How can I connect a PGP certificate to an email address in Thunderbird?

Question

Is it possible to assign a public key from your key manager to a particular email address so that Thunderbird 78.6.0 automatically uses that key to encrypt when that email address is in the "To" field?

I want Thunderbird (later abbreviated TB) to encrypt an email to my friend, firstname@domain.com. I have a certificate for him which is assigned to his name, firstname, but the certificate doesn't have an email setting. While I ran enigma, I could choose the certificate to use when I sent an email and Enigma (IIRC) would ask if I'd like to make this assignment permanent (a "per-recipient" certificate assignment or something like that). I'd often say NO and then have to select the cert manually next time also.

After I compose an email to firstname, Thunderbird first says "Unable to send this message with end-to-end encryption, because there are problems with the keys of the following recipients: firstname@domain.com ... OK?"

OK! (I click) and then it says "In order to send... you must obtain and accept..." and doesn't even present the list of certs (which I have already obtained and accepted) so that I can choose one. It lists the recipient (there's only firstname@domain.com) and I can select it and click "Manage Keys for selected recipient." There are no keys to manage, and no clue as to how one (which is already in my certificate list) can be selected!

Perhaps I am blind, or maybe when they built Enigma right into Thunderbird, they made some bad assumptions or forgot to include this feature. How do I tell Thunderbird that firstname@domain.com should use the certificate that I already have for firstname?

Answer 1

You can do that with recipient key aliases for email or domain rules since Thunderbird v78.9.1.

There's a documentation entry on how to do this in the Mozilla Wiki (Archive, Wayback Archive). I quote:

Set preference mail.openpgp.alias_rules_file to an empty string (default) to disable the use of aliases. To use a file that you have manually copied to the profile directory, enter its filename without a path (e.g. openpgp_alias_to_keys.json, no / or \ characters are allowed). To use a file that is stored elsewhere on your system, you may enter a full file:// URL.

The file that you manually edit must follow this structure:

 {
   "description": "Thunderbird OpenPGP Alias Rules",
   "rules": [
     {
       "domain": "domain1.example.com",
       "keys": [
         {
           "description": "Catch-all for domain1.example.com",
           "fingerprint": "EB85BB5FA33A75E15E944E63F231550C4F47E38E"
         }
       ]
     },
     {
       "domain": "domain2.example.com",
       "keys": [
         {
           "description": "domain2.example.com folks",
           "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330"
         }
       ]
     },
     {
       "email": "list@domain1.example.com",
       "keys": [
         {
           "description": "John",
           "fingerprint": "D1A66E1A23B182C9980F788CFBFCC82A015E7330"
         },
         {
           "description": "Eve",
           "id": "F231550C4F47E38E"
         }
       ]
     }
   ]
 }

Note that descriptions are optional.