Zonke iiMveliso Community Forum

I am trying to send an S/MIME encrypted email from Thunderbird to:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The recipient certificate is provided by the official certificate directory of the German Federal Employment Agency (Bundesagentur für Arbeit).

I downloaded the recipient certificate and successfully imported it into Thunderbird under:

Settings → Privacy & Security → Certificates → Manage Certificates → People

The certificate is displayed correctly there. The email address contained in the certificate is:

jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de

The certificate is valid from July 29, 2026 to July 29, 2028 and includes E-mail Protection and Key Encipherment.

The required CA certificates are also installed:

BA-Class-1-Root-CA-4:PN BA-VPS-CA-11:PN

However, when I compose an encrypted email to this exact address, Thunderbird reports:

“You have selected to encrypt this message, but the application failed to find an encryption certificate for jobcenter-chemnitz.netzwerkpartner@jobcenter-ge.de.”

Under S/MIME → Recipient Certificates, Thunderbird also shows the certificate as “Not found”.

I have already tried:

deleting and re-importing the recipient certificate completely restarting Thunderbird after importing it manually typing the recipient address in lowercase without using autocomplete checking the complete CA certificate chain temporarily disabling OCSP

None of these changed the result.

My own personal S/MIME certificate works correctly. As a test, I can compose an encrypted email to my own email address without any certificate error. Therefore, the basic S/MIME configuration and my own certificate appear to be working.

When I reproduce the problem with the Thunderbird Error Console open, I get:

NS_ERROR_ILLEGAL_VALUE (0x80070057)

related to:

nsIMsgComposeSecure.beginCryptoEncapsulation

This seems similar to Mozilla Bug 2021265, where a manually imported recipient certificate is visible in Certificate Manager but is not found when composing an encrypted message.

Is this a known issue in Thunderbird 140 ESR, and is there a workaround for using this manually imported recipient certificate?

Firefox new today stopped from loading some of my own websites that are http. Some http sites still work. Sends me to my hosting site https://www.forexample.org/login_up.php Cleared all history and caches. No change. Turned off http to https. No change. Again, just started today with no other changes on my part.

I have been using the site codeskulptor.org for years. Creating images and saving them easily. Lately I have been getting a little shield with a red cross thru it up in the front of the url bar for the page images i wish to save but am not able to as easily as before. I would like Mozilla to approve the pages i spin off as images in new tabs from codeskulptor.org.

Thank you, Ben Winsor

OpenKeychain is a free and open-source Android app that implements the OpenPGP standard. It lets you manage cryptographic keys and use them to encrypt, decrypt, sign, and verify text, files, and messages so that only the intended recipients can read them and so that authenticity can be checked.

It is no longer actively developed for new features (maintenance mode with security fixes only), though a maintained hard fork called OpenKeyRing exists that continues development and adds features such as S/MIME support.

Hi, I’ve been using Thunderbird Desktop for years with S/MIME encryption. Since S/MIME is not currently supported in Thunderbird Mobile, I can’t use it on my mobile device.

Is S/MIME support planned for a future release?

Thanks.

Hallo, my setup is some server (keycloak) with mTLS needing keypairs just for allowance for the machines in the enterprise. But as far as i know, i need to setup personal keypairs for the users, not just the machines. How do i push a ".p12" keypair into the browsers trust stores? Is there a way via GPOs? As far as i have read the https://firefox-admin-docs.mozilla.org/reference/policies/, there is no support for ".p12" files?

The only way i got told from AI is via a script. If i could just stuff that ".p12" file into some place in the GPO, i would be perfectly happy... (?)

In Plain English how to use and secure encryption on all outgoing emails please and whether or not to use this great advantage. Many thanks to all those who contribute to this work, PB

Hi,

I have exported a from my Debian linux GnuPG private ed25519 keyring a private armor format private.asc file for upload into my mobile OpenKeyChain (showing healthy) and imported on my mobile thunderbird version 21.1 the private key from OpenKeyChain.

When receiving an encrypted email, my thunderbird PC version decrypts while my Mobile thunderbird show an error in decryption operation: I can read encrypted email on my PC, not on my mobile.

When I send a encrypted message From my mobile TB exact identical key to another of my email addresses, the email received into my mobile TB is automatically showing decrypted. This email is also decrypted on my PC thunderbird.

The TB account on both devices are the same. The private key is the same. The email provider is the same. The email addresses are identities of the the same key.

I have had this problem before. I have resolved this in the past and can no longer figure out how.

Any intuition? cheers.

Firefox for Android has a Custom Tabsl browser for apps to use fdor in app browsing. When clicking on the top the site security symbol while in an app using the cusotm tabls it will open up custom tabs with an address bar instyead of just displaying the security certificate details. This is a bug and should not happen. It should NOT hamper the in app experience. If somebody clicks ont he certificate details it should show up as a popup like Fireox focus does and all other custom tab browsers. Please fix.

Please see attached images that show my settings for DNS over HTTPS set to cloudflare (default) i have to add exceptions to this for multiple sites that do not open. these websites either show me SSL errors or they completely stop opening entirely. what could be the issue here? the websites open completely fine once i turn off this feature or use another browser.

Suddenly this week all links from/for various sources/websites have stopped working in Firefox: "Error Code: SSL_ERROR_RX_RECORD_TOO_LONG".

Links from common trusted sources that I access regularly no longer work. All display the same error message seen above. So it seems like a change by Firefox and not the websites. New York Times Economist USAA Comcast

Recent Mozilla/Firefox Update installed & restarted

MacBook Air macOS 15.77 (24G720)

Can't get onto national-lottery.co.uk site. Error code: SSL_ERROR_NO_CYPHER_OVERLAP But am using latest Firefox (152.0.6) Solution in no-technical language please...

https not recognized by Firefox in 151 Thunderbird on silicon iMac with Sonoma. Tried & checked many solutions with no results.

Firefox browser primary , always Nothing in Modified Important Preferences With Extensions off still a problem

Receive popup message: The certificate for mobile.charter.net does not come from a trusted source. In trying to send email, popup message: Sending the email failed. Peer's Certificate issuer is not recognized. The configuration related to mobile.charter.net must be corrected. Then it wants me to Add Security, Get Certificate.

Hi

I have a problem with Thunderbird which might be a bit niche but here goes...

The first attempt at sending an email fails as TLS Record Layer v1 is used, the mail server sees this and hard resets the connection so sending halts. See attached Wireshark trace screenshot "Failed".

If I retry the send again Thunderbird uses TLS Record Layer v1.3 and the email goes out ok. See attached Wireshark trace screenshot "Success".

If I send another message immediately no problem but if I wait 20-30 minutes the above cycle happens again.

I have set the minimum TLS version in the config to 1.3 (option 4) and restarted Thunderbird but this has not changed anything.

Any ideas how I can fix this? It's a pain because automated replies don't work.

Hi,

I have successfully added my personal certificate in my account's E2EE and I can ever since digitally sign messages. Yay! After importing a multiple valid certificates for recipients, I tried to send encrypted emails to some of these (one recipient per email draft). All of them highlight the recipient's address in yellow with a yellow status bar: "End-to-end encryption requires resolving certificate issues for [recipient address]"

Clicking on the button "S/MIME" -> "View Certificates Of Recipients", a window comes up showing the address with the status "Not found". When I open "Settings -> Privacy & Security -> Certificate Manager", I see the certificates present with valid dates. Using certutil to investigate cert9.db in Thunderbird's profile folder, I also see the certificates being in there, but what struck me was the trust status: [...] Fingerprint (SHA-256):

       7B:DF:9F:28:F2:B4:42:5E:37:06:EE:B8:D6:22:0C:70:12:05:F8:33:26:10:5A:1C:03:21:65:2A:C0:C3:3F:5E
   Fingerprint (SHA1):
       56:43:79:93:41:E0:8B:16:0A:FC:64:3E:74:B6:6F:F8:4E:67:93:D4

   Mozilla-CA-Policy: false (attribute missing)
   Certificate Trust Flags:
       SSL Flags:
       Email Flags:
       Object Signing Flags:

I changed the Trust flags (first for emails, then for SSL email) by running certutil -M -n <recipient's email addresss> -t ",P," -d <certdir>

This lead to

Fingerprint (SHA-256):
       7B:DF:9F:28:F2:B4:42:5E:37:06:EE:B8:D6:22:0C:70:12:05:F8:33:26:10:5A:1C:03:21:65:2A:C0:C3:3F:5E
   Fingerprint (SHA1):
       56:43:79:93:41:E0:8B:16:0A:FC:64:3E:74:B6:6F:F8:4E:67:93:D4

   Mozilla-CA-Policy: false (attribute missing)
   Certificate Trust Flags:
       SSL Flags:
       Email Flags:
           Terminal Record
           Trusted
       Object Signing Flags:

Whils I am not sure if this makes any difference to my beforementioned problem, I realize "Mozilla-CA-Policy: false (attribute missing)". How can I address this missing attribute and what can I do to get my emails encrypted, please?