Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I exported my CA chain (Deutsche Telekom > DFN > Uni Koeln) using

smime_keys add_root CertName.cer

after exporting the relevant certificates from my keychain. But when I import my personal certificate issued by Uni Koeln using

smime_keys add_p12 MyCertName.p12

the following error occurs

Couldn't identify root certificate!
No root and no intermediate certificates. Can't continue. at /usr/local/bin/smime_keys line 669.

although the imported root certificates are present in ~/.smime/ca-bundle.crt and .muttrc points to that file for trusted certificates.

What's going on here?

share|improve this question
For your key-cert pairs, you need an unbroken chain of certs all the way up to the CA. It's possible the CA you chose is not in your ca-bundle.crt file. – JeffG Sep 26 '11 at 19:09
I made sure to import the root and all intermediate CA certs into ca-bundle.crt. – janeden Sep 27 '11 at 8:08
up vote 2 down vote accepted

My problem was related to Apple's Keychain Access app.

If a certificate request is created in Safari, the private key is stored in the OS X login keychain. The public key can be downloaded subsequently using Safari as a file named pki, which can be imported to the login keychain using Keychain Access. When exporting the certificate, the certficate chain (CA, intermediate CA, root CA) is not included in the PKCS#12 file (which causes the error message). Of course, you could manually export all the elements of your certificate chain and merge them using e.g. OpenSSL.

But it is much easier to create certificate requests in Firefox and export ("backup") the complete certificate from this browser. A PKCS#12 file from Firefox can be imported using smime_keys without further ado.

Summary: I created ~/.smime and copied some trusted CA certs to this directory (~/.smime/ca-bundle.crt). To import my personal certificate, I executed smime_keys add_p12 cert.p12, then added the following lines

set smime_is_default
set smime_default_key="foobar"

to my ~/.muttrc, where "foobar" is the key ID returned for my personal cert by smime_keys list.

share|improve this answer
It would be awesome if you could add details on how you achieved this. – Keith Smiley Mar 10 '14 at 22:53
Sure, I updated the answer with configuration details. – janeden Mar 18 '14 at 8:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.