1235650 - Thunderbird does not trust certificate authority for Digital Signature

Status: RESOLVED INCOMPLETE

(Thunderbird :: Security, defect)

Description

[Germano Massullo (Thetra)]

Attachment: thunderbird.png

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20151210112434

Steps to reproduce:

Users of Republic of Estonia Digital Identity Card [1], can do many things with their smartcard, like digitally signing e-mail messages.
The autorithy that signs the certificates is [2], in particular, according to guide [3] any person who receives and/or sends e-mail digitally signed using that smartcard, must import certificates [4] and [5] and set them as trusted.

However, every person using Thunderbird, that receives my digitally signed e-mails, and that has imported the mentioned certificates, told me that Thunderbird states that the e-mail signature is issued by a non trusted authority (see attached screenshot).

I tried to follow the same procedure using Evolution e-mail client, and it works perfectly (see attached screenshots), so it must be a Thunderbird bug.

[1]: https://e-estonia.com/e-residents/about/
[2]: https://sk.ee/en/repository/certs/
[3]: http://www.id.ee/?id=34280
[4]: https://sk.ee/upload/files/ESTEID-SK_2007.pem.crt
[5]: https://sk.ee/upload/files/ESTEID-SK_2011.pem.crt

Comment 1

[Germano Massullo (Thetra)]

Attachment: Evolution 1.jpeg

Comment 2

[Germano Massullo (Thetra)]

Attachment: Evolution 2.jpeg

Comment 3

[Germano Massullo (Thetra)]

Attachment: Evolution 3.jpeg

Comment 4

[Kent James (:rkent)]

The error message indicates that the certificate does not have the email signing usage allowed. In my email signing certificate, under Details, Certificate Fields, Extensions, Certificate Key Usage I see "Signing" and under Extended Key Usage I see "E-mail protection (1.3.6.1.5.5.7.3.4)"  What do you see in those fields?

Comment 5

[Germano Massullo (Thetra)]

(In reply to Kent James (:rkent) from comment #4)
> The error message indicates that the certificate does not have the email
> signing usage allowed. In my email signing certificate, under Details,
> Certificate Fields, Extensions, Certificate Key Usage I see "Signing" and
> under Extended Key Usage I see "E-mail protection (1.3.6.1.5.5.7.3.4)"  What
> do you see in those fields?

+++CERTIFICATE KEY USAGE+++
Critical
Signing
Key Encipherment
Data Encipherment

+++EXTENDED KEY USAGE+++
Critical
TLS Web Client Authentication (1.3.6.1.5.5.7.3.2)
E-mail protection (1.3.6.1.5.5.7.3.4)

+++CERTIFICATE POLICIES+++
Not Critical
1.3.6.1.4.1.10015.1.2.4:
  User Notice: 
    none
  Certification Practice Statement pointer:
    http://www.sk.ee/cps/

Comment 6

[Wayne Mery (:wsmwk)]

Does this still occur in current version?

Comment 7

[Germano Massullo (Thetra)]

I don't know when I will have time to test it

Comment 8

[Wayne Mery (:wsmwk)]

Kaie, how do you want to proceed with this - keep, duplicate, close, ... ?

Comment 9

[Kai Engert [:KaiE:]]

Reporter, please create a signed email message to yourself. Then save the email message to a file, and attach it to the bug. (Feel free to remove headers from that message prior to attaching, like which gateway systems it traveled across.)

We need that message to confirm the bug is still present, or if it's not. Or, to understand why it's failing.

Are you able to do that? Without it, we might have to close this bug as incomplete.

Comment 10

[Phoenix]

Resolved per whiteboard

Comment 11

[Germano Massullo (Thetra)]

(In reply to Kai Engert (:KaiE:) from comment #9)

Reporter, please create a signed email message to yourself. Then save the email message to a file, and attach it to the bug. (Feel free to remove headers from that message prior to attaching, like which gateway systems it traveled across.)

How can I remove headers from an email saved as a file?

Comment 12

[Kai Engert [:KaiE:]]

(In reply to Germano Massullo from comment #11)

How can I remove headers from an email saved as a file?

You can use any text editor, eml files are plain text.