1753886 - S/MIME X.509 certificate validation fails

Status: UNCONFIRMED

(Thunderbird :: Security, defect)

Description

[Rufus Buschart]

Attachment: Error message in Thunderbird

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Edg/98.0.1108.43

Steps to reproduce:

In Thunderbird on OS X I open an email with an S/MIME signature that was created with the private key of a publicly trusted end-entity-certificate.

Actual results:

The S/MIME signature is displayed as "invalid". See attached screenshot.

Expected results:

The signature should be displayed as "valid", like it is on Outlookk for Windows or within GMail. See attached screenshot.

Ideally Thunderbird would display a message, why it considers a certificate as "invalid".

Comment 1

[Rufus Buschart]

Attachment: Valid in GMail

Comment 2

[Rufus Buschart]

Attachment: Certificate in Gmail

Comment 3

[Rufus Buschart]

Attachment: Certificate

Comment 4

[Rufus Buschart]

I have been able to reproduce this behavior also on an out-of-the-box Windows with Thunderbird.

Comment 5

[Rufus Buschart]

One additional update: if the S/MIME signature contains a full certificate chain, the signature is validated correctly, but if Thunderbird has to download the intermediate and issuing CAs from the AIPs it fails.

Comment 6

[Rufus Buschart]

Attachment: Repro NOT working with EE embedded.eml

Comment 7

[Rufus Buschart]

Attachment: Repro working with full CA chain embedded.eml

Comment 8

[Rufus Buschart]

Is there someone who could have a look in this issue?