<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 11-01-06 03:13 PM, Ivan Avery Frey wrote:
<blockquote cite="mid:4D262287.3050005-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org" type="cite">I have
digital certificates from startssl.com that are expiring soon.
I've never used them. Currently my only use for them would be for
encrypting and signing emails. Instead of getting new ones from
startssl.com or should I roll my own? Should I get a free one from
Verisign?
<br>
<br>
Ivan.<br>
</blockquote>
<br>
<font face="sans-serif">I've been using cacert.org since around
2006. It is a free collaborative approach to SSL certificates
based on government-issued identity documents, where other
previously-assured community members view your documents to verify
that you are who you claim to be. They also have a process for
verifying domain ownership for server certificates (not
necessarily tied to the personal identity side of things).<br>
<br>
Their stated goal for all of that time has been to get their root
certificate included into the pre-installed sets in various
products. It seems they are in quite a few distros now but they
still aren't in Firefox as there still seem to be some major hoops
to jump through to allow them to pass an audit (in lieu of the
prohibitively expensive WebTrust audit)
<a class="moz-txt-link-freetext" href="http://wiki.cacert.org/InclusionStatus">http://wiki.cacert.org/InclusionStatus</a><br>
<br>
So you still have to put the root certificate into your browser
before all the cacert-issued certificates will be trusted.
(However this is not difficult, we even have our end users do it).
<a class="moz-txt-link-freetext" href="http://www.cacert.org/index.php?id=3">http://www.cacert.org/index.php?id=3</a>, (e.g. for Firefox, check
boxes for "trust this CA to identify web sites / e-mail users /
software developers".)<br>
<br>
</font><font face="sans-serif">So in some ways it is not much butter
than self-signed,</font><font face="sans-serif"> but for your
stated purposes, I would think it would be fine, plus it gives you
some management GUI, a way to revoke, some CRL (certificate
revocation list) infrastructure, etc. In other ways it is much
better as you can do wildcard certificates, multi-domain
certificates on the same server (using subject-alt-name part of
the standard), and I think even code signing (additional set of
hoops).<br>
<br>
<br>
I think the free-from-Verisign (and similar) option will likely
have restrictions like including your e-mail address but cannot
include your name.<br>
<br>
Also I know a few list members besides myself are "assured" and
are "assurers" in cacert parlance so it has something of a
critical mass in Toronto.<br>
<br>
Good luck.<br>
<br>
Martin<br>
<br>
</font><br>
</body>
</html>