CAcert

CAcert
Name	CAcert
Developer	Volunteer community
Released	2001
Programming language	PHP, Perl
Operating system	Cross-platform
Genre	Public key infrastructure, certificate authority
License	Free software / community

CAcert

CAcert is a volunteer-driven certificate authority and public key infrastructure project founded in 2001 that issued X.509 certificates for secure web, email, and code-signing use. The project emphasized community-based identity assurance and free certificate issuance, positioning itself as an alternative to commercial certificate authorities such as VeriSign, DigiCert, Comodo, GlobalSign, and Entrust. Despite usage among advocates of free software and privacy, the project struggled for recognition by major browser vendors and formal trust programs including Mozilla Foundation, Microsoft Corporation, and Google LLC.

History

CAcert was established in 2001 amid growth in TLS adoption and debates over centralization in public key infrastructure following events like the Netscape Navigator era and controversies involving Thawte and VeriSign certificate policies. Early work drew on open source communities associated with projects such as Debian, Apache HTTP Server, OpenSSL, and GnuPG. Throughout the 2000s, CAcert pursued integration with root programs of vendors including Mozilla Corporation and Microsoft Windows while maintaining grassroots identity vetting inspired by models used by Key Signing Party practices from the OpenPGP community. The organization expanded its offerings and policies in response to incidents involving certificate misuse and disputes over cryptographic algorithm transitions such as the move from SHA-1 to SHA-256.

Organization and Governance

Governance was handled by an elected Board and volunteer technical teams, with structures influenced by nonprofit and cooperative models similar to Internet Society chapters and community-run entities like Mozilla Foundation affiliates. Membership and assurance policies were codified through documents akin to certification practice statements used by organizations like IETF and CA/Browser Forum. Oversight included dispute resolution and elections modeled after procedures familiar to Free Software Foundation projects and community commons governance seen in Creative Commons. The volunteer nature meant operational continuity relied on contributors with backgrounds tied to institutions such as University of California, Australian National University, and regional tech groups.

Certificate Services and Trust Model

CAcert issued free domain-validated and personal S/MIME certificates, employing an assurance model where community members performed identity checks similar to Web of Trust methods used by OpenPGP and PGP Corporation adherents. The trust model resembled decentralized assurance experiments by entities like StartCom and contrasted with hierarchical models exemplified by Entrust and Symantec. Technical use cases targeted services run on Apache HTTP Server, Nginx, Postfix, Exim, and client integrations in Mozilla Firefox, Thunderbird, and Microsoft Outlook via X.509. Interoperability efforts referenced standards from RFC 5280 and coordination with the IETF community.

Security Incidents and Criticism

The project faced criticisms over operational security, auditability, and key management comparable to controversies that affected DigiNotar and Comodo Hacker. Auditors and critics from groups like EFF and security researchers at institutions such as University of Cambridge and University of Maryland questioned the sufficiency of revocation mechanisms and incident response, particularly when compared to incident handling by Let's Encrypt and vendor-rooted trusted authorities. Concerns were raised about assurance consistency relative to best practices promulgated by the CA/Browser Forum and academic analyses published in venues like USENIX and IEEE Security and Privacy.

Community and Membership

Membership relied on volunteers and assurers drawn from regional meetups, conferences, and associations such as DEF CON, Black Hat, Chaos Communication Congress, FOSDEM, and local Linux User Groups. The assurance process mirrored social practices seen in Key Signing Party events at conferences like KubeCon and GUADEC. Community governance and outreach intersected with nonprofit ecosystems including Apache Software Foundation contributors, Electronic Frontier Foundation activists, and privacy advocates connected to Tor Project and Open Rights Group.

Software and Technical Infrastructure

The platform used web application stacks built with PHP and Perl, databases, and certificate management tools integrating with OpenSSL and related tooling used by Let's Encrypt clients and management utilities such as certbot. Development workflows referenced version control practices common to GitHub and GitLab projects and continuous integration patterns visible in Travis CI and Jenkins usage. Interoperability testing considered clients and servers across Windows Server, Linux, FreeBSD, and client software including Android and iOS.

Legal and Policy Issues

Legal and policy debates involved liability for certificate issuance, jurisdictional considerations across countries including Australia, United Kingdom, Germany, and United States, and compliance with data protection regimes like EU Data Protection Directive predecessors and later General Data Protection Regulation influences. Negotiations over root inclusion engaged vendor policies from Microsoft Corporation, Apple Inc., and the Mozilla Foundation, invoking standards and contract-like arrangements comparable to those in ICANN interactions and discussions at IETF working groups. Disputes over trademark and organizational status paralleled cases involving other community projects that evolved into formal entities such as OpenSSL Software Foundation initiatives.

Category:Public key infrastructure Category:Certificate authorities