Ca-certificates: removal of SPI CA

Ca-certificates: removal of SPI CA
bugs.debian.org

https://lists.debian.org/debian-devel-changes/2015/11/msg025...

This has been planned for a while now. Between Let's Encrypt and StartCom, Debian and SPI don't need to run a CA anymore, especially not a CA that only Debian systems trust. Several Debian sites used to use SPI certificates, back when HTTPS seemed like an optional nicety. These days, every connection should use HTTPS, so Debian sites need to use certificates that all browsers trust, which they can easily do now.

SPI actually got an offer to cross-sign their root so that all browsers would trust it, but the consensus was that SPI didn't want to take on that risk given the availability of multiple other free CAs.

edit: Running a CA is a full-time job that requires financial backing, gear, well-trained operational staff and a lot of policies to operate in a reasonable and safe way. I'm happy that Let's Encrypt take their time to get everything in place and do not rush General Availability, BTW. I could not find /any/ information on SPI's CA on the web. I have no idea who or how they currently operate their CA. Their Website has a horrible and real-world vulnerable HTTPS set-up. I imagine their CA might also have aged a bit.

> Between Let's Encrypt and StartCom ...

What do we have?

StartCom doesn't allow their free certificates to be used for commercial purposes and will hold you to ransom if you need to revoke it (eg. after a major vulnerability which exposes private keys).

Let's Encrypt only issue certificates that are valid for 90 days[0] because they want you to automate renewal by having your server automatically run their script which needs root privileges, and they use Google as the gatekeeper of who is allowed a certificate[1].

We are still short an option that issues certificates that are valid for 1+ years, which can be revoked at any time, can be used for any purpose and doesn't pass every request to a corporation for approval.

[0] https://letsencrypt.org/2015/11/09/why-90-days.html

[1] https://letsencrypt.org/2015/10/29/phishing-and-malware.html