CAcert
From Openmoko
(new page, CAcert basics) |
m (→Openmoko IT Infrastructure) |
||
Line 5: | Line 5: | ||
== Openmoko IT Infrastructure == | == Openmoko IT Infrastructure == | ||
− | On our Infrastructure we deploy | + | On our Infrastructure we deploy [http://www.cacert.org/ CAcert] Certificates on all '''SSL''' services. |
Many systems have a x509 certificate signed by the CAcert class 3 Root Certificate | Many systems have a x509 certificate signed by the CAcert class 3 Root Certificate |
Revision as of 16:18, 5 December 2007
Contents |
CAcert and Openmoko
CACert is utilized and deployed by OpenMoko on multiple systems.
Openmoko IT Infrastructure
On our Infrastructure we deploy CAcert Certificates on all SSL services.
Many systems have a x509 certificate signed by the CAcert class 3 Root Certificate http://www.cacert.org/index.php?id=3
Client Support
So make full use of the CA Certs your client software has to now about the Root Certificate. Depending on the client you use there will be a popup telling you about security concerns or in worst case will fail entirely.
Integrating the Root Certs to your Application is the best way to archive more reliable encryption.
Applications where you might want to import the root certificates are:
- Webbrowser
- Mailclients
- svn (svn over https/DAV)
- jabber clients
- system wide
- some Linux Distributions supoort /etc/ssl/certs
- on Mac OSX use the Keychain to add Root Certs to X509Anchors
Common Problems
- vhost webserver
- this is a common thread to the whole internet society (http://wiki.cacert.org/wiki/VhostTaskForce)
- we use subjectAltName for multiple FQDNs. checking against this AltName might be broken with some clients.