GNU Savannah and HTTPS

StartSSL

Savannah is currently using certificates from StartSSL that should require no special actions by users to validate. We hope we'll be able to use CAcert again in the future. Meanwhile, we leave the rest of this page for informational purposes for anyone wishing to use CAcert now.

CAcert usage (old)

If you have not imported CAcert's root certificate, see the instructions.
Root cert fingerprint = A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B
Root cert fingerprint = 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33

Why using CAcert.org?

You can find the CAcert root certificate from the following locations:

Savannah fingerprints

savannah.gnu.org:
  MD5 fingerprint:
    b5d537d80b2317887116ff91b0ecdccb
  SHA-1 fingerprint:
    22e8ba8d6cf8b1f0f5c893d0977a0fa055b0051d
  Public Key Id:
    060f248fbf01ece87c23658235c798d95fc211e7

savannah.nongnu.org:
  MD5 fingerprint:
    7bde181919c336af2d8e2b7343743e63
  SHA-1 fingerprint:
    423fd06b6ae9c021880c3cdf9aedcfee540ff32f
  Public Key Id:
    528b42b7faf5922388c2c470a3a8e635d4325a1e
    

Check it yourself!

Check the certificates fingerprints


Get GnuTLS and its certtool utility [doc].
(Debian package: gnutls-bin, Fedora package: gnutls-utils):


$ certtool --certificate-info --infile savannah.gnu.org.pem
[...]
Other information:
        MD5 Fingerprint: XX:XX:XX:...
[...]
# shorter version: certtool -i < savannah.gnu.org.pem

Simulate a connection

We'll use gnutls-cli [doc]:

$ gnutls-cli --x509cafile /usr/share/ca-certificates/cacert.org/cacert.org.crt savannah.gnu.org
Processed 2 CA certificate(s).
Resolving 'savannah.gnu.org'...
Connecting to '199.232.41.3:443'...
- Ephemeral Diffie-Hellman parameters
 - Using prime: 1024 bits
 - Secret key: 1021 bits
 - Peer's public key: 1024 bits
- Certificate type: X.509
 - Got a certificate list of 1 certificates.
 - Certificate[0] info:
  - subject `CN=savannah.gnu.org', issuer `O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org', RSA key 2048 bits, signed using RSA-SHA, activated `2009-08-25 10:55:26 UTC', expires `2010-02-21 10:55:26 UTC', SHA-1 fingerprint `8dbc5960da8365c1bd2803d2fe0a298db6af853f' <-- verify the fingerprint
- The hostname in the certificate matches 'savannah.gnu.org'.
- Peer's certificate is trusted <-- check this line
- Version: TLS1.0
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

- Simple Client Mode:
[...]

Extract the key from the live server

$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem

You then can display the certificate as usual:

$ certtool -i < sv.pem

Verify the certificate chain

$ cat sv.pem /usr/share/ca-certificates/cacert.org/cacert.org.crt | certtool -e
Certificate[0]: CN=savannah.gnu.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[1].
Verification output: Verified.

Certificate[1]: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Issued by: O=Root CA,OU=http://www.cacert.org,CN=CA Cert Signing Authority,EMAIL=support@cacert.org
Verifying against certificate[2].
Error: Issuer's name: O=CAcert Inc.,OU=http://www.CAcert.org,CN=CAcert Class 3 Root
certtool: Issuer's name does not match the next certificate
The first paragraph indicates that the key does validate against CAcert's root certificate. The second one show a slight inconsistency in the CAcert canonical name.

Get your own CAcert certificate

Check this blog post from GnuTLS' maintainer.