Getting certificates.

[Anonymous via the Cypherpunks Tonga Remailer]

On Wed, 3 Sep 2003, James A. Donald wrote:

>     --
> SSH server public/private keys are widely deployed.  PKI public
> keys are not.  Reason is that each SSH server just whips up its
> own keys without asking anyone's permission, or getting any
> certificates.
>
> Outlook and outlook express support digital signing and
> encryption -- but one must first get a certificate.
>
> So I go to Thawte to get my free certificate, and find that
> Thawte is making an alarmingly great effort to link
> certificates with true name information, and with the beast
> number that your government has assigned to you, which imposes
> large costs both on Thawte, and on the person seeking the
> certificate, and also has the highly undesirable effect that   
> using these certificates causes major loss of privacy, by  
> enabling true name and beast number contact tracing of people
> using encryption.
> 
> Now what I want is a certificate that merely asserts that the
> holder of the certificate can receive email at such and such an
> address, and that only one such certificate has been issued for
> that address.  Such a certification system has very low costs
> for issuer and recipient, and because it is a nym certificate,
> no loss of privacy.
> 
> Is there any web page set up to automatically issue such
> certificates?
> 
> The certs that IE and outlook express accept oddly do not seem
> to have any provision for defining what the certificate
> certifies.
> 
> This seems a curious and drastic omission from a certificate  
> format.
> 
> Since there is no provision to define what a certificate
> certifies, one could argue that any certification authority
> that certifies anything other than a true name connected to a
> state issued id number, the number of the beast, is guilty of 
> fraud.  This would seem to disturbingly limit the usefulness
> and application of such certificates.  It also, as anyone who
> tries to get a free certificate from Thawte will discover,
> makes it difficult, expensive, and inconvenient to get
> certificates.
> 
>     --digsig
>          James A. Donald

Here is an interesting post regarding the CA issue:

http://lists.spack.org/pipermail/wordup/2003/000684.html

You may want to look at http://www.cacert.org. It may do what you want.