Thunderbird コミュニティフォーラム

We are not getting emails because we keep getting an error message which reads The certificate for imap.shaw.ca does not come from a trusted source.

Thunderbird email says the certificate for my Shaw email server does not come from trusted source. The certificate looks fine. I cannot get Thunderbird to "Add exception". The certificate issue seems to be an intermittent problem since yesterday lunchtime. It started working again yesterday afternoon, but stopped working at lunchtime today. How do I stop this error?

Hi,

I remember i tried 7y. ago a email certificate signed with SHA3, it was not OK.

I tried again now, and it is still blocked.

1) the certs can be added in the account settings > S/MIME for signature and ciphering, with a warning. 2) then creating a new email, the recipients certificates are not detected (while configured in another account on the same thunderbird client), and forcing ciphering is not allowed with the error message

"Sending of the message failed. This message cannot be digitally signed because the signing certificate selected in your End-to-End Encryption settings is not valid for this operation. (The certificate was signed using a signature algorithm that is disabled because it is not secure.)"

"Unable to save your message as a draft. This message cannot be digitally signed because the signing certificate selected in your End-to-End Encryption settings is not valid for this operation. (The certificate was signed using a signature algorithm that is disabled because it is not secure.)"

Even, when using only ciphering, and no signature in S/MIME.

The parameter mail.smime.accept_insecure_sha1_message_signatures do not change the bahavior.

-> Can Thunderbird allow SHA3 usage, please ?

Even if thunderbird does not want to generalize it, mozilla may create a parameter by default false

mail.smime.accept_sha3_message_signatures

Best Regards, Gwenolé

I am using an email server that currently is using certificates that have expired. That problem is being worked on. In the meantime, whenever I access the server to open a folder, I get a pop-up notification telling me that the certificate has expired. I go ahead and confirm the security exception and check the box to permanently store the exception. Trouble is this ISN'T being persisted, when I open a different folder I have to go through this process again in order to access my emails in that folder.

Me thinks you got a bug in your software Kemosabe!

I can't get my e-mails today. I got a message saying The certificate for pop.centurylink.net is not valid for that server. Someone could be trying to impersonate the server and you should not continue.

Why did I get this message? I never saw this before. I like to get my e-mails. I tried reseting my router and turned off my computer and it still says the same thing. What do I do and how will I see your reply if I can't get the e-mails? Please fix this. My e-mail is toosmiley@centurylink.net

Thank you

I can't find the certificate in order to delete/distrust it. Its name is my mail server. Organization: Lumen Technologies, Monroe, Louisiana

Subject Name Country US State/ProvinceLouisiana LocalityMonroe Organization Common Name Lumen Technologies, Inc. mail.centurylink.net Issuer Name Country Organization Common Name US DigiCert Inc DigiCert Global G2 TLS RSA SHA256 2020 CA1 Validity Not BeforeWed, 27 Aug 2025 00:00:00 GMT Not AfterSun, 27 Sep 2026 23:59:59 GMT

I am trying to send an S/MIME encrypted email from Thunderbird to:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The recipient certificate is provided by the official certificate directory of the German Federal Employment Agency (Bundesagentur für Arbeit).

I downloaded the recipient certificate and successfully imported it into Thunderbird under:

Settings → Privacy & Security → Certificates → Manage Certificates → People

The certificate is displayed correctly there. The email address contained in the certificate is:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The certificate is valid from July 29, 2026 to July 29, 2028 and includes E-mail Protection and Key Encipherment.

The required CA certificates are also installed:

BA-Class-1-Root-CA-4:PN BA-VPS-CA-11:PN

However, when I compose an encrypted email to this exact address, Thunderbird reports:

“You have selected to encrypt this message, but the application failed to find an encryption certificate for jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de.”

Under S/MIME → Recipient Certificates, Thunderbird also shows the certificate as “Not found”.

I have already tried:

deleting and re-importing the recipient certificate completely restarting Thunderbird after importing it manually typing the recipient address in lowercase without using autocomplete checking the complete CA certificate chain temporarily disabling OCSP

None of these changed the result.

My own personal S/MIME certificate works correctly. As a test, I can compose an encrypted email to my own email address without any certificate error. Therefore, the basic S/MIME configuration and my own certificate appear to be working.

When I reproduce the problem with the Thunderbird Error Console open, I get:

NS_ERROR_ILLEGAL_VALUE (0x80070057)

related to:

nsIMsgComposeSecure.beginCryptoEncapsulation

This seems similar to Mozilla Bug 2021265, where a manually imported recipient certificate is visible in Certificate Manager but is not found when composing an encrypted message.

Is this a known issue in Thunderbird 140 ESR, and is there a workaround for using this manually imported recipient certificate?

In Plain English how to use and secure encryption on all outgoing emails please and whether or not to use this great advantage. Many thanks to all those who contribute to this work, PB

https not recognized by Firefox in 151 Thunderbird on silicon iMac with Sonoma. Tried & checked many solutions with no results.

Firefox browser primary , always Nothing in Modified Important Preferences With Extensions off still a problem

Receive popup message: The certificate for mobile.charter.net does not come from a trusted source. In trying to send email, popup message: Sending the email failed. Peer's Certificate issuer is not recognized. The configuration related to mobile.charter.net must be corrected. Then it wants me to Add Security, Get Certificate.

Hi

I have a problem with Thunderbird which might be a bit niche but here goes...

The first attempt at sending an email fails as TLS Record Layer v1 is used, the mail server sees this and hard resets the connection so sending halts. See attached Wireshark trace screenshot "Failed".

If I retry the send again Thunderbird uses TLS Record Layer v1.3 and the email goes out ok. See attached Wireshark trace screenshot "Success".

If I send another message immediately no problem but if I wait 20-30 minutes the above cycle happens again.

I have set the minimum TLS version in the config to 1.3 (option 4) and restarted Thunderbird but this has not changed anything.

Any ideas how I can fix this? It's a pain because automated replies don't work.

Mozilla suddenly says "The certificate for mobile.charter.net does not come from a trusted source." It will not let me get my emails. Is this a problem with Thunderbird or Charter (Spectrum) I am able to receive email on my I Phone. I do not know which Thunderbird version and can't find it using your instructions. Help please

When i try to update my schooles secure mail, i get the nev certifikat and the Root, and Ca1 under autoreties and give it the right rights but it keeps giving me this error message " Certificate verification failed with the following error: The peer's certificate issuer is unknown. (Error code: SEC_ERROR_UNKNOWN_ISSUER)"

Email not working on my desktop. Using Edge 11, Settings show certificate for mobile.charter.net:993 does not come from a trusted source. I can not send or receive email on my desktop. This started this morning. I have not made any changes to my computer, but did do an Edge update. I can check my email on my cellphone if there is a fix.

I am using Thunderbird 151.0.1 (64-bit), and I get the "trusted source" message in a pop-up every time Thunderbird checks for email. There is only an option to Dismiss presented. My account name changes color to red and has a red triangle with an exclamation mark displayed. I went to Settings > Privacy & Security > Security > Certificates > Manage Certificates and looked at all the certificates listed in the Certificate Manager > Authorities (which is the only section with anything listed) and don't see anything from mobile.charter.net. I can go to SPECTRUM.NET (Charter) and view my email with no problems. I'm at a loss as to be able to view my email in Thunderbird.

We have used mobile.charter,net for our emails since we signed up for your product. Now my husband gets the mobile.charter.net "certificate is not from a trusted source" error when Modzilla is retrieving emails. I have the same email provider, and do not get the error message from Modzilla. Can you help us correct this problem?

I am unable to download email for my Bell email accounts. For one of the two Bell accounts all messages disappeared. I get an error message saying saying the server's certificate is invalid.

I recently obtained a digital certificate for use with S/MIME. I followed the process laid out in

https://support.mozilla.org/en-US/kb/instructions-smime-certificate-using-csr

to generate my key pair, create a CSR, submit it to a CA, download the resulting certificate file, and import it into Thunderbird. I also imported the intermediate certificate showed as the issuer for my cert, which in turn appears to be signed by one of the certs trusted by default in Thunderbird.

Having done that, I see the certificate showing up under "your certificates" in the Certificate Manager, with a "not before" date in the past and a "not after" date in the future. So everything appears to look correct, but when I try to send a signed email I get the following error message as a pop-up:

"Sending of the message failed. You specified that this message should be digitally signed, but the application either failed to find the signing certificate specified in your Mail & Newsgroup Account Settings, or the certificate has expired."

And if I look at the console in developer tools I see:

"mailnews.send: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIMsgComposeSecure.beginCryptoEncapsulation]

   _startCryptoEncapsulation resource:///modules/MimeMessage.sys.mjs:488
   _writePart resource:///modules/MimeMessage.sys.mjs:536
   createMessageFile resource:///modules/MimeMessage.sys.mjs:82
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:147
   CompleteGenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6456
   GenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6372
   SendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6984
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1085
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1263
   goDoCommand chrome://messenger/content/globalOverlay.js:99
   oncommand chrome://messenger/content/messengercompose/messengercompose.xhtml:1
   openWindowPrompt resource:///actors/PromptParent.sys.mjs:75
   receiveMessage resource:///actors/PromptParent.sys.mjs:18
   openPrompt resource://gre/modules/Prompter.sys.mjs:1228
   openPromptSync resource://gre/modules/Prompter.sys.mjs:1071
   alert resource://gre/modules/Prompter.sys.mjs:1375
   alert resource://gre/modules/Prompter.sys.mjs:78
   fail resource:///modules/MessageSend.sys.mjs:358
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:157

MessageSend.sys.mjs:149:32

   createAndSendMessage resource:///modules/MessageSend.sys.mjs:149
   CompleteGenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6456
   GenericSendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6372
   SendMessage chrome://messenger/content/messengercompose/MsgComposeCommands.js:6984
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1085
   doCommand chrome://messenger/content/messengercompose/MsgComposeCommands.js:1263
   goDoCommand chrome://messenger/content/globalOverlay.js:99
   oncommand chrome://messenger/content/messengercompose/messengercompose.xhtml:1
   openWindowPrompt resource:///actors/PromptParent.sys.mjs:75
   receiveMessage resource:///actors/PromptParent.sys.mjs:18
   openPrompt resource://gre/modules/Prompter.sys.mjs:1228
   openPromptSync resource://gre/modules/Prompter.sys.mjs:1071
   alert resource://gre/modules/Prompter.sys.mjs:1375
   alert resource://gre/modules/Prompter.sys.mjs:78
   fail resource:///modules/MessageSend.sys.mjs:358
   createAndSendMessage resource:///modules/MessageSend.sys.mjs:157"

I can't make sense of the error message, since the certificate appears under "your certificates" in the certificate manager, and it does not appear to be expired. Can anyone suggest how to determine the root cause and fix it? Does it matter that the certificate is for a non-default identify I've added for the account in Thunderbird? Does it matter if the "common name" in the certificate doesn't match the "Your Name" field in Thunderbird? Any pointers on what to check would be appreciated.

Receiving emails was no problem, but when sending one I was repeatedly asked for my password. I did check the save password in the dialog box. I checked the account settings and saw a yellow alert next to certificate exception and clicked on remove. That apparently was a mistake because now I can't get into email since the security certificate is not valid. Reinstalling Thunderbird may be needed, but I need some advice before I try anything else.