This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Recipient's "encrypt-only" S/MIME certificate deemed not valid by Thunderbird

more options

My Thunderbird version at the moment is 102.13.0 (64-bit) running under Linux but the issue is not limited to either this particular version, nor the OS - colleagues running Thunderbird on Windows boxes report the same thing. We deal with an organization which issues their own S/MIME certificates. For a long time it worked flawlessly - we imported their CA as trusted, imported personal certificates of email recipients and everything worked smooth. Lately they started issuing two different certificates per person - one for signing emails, another for encryption. And now since emails from them come with a signature created with a certificate which has "Digital Signature" and "Non Repudiation" uses - everything works fine "inbound". The problem starts if we want to send encrypted emails back to them. Even if we import the encryption certificates we get (those have only "Key Encipherment" usage) and the certificates themselves are valid in any possible way (lifetime, proper CA chain imported and so on), still Thunderbird tells us it can't find proper certificate to encrypt the message.

My Thunderbird version at the moment is 102.13.0 (64-bit) running under Linux but the issue is not limited to either this particular version, nor the OS - colleagues running Thunderbird on Windows boxes report the same thing. We deal with an organization which issues their own S/MIME certificates. For a long time it worked flawlessly - we imported their CA as trusted, imported personal certificates of email recipients and everything worked smooth. Lately they started issuing two different certificates per person - one for signing emails, another for encryption. And now since emails from them come with a signature created with a certificate which has "Digital Signature" and "Non Repudiation" uses - everything works fine "inbound". The problem starts if we want to send encrypted emails back to them. Even if we import the encryption certificates we get (those have only "Key Encipherment" usage) and the certificates themselves are valid in any possible way (lifetime, proper CA chain imported and so on), still Thunderbird tells us it can't find proper certificate to encrypt the message.

All Replies (1)

more options

Hi "Crack my back" Perhaps the folks at #openpgp:mozilla.org on Matrix can help

Cheers! ...Roland