Barry
Leiba

Around three and a half years ago, I posted an item in my personal blog about public key infrastructure.^[1] In it, I mentioned two certificate authorities from which one could get free certificates for personal use: Thawte and CAcert. (You can also get free certificates from Comodo, ipsCA, and StartCom.) For somewhat arbitrary reasons — mostly because Thawte seemed better situated, and its root certificate was already set up in Windows as a trusted signer (CAcert is not) — I settled on that one, and have been using a Thawte certificate.

Unfortunately, it seems that Thawte is getting out of the “business” of issuing personal certificates. I got this email yesterday:

Important Thawte® Personal E-mail Certificate Holder Notice

Thawte Personal E-mail Certificates and Web of Trust are being discontinued

Dear Barry Leiba,

Over the past several years, security compliance requirements have become more restrictive, while the technology infrastructure necessary to meet these requirements has expanded greatly. Despite our strong desire to continue providing the Thawte Personal E-mail Certificate and Web of Trust services, the ever-expanding standards and technology requirements will outpace our ability to maintain these services at the high level of quality we require. As a result, Thawte Personal E-Mail Certificates and the Web of Trust will be discontinued on November 16, 2009 and will no longer be available after that date.

Deciding to conclude these services was a difficult decision for us to bear, specifically because of the community that has been built around these products over the years.

To express our gratitude and sincere appreciation for being a part of our Thawte community, we would like to offer you up to $100.00 off the purchase price of our SSL and/or code signing certificates.

If you would like to take advantage of our offer, please forward this email to our sales department. Their contact details are listed at the foot of this message. Please note that this offer expires on November 16, 2009.

We have also made a special arrangement with VeriSign regarding replacing your personal email certificate. VeriSign’s exclusive offer to you is for a FREE 1-year replacement personal email certificate - a $19.95 value. This offer will be open for 2 months after the service is discontinued and will no longer be available after January 16, 2010. Simply follow appropriate link below to request your certificate.

Interestingly, their web page for requesting new certificates hasn’t been updated yet. But even if you can still request one for another month, I’m not sure why you’d want to: according to their FAQ page on the matter, all outstanding certificates will be revoked on that date, so any certificate you get now will only be valid for another month (or less) anyway. It’s not like you can grab one at the last minute and be OK for another year.

I think I shan’t take them up on their VeriSign offer. I’ve already revoked my Thawte certificate and have gotten one from CAcert instead (and that’s the one you’ll see on my business-related web page now, in its right sidebar).

Of course, I say that I’ve been “using” a certificate only in the loosest sense of “use”. I rarely have any need to digitally sign email, and no one ever has cause to send me encrypted mail. At least, that’s the case with the way we do email today. I’d still like to see this technology used more, but it remains a curiosity.

Why it’s no more than a curiosity is mostly covered in the PKI entry. The short answer: it’s too cumbersome and confusing to get certificates, to give them to people who need them, to manage them (they expire annually, and need to be replaced with new ones), and to deal with the error conditions when something doesn’t work right.

I know what I’m doing, and the process for replacing my Thawte certificate with the CAcert one was not trivial for me, and didn’t work right away. I had to “install” the new certificate into multiple programs, as well as into the MacOS “keychain” (theoretically, they should all get it through the keychain, but...). After installing it, I had to tell some of the programs to use the new certificate instead of the old one. One program didn’t allow me to choose, and insisted on using the Thawte certificate, so I actually had to delete it from that program’s certificate list (that was before I did the revocation, so maybe it would work correctly now, when it saw that the certificate it wanted to use was revoked). Deleting the old certificate is a bad idea, if you might have encrypted mail or files that need it. And then I had to remove the public version of the old certificate from my web site and put the new one there.

But another reason that all this is just a curiosity is that there’s no compelling reason to use this stuff anyway. That is to say, there are plenty of good reasons that we should be using it, but we lack the critical mass to make any of that matter. If no one expects my email to be digitally signed, nor cares whether it is or isn’t, then it doesn’t matter that I can do it. If no one wants to send me encrypted mail, it doesn’t matter that they can.

My bank should be sending my online bank statements to me, encrypted and signed. Instead, I get plain-text mail that tells me my statement is ready, and I go log into their web site to get it. I should be sending instructions to my financial advisor, encrypted and signed. Instead, we use the phone, or I go to the company’s web site and log in.

And the web sites don’t even use my certificate to identify me, though they could, and it would be better than the username/password system. But it’s still too hard, three and a half years after I last ranted about it, to make digital certificates work for general users. We haven’t gotten anywhere.
 

^[1] While you’re reviewing that, go back and read my series on digital signatures.