6

I created a certificate with OpenSSL and following commands:

openssl req   -x509 -nodes -days 365   -subj '/C=DE/ST=state/L=city/CN=hostname'   -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

openssl pkcs12 -export   -out mycert.pfx -in mycert.pem   -name "My Certificate"

And installed it with my Windows 7 machine. Then I tried to send an encrypted email and I got a message that there is no certificate matching my email address

What am I missing?


Edit 1

Thank you for those insights, Thomas. I added the email address but the message still pops up :-( I also read about a root certificate, do I need such thing?

  • I assume CN is sven@security.stackexchange.com rather than security.stackexchange.com? – logicalscope Feb 9 '12 at 14:35
  • CN is actually my username, while emailAddress is the email address. That's my setting but it doesn't work. – Sven Feb 9 '12 at 15:55
  • You should have put your edit as a comment to Thomas' answer instead, that way he would have been notified about it... You don't need a root certificate (it's useful if you want to create multiple certificates but require others to only verify&trust a single one). For email address you'll probably need the subjectAltName entry as well, here's how I solved that for multiple email addresses in one certificate. I don't know how to add the email:copy entry via the command line though – Tobias Kienzler Feb 6 '13 at 7:27
5

A certificate binds a public key to an identity. The notion of identity that S/MIME uses is email addresses. Namely, for your certificate to be usable with S/MIME, it should contain your email address.

The email address can be added in the subject name (simple but officially deprecated), like this:

openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=Sven/emailAddress=sven@svenisgreat.com' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

or (the "normal solution", but more complex) as part of a "Subject Alt Name" extension (with OpenSSL, this requires using the -extensions flag and a configuration file; see the documentation).

  • Sven forgot to comment on your answer and edited his question instead - I think the subjectAltName is mandatory even for certificates with only one email address – Tobias Kienzler Feb 6 '13 at 7:29
3

Do not use emailAddress, but subjectAltName instead. You can do this with a single command and without editing the openssl.cnf file:

openssl req -x509 \
    -newkey rsa:4096 \
    -sha256 \
    -nodes \
    -days 3650 \
    -keyout smime.key \
    -out smime.crt \
    -subj "/CN=Nobody" \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf; echo '[SAN]'; echo 'subjectAltName=email:nobody@example.com')

For more information, see: Provide subjectAltName to openssl directly on command line

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.