X
Tap here to go to the mobile version of the site.

Support Forum

digital pkcs7 s/mime signature is not recognized

Posted

A pkcs7 s/mime signature is not recognized by the client. I compared what is the difference between a recognized and an unrecognized signature.

correctly recognized:


Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=SHA1; boundary="----=_NextPart_000_0000_01D6040E.23370570"
MIME-Version: 1.0
...
------=_NextPart_000_0000_01D6040E.23370570
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
----------------------------------------------------------------------------------------------------------

not recognized:

Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	boundary="--=_V1R2=_=q1202.27865.7237_1"
MIME-Version: 1.0
...
----=_V1R2=_=q1202.27865.7237_1
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
----------------------------------------------------------------------------------------------------------

The source code of the email does not differ anywhere else. In the past, he still displayed the smime.p7s attachment for such undetected signatures, which he no longer does. By the way, the manufacturer of the outlook plugin "cv act s / mail" for signing writes that he did everything correctly and the email client (thunderbird) has to be checked.

the error occurs with a Thunderbird 68.5.0 build ID 20200210021033 under debian Linux (Bullseye).

A pkcs7 s/mime signature is not recognized by the client. I compared what is the difference between a recognized and an unrecognized signature. correctly recognized: Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0000_01D6040E.23370570" MIME-Version: 1.0 ... ------=_NextPart_000_0000_01D6040E.23370570 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" ---------------------------------------------------------------------------------------------------------- not recognized: Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; boundary="--=_V1R2=_=q1202.27865.7237_1" MIME-Version: 1.0 ... ----=_V1R2=_=q1202.27865.7237_1 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" ---------------------------------------------------------------------------------------------------------- The source code of the email does not differ anywhere else. In the past, he still displayed the smime.p7s attachment for such undetected signatures, which he no longer does. By the way, the manufacturer of the outlook plugin "cv act s / mail" for signing writes that he did everything correctly and the email client (thunderbird) has to be checked. the error occurs with a Thunderbird 68.5.0 build ID 20200210021033 under debian Linux (Bullseye).

Modified by Matt

Quote

Additional System Details

Application

  • User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36

More Information

Matt
  • Top 10 Contributor
  • Moderator
3422 solutions 23771 answers

Helpful Reply

mime type do not start with X. The registered Content type is what is in your first example. See https://www.iana.org/assignments/media-types/media-types.xhtml#application for a list of registered type and their relevant RFC references.

Most outlook developers think file extensions are important and they tend to ignore the Content type as not important. Hence they often make mistakes when dealing with MIME.

mime type do not start with X. The registered Content type is what is in your first example. See https://www.iana.org/assignments/media-types/media-types.xhtml#application for a list of registered type and their relevant RFC references. Most outlook developers think file extensions are important and they tend to ignore the Content type as not important. Hence they often make mistakes when dealing with MIME.
Was this helpful to you? 1
Quote

Question owner

Thanks for the hint Matt, but that's not my problem. In the example, everything works as it should. Thunderbird recognizes a valid signature.

Where the "micalg = SHA1;" missing s / MIME does not work. I have reported the problem to the plugin manufacturer including RFC. Unfortunately, he does not want to adjust this in the existing product anymore and tells me: "It is only a problem with Thunderbird, Outlook and other clients do not have this. This" micalg "parameter is optional by the way. Contact the manufacturer of your client to get a solution ".

Well, what can I say, I did it here ;-)

So why does the Thunderbird show me a valid signature for an Outlook signed e-mail with the wrong MIME type, during which it does not do so for the other? Maybe Thunderbird doesn't know the value "V1R2"?

By the way, thanks for formatting Matt

Thanks for the hint Matt, but that's not my problem. In the example, everything works as it should. Thunderbird recognizes a valid signature. Where the "micalg = SHA1;" missing s / MIME does not work. I have reported the problem to the plugin manufacturer including RFC. Unfortunately, he does not want to adjust this in the existing product anymore and tells me: "It is only a problem with Thunderbird, Outlook and other clients do not have this. This" micalg "parameter is optional by the way. Contact the manufacturer of your client to get a solution ". Well, what can I say, I did it here ;-) So why does the Thunderbird show me a valid signature for an Outlook signed e-mail with the wrong MIME type, during which it does not do so for the other? Maybe Thunderbird doesn't know the value "V1R2"? By the way, thanks for formatting Matt

Modified by Bjoern

Was this helpful to you?
Quote
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.