803017 - Intermediate S/MIME certificate cannot be validated

Status: RESOLVED INVALID

(Thunderbird :: Security, defect)

Description

[u454259]

Attachment: Root CA (web.de)

I was experimenting with S/MIME certificates. My e-mail provider (web.de) issues X.509 certificates. They also provide a root CA and an intermediate CA for e-mail certificates.

Problem:
I can import both CAs to TB's "Authorities" cert tab. But only the root CA seems to be valid (and only if trust it to "identify websites"). The intermediate CA appears invalid, no matter which trust seetings are applied to it or to the root CA.
I'll attach both CA certs.

The certificate chain is perfectly fine, e.g. if I import them into Windows' certificate management.

Expected behavior:
Thunderbird accepts both CAs as valid and - in turn - accepts S/MIME certificats signed by them.

Comment 1

[u454259]

Attachment: Intermediate CA (web.de)

Comment 2

[u454259]

Attachment: Root CA (web.de)

Comment 3

[Ludovic Hirlimann [:Usul]]

Does it work if you switch security.enable_md5_signatures to true ?

Comment 4

[u454259]

Yes, it does. If set, the intermediate certificate is valid, as well as my private certificate.
Thank you.

Comment 5

[Mark Banner (:standard8)]

Adalbert, the fact the toggling the preference makes your certificate work, means that your email provider is using md5-based certificates.

md5-based certificates are widely agreed no longer to be secure, so you should contact your provider and request a non-md5 certificate immediately as their security is at significant risk.

Resolving as invalid, as this is an issue with the issued certificates rather than with Thunderbird.