Trust & certificates

Internal sites use certificates issued by our own certificate authority (CA). Browsers and operating systems do not trust it out of the box, so they warn on internal sites and reject client-certificate sign-in until you import the CA once. Import the root below to trust every internal site signed by it. Verify the fingerprint out-of-band before you trust it.

Download

Import the root CA as a trusted authority. The full chain is for tools (curl, system trust stores) that want the intermediate too.

Root CA (.pem) Root CA (.crt / DER) Full chain (.pem)

Certificate details

Confirm these SHA-256 fingerprints against a trusted channel (this documentation, an admin over Matrix) before importing.

Root CA

Subject: CN=BingerInnen Identity CA
Issuer: CN=BingerInnen Identity CA
Valid until: 2036-09-03
SHA-256: 5D:B5:14:EF:40:06:43:93:5D:35:7F:C2:EF:61:C8:93:83:14:29:53:A7:81:39:65:7F:A1:C7:FC:60:57:03:FF

Revocation

A certificate can be revoked before it expires. This is the browser-reachable revocation list (CRL) endpoint - the address baked into issued certificates points inside the cluster and is not reachable from your device.

Revocation URL: https://identity.bingerinnen.de/trust/crl.pem
Last updated: 2026-09-06 14:58 UTC
Next update by: 2026-09-09 14:58 UTC
Revoked certificates: 0

CRL (.pem) CRL (.der)

Matrix key attestation

The identity service @identity:bingerinnen.de signs security messages on Matrix. Its Matrix master key is attested by this organisation's root CA (BingerInnen Identity CA - the same root published above): a signed statement binds the account to the key, so the binding can be checked cryptographically rather than by comparing a fingerprint by eye.

Attested account: @identity:bingerinnen.de
Master-key fingerprint: o5OO HjcZ WAqm s6Zg QbTs CxXv HVVA oqjG pDJP sM4l uGc
Statement valid until: 2026-09-09 17:27 UTC (renewed automatically)

Attestation (matrix.json)

Verify it yourself: each entry in /trust/matrix.json is a JWS whose x5c chain validates against /trust/root.pem; its master_key claim must equal the key served by the Matrix /keys/query API for the account.

How to import

Import the root CA. Only ever trust a CA you obtained over a channel you trust and whose fingerprint you verified above.

Firefox

Firefox keeps its own trust store. Settings → Privacy & Security → Certificates → View Certificates → Authorities tab → Import, choose the .pem, and tick Trust this CA to identify websites.

Chrome / Edge / Chromium (via the OS store)

These browsers trust the operating system store - follow the macOS, Windows, or Linux steps below. (On Linux, Chromium reads its own NSS store: certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "Loop Coop Root CA" -i loop-coop-root-ca.pem.)

macOS

Open the .crt in Keychain Access (login or System keychain), then set it to Always Trust under Get Info → Trust. Or: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain loop-coop-root-ca.crt

Windows

Double-click the .crt → Install Certificate → Local Machine → place in Trusted Root Certification Authorities. Or, elevated: certutil -addstore -f Root loop-coop-root-ca.crt

Linux (system trust store)

Debian/Ubuntu: sudo cp loop-coop-root-ca.pem /usr/local/share/ca-certificates/loop-coop-root-ca.crt && sudo update-ca-certificates
Fedora/RHEL: sudo cp loop-coop-root-ca.pem /etc/pki/ca-trust/source/anchors/ && sudo update-ca-trust

curl / command line

Point a single command at the chain without touching the system store: curl --cacert loop-coop-ca-chain.pem https://….loop-coop.net