From YobiWiki
Jump to navigation Jump to search


I'm CAcert assurer, able to attribute you up to 35 points as I've 150 points

  • I passed the CATS Challenge with 100% (it requires 80%, I did 84% then 84% then 88% then 100% and got bored ;-) )

Misc infos

openssl pkcs12 -in mycert.p12 -nocerts -nodes -out mycert.key.pem
openssl pkcs12 -in mycert.p12 -clcerts -nokeys -out mycert.crt.pem
openssl pkcs12 -in mycert.p12 -cacerts -nokeys -out
  • For server certificates: if using a Class 3 certificate as proposed you'll need the certificate chain file. This is just the Class 3 root certificate and the Class 1 root certificate in PEM format concatenated. Do it yourself or download it from the attachments. Store the certificate chain file in the ssl.crt directory and let's call it CAcert_chain.pem for future reference.
    Now all that remains to be done is to correctly configure Apache's mod_ssl. To use the certificate set the following directives in your SSL-configuration:
SSLCertificateFile <Path to your certificate file>/example_cert.pem
SSLCertificateKeyFile <Path to your key file>/example_key.pem
SSLCertificateChainFile <Path to your chain file>/CAcert_chain.pem

old story

  • I tried to get the client certificate out of Firefox/Iceweasel as it repeatedly told me "Failed to create the PKCS #12 backup file for unknown reasons"
    The bug is now solved: #469079: remove libnss3 and keep only libnss3-1d



python -c "import sys, urllib as ul; name=ul.quote_plus(sys.argv[1]); dob=sys.argv[2]; email=ul.quote_plus(sys.argv[3]); \
assurer=ul.quote_plus('Philippe Y. F. Teuwen'); print ''\
+name+'+&dob='+dob+'&email='+email+'&assurer='+assurer+'+&date=now&maxpoints=35'" "Firstname Lastname" yyyy-mm-dd email@address

Personal notes

When renewing the certificate, change it in:

  • Apache config:
    • /etc/apache2/ssl/myserver.crt
    • /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: CAcert_chain.pem
/etc/init.d/apache2 restart
  • Exim config:
    • /etc/exim4/exim.crt
/etc/init.d/exim4 restart
  • IMAP config:
    • /etc/courier/imapd.pem Beware this file contains also the private key! Overwrite only the certificate section!
/etc/init.d/courier-authdaemon restart
/etc/init.d/courier-imap restart
/etc/init.d/courier-imap-ssl restart
  • OpenVPN config:
    • /etc/openvpn/myserver.pem
    • /etc/apache2/ssl/CAcert_chain.pem : renew it too if still using the md5-signed class 3, it's here: CAcert_chain.pem
/etc/init.d/openvpn restart
  • Global CA list:
mkdir /usr/local/share/ca-certificates/
wget -P /usr/local/share/ca-certificates/