This is aimed at beginners - or at least, at non-developers. Every so often, we forget to mention the “easy” stuff like this, and people get confused, or - like in this case - downright frightened by warnings like these:
I played through this situation here with a virtual Ubuntu 7.10 “Gutsy” machine (in German, but you will get the picture), because on my standard desktop (which is Debian Etch), the “problem” simply didn’t occur, and only after a friend asked me about it, I became aware of the situation.
So - what does this picture mean and say? To the end-user, who may be interested in logging into a site like the one here, or to even buy something from there, it’s a downright scary message - someone could possibly “intercept” his connection like the typical “man in the middle”, and steal at least personal data, if not even credit card information, or money. So, some of the people will be afraid and never come back. Others will probably “just click this thing away” with hitting “OK”, and proceed.
It’s in our responsibility to educate, so this is what I’m trying to do here. So let’s start with the first possible reason for that scary pop-up thing, which says:
“Ihr Browser erkennt die Zertifizierungsstelle nicht, die dieses Zertifikat herausgegeben hat.”
which - translated by me - means:
“Your browser doesn’t know the certification authority which issued this certificate.”
Hm. Could be, right? The problem with those certificates, especially for private people or small businesses is that they are expensive (I know some guy who became a billionaire with issuing those, and later he sold that shop and started a Linux distribution based on Debian). So maybe here we have one of those small shops whose owner cannot afford - or doesn’t want to spend money on - one of those commercially sold certificates. Instead of this, he made up his own certificate authority or used a free one, which isn’t included in the browser’s list of known authorities. Clicking on “Zertifikat untersuchen” (or: “examine certificate”) will confirm the latter.
So - what can we do?
Fortunately, in Debian and Ubuntu, there’s a package called “ca-certificates”, which has a list of those authorities which issue certificates to anyone without asking for money. Ubuntu users wouldn’t find it with the “Add software” menu entry; they have to fire up Synaptic to do so. And Synaptic is found under:
System — Systemverwaltung — Synaptic-Paketverwaltung (in the used German Gutsy), or
Desktop — Administration — Synaptic Package Manager (in my English Debian Etch menu).
Once Synaptic has started, there’s a button “Suche” (”search”), which brings up a small window:
And into that search box, you type in what you’re searching for - in this case, it’s the package “ca-certificates”. Another click on “Suchen” (”search”) in that smaller window will search the already downloaded repository on the local machine for a match.
And voilà - it’s found, and a short description and a list of to-be-imported certificate authorities is shown:
Here I tried to make use of the small checkbox in front of the package name already, and there’s another small window opening, asking me what I’d like to do (with only one possible answer at this point, which I confirmed).
Ok; for the moment this is the only package we want to install, so I have to apply this:
A click on the green-checkmarked menu item called “Anwenden” (”Apply”) will actually start the process of downloading and installing the package, which is what we want in this case.
Still, we have to confirm again, like in the next picture:
Again, we see the packages to be installed, and if we’d like, we could view details about them, we could select to only download but not to install them at the moment, or we just proceed - which is what we do here.
And up comes the next window:
And Synaptic, that nice frontend to aptitude, does its magic. It connects to the repositories defined in /etc/apt/sources.list, downloads the wanted package(s) from the first possible location, and after downloading, it installs them. No need to use any search engine in the world to install software in Linux; especially so in Debian or Ubuntu…
Ok; let’s try again.
The next time the user fires up his or her browser - in this case, Firefox on Ubuntu - the scary security warning doesn’t appear anymore when trying to register or to log in. Instead of this we have a secure https connection with a small lock symbol, which tells us - when clicked - that we are using a web site which is verified by CAcert, which is an authority we now trust. We have a secured connection which uses an AES-256 “scrambling” of the whole connection. So we’re not afraid that anyone except the server we want to reach will get any information.
What if it didn’t work? Could be that we’re using a different Linux distribution, or even a proprietary operating system, or Firefox is simply not aware of the changes?
Well, if your Linux distribution or other OS doesn’t have the ca-certificates package, you have to manually download the root certificate from cacert.org - they have a Howto on their Wiki page which explains how to do that. Get their cert as a *.pem file, and save it somewhere (in Debian/Ubuntu, the place for this would be in /etc/ssl/certs).
Then, within Firefox:
You go to Einstellungen — Erweitert — Verschlüsselung — Zertifikate anzeigen
(Preferences — Advanced — Encryption — View Certificates)
Here you can check if you really have the needed authority:
As you can see here, you won’t find CAcert under “C”, but under “R” - like “Root CA”. If you do not see CAcert as an authority at this point, then you can import the manually downloaded or ca-certificate-included *.pem from this window.
Like mentioned already, under Debian or Ubuntu, you’ll find it in /etc/ssl/certs:
Here also, it is called “root.pem”. Once you “open” this (”Öffnen” in German), it should become installed into your browser.
And from now on, the security warnings should have gone.
What have we learned? Well, from now on you can visit the secure sites of friends or small businesses without being afraid - and you have done it the correct way, with not just clicking away things with “Accept”, without really understanding them.
If you have an own web presence which has an own IP address (a small so-called “vserver” will do), then you can do the same to get your site secured without spending lots of money to do so (tho setting up this is probably beyond “entry” level, but I can explain that later, should the need arise).
Now have fun and feel safer.
