What Is SSL, a CA, and FreeCert?

Architecture and Background

Description from DEF CON 9 Speaker’s Page: Len Sassaman - What is SSL, a CA and FreeCert? What is SSL, a CA and FreeCert? The goal of FreeCertis to provide free or low-cost certificate authority services to individuals and organizations with limited budgets, as well as raise awareness of the services that CA's actually provide.

Vulnerability Analysis

Many users of the Internet today are unaware of what role a CA plays in the process of secure website viewing. In my presentation, I intend to give a brief explanation of how SSL works and what it is that a CA does. I will explain what the browser warning messages mean to the user, and what to do when encountering them.

Exploitation and Demonstrations

I will discuss the dangers of trusting CAs, and methods of ensuring that certificates are valid when the CA cannot be ultimately trusted. Following this, I will present details about FreeCert: what it does and does not intend to accomplish, who can benefit from it, and how it will execute these goals. Information on becoming involved in the development of FreeCert will be provided, and questions about FreeCert will be answered.

Remediation and Defensive Strategies

Len Sassaman is a Systems Engineer for PDC Solutions, Inc. His primary focus is information security, specializing in email security and anonymity services. Len is an anonymous remailer operator, a member of The Shmoo Group, and a CryptoRights Foundation staff member.