Why browsers report the CAcert.org website as improperly configured

Basic situation

Recently (2018+), complaints from users have increased, the essence of which is the following:

Believe it or not, in this case there is a flaw in the browser ... and a bit in the fact that users feel too comfortable due to browsers.

Zak Doffman, security and privacy analyst, says: Remember: If you're not paying for it, you become the product.

You do not pay for web browsers, they are for free ... and they contain root certificates of tens of CA's, to which you fully trust without knowing that !

In CAcert, we are aware of the fact, that all mainstream browsers:

Please realize that giving your confidence to a CA (including CAcert) is the act of your will. This means that your computer must have installed the root certificates of the CA (CAcert in this case). So you trust that neither the http connection (without S yet) needed to download the roots will harm your computer, nor that any malware will come from the CA's web.

You should check the fingerprint published on the CAcert web against the ones you can see in CAcert's root certificates you download. Only then you can securely install the roots into your system, browser, e-mail client, etc.

After this is done, the connection of your computer / browser with CAcert main website became secure, using https protocol. And then, although if you write "http://www.cacert.org", the CAcert web will switch to "https://www.cacert.org", and no problem will arise.

How to do it

Suppose that you are not a member of the CAcert community yet. But you want to join and create an account at CAcert. So you visit the www.cacert.org website, which opens as http://www.cacert.org, thus using unprotected (unciphered) connection.

Afterwards, you want to create your account, so you go to the "Join" menu item. Your connection changes to secured|strong HTTP (ciphered connection) in this moment. The browser warns you strongly:

What is the very reason of that warning ?

First of all, it's necessary to say: that warning is misleading at least for Firefox, Opera, and Safari. Website www.cacert.org is secure; it is not improperly configured; the login data are not damaged; and the certificate of the web is not invalid. You can approach to the truth (at Firefox) after you press "Advanced", and you can read: "...invalid security certificate". All right; and why? Because "...the certificate issuer is unknown"!

Thus, a trust is not set to the CAcert certification authority, which has issued the website www.cacert.org its certificate. A reason is that the browser does not know the CA's root certificate, or does not trust it.

You have not installed CAcert root certificates so far. In other words, you have not decided yet to trust the CAcert certification authority. What you need is to go to the www.cacert.org website, menu item "Root certificate", and install from there the public root certificates of CAcert, i.e. "PKI Class 1 Key" (the main root certificate), and "PKI Class 3 Key" (the intermediate root certificate). If your browser (as Firefox) explicitly asks you for trust the root certificate, please set it.

Note-1: The certificate has been installed in my example, only the trust has been abolished.

Note-2: Unclear error messages are often reported deliberately in security issues; however, verbal verses as "improper configuration" or "damaged login data" are kind of a strong coffee!

Another websites do not need to install root certificates, yet such a warning is not reported !

The reason is that the root certificates of some CA's are preinstalled in your browser or operating system used. The vendors of OS|browser in fact have decided for you that you blindly trust ALL the websites using certificates issued by those "privileged" certificate authorities; and CAcert is not one of them. You can read more about that issue in the article What is it for?

If you want to know which CA's are those "privileged", look into the repository of the "trusted certificate authorities". Every browser should offer that possibility; the paths in the most used browsers follows:

You can see there (with surprise) CA's, to whom you blindly trust without knowing about.

I have installed CAcert's root certificates and the browser still complains, why ?

You can see different error messages, like:

The reason is that the main root CAcert certificate (Class 1, published on the CAcert website till 20190410) is self-signed using the MD-5 algorithm, which is no longer considered to be safe. You may still have this root certificate installed. However, if you trust the CAcert CA, you trust its public key contained in the main root certificate. It is not at all essential with which algorithm it is signed. Unfortunately, browsers take it flat and demand that all certificates, including the main root certificate, have been signed using the more robust algorithm, e.g. SHA256!

So, replace the root Class 1 certificate with the SHA256-signed one you can download from the page http://www.cacert.org/index.php?id=3, or the Wiki page FAQ - look for "SHA256". Here is the procedure.

Note also that the Firefox browser has its own repository. However, you can set Firefox to read also CA root certificates from the system repository of Windows.
You can find that setting in the Firefox page about:config as security.enterprise_roots.enabled. You need to set it to true.

More explanation about mainstream browsers

The brief history of troubles CAcert has/had with mainstream browsers:

  1. MD5 was declared as unsecure algorithm. It's true - with one exception: the main root of CA itself, as you trust the CA's private key, and the algorithm is unimportant here. Despite this fact, browsers decided to get rid of MD5 in ALL certs.

  2. Browsers also got rid of the <keygen> tag, and this is why you cannot make a new cert request, containing a new key pair, with all mainstream browsers like Firefox, Edge, IE, Chrome, Opera, Maxthon, Avast Secure,... These days only Palemoon browser can make a new request (CSR). However, you can create CSR with another program, as MMC-Certificates in Windows, OpenSSL in Linux and Windows, XCA, Kleopatra...

  3. Browsers started to warn (or better, spook) all the users, that all CAs except the "privileged default ones" are unsecure, dangerous, badly configured, etc. But the true is, that YOU should decide, which CA is trustworthy, and thus YOU should put its roots to your browser or system! Unfortunately, every user has to accept that "privileged default CAs" are the best and unmistakable. And users dislike to be bored...

After new CAcert roots have been issued, I can recommend the following:

  1. Delete old roots (root #00, class3 #0A418A or #0E) from all repositories you have (system, Firefox, Thunderbird, Palemoon), and (after pertinent renewal) delete also all certificates signed by them (you can see roots in cert's chain). In Firefox, this is necessary for the browser to work, as Firefox does not like orphan certificates (without roots and root chains).
  2. Install new roots (root #0F, class3 #14E228), where you have deleted the old ones. Check the fingerprints (published on the CAcert roots page).
  3. There are 2 ways to get a valid certificate:
    1. Renew (key pair remains, so you have to have the private key),
    2. Create new one (a new key pair, i.e. the new private key and the new public key, is created).
    My advice here is b. You need not search for an old private key.
  4. Make the backup file .p12 or .pfx, and save it well. If you have installed ONLY new roots, that file will contain:
    1. new roots,
    2. the private key,
    3. the certificate itself, containing corresponding public key.
    This is all the Firefox, Palemoon, or Thunderbird need. The file contains sensitive information, so it has to be encrypted. Remember the file's password you have chosen.

FAQ/Mess (last edited 2021-05-18 16:36:07 by AlesKastner)