I have client certificates for my email addresses from cacert.org and I have successfully stored themn as PKCS12 files and used them to sign emails in Thunderbird.
However, when someone uses my signed emails to send me an encrypted response, I can't decrypt them. Thunderbird tells me I have no private key, and come to think of it, I never made one in the process. Although, it would seem strange to me if the CA would send me the private key, that seems a bit unlikely.
Since only I can make the private key, and since the CA gives me the certificate, how do I create a matching key for the cert? What strikes me as weird is that I really shouldn't be able to do it this way, I think. Shouldn't I have a private-public key pair and have my public key certified?
I'm on Linux (Ubuntu Precise), and I have used
openssl before, in different contexts. A general explanation that extends to more than just my setup would be appreciated.