Why are you trying to use a self signed certificate for you email? How is the receiving party to determine your certificate is anything but bad?

I think you probably need to install enigmail if you want to issue your own certificates.

Matt said

Why are you trying to use a self signed certificate for you email? How is the receiving party to determine your certificate is anything but bad? I think you probably need to install enigmail if you want to issue your own certificates.

Sorry, the certificate is just a development test. I'm not actually concerned about trust in this certificate.

I am no expert, but I do not think Thunderbird will accept a self signed certificate for the purpose of s/mime. You would need certifying authority and intermediate certificates for the email cert at the very least.

Just go to comodo and get a free personal use one for your development requirements.

Looking at my own signing certificates, they appear to be PKCS12.

Matt said

I am no expert, but I do not think Thunderbird will accept a self signed certificate for the purpose of s/mime. You would need certifying authority and intermediate certificates for the email cert at the very least. Just go to comodo and get a free personal use one for your development requirements. Looking at my own signing certificates, they appear to be PKCS12.

Are you sure I can't use a self-signed certificate? Because that does not make sense at all for me. When you are browsing you have an icon which lets you know if the server's certificate is valid or not, but it won't prevent you from connecting right away. It should advice the recipient that the certificate is expired/invalid/self-signed/whatever but why shouldn't it be allowed? And more importantly, why wouldn't it throw a more descriptive error?

I appreciate your answer but I can't use PKCS12 certificate, I need to use PKCS11 provider.

Thanks.

I'm trying to add a certificate through PKCS11 in order to digitally sign emails in Thunderbird.

What exactly are you trying to achieve? Accessing a cert (and private key) on a smartcard through a PKCS11 interface, or importing a cert and private key stored in a PKCS12 file into the Thunderbird certificate store? Also see https://kbdeveloper.qoppa.com/difference-between-pkcs11-and-pkcs12/

When you are browsing you have an icon which lets you know if the server's certificate is valid or not,

That alone would be pretty much useless. The whole point of using a cert is to assure that it has been issued by a CA you trust.

christ1 said

I'm trying to add a certificate through PKCS11 in order to digitally sign emails in Thunderbird.

What exactly are you trying to achieve? Accessing a cert (and private key) on a smartcard through a PKCS11 interface, or importing a cert and private key stored in a PKCS12 file into the Thunderbird certificate store? Also see https://kbdeveloper.qoppa.com/difference-between-pkcs11-and-pkcs12/

Hello christ1.

What I'm trying to achieve is Thunderbird digitally signing an email with a cert stored in a device accessed through PKCS11. I know the difference between PKCS11 and PKCS12. I'm not trying to store the cert, I'm creating the cert inside the security device and trying to use it through PKCS11.

I can do this with Firefox, and I can successfully manage certificates inside Thunderbird after I added my security device, the point is that I can't just select it to digitally sign.

When you are browsing you have an icon which lets you know if the server's certificate is valid or not,

That alone would be pretty much useless. The whole point of using a cert is to assure that it has been issued by a CA you trust.

My point is that there's no need to directly block it. Why wouldn't you want to decide yourself whether you want to trust a certain certificate or not?

Regards.

As a test, can you try to create a keypair outside of the security device. Then generate the cert as before, and import the cert and private key in PKCS12 format into the Thunderbird certificate store. Can you use the cert for signing?

If so, delete the cert from the Thunderbird certificate store. Import the cert and private key into your security device. Connect the security device, so that Thunderbird can access it. Can you use the cert for signing now?

Why wouldn't you want to decide yourself whether you want to trust a certain certificate or not?

Typically you can do that by creating a security exception. I don't think the problem here is your self-signed cert. I was simply responding to your statement about 'an icon which lets you know if the server's certificate is valid or not'. Even if a cert is valid, it isn't necessarily one you should trust.

Does this problem sound similar to yours? https://support.mozilla.org/en-US/questions/1205284

I've already managed to get it working. I'm not sure if it's due to some changes on the PKCS11 provider or just restarting Thunderbird, but I can do what I expected now.

Thanks for your replies anyway.

Best regards.

When your problem is fixed, can you mark the topic as 'Solved' please? Thank you.