7

I exported my CA chain (Deutsche Telekom > DFN > Uni Koeln) using

smime_keys add_root CertName.cer

after exporting the relevant certificates from my keychain. But when I import my personal certificate issued by Uni Koeln using

smime_keys add_p12 MyCertName.p12

the following error occurs

Couldn't identify root certificate!
No root and no intermediate certificates. Can't continue. at /usr/local/bin/smime_keys line 669.

although the imported root certificates are present in ~/.smime/ca-bundle.crt and .muttrc points to that file for trusted certificates.

What's going on here?

2
  • For your key-cert pairs, you need an unbroken chain of certs all the way up to the CA. It's possible the CA you chose is not in your ca-bundle.crt file.
    – JeffG
    Sep 26, 2011 at 19:09
  • I made sure to import the root and all intermediate CA certs into ca-bundle.crt.
    – janeden
    Sep 27, 2011 at 8:08

1 Answer 1

4

My problem was related to Apple's Keychain Access app.

If a certificate request is created in Safari, the private key is stored in the OS X login keychain. The public key can be downloaded subsequently using Safari as a file named pki, which can be imported to the login keychain using Keychain Access. When exporting the certificate, the certficate chain (CA, intermediate CA, root CA) is not included in the PKCS#12 file (which causes the error message). Of course, you could manually export all the elements of your certificate chain and merge them using e.g. OpenSSL.

But it is much easier to create certificate requests in Firefox and export ("backup") the complete certificate from this browser. A PKCS#12 file from Firefox can be imported using smime_keys without further ado.

Summary: I created ~/.smime and copied some trusted CA certs to this directory (~/.smime/ca-bundle.crt). To import my personal certificate, I executed smime_keys add_p12 cert.p12, then added the following lines

set smime_is_default
set smime_default_key="foobar"

to my ~/.muttrc, where "foobar" is the key ID returned for my personal cert by smime_keys list.

2
  • It would be awesome if you could add details on how you achieved this. Mar 10, 2014 at 22:53
  • Sure, I updated the answer with configuration details.
    – janeden
    Mar 18, 2014 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .