The Opera Rootstore

Still sorely waiting year after year for the first and second most used CAs in Hungary.

Most secure websites use Netlock here, while e.g. the official e-government site recently swithched to the other local CA, Microsec e-Szigno. (Which is, in itself, good, because they don't seem to be as negligent as Netlock.)

Talk about low Opera market share here! Most people are annoyed and intimidated by the security warnings on most secure sites, including most banks too. Most are unable to install the needed certificates manually. They may conclude that Opera is less secure than other browsers.

I'm a power user, but this issue annoys me even! (Having to manually get all the several types of certs and install them one by one on all new Opera installation. I was even too lazy to install Netlock on my Symbia S60 for use with Opera Mobile, because Netlock's downloadable certs are in a format that is not supported by S60!)

I have given up hope though. After all, David Storey reported more than a year ago that he is in talks with Netlock. And still no progress...

Huxr: To be able to include a CA we need to receive and verify specific documents from and about the CA, see http://www.opera.com/docs/ca/ . At the moment we don't have those documents for Netlock, though we may have received electronic copies recently.

For reference, users can install a Root manually for CAs that they personally trust (remember to set the permission flags correctly).

Please include support for CAcert (http://www.cacert.org/)
and support locally installed certificates on Linux (i.e. /etc/ssl/certs/)

Good news.Thnaks.

Roman Kyrylych: To the best of my knowledge CAcert does not qualify, since they do not have a WebTrust or ETSI CA audit, or something that is equivalent. I am also not aware that any other browser vendor have embedded this CA, though it may be that some smaller distributions have.

If you choose to trust them, that is your choice.

Yngve: Thanks for checking. I know the guidelines, but can a mere user (like me) do anything about this issue with little time and effort? I certainly cannot and would not want to do major volunteer evangelization and coordination for Opera, because I have more than enough tasks for myself nowadays.

At least it would be good if Opera Link could act as a "personal rootstore", saving the manually added certificates on the server, and pushing them to the other instances of Opera Desktop and Mobile (btw, does it use the Rootstore too?) of the same user. Opera Link is done through a secure channel, if I'm not mistaken.

Btw, yes, of course, in an ideal world, users would be able to install the certs on their own. But reality is very different.

Anyway, I personally do not trust the certs that can be downloaded from the two Hungarian CAs' website *through plain HTTP*. Am I right on this stance?

So I exported the Netlock root certs from Firefox, and the Microsec ones from IE, because when I last checked, afaik, Firefox didn't have the latter ones.

But I expect that Joe next door will only go as far as dismissing Opera's security warnings, or setting it to remember the dismissal. Or switching to another browser if they know how.