Self-signed encryption cert stopped working in Thunderbird 60.2.1
I've used a self-signed certificate for years to send and receive encrypted emails with family. I don't use Enigmail or PGP.
Somewhere near Thunderbird 60.2.1, this stopped working. When I try to send an email, Thunderbird reports:
"Sending of the message failed. You specified encryption for this message, but the application either failed to find the encryption certificate specified in your Mail & Newsgroup Account Settings, or the certificate has expired."
The certificate has not expired, and it can be found in the Certificate Manager. Viewing details it says "This certificate has been verified for the following uses: SSL Certificate Authority". I can't remember if this used to say something different.
The CA is my own generated CA called "self-signed".
Did something tighten down recently?
Chosen solution
gbell12 said
Matt saidI think the key is self signed certificates are not valid for encryption.Just recently? Because these same certs have been working for years.
I "sort of" follow certificate changes, but in all honesty most of it goes over my head. One of the reasons is the Thunderbird community use the Firefox certificate manager and store, so the developers never touch the stuff really. SO I try and follow it a bit, but usually the first we know about certificate changes are when something stops working.
I think perhaps this bug is relevant https://bugzilla.mozilla.org/show_bug.cgi?id=1485013 "The problem appears to that certs without the x509 v3 extensions cannot be added."
This might be relevant https://bugzilla.mozilla.org/show_bug.cgi?id=1475348
This is also in the current sort of timeframe. https://bugzilla.mozilla.org/show_bug.cgi?id=1122239
But given how easy it is to get a SSL/TLS certificate https://letsencrypt.org/ really is it worth messing around with self signed ones.
Read this answer in context 👍 0All Replies (7)
I should note that I've checked the release notes.
And in the message compose window, if I go Security->View Security Info, it does indeed show that the status is Invalid, but no indication as to why.
Modified by gbell12
References: https://bugzilla.mozilla.org/show_bug.cgi?id=531073 https://bugzilla.mozilla.org/show_bug.cgi?id=1321977
Modified by gbell12
I think the key is self signed certificates are not valid for encryption.
Matt said
I think the key is self signed certificates are not valid for encryption.
Just recently? Because these same certs have been working for years.
Chosen Solution
gbell12 said
Matt saidI think the key is self signed certificates are not valid for encryption.Just recently? Because these same certs have been working for years.
I "sort of" follow certificate changes, but in all honesty most of it goes over my head. One of the reasons is the Thunderbird community use the Firefox certificate manager and store, so the developers never touch the stuff really. SO I try and follow it a bit, but usually the first we know about certificate changes are when something stops working.
I think perhaps this bug is relevant https://bugzilla.mozilla.org/show_bug.cgi?id=1485013 "The problem appears to that certs without the x509 v3 extensions cannot be added."
This might be relevant https://bugzilla.mozilla.org/show_bug.cgi?id=1475348
This is also in the current sort of timeframe. https://bugzilla.mozilla.org/show_bug.cgi?id=1122239
But given how easy it is to get a SSL/TLS certificate https://letsencrypt.org/ really is it worth messing around with self signed ones.
According to http://kb.mozillazine.org/Getting_an_SMIME_certificate
"Let's Encrypt does not currently offer S/MIME certificates"
I grabbed 4 from comodo for all the people in my family, but unfortunately they expire in a year! When the "Greg CA" was acceptable to TBird, my certs had a 10-year expiry :)
Thanks for the info Matt.
I know the pain, as comodo is the last free S/mime certificate issuer I use them myself.
The only other option is enigmail and while I do not use it, it has become much more user friendly in recent years is my understanding. (at least you get to issue and revoke your own certificates.)