602221 - Unable to X.509 encrypt to myself or decrypt messages sent to me using my certificate

Status: RESOLVED INCOMPLETE

(Thunderbird :: Security, defect)

Description

[alphazo]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.536.2 Safari/534.10
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.9) Gecko/20100928 Lightning/1.0b2 Mnenhy/0.8.3 Lanikai/3.1.4

I use a class 3 X.509 certificate from CACert (stored in Software Security Device at the moment). Both Class 1 and Class 3 root CA have been manually imported and set as trusted in TB's keystore. 
I can sign my outgoing emails without problem. However I cannot either encrypt to myself or decrypt email sent by others (using my public key certificate).

Reproducible: Always

Steps to Reproduce:
- When I put not recipient in the email and hit S/MIME encrypt and then Save, I can see the email in my Draft folder. However when I click on it it says:
Lanikai cannot decrypt this message

The sender encrypted this message to you using one of your digital certificates, however Lanikai was not able to find this certificate and corresponding private key.
Possible solutions:

    * If you have a smartcard, please insert it now.
    * If you are using a new machine, or if you are using a new Lanikai profile, you will need to restore your certificate and private key from a backup. Certificate backups usually end in ".p12".

- If I put a friend's email address that I received a signed email from, I can click on S/MIME and it shows that this person has been found. Email can be sent and it is encrytped. However I couldn't not decrypt the sent email in my outbox and could not decrypt the email my friend sent back in an encrypted form.

- If I put my own email addres and hit S/MIME, TB says that my email address is not found and therefore it cannot encrypt.
Actual Results:  
Unable to decrypt email even with fully trusted certificate and associated private key.

Comment 1

[Ludovic Hirlimann [:Usul]]

is the email embedded in the certificate the one you are actually using to send/receive emails ?

Anything in tools -> Error console when this happens ?

Does it work better in -safe-mode (http://support.mozillamessaging.com/en-US/kb/Safe+Mode) ?

Comment 2

[Wayne Mery (:wsmwk)]

alphazo ?


(In reply to Ludovic Hirlimann [:Usul] from comment #1)
> is the email embedded in the certificate the one you are actually using to
> send/receive emails ?
> 
> Anything in tools -> Error console when this happens ?
> 
> Does it work better in -safe-mode
> (http://support.mozillamessaging.com/en-US/kb/Safe+Mode) ?

Comment 3

[Phoenix]

Resolved per whiteboard