How can I trust CAcert's root certificate?

See also BrowserClients

In order to have your browser or system automatically trust all certificates signed by the CAcert CertificateAuthority, you must instruct your platform or browser to trust the CAcert RootCertificate.

Note that for all systems, you will need to trust both the root certificate root.crt, as well as the class 3 certificate class3.crt.

Some of this information is already covered in the BrowserClients article, so also look there to see if it has the information you need.

Trusting a new CertificateAuthority is a process that varies from one platform to the next, so here are some of the ways to trust the CAcert root certificates. The instructions below will only outline how to trust one certificate, and just repeat the process to trust the second certificate.

WARNING: Always double-check the fingerprint on the downloaded certificates before trusting them. If you don't, you could be trusting a maliciously modified root certificate.

Mac OS X

There are two ways to trust the CAcert root certificates: one from the command line, and one from the Keychain GUI. Each method requires that you use an account with administrative privileges.

Using the Keychain GUI

  1. Download the desired certificate to your desktop from here.

  2. CAUTION: Verify the certificate fingerprints before proceeding!

  3. Open the certificate file, either using Command-O or by double-clicking on the file.

  4. When Keychain appears, select the X509Anchors keychain.

  5. You will be prompted to authenticate with your password to modify the system-wide X509Anchors keychain.

Using the command line

# Download the certificates
curl -k -o "cacert-root.crt"   "https://www.cacert.org/certs/root.crt"
curl -k -o "cacert-class3.crt" "https://www.cacert.org/certs/class3.crt"
#
# CAUTION: Verify the certificate fingerprints before proceeding!
#
# Import the certificates into the desired keychain
sudo certtool i "cacert-root.crt"   k=/System/Library/Keychains/X509Anchors
sudo certtool i "cacert-class3.crt" k=/System/Library/Keychains/X509Anchors
# Clean up after ourselves
rm "cacert-root.crt"
rm "cacert-class3.crt"

Windows

Covering all of the ways to import this certificate into Windows is beyond the scope of this article, and is already covered by BrowserClients.

WindowsMobile

Windows Mobile 5 (WM5)

* On WindowsMobile2005 you need to download the DER-Encoded certificate (pocketIE cannot save it, so you need to store it in a zip-file for download.) * Then you need to rename it to .cer . Only then will you be able to install it with a double-click. * On https://wap.kleinbetrieb.biz/cacert.zip you can find the certificate in a zip, directly downloadable to your device.

* You can also import new certificates using a CAB file in Windows Mobile. Generic instructions on how to make them can be found on the Windows Mobile blog. A premade CAB file with both the Class 1 and Class 3 certificates can be found at http://jacob.steenhagen.us/CAcert.cab. This CAB, signed by Jacob Steenhagen's CAcert certificate, can simply be downloaded to your device and installed. You can verify the certificates are genuine by opening the CAB file and inspecting _setup.xml ensuring that the line before the <param/> (which contains the actual certificate) reads: 

   <characteristic type="135cec36f49cb8e93b1ab270cd80884676ce8f33">

for class 1 and: 

   <characteristic type="db4c4269073fe9c2a37d890a5c1b18c4184e2a2d">

for class 3. (Note: These should be verified against the Internet Explorer thumbprint at http://www.cacert.org/index.php?id=3).

PocketPC2002

To verify the certificate has been successfully imported into the Pocket PC device:

notes

(Note that for wap1.x-gateways there is no way to host encrypted wap-pages if your provider's wap-gateway does not have the certificate because it's not end-to-end but decrypted on the gateway, not the device.)

Linux

How your particular distribution will need to be modified to trust the CAcert root certificates will vary from one distribution to the next. However, there are some distributions about which we know some information, listed below.

Otherwise, you can obtain the certificates from the website as usual, from here. 

On debian/ubuntu : try 
sudo apt-get install ca-certificates
when installed the package is installedn, you can do : 
dpkg-query -L ca-certificates
to have the list of the root certs

KDE

The CAcert root certificate can be added to KDE's certificate store so that all KDE applications, including Konqueror, will trust certificates signed by it.

Symbian

Nokia E61

Acrobat Reader

See also AdobeReader.

Procedure for Acrobat 8:

How can I be sure that it is authentic?

There are many ways to ensure that you have an authentic, non-tampered copy of the root certificates, all of which boil down to having a trusted party verify the certificate fingerprints. In some cases, your system distribution is the trusted party, but you can also verify it for yourself.

Finding the correct fingerprints

CAcert is working to provide multiple places to verify the certificate fingerprints. The following are already known ways to find authentic copies of the CAcert root certificate fingerprints.

CAcert is currently working on providing fingerprints through these additional means:

External websites with generally accepted server certificates:

CAcert Wiki: ImportRootCert (last edited 2009-02-03 22:22:15 by PhilippGuehring)