A recent Thunderbird release (somewhere between 27 and 31) broke my self-signed CA's which were used to vouch for my self-signed keys.

I use self-signed certificates for communicating with family. They have worked for years.

Now, a signed message comes in with the sealed envelope icon like this:

tbird sealed envelope with red cross

Clicking on it yields:

message about cert not being trusted for this sort of thing

If I view the certificate, I see:

certificate details showing it's OK

So it seems to be trusted as a CA.

Another symptom: When I go to mail the user who owns the self-signed private key who counts on that self-signed CA, I get "Didn't find certificates for all recipients, disable encrypt message?"

Again, all of this worked fine before the upgrade.

  • Are you looking at messages that are using old certificates? (From screen shots looks like prior to 2/14/14) – No Time Sep 10 '14 at 5:02
  • I wasn't needing new certs, I was needing Tbird to be OK with my old ones... at least I didn't think I needed new ones. See the answer below. – Greg Bell Sep 10 '14 at 6:12

Goodness, well, that was painful. Hours gone!

As Thunderbird says, it is trusting that CA to vouch for SSL certs... ONLY SSL certs!

There are options in openssl.cnf for "keyUsage" and "extendedKeyUsage". But I wasn't able to get these to be recognized in /etc/ssl/openssl.cnf.

Using openssl x509 -in mykey.crt -text I was not able to verify if this setting was doing anything.

The trick is to make a local one, called basic.cnf:

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
prompt                 = no

[ req_distinguished_name ]
C                      = {Country}
ST                     = {Provice/State}
L                      = {City}
O                      = {Org}
OU                     = {Org Unit}
CN                     = user@domain.com
emailAddress           = user@domain.com

Probably can be even more stripped down that that. Apparently the default one packaged with Ubuntu 14.04 is limiting the uses of the key. Because with this, I can use my usual incantations to make keys and certificates, but with a new -config option to point to that stripped down config file:

openssl genrsa -des3 -out ${KEYNAME}_private.pem 1024 -config basic.cnf
openssl req -new -key ${KEYNAME}_private.pem -out ${KEYNAME}.csr
openssl x509 -req -days 3650 -in ${KEYNAME}.csr -signkey ${KEYNAME}_private.pem -out ${KEYNAME}.crt
openssl pkcs12 -export -inkey ${KEYNAME}_private.pem -in ${KEYNAME}.crt -out ${KEYNAME}.p12

Then, importing the .crt into Thunderbird, I see this now:

enter image description here

And everything's happy again (after importing the new keys, etc.)

| improve this answer | |
  • Shouldn't your basic.cnf example contain a keyUsage field? – Ángel Sep 10 '14 at 19:17
  • Didn't need it - can only assume that the default is for it to be "fully useful"? – Greg Bell Sep 11 '14 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.