A private certificate authority. It issues certificates to people, not to servers.
Certificates from this authority identify a person: they sign email (S/MIME),
sign documents, and authenticate to services that ask for a client certificate.
The addresses it will issue for are at langbein.org qyber.black qyber.dev.
If you have received a signed message from one of those addresses and your mail client called the signature untrusted, that is because your machine does not have this root. Installing it below is what fixes that, and it is your decision to make, not a formality.
| Subject | CN=LANGBEIN Root CA |
| Expires | Dec 31 23:59:59 2035 GMT |
| Files | root.crt · chain.pem · intermediate.crt |
| Revocation | root.crl_pem · intermediate.crl_pem |
This page is served over a certificate from a public authority. That protects the page, not the file you fetch from it. Verify the fingerprint before you install anything:
openssl x509 -in root.crt -noout -fingerprint -sha256
If it does not match, character for character, discard the file. Do not install it and then wonder.
It cannot issue a certificate for a website, an IP address, or any host name at all. That is not a promise about how it is operated: the root carries name constraints that exclude every DNS name and every address, so a certificate naming one fails verification in any client that implements RFC 5280 — including the ones you already have. The only names it can sign are mailboxes at the domains listed above.
Its signing key is kept offline.
Debian, Ubuntu: put root.crt in
/usr/local/share/ca-certificates/ and run
update-ca-certificates.
Thunderbird, Firefox: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, and tick the option for identifying mail users.
macOS: open root.crt in Keychain Access and set
it to Always Trust.
Windows: right-click root.crt → Install
Certificate → Trusted Root Certification Authorities.