1

I am unable to send an encrypted email to someone for whom I have a valid certificate, but they recently moved to a new company. Outlook is refusing to encrypt the email because the email address inside the certificate does not match the address I want to send to. Outlook is also refusing to even add the person as a contact with the mismatched cert.

How can I override this behavior?

Platform is Outlook 2013 running on Windows 8.

One possibility I suppose would be to compose the encrypted email using some tool outside of Outlook, then mail the encrypted content via Outlook after the other tool has encrypted it.

Improve this question

2 Answers 2

Reset to default
4
+25

The article How to turn off e-mail matching for certificates in Outlook says this for Outlook 2013 :

When you send a secure message in Microsoft Outlook 2013 [..], you may need to use a certificate that does not match your e-mail address. This article describes how to turn off e-mail matching for certificates.

You can turn off e-mail address matching for certificates by editing your registry. To do this, follow these steps [..].

  1. Click Start, click Run, type regedit in the Open box, and then click OK.

  2. Locate the following registry key:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Security

  3. If a Security registry key does not exist, create a new key. To do this, follow these steps:
    a. Click the following registry key:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook
    b. On the Edit menu, point to New, and then click Key.
    c. Type Security, and then press Enter.

  4. Right-click the Security key, click New, and then click DWORD Value.

  5. Type SupressNameChecks, and then press Enter.

  6. On the Edit menu, click Modify.

  7. Type 1, and then click OK.

  8. On the Registry menu, click Exit.

Improve this answer
3
  • I am going to try this tomorrow.
    – Tyler Durden
    Nov 15, 2015 at 23:10
  • I tried this and it lets me get farther but then Outlook crashes. So what happens is that I click on the person's name (in the email with the mismatched certificate) and say "Add to Outlook Contacts", then it prompts me: "The email address in the certificate was not found in the recipient's email list. Do you still want to add the contact?" If you click Continue, Outlook crashes. I also tried manually adding the certificate to the contact record, but in this case Outlook refuses to send the email encrypted complaining about an "invalid certificate".
    – Tyler Durden
    Nov 16, 2015 at 23:14
  • Unfortunately, this seems to be the only official solution by Microsoft. From your experience, Outlook does implement code for handling it, but then you hit a bug and it crashes. I'm not sure that there is much to do beside notifying Microsoft of the bug and waiting patiently for a solution to arrive, or the problem might already be fixed in Outlook 2016 (you may test the trial version). Other email programs exist, principally Gmail and Thunderbird, although I really don't know how well they handle this case.
    – harrymc
    Nov 17, 2015 at 19:10
3

This is expected behaviour, though mostly for preventing gross misconfigurations. If a certificate could be associated with a contact with not matching mail address, things get broken quickly. (E.g., just let me alone for thirty seconds with your computer and I add my cert to your best friends contact without you noticing and henceforth can forge mails which you accept as undoubtedly coming from them - after all they have valid digital signatures).

Even if you succeeded, it is likely that the receiver does not have access to their previous private key (probably stored on the computer they had available at their old company)

Request a new certificate from the receiver, matching their new email address.

Improve this answer
2
  • I know the logic of WHY Outlook is enforcing the constraint. I want to know how to override it.
    – Tyler Durden
    Nov 9, 2015 at 20:56
  • 1
    @TylerDurden I assume you can't because the behaviour is expected. Though it seems harrymc's answer could prove me wrong - it is possible to make Outlook a piece of insecure software ...
    – Hagen von Eitzen
    Nov 15, 2015 at 22:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .