CAL Certificate Authority

The Columbia Astrophysics Laboratory is going to run its own certificate authority. Its SHA1 fingerprint is:

SHA1 Fingerprint 32:F7:12:29:A7:30:AB:0E:2A:AA:6A:C3:A4:16:AF:B6:55:44:F9:AD

You can get a copy of the current Certificate Authority Root Certificate in the repository

If you want to smoothly use secure connections to servers on the CAL network, download that file and import it into your browser or other SSL/TLS-aware application.

using the certificate in Firefox

To import the certificate in ​Mozilla Firefox 1.5, just navigate to the file in the repository and click the "Original Format" link at the bottom of that page. You can click the View button to double-check the fingerprint of the certificate, and you should check at least "can identify web servers" before accepting the import of the certificate. That's it!

using the certificate in Thunderbird

To import the certificate in ​Mozilla Thunderbird 1.5, first download the file from the repository (right-click the "plain text" link at the bottom of that page, and choose "save target as"), and save it somewhere reasonable. Now, in Thunderbird, choose Edit|Preferences and select the Privacy icon. In the tabs that show up, choose Security, and click the "View Certificates" button.

In the new "Certificate Manager" dialog that appears, choose the Authorities tab, and click the Import button. Navigate to the file you just downloaded, and select it.

In the "Downloading Certificate" dialog that appears, select the levels of trust that you want to grant it. For typical use with Thunderbird, you want to at least choose "can identify web sites", but it might be handy to select "email users" as well. If you want to check the SHA1 fingerprint by clicking View before you click OK, that would be good.

Choose OK, OK, Close, and now Thunderbird is ready to interact cleanly with CAL mailservers.

using the certificate in mutt

download the certificate as described in the Thunderbird section, and append it to the file specified by your mutt configuration's certificate_file variable (by default, this is is ~/.mutt_certificates).

For example, if you downloaded it and saved it as ~/CAL-CA_root_cert.pem, you can simply do:

cat ~/CAL-CA_root_cert.pem >> ~/.mutt_certificates

To ensure that you are putting it in the right place, you can query mutt about the value of its certificate_file variable with:

mutt -Q certificate_file

personal certificates

You may also want to consider setting up a Personal Certificate