Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a certificate with OpenSSL and following commands:

openssl req   -x509 -nodes -days 365   -subj '/C=DE/ST=state/L=city/CN=hostname'   -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

openssl pkcs12 -export   -out mycert.pfx -in mycert.pem   -name "My Certificate"

And installed it with my Windows 7 machine. Then I tried to send an encrypted email and I got a message that there is no certificate matching my email address

What am I missing?

Edit 1

Thank you for those insights, Thomas. I added the email address but the message still pops up :-( I also read about a root certificate, do I need such thing?

share|improve this question
I assume CN is rather than – logicalscope Feb 9 '12 at 14:35
CN is actually my username, while emailAddress is the email address. That's my setting but it doesn't work. – Sven Feb 9 '12 at 15:55
You should have put your edit as a comment to Thomas' answer instead, that way he would have been notified about it... You don't need a root certificate (it's useful if you want to create multiple certificates but require others to only verify&trust a single one). For email address you'll probably need the subjectAltName entry as well, here's how I solved that for multiple email addresses in one certificate. I don't know how to add the email:copy entry via the command line though – Tobias Kienzler Feb 6 '13 at 7:27

A certificate binds a public key to an identity. The notion of identity that S/MIME uses is email addresses. Namely, for your certificate to be usable with S/MIME, it should contain your email address.

The email address can be added in the subject name (simple but officially deprecated), like this:

openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=Sven/' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

or (the "normal solution", but more complex) as part of a "Subject Alt Name" extension (with OpenSSL, this requires using the -extensions flag and a configuration file; see the documentation).

share|improve this answer
Sven forgot to comment on your answer and edited his question instead - I think the subjectAltName is mandatory even for certificates with only one email address – Tobias Kienzler Feb 6 '13 at 7:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.