Cryptography
This page exists so you can verify things: which certificates to trust, how to
check a signature, and what to do when something does not match. It deliberately
describes what a reader needs in order to verify, not the operational detail of
how the private side is run.
Internal CA
Internal services use a private certificate authority. It is not in any public
trust store and is not meant to be: nothing on the public internet is signed by
it, and no browser should ever accept it without being told to.
The root is offline and its key is held on hardware. Only the intermediate signs
end-entity certificates. If you are ever asked to trust a certificate from this
CA for a public site, that is wrong and worth reporting.
Both certificates use ECDSA P-256 with SHA-256.
Certificate fingerprints
Mayer Internal Root CA — valid 2026-04-18 to 2036-04-15
SHA-256: 23:70:6C:C5:89:0D:14:3E:80:41:53:CF:47:7E:74:65:CF:04:A0:12:1D:FB:40:C8:40:A2:E6:D6:F5:14:2E:D2
Mayer Internal Intermediate CA — valid 2026-04-18 to 2031-04-17
SHA-256: 75:7D:E6:76:87:05:2A:84:54:DD:8D:81:30:33:7C:94:6C:3B:DF:C4:51:8E:3A:88:5A:E3:CD:1D:73:2D:D0:79
Verify with: openssl x509 -in <file> -noout -fingerprint -sha256
Public services
Everything reachable from the public internet uses certificates from a public
CA, issued and renewed automatically. The internal CA above is never involved.
Note that automatic renewal generates a fresh key each time, which is why DANE
TLSA records pinning a leaf public key are not published for these services.
Signed commits
Commits are signed with an SSH key. To verify them yourself, configure git with
an allowed-signers file containing the public key, then git log --show-signature
will report each commit as verified or not.
An unsigned commit is not evidence of anything sinister on its own — some
tooling and some hosts commit unsigned — but a commit whose signature does not
verify against the expected key is worth reporting.
PGP
A PGP key for encrypted mail and signature verification is not published here
yet. More to come.
Until it is: a key attributed to these domains that is not published on this
page should not be trusted. If you need to send something confidentially in the
meantime, ask via the contact address in the Impressum and a channel will be
arranged.
Revocation and rotation
If a key or certificate on this page is ever retired or compromised, this page
is where it will be said, with the date and the replacement fingerprint. The
page carries an updated date for that reason.
If a fingerprint you are shown does not match the one published here, do not
proceed, and report it using the vulnerability disclosure policy.