', RSA key 2048 bits, signed using RSA-SHA, activated `2009-08-25 10:55:26 UTC', expires `2010-02-21 10:55:26 UTC', SHA-1 fingerprint `8dbc5960da8365c1bd2803d2fe0a298db6af853f' <-- verify the fingerprint - The hostname in the certificate matches 'savannah.gnu.org'. - Peer's certificate is trusted <-- check this line - Version: TLS1.0 - Key Exchange: DHE-RSA - Cipher: AES-128-CBC - MAC: SHA1 - Compression: NULL - Handshake was completed - Simple Client Mode: [...]
$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem
You then can display the certificate as usual:
$ certtool -i < sv.pem
$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e Certificate[0]: CN=savannah.gnu.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[1]. Verification output: Verified. Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org Verifying against certificate[2]. Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root certtool: Issuer's name does not match the next certificateThe first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.
Check this blog post from GnuTLS' maintainer.