• FAQ
• Class3Resign

• To New Roots & Escrow Project - To Class3 Re-sign Procedure

• To Class3 Subroot Fingerprint - Sources - To PR Distribution list for Class3 Re-sign Project rollout

Class3 Re-sign - Members and users FAQ

CAcert has embarked on an interim project to re-sign the Class 3 root. The project is inspired by the Mozilla announcement of Dates for Phasing out MD5-based signatures and 1024-bit moduli. Community members from the Software-Assessment Project team and Critical System Administrators team rose to the challenge to prepare, test and implement a class3 re-sign procedure.

The intention is to re-sign the class3 subroot with new sha256, and rollout the certificate. All issued class3 keys are still valid, because the class3 private key is still intact. It is similiar in process and effect to a certificate renewal. All users who uses a class3-issued cert have to replace the class3 subroot certificate in their browser, email client, or server (once only).

• The proposed procedure: Class3 Re-sign Procedure

Project timeline

• 	Board meeting 2011-05-15 presentation, approval
  	Motions: m20110515.2 that we upgrade the class-3 root ...
  	m20110515.3 that we ask the community to prepare a press statement ...
  2011-05-23	Class 3 subroot re-signed according to procedure by Critical Sysadms Team
  2011-05-23	Exec report from Critical Team
  2011-05-25	bug# for source code changes: bug #946
  May 2011	prepare press release, blog post, members notifications to be presented to board
  May 2011	prepare support FAQ, present to SEs and support maillist
  2011-06-05	approval of press release, blog post, members notifications: m20110605.2
  2011-06-15 - 2011-06-20	proposed class3 subroot rollout date, send out press release, blog post
  2011-06-10	New Class3 Subroot rollout day
  end+some days	from our experiences of this project, write up the procedure for rollout, so as to prepare for the Big New Roots Rollout

Press Release

Q: Am I affected ?

• Q: The question most users asks - Am I affected by the Class3 Subroot re-signing ?
• A: most users are affected, being users and members that created class3 client- or server-certs, codesigning certs or certs for document signing. If you do not support any class3 certs you're probably not affected.

Q: What do I have to do ?

• A: Download the new re-signed class3 subroot cert from the CAcert main website. Depending on what format your application needs, select either the class3 subroot cert type PEM or DER.

Q: Do I have to recreate my class3 certificates ?

• A: No. You only have to download and to re-install the class3 subroot cert from CAcert. Your personal class3 cert still continues working.

Q: My email partner receives a notification that my class3 cert produces an error

• A: Please inform also all your email partners that they have to download the renewed class3 subroot cert and to install it into their email client.

Q: Do my email partners receives a notification too if I have a class1 issued cert ?

• A: If your email partners have installed the public CAcert root (class1) they are not affected.

Q: I have a server cert issued by the CAcert Root as a Class 1. Am I affected ?

• A: You not affected directly, as the Root remains untouched. But you should also download and install the renewed class3 subroot cert. When you receive a class3 issued cert from another user, you will need the class3 subroot cert for verification and to keep the certificate secure chain intact.

Q: I have only installed a class3 issued server cert. Am I affected ?

• A: Yes. You and your users visiting your website will be affected. For you, you will need the class3 subroot cert in order to keep the cert chain path intact. For your users, they will need to be able to verify your class3 issued server cert.

Q: I run a website with one of these class3 certificates. How can I help my users over the transition?

• A: One way is to put some download buttons on the site for your users. An example can be found in CAcert's download page.

Probably, we can do more here... example code? Example HTML? Example disclosures?

Q: Why don't you update Class 1-certificate that is also signed using MD5 as well while you're at it?

• A: well, this is one of the next major upgrades on the way to CAcert's Audit.
  
  The replacement of the Root cert is a big step that depends on a working Escrow method (at this step the 2008 roots ceremony becomes audit fail).
  
  So therefor we have to develop and deploy a Roots escrow method that will work for CAcert.
  
  This project was discussed in the cacert-roots@lists.cacert.org mailing list, but did not yet undergo a risc management test along with risc management tests of alternate escrow methods.
  
  By Mozillas announcement to no longer support md5 signed subroots after June 30th, 2011, CAcert has to react quickly.
  
  We're also thought to push the new roots and escrow plan, but as said above, the escrow plan did not finish in time, so we had to deploy the intermediate class3 subroot renewal. The renewed class3 subroot rollout process can be seen as a final rehearsal for the New Roots & Escrow project.
  
  btw md5 signed roots are not affected yet by the Mozilla announcement with deadline set for end of June, 2011. Only md5 signed intermediate certs.
  
  So thats why we decided to do the subroots renewal first and finshed before the deadline set.

Q: New class3 cert doesn't work, but old class3 subroot does?

• A: You might have an exotic software running that doesn't support sha-256?

• Check the Hash algorithm interoperability list.

Add your questions here ...

• Your Question here

• CategoryAudit

• CategoryNewRootsTaskForce