-- --
- -By policy group decision p20100710:
-
-"Finally, that other proposals (CC-BY-ND and 3pv-DaL) be taken off the table. Policy group contributors and editors are thanked for thought-provoking comments and useful debate."
-This document is dead.
-It is no longer under consideration by policy group, being overtaken by -the RDL."
-
D E A D
- --- -0. Preamble
- --This section is not part of the licence but may be explanatory. -Skip to licence. -
- -0.1 -Being that, -
- -- -
- - CAcert is a Certification Authority ("the CA"), -
- - the CA offers a free certificate service to its subscribers, -
- - for the direct benefit and RELIANCE of its Community of signed-up users - ("Members"), - RELIANCE being defined as the Member's act in making a decision, - that takes on a risk or liability, - in whole or in part based on the certificate, - and -
- - where possible, of some indirect benefit and USE to other general users - ("end-users") of the Internet, - where USE is defined as allowing a certificate to - participate in a protocol, as decided and facilitated - by the user's software, with no significant input or - knowledge being required of the user; -
0.2 -And that, -
- -- -
- - the end-user has a choice in software - (such as browsers and email clients), -
- - such software offers features which are wholly or partly - based on use of certificates, -
- - which may include the certificates of the CA - and/or of any other certificate authority, -
- - the end-user may have strictly limited or opaque - possibilities to choose or - control the usage made of certificates, -
- - and that it may not be economic nor reasonable for software - to provide for a high degree of choice and control over certificates; -
0.3 -And that, in offering the USE of certificates to the end-user, -
- -- -
- - the CA has no direct relationship with the end-user, -
- - it is not economic nor reasonable to expect such a - direct relationship, -
- - by way of an open, indirect offering, - the CA offers its - - Non-Related Persons -- Disclaimer and Licence - to the end-user ("NRP") in which -
-
- - the CA disclaims liability to NRPs, -
- - the CA offers a free licence to USE to all NRPs, -
- - the CA specifically does not permit the NRPs to RELY, -
- - and that NRPs have a choice of joining the Community - and thus becoming a Member (which overrides the NRP-DaL); -
0.4 -And that, -
- -- -
- - you are a third party vendor or distributor of software for end-users - ("the Vendor"), -
- - the Vendor offers a free distribution of root certificates ("root list"), - within software, -
- - that in choosing the Vendor's software, - the end-user would enter into an - End-User Licence Agreement ("EULA") with the Vendor, -
- - the Vendor has the primary and only direct relationship with the end-user, -
- - the Vendor chooses not to be a Member of CAcert, -
- - and therefore Vendor needs a Licence to distribute the roots - to its end-users; -
0.5 -We both, CA and Vendor, agree that, -
- -- - -
- - we are committed to providing a - free and USABLE way to benefit from cryptography, -
- - we are committed to the security of our respective communities, -
- - the design, custom and history of the public key infrastructure - ("the PKI") creates risks and liabilities - for inappropriate RELIANCE by the end-user, -
- - it is not economically possible nor reasonable - to provide a free, open and unconstrained service - that can be RELIED upon by end-users. -
-With the above understanding, -the following Licence and Disclaimer is offered by CAcert to Vendor. -
- -
-
-1. Agreement and Licence- -1.1 Agreement- --We (the Vendor and the CA) -both agree to the terms and conditions in this agreement. -The relationship between the CA and the Vendor is based on this agreement. -Your agreement is given by your distribution of the root within your -distribution of your root list. - - -1.2 Other Agreements- --The relationship between the Vendor and the end-user -is based on Vendor's own agreement -("end-user licence agreement" or EULA). -Generally, the Vendor offers the EULA to the end-user -in the act of distributing the software and roots. - - --The relationship between the CA and the end-user is based on CA's -Non-Related Persons -- Disclaimer and Licence -("NRP-DaL"). -This Licence follows the style of popular open source licences, -in that it is offered to an unknown audience, without a necessary -expectation for explicit agreement by the end-user, -because of the methods and restrictions of delivery. - - -1.3 Licence to Distribute- --CA offers this licence to permit Vendor to distribute CA's roots -within Vendor's root list to Vendor's end-users. - - -1.4 Vendor's Agreement with End-User--Vendor agrees - - -
1.5 Fair and Non-Discriminatory- --Vendor agrees to make available CA's root key -in a fair and non-discriminatory way to Vendor's end-users. - - --In accordance with the general principles of PKI -and the fact that the CA makes statements of interest -within certificates, the Vendor is strongly encouraged -to reasonably represent to the end-user -that the CA is the issuer of the certificate -and the maker of claims within the certificate. -The extent to which the end-user is aware that the -CA is the person making claims is likely to be -material in a dispute over claims. - - -2. Disclaimer- -2.1 All Liability- --Vendor's relationship with end-users creates risks, liabilities -and obligations due to the end-user's permitted USE of the certificates, -and potentially through other activities such as inappropriate -and non-permitted RELIANCE. - - --We in general DISCLAIM ALL LIABILITY to each other. -Vendor acknowledges and confirms that -the CA disclaims all liability to the end-user -in NRP-DaL. - - - -2.2 Monetary Limits on Liability- --Notwithstanding the general disclaimer on liability above, -we agree that, -liability of Vendor and of the CA is strictly limited to be 1000 euros. -This is the same limit of liability that applies to each -member of the CAcert Community. - - -3. Legal Matters- -3.1 Law- --The Choice of Law is that of NSW, Australia. -Policies in force within CAcert are incorporated. - - -3.2 Dispute Resolution- --We agree that all disputes arising out -of or in connection to this agreement -and the root and certificates of the CA -shall be referred to and finally resolved -by Arbitration under the -Dispute Resolution Policy of the CA -(COD7). -The ruling of the Arbitrator is binding and -final on CA and Vendor alike. - - - |
- -- - --The following parts are not part of the above licence, -but may shed light. -
- -Z. FAQ
- -Z.1 Notes on Liability
- --Liability agreement between CA and Vendor -suggests that the end-user be presented with the name of the CA -in any act where the certificate is USED. -This is useful for identifying the particular characteristics -of the CA, and accepts that all CAs are different. -Each CA has its ways of checking, its relevent laws, and its -particular view as to the interests of the end-user, -and it is PKI practice and CPS practice that the -obligation falls on the end-user to understand this. -
- --The Vendor should present the name of the CA so as to inform -the end-user of what can be known about the claim being made. -In the event that the Vendor does not present the CA's name, -the CA is taking on the risk and liability that is -equivalent to other CAs. Such a position can be seen -rationally as the lowest-common-denominator, that is, -the claim is no better than the worst claim made by the -worst of CAs. -Therefore the liability that is accepted by this CA is -the lowest that can be applied to any CA in the same position. -This liability limit would generally be zero. -Any additional liability would therefore fall to the Vendor. -
- --If the CA has been presented to the end-user, the end-user -is able to discriminate. CAs are no longer equivalent. -In this case, it is reasonable for the CA to share -the liability, over and above the lowest common denominator, -up to the limit expressed in the above licence. -
- --Always remembering that this is strictly within the -relationship with the Vendor. -As there are millions and one day, billions of users, and as -the software and the certificates are free, the liability -to the end-user must be disclaimed totally. -In other words, set to zero. -
- -Z.2 Reasonably Shown
- --To reasonably show the name of the CA is undefined, -as security user interfaces currently are not representative -of reasonable descriptions, and the area is an open research -topic (sometimes known as "usable security"). -
- --A reasonable man test is known in law, and selects someone -who would be the reasonable person who would use the software. -This might hypothetically examine whether a majority of -random users would have "got it" when presented with the -same information, however this is not quite how it is tested -in law; instead, it is more of a gut-feeling. -
- -Z.3 Recursive Distribution
- --This licence is not intended to limit the ability of -a re-distributor of Vendor's root list from operating under -the same conditions as the Vendor. The licence applies -equally to all distributors of CA's roots. -It is the re-distributor's responsibility -to be aware of this licence and to take appropriate -steps. The primary Vendor discharges any responsibility -to the re-distributor by making available this licence -on the same basis as its other licences. -See §1.4-1. -
- -Z.4 Persons, Parties, Numbers
- --As a convention of contract law, the participants -are typically called parties. -The CA is the first party. -The Member is the second party, -under a direct contract with CA -(CCA). -
- --The end-user however is typically not a direct party to the contract -known as -NRP-DaL -because she has typically not seen it nor agreed to it. -In deference to this difficult position, she is termed -the second person rather than second party, -and more formally known as a Non-Related Person to -underscore that situation. -
- --Therefore, -in order to keep the above terms constant and less confusing, -any distributor is therefore termed the third person. -Hence this present agreement is between the first and third persons, -and the title reflects that. -(The use of the term Vendor does not imply there is a sale, -it is only industry convention to include free distributors -under this label.) -
- -