Riseup Certificate Authority

What is a Certificate Authority?

On the internet, a certificate is needed in order to verify the identity of people or computers, and to establish secure connections to services to keep people from listening in your connection. All riseup.net services require secure connections and thus use certificates to verify the identity of the server.

For a certificate to be considered valid, it must be blessed by a private corporation who acts as a Certificate Authority. This centralized authority model has troubling social and political ramifications, especially when we rely on it for security. Some day, we hope that alternative, non-heriarchical models will replace this flawed system.

Until then, Riseup has purchased certificates from a commercial certificate authority that is recognized by your web browser, mail client, or chat client. These certificates will work seamlessly without any further action on your part.

However, some riseup.net services, like the Riseup VPN, use certificates that are blessed by our own certificate authority. This page is for people who need to download and install this Riseup Certificate Authority.

Download the Riseup CA certificate

Every CA (certificate authority) has a file that is distributed publicly. This file, called a “CA certificate”, is used by your local program to confirm the identity of servers you connect with.

Download the Riseup CA certificate:

All the possible OpenVPN clients require this file.

Verify the Riseup CA certificate (optional)

This verification process is not required in order to use the Riseup CA certificate. However, without verification, you cannot be certain you have downloaded the correct certificate, and you cannot be certain that your connections are secure.

Be warned: this verification process is difficult, requires an understanding of OpenPGP, and ultimately depends on trusting someone you already know who has certified riseup.net’s public OpenPGP key.

In brief, the steps are:

  1. download the RiseupCA.pem file (see above).
  2. import Riseup’s public PGP key
  3. verify that the instructions on this page have been signed by Riseup’s PGP key.
  4. calculate the fingerprint of RiseupCA.pem
  5. compare the fingerprint you calculated with the fingerprint listed, and signed, on this page.

import Riseup’s public PGP key

On the command line:

$ gpg --keyserver keys.riseup.net --recv-key 0x4E0791268F7C67EABE88F1B03043E2B7139A768E

There is no particular reason that you should trust this key. You can see who has certified it:

$ gpg --list-sigs 0x4E0791268F7C67EABE88F1B03043E2B7139A768E

verify these instructions

Now that you have imported Riseup’s public key, you can verify the certificate is correct:

  1. Download this cryptographically signed file containing the SHA256 Sum of the RiseupCA.pem
  2. Then run this command in a terminal: gpg --verify riseupCA-signed-sha256.txt
  3. You should get output that says:
    gpg: Good signature from "Riseup Networks <collective@riseup.net>"

You should make sure that it says “Good signature” in the output! If this text has been altered, then this information should not be trusted.

Unless you have taken explicit steps to build a trust path to the Riseup Collective key, you will see a warning message similar to:

  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.

However, you still should see the “Good signature”.

calculate the fingerprint of RiseupCA.pem

Open a terminal and use either certtool, or openssl to get the correct fingerprints:

$ certtool -i < RiseupCA.pem |egrep -A 1 'SHA256 fingerprint'
$ openssl x509 -sha256 -in RiseupCA.pem -noout -fingerprint

compare the fingerprints

Now that you have calculated the fingerprint or sha256sum of RiseupCA.pem, you can compare this value to the value signed by Riseup and listed on this page.

If the values match, and you trust the Riseup public PGP key, then you can be confident you are really communicating with riseup.net servers when using an application that uses RiseupCA.pem.

PLEASE NOTE
The fingerprint as described above is a hash of the certificate content, not of the actual RiseupCA.pem file. To compute this from the file, it needs have the header and footer removed, then needs to be base64 decoded, at which point it can have the hash computed successfully. Example:

head -n -1 RiseupCA.pem | tail -n +2 | base64 -d | sha256sum