6

I created a certificate with OpenSSL and following commands:

openssl req   -x509 -nodes -days 365   -subj '/C=DE/ST=state/L=city/CN=hostname'   -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

openssl pkcs12 -export   -out mycert.pfx -in mycert.pem   -name "My Certificate"

And installed it with my Windows 7 machine. Then I tried to send an encrypted email and I got a message that there is no certificate matching my email address

What am I missing?


Edit 1

Thank you for those insights, Thomas. I added the email address but the message still pops up :-( I also read about a root certificate, do I need such thing?

3
  • I assume CN is [email protected] rather than security.stackexchange.com? Feb 9, 2012 at 14:35
  • CN is actually my username, while emailAddress is the email address. That's my setting but it doesn't work.
    – Sven
    Feb 9, 2012 at 15:55
  • You should have put your edit as a comment to Thomas' answer instead, that way he would have been notified about it... You don't need a root certificate (it's useful if you want to create multiple certificates but require others to only verify&trust a single one). For email address you'll probably need the subjectAltName entry as well, here's how I solved that for multiple email addresses in one certificate. I don't know how to add the email:copy entry via the command line though Feb 6, 2013 at 7:27

2 Answers 2

5

A certificate binds a public key to an identity. The notion of identity that S/MIME uses is email addresses. Namely, for your certificate to be usable with S/MIME, it should contain your email address.

The email address can be added in the subject name (simple but officially deprecated), like this:

openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=Sven/[email protected]' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

or (the "normal solution", but more complex) as part of a "Subject Alt Name" extension (with OpenSSL, this requires using the -extensions flag and a configuration file; see the documentation).

1
  • Sven forgot to comment on your answer and edited his question instead - I think the subjectAltName is mandatory even for certificates with only one email address Feb 6, 2013 at 7:29
3

Do not use emailAddress, but subjectAltName instead. You can do this with a single command and without editing the openssl.cnf file:

openssl req -x509 \
    -newkey rsa:4096 \
    -sha256 \
    -nodes \
    -days 3650 \
    -keyout smime.key \
    -out smime.crt \
    -subj "/CN=Nobody" \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf; echo '[SAN]'; echo 'subjectAltName=email:[email protected]')

For more information, see: Provide subjectAltName to openssl directly on command line

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .