Thunderbird Community Forum

I am trying to send an S/MIME encrypted email from Thunderbird to:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The recipient certificate is provided by the official certificate directory of the German Federal Employment Agency (Bundesagentur für Arbeit).

I downloaded the recipient certificate and successfully imported it into Thunderbird under:

Settings → Privacy & Security → Certificates → Manage Certificates → People

The certificate is displayed correctly there. The email address contained in the certificate is:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The certificate is valid from July 29, 2026 to July 29, 2028 and includes E-mail Protection and Key Encipherment.

The required CA certificates are also installed:

BA-Class-1-Root-CA-4:PN BA-VPS-CA-11:PN

However, when I compose an encrypted email to this exact address, Thunderbird reports:

“You have selected to encrypt this message, but the application failed to find an encryption certificate for jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de.”

Under S/MIME → Recipient Certificates, Thunderbird also shows the certificate as “Not found”.

I have already tried:

deleting and re-importing the recipient certificate completely restarting Thunderbird after importing it manually typing the recipient address in lowercase without using autocomplete checking the complete CA certificate chain temporarily disabling OCSP

None of these changed the result.

My own personal S/MIME certificate works correctly. As a test, I can compose an encrypted email to my own email address without any certificate error. Therefore, the basic S/MIME configuration and my own certificate appear to be working.

When I reproduce the problem with the Thunderbird Error Console open, I get:

NS_ERROR_ILLEGAL_VALUE (0x80070057)

related to:

nsIMsgComposeSecure.beginCryptoEncapsulation

This seems similar to Mozilla Bug 2021265, where a manually imported recipient certificate is visible in Certificate Manager but is not found when composing an encrypted message.

Is this a known issue in Thunderbird 140 ESR, and is there a workaround for using this manually imported recipient certificate?

In Plain English how to use and secure encryption on all outgoing emails please and whether or not to use this great advantage. Many thanks to all those who contribute to this work, PB

https not recognized by Firefox in 151 Thunderbird on silicon iMac with Sonoma. Tried & checked many solutions with no results.

Firefox browser primary , always Nothing in Modified Important Preferences With Extensions off still a problem

Receive popup message: The certificate for mobile.charter.net does not come from a trusted source. In trying to send email, popup message: Sending the email failed. Peer's Certificate issuer is not recognized. The configuration related to mobile.charter.net must be corrected. Then it wants me to Add Security, Get Certificate.

Hi

I have a problem with Thunderbird which might be a bit niche but here goes...

The first attempt at sending an email fails as TLS Record Layer v1 is used, the mail server sees this and hard resets the connection so sending halts. See attached Wireshark trace screenshot "Failed".

If I retry the send again Thunderbird uses TLS Record Layer v1.3 and the email goes out ok. See attached Wireshark trace screenshot "Success".

If I send another message immediately no problem but if I wait 20-30 minutes the above cycle happens again.

I have set the minimum TLS version in the config to 1.3 (option 4) and restarted Thunderbird but this has not changed anything.

Any ideas how I can fix this? It's a pain because automated replies don't work.

Hi,

I have successfully added my personal certificate in my account's E2EE and I can ever since digitally sign messages. Yay! After importing a multiple valid certificates for recipients, I tried to send encrypted emails to some of these (one recipient per email draft). All of them highlight the recipient's address in yellow with a yellow status bar: "End-to-end encryption requires resolving certificate issues for [recipient address]"

Clicking on the button "S/MIME" -> "View Certificates Of Recipients", a window comes up showing the address with the status "Not found". When I open "Settings -> Privacy & Security -> Certificate Manager", I see the certificates present with valid dates. Using certutil to investigate cert9.db in Thunderbird's profile folder, I also see the certificates being in there, but what struck me was the trust status: [...] Fingerprint (SHA-256):

       7B:DF:9F:28:F2:B4:42:5E:37:06:EE:B8:D6:22:0C:70:12:05:F8:33:26:10:5A:1C:03:21:65:2A:C0:C3:3F:5E
   Fingerprint (SHA1):
       56:43:79:93:41:E0:8B:16:0A:FC:64:3E:74:B6:6F:F8:4E:67:93:D4

   Mozilla-CA-Policy: false (attribute missing)
   Certificate Trust Flags:
       SSL Flags:
       Email Flags:
       Object Signing Flags:

I changed the Trust flags (first for emails, then for SSL email) by running certutil -M -n <recipient's email addresss> -t ",P," -d <certdir>

This lead to

Fingerprint (SHA-256):
       7B:DF:9F:28:F2:B4:42:5E:37:06:EE:B8:D6:22:0C:70:12:05:F8:33:26:10:5A:1C:03:21:65:2A:C0:C3:3F:5E
   Fingerprint (SHA1):
       56:43:79:93:41:E0:8B:16:0A:FC:64:3E:74:B6:6F:F8:4E:67:93:D4

   Mozilla-CA-Policy: false (attribute missing)
   Certificate Trust Flags:
       SSL Flags:
       Email Flags:
           Terminal Record
           Trusted
       Object Signing Flags:

Whils I am not sure if this makes any difference to my beforementioned problem, I realize "Mozilla-CA-Policy: false (attribute missing)". How can I address this missing attribute and what can I do to get my emails encrypted, please?

Mozilla suddenly says "The certificate for mobile.charter.net does not come from a trusted source." It will not let me get my emails. Is this a problem with Thunderbird or Charter (Spectrum) I am able to receive email on my I Phone. I do not know which Thunderbird version and can't find it using your instructions. Help please

When i try to update my schooles secure mail, i get the nev certifikat and the Root, and Ca1 under autoreties and give it the right rights but it keeps giving me this error message " Certificate verification failed with the following error: The peer's certificate issuer is unknown. (Error code: SEC_ERROR_UNKNOWN_ISSUER)"

Email not working on my desktop. Using Edge 11, Settings show certificate for mobile.charter.net:993 does not come from a trusted source. I can not send or receive email on my desktop. This started this morning. I have not made any changes to my computer, but did do an Edge update. I can check my email on my cellphone if there is a fix.

I am using Thunderbird 151.0.1 (64-bit), and I get the "trusted source" message in a pop-up every time Thunderbird checks for email. There is only an option to Dismiss presented. My account name changes color to red and has a red triangle with an exclamation mark displayed. I went to Settings > Privacy & Security > Security > Certificates > Manage Certificates and looked at all the certificates listed in the Certificate Manager > Authorities (which is the only section with anything listed) and don't see anything from mobile.charter.net. I can go to SPECTRUM.NET (Charter) and view my email with no problems. I'm at a loss as to be able to view my email in Thunderbird.

We have used mobile.charter,net for our emails since we signed up for your product. Now my husband gets the mobile.charter.net "certificate is not from a trusted source" error when Modzilla is retrieving emails. I have the same email provider, and do not get the error message from Modzilla. Can you help us correct this problem?

I am unable to download email for my Bell email accounts. For one of the two Bell accounts all messages disappeared. I get an error message saying saying the server's certificate is invalid.

I recently obtained a digital certificate for use with S/MIME. I followed the process laid out in

https://support.mozilla.org/en-US/kb/instructions-smime-certificate-using-csr

to generate my key pair, create a CSR, submit it to a CA, download the resulting certificate file, and import it into Thunderbird. I also imported the intermediate certificate showed as the issuer for my cert, which in turn appears to be signed by one of the certs trusted by default in Thunderbird.

Having done that, I see the certificate showing up under "your certificates" in the Certificate Manager, with a "not before" date in the past and a "not after" date in the future. So everything appears to look correct, but when I try to send a signed email I get the following error message as a pop-up:

"Sending of the message failed. You specified that this message should be digitally signed, but the application either failed to find the signing certificate specified in your Mail & Newsgroup Account Settings, or the certificate has expired."

And if I look at the console in developer tools I see:

"mailnews.send: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIMsgComposeSecure.beginCryptoEncapsulation]

   _startCryptoEncapsulation resource:///modules/MimeMessage.sys.mjs:488
   _writePart resource:///modules/MimeMessage.sys.mjs:536
   createMessageFile resource:///modules/MimeMessage.sys.mjs:82
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:147
   CompleteGenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6456
   GenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6372
   SendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6984
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1085
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1263
   goDoCommand chrome://messenger/content/globalOverlay.js:99
   oncommand chrome://messenger/content/messengercompose/messengercompose.xhtml:1
   openWindowPrompt resource:///actors/PromptParent.sys.mjs:75
   receiveMessage resource:///actors/PromptParent.sys.mjs:18
   openPrompt resource://gre/modules/Prompter.sys.mjs:1228
   openPromptSync resource://gre/modules/Prompter.sys.mjs:1071
   alert resource://gre/modules/Prompter.sys.mjs:1375
   alert resource://gre/modules/Prompter.sys.mjs:78
   fail resource:///modules/MessageSend.sys.mjs:358
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:157

MessageSend.sys.mjs:149:32

   createAndSendMessage resource:///modules/MessageSend.sys.mjs:149
   CompleteGenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6456
   GenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6372
   SendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6984
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1085
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1263
   goDoCommand chrome://messenger/content/globalOverlay.js:99
   oncommand chrome://messenger/content/messengercompose/messengercompose.xhtml:1
   openWindowPrompt resource:///actors/PromptParent.sys.mjs:75
   receiveMessage resource:///actors/PromptParent.sys.mjs:18
   openPrompt resource://gre/modules/Prompter.sys.mjs:1228
   openPromptSync resource://gre/modules/Prompter.sys.mjs:1071
   alert resource://gre/modules/Prompter.sys.mjs:1375
   alert resource://gre/modules/Prompter.sys.mjs:78
   fail resource:///modules/MessageSend.sys.mjs:358
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:157"

I can't make sense of the error message, since the certificate appears under "your certificates" in the certificate manager, and it does not appear to be expired. Can anyone suggest how to determine the root cause and fix it? Does it matter that the certificate is for a non-default identify I've added for the account in Thunderbird? Does it matter if the "common name" in the certificate doesn't match the "Your Name" field in Thunderbird? Any pointers on what to check would be appreciated.

Receiving emails was no problem, but when sending one I was repeatedly asked for my password. I did check the save password in the dialog box. I checked the account settings and saw a yellow alert next to certificate exception and clicked on remove. That apparently was a mistake because now I can't get into email since the security certificate is not valid. Reinstalling Thunderbird may be needed, but I need some advice before I try anything else.

I've been trying to set up a GPG key, but Thunderbird doesn't recognize my pub.asc file. So I created a PGP key thru Thunderbird and I would like to export it as ASCII-armored public key.

Every time I log in and then every so often afterwards I get the pop up - you are about to override how Thunderbird identifies this site- for a now deleted mail.co.uk account. I have tried all the fixes suggested by Google but it still keeps happening and is driving me mad. It tells me the certificate is outdated or invalid and asks to confirm to permanently store the exception but just keeps coming back every time I click on confirm, it only goes away if I click cancel but then keeps coming abck.

Server Posteingang IMAP (empfohlen) imap.vodafonemail.de Ports für Posteingang IMAP SSL: 993 / TLS: 143

Server Postausgang SMTP smtp.vodafonemail.de Ports für Postausgang SSL: 465 / TLS: 25 oder 587