Index: /trunk/tls-centralization/Makefile =================================================================== --- /trunk/tls-centralization/Makefile (revision 240) +++ /trunk/tls-centralization/Makefile (revision 241) @@ -2,3 +2,3 @@ mediawikioutput: index.html - ./mediawikiconversion mediawikioutput + (echo '[[category:Organic Internet]]' && (./mediawikiconversion mediawikioutput Index: /trunk/tls-centralization/index.html =================================================================== --- /trunk/tls-centralization/index.html (revision 240) +++ /trunk/tls-centralization/index.html (revision 241) @@ -229,21 +229,26 @@ signature is a statement by the Certificate Authority that the public key shown does in fact belong to the -subject. You can think of these three parts as a state driver's -license. The certificate's key is sort of like the driver's -license ID number. The certificate's subject is the driver's -name, photo, and other identifying characteristics. The certificate's -signature is like the hologram on a state driver's license. -Only the DMV -can make that hologram, and by applying it over the ID number and the -statistics, the DMV is saying that this particular driver has this -particular ID number. The specific format of the certificate used in -TLS is not a driver's license, of course. It is -specified by the X.509 standard. - -

X.509 +subject. + +

You can think of these three parts of the certificate as a state +driver's license. The certificate's public key is sort of like +the driver's license ID number. The certificate's subject is +the driver's name, photo, and other identifying characteristics. The +certificate's signature is like the hologram on a state +driver's license. The DMV plays the role of the Certificate +Authority. Only the DMV can make that hologram, and by +applying it over the ID number and the statistics, the DMV is saying +that this particular driver has this particular ID number. The +specific format of the certificate used in TLS is not a +driver's license, of course. It is specified by the +X.509 standard. + +

X.509 covers a lot of different things, but for the purposes of this discussion, we're only interested in how it specifies the certificates used in TLS. In particular, I want to focus on two -things: how the server is identified, and how the signature is +things: how the web server is identified, and how the signature is attached to the identity/public key combination. @@ -599,4 +604,62 @@ server as well, if you needed a server to test browsers. +

Next Steps

+ +

What can you do, yourself? Depending on how you use computers, +there are different things you might want to do. If some of them seem +confusing or you aren't sure how to start them, ask for help! There +are web forums, mailing lists, and user groups filled with people who +are interested in helping out. + +

+ +
All users
If you are a typical computer user these days, +using standard tools, you can't switch to this new architecture all by +yourself yet. But you can prepare yourself for a move to a more open, +secure architecture in a number of ways:
+ +
Webmaster
If you manage a website, and your site doesn't +use HTTPS, consider offering it as an option so that your +users can communicate with your site securely. For technical reasons, +this will usually mean that you need your web site to have its own IP +address. In the process of doing this, you'll also need to generate +an X.509 certificate, as discussed here. You can either +generate your own certificate (self-signed), get a commercial +Certificate Authority to sign one for you, or you could +ask for a cert from an alternate CA (such as CACert.org). Ask your +system administrator if your web server is one of the few which +supports OpenPGP certificates. If it does, generate and install one. +If you're not sure how to do any of these steps, ask for help!
+ +
System Administrator
If you maintain a web server which +offers HTTPS, consider offering support for +OpenPGP certificates. If you administer an +apache server, you might want to experiment with +mod_gnutls where you would normally use +mod_ssl.
+ +
Programmer
If you can read or write code, consider digging +into one of the software packages above. If you see features that +make sense but are not-yet ready for the public, test them and give +feedback. If you see features that are needed but lacking, write up a +proposal and pass it by the primary maintainer of the software, +offering to implement it yourself if you think you can.
+ +
+ +

Who will be the new authorities?

@@ -614,6 +677,6 @@ authority. -

And of course, everyone who is aware and interested in these things -can perform their own certifications, and publish them freely. +

And most importantly, everyone who is aware and interested in these +things can perform their own certifications, and publish them freely.

Back to the larger issue

@@ -656,4 +719,4 @@
-Last modified: Tue Feb 20 10:13:41 EST 2007 +Last modified: Tue Feb 20 21:39:19 EST 2007