Re: SSL certificate issues for git.gnus.org

[Simon Josefsson <simon@josefsson.org>]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Simon Josefsson <simon@josefsson.org> writes:
>
>> I have made the request -- but Lars will need to approve it.
>
> (Sorry for the tardy response -- I've been building Ikea shelves for a
> week now.)
>
> I got the cacert email, and clicked through, and it said
>
> "Your domain has been verified. You can now start issuing certificates
> for this domain."

Thanks -- it seems approved alright.

>> Lars, to generate the git.gnus.org certificate, please run something
>> like this and send me the CSR at the bottom (it is fine to post to the
>> list, it is not security sensitive) and I'll paste the request through
>> cacert and get a certificate back:
>
> PKCS #10 Certificate Request Information:

Thanks, here is the certificate:

-----BEGIN CERTIFICATE-----
MIIE0TCCArmgAwIBAgIDAMjmMA0GCSqGSIb3DQEBBQUAMFQxFDASBgNVBAoTC0NB
Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV
BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTEwMzE0MDg1MTEyWhcNMTMwMzEz
MDg1MTEyWjAXMRUwEwYDVQQDEwxnaXQuZ251cy5vcmcwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQC3t+RplIRbxvdt6FtrGy1IJFTrHz5g5Jnx80yja/4M
kyVcqOM8BO1bbCysTyobmnext5F1U9cJ0oLnCwa20Sm79PyzUvsp1iscw2CDgmlb
SpOashuWgE48N7i2NmMYHgzKzGyn8sqOJvbazsxrK3E7s1dVcjqDctii0hOmdGZ7
JKxA02blVLbfvXK1xvZL5X77tcW9WX+H3Vr4FuE6K+3vJPlUyNefa5rJ0FRqcLbV
k4oc+ZrfFDrSBfhXsiEvpgQdwviU573992A+jlnG/cSFFMTD4cdKOM3OjZjAMRHX
t2SuQt3wJ9vb2Uex/zGRNoNz8fByjPrBtWjMO9cz6X29AgMBAAGjgegwgeUwDAYD
VR0TAQH/BAIwADA0BgNVHSUELTArBggrBgEFBQcDAgYIKwYBBQUHAwEGCWCGSAGG
+EIEAQYKKwYBBAGCNwoDAzALBgNVHQ8EBAMCBaAwMwYIKwYBBQUHAQEEJzAlMCMG
CCsGAQUFBzABhhdodHRwOi8vb2NzcC5jYWNlcnQub3JnLzBdBgNVHREEVjBUggxn
aXQuZ251cy5vcmegGgYIKwYBBQUHCAWgDgwMZ2l0LmdudXMub3JnggxnaXQuZ251
cy5vcmegGgYIKwYBBQUHCAWgDgwMZ2l0LmdudXMub3JnMA0GCSqGSIb3DQEBBQUA
A4ICAQBEQ0M46NbqXlYYjSi+RH/wQ/Z4gbtLKG5uHZSV3V7RUUl6IgerXPDiGkF0
CwPXzD2K7A/qRWtsR9ymxDqyMYpBZMpP7dzIN5AJzAuIaUUCBoU3CIwLHOlirAyx
1Ks+qLfQFQ7CI3gnpebzkdC/QGMd4R+AaCMzvW10Gvg2V6xyfhreQ43g6zj5jLpQ
mcylstzvGrnN6I+YjL6FVOAD6zYNX+rxy/Q0YdXM8u0Tz1lMe1SDx6XGwojdH1uf
9eUTIB0J0+woKm+VIrrKcSWxKCnzUpSfw7985No+uuxzRhqD58rXOQrjkddQcXlk
Wxf5QXqXuLYl5rGrQFSDBONDKuOIN30908JUidzsuWHBzUWQ+9rom2hvRq+NeYWf
vjdtADDt8+cAsmw6FMDaqpf867J5TOeV5KA2BbTXb/V5rfe0kNAwPSKbHs7aUPsS
3SPdeCEGemV+J0WcB3MfhvvkaFwVclTr41FToX4ECFVuIJTfN8ZKdT74/XsrVGM9
a+jmmELarhpfLR4c2HexaACkn+GyNMuFOo9tDyg/W/uWrJjbrK2RKZynulP6C9O4
23Zv08PB1Sy7hikZSMhBNJiEr36G+peqc/0qFweVUcIg/2saZMhDzJf8P8xnPgzL
+Kwzb5FCUZpauiEH9YRyta5MlcRHTER7G2yWLH0LBVNwBz0KcA==
-----END CERTIFICATE-----

It is not strictly needed, but you may want to make the web server send
the following as an intermediate certificate too:

http://www.cacert.org/certs/class3.txt

Then clients only have to trust the root CACert CA without also knowing
the intermediate CACert certificate.  I suspect most clients already
trust the intermediate CACert CA anyway though.

If you are using apache with mod_gnutls (Debian libapache2-mod-gnutls)
just concatenate the git.gnus.org PEM blob above with the PEM blob in
the URL above into a text file and then point to the files like this:

        GnuTLSEnable on
        GnuTLSCertificateFile /etc/ssl/private/git.gnus.org-chain.pem
        GnuTLSKeyFile /etc/ssl/private/git.gnus.org-key.pem
        GnuTLSPriorities NORMAL

/Simon