Windows 10 已于2025年10月14日停止支持。如果您正在使用 Windows 10，参见 这篇文章。

Windows 10 reached EOS (end of support) on October 14, 2025. If you are on Windows 10, see this article.

Avatar for Username

搜索 | 用户支持

防范以用户支持为名的诈骗。我们绝对不会要求您拨打电话或发送短信，及提供任何个人信息。请使用“举报滥用”选项报告涉及违规的行为。

详细了解
话题已存档。 如果需要帮助请提出新问题。
Solved 已存档

Thunderbird saved/cached private key that I want to delete

Thunderbird 隐私与安全
Jacek Bilski 已回复
Jacek Bilski
Jacek Bilski

I'm using an SSL certificate to sign and encrypt my mail. It was working OK. Then I bought myself a security key with a smartcard functionality (YubiKey 5) and moved my private key there. I also installed another "security device" using OpenSC and through that I can see, that there is indeed my certificate on this smartcard. The problem is that when I first decrypt a mail with this key, remove the security key from USB and restart Thunderbird, I can now encrypt, decrypt and sign mails as if I had my smartcard in USB port. So the whole security idea goes completely away.

I'm looking at my key4.db file, which looks like it contains still my private key, or at least traces of certificate (if I look inside using text editor). SQLite3 is also showing some inserts. I found out about certutil and tried to take a peek inside this key4.db, but it asks me for a password which I don't have.

What am I doing wrong? What did I miss? How can I remove from Thunderbird all traces of this private key and force it to ask me for this smartcard?

I'm using an SSL certificate to sign and encrypt my mail. It was working OK. Then I bought myself a security key with a smartcard functionality (YubiKey 5) and moved my private key there. I also installed another "security device" using OpenSC and through that I can see, that there is indeed my certificate on this smartcard. The problem is that when I first decrypt a mail with this key, remove the security key from USB and restart Thunderbird, I can now encrypt, decrypt and sign mails as if I had my smartcard in USB port. So the whole security idea goes completely away. I'm looking at my key4.db file, which looks like it contains still my private key, or at least traces of certificate (if I look inside using text editor). SQLite3 is also showing some inserts. I found out about certutil and tried to take a peek inside this key4.db, but it asks me for a password which I don't have. What am I doing wrong? What did I miss? How can I remove from Thunderbird all traces of this private key and force it to ask me for this smartcard?

所有回复 (2)

sfhowes
sfhowes

选择的解决方案

I think you need to remove cert9.db, and possibly the obsolete cert8.db, together with key4.db (and obsolete key3.db).

http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Thunderbird#Saved_passwords

http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird

Jacek Bilski
Jacek Bilski 提问者

OK, the method was a bit brutal, because, as expected, I had to enter all passwords to all accounts again, but now it does seem to finally work like expected.

Thanks