5

Is it possible to assign a public key from your key manager to a particular email address so that Thunderbird 78.6.0 automatically uses that key to encrypt when that email address is in the "To" field?

I want Thunderbird (later abbreviated TB) to encrypt an email to my friend, [email protected]. I have a certificate for him which is assigned to his name, firstname, but the certificate doesn't have an email setting. While I ran enigma, I could choose the certificate to use when I sent an email and Enigma (IIRC) would ask if I'd like to make this assignment permanent (a "per-recipient" certificate assignment or something like that). I'd often say NO and then have to select the cert manually next time also.

After I compose an email to firstname, Thunderbird first says "Unable to send this message with end-to-end encryption, because there are problems with the keys of the following recipients: [email protected] ... OK?"

OK! (I click) and then it says "In order to send... you must obtain and accept..." and doesn't even present the list of certs (which I have already obtained and accepted) so that I can choose one. It lists the recipient (there's only [email protected]) and I can select it and click "Manage Keys for selected recipient." There are no keys to manage, and no clue as to how one (which is already in my certificate list) can be selected!

Perhaps I am blind, or maybe when they built Enigma right into Thunderbird, they made some bad assumptions or forgot to include this feature. How do I tell Thunderbird that [email protected] should use the certificate that I already have for firstname?

2
  • I am sorry but I really can't understand what you are saying, your question isn't clear so it would be hard to answer, please edit your question and make it clear so that we can understand it and help you. Jan 10, 2021 at 7:06
  • Done, thanks for pointing it out. I don't know what part was unclear so my editing was kind of light. The question was at the end and is now a little bit clearer, I think. Jan 11, 2021 at 0:21

1 Answer 1

4

You can do that with recipient key aliases for email or domain rules since Thunderbird v78.9.1.

There's a documentation entry on how to do this in the Mozilla Wiki (Archive, Wayback Archive). I quote:

Set preference mail.openpgp.alias_rules_file to an empty string (default) to disable the use of aliases. To use a file that you have manually copied to the profile directory, enter its filename without a path (e.g. openpgp_alias_to_keys.json, no / or \ characters are allowed). To use a file that is stored elsewhere on your system, you may enter a full file:// URL.

The file that you manually edit must follow this structure:

 {
   "description": "Thunderbird OpenPGP Alias Rules",
   "rules": [
     {
       "domain": "domain1.example.com",
       "keys": [
         {
           "description": "Catch-all for domain1.example.com",
           "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E"
         }
       ]
     },
     {
       "domain": "domain2.example.com",
       "keys": [
         {
           "description": "domain2.example.com folks",
           "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330"
         }
       ]
     },
     {
       "email": "[email protected]",
       "keys": [
         {
           "description": "John",
           "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330"
         },
         {
           "description": "Eve",
           "id": "F231550C4F47E38E"
         }
       ]
     }
   ]
 }

Note that descriptions are optional.

1
  • Thank you very much, and +1. Great answer, precise and absolutely correct. Saved me a lot of hassle, because Google didn't list the link to the Mozilla article. Note to others: If it doesn't work at first, double check that you don't have a comma leftover in the JSON file after you have removed the superfluous entries :-)
    – Binarus
    Jun 23, 2023 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .