I have a number of contacts who can only decrypt 3DES, when it comes to S/MIME encrypted mails. I'm aware that this is by far not ideal, but better than no encryption at all.

My problem is, that I can't find a way to force Thunderbird to use 3DES for specific mails. Thunderbird itself doesn't seem to have an option, so I've installed the Enigmail plug-in, which states in the FAQ:

Note that you can force usage of a specific symmetric algorithm by using the GnuPG option --cipher-algo, but this is not recommended; this option can easily break things and is intended for debug purposes only.

This sounds good, but the setting does not change a thing for me.

I've also asked on the mozilla support page and on the enigmail support page

I'm baffled that there's no obvious solution to this.

How can I force Thunderbird to use a specific encryption cipher for S/MIME encrypted mails?

  • An email client should automatically recognize the ciphers supported by the other client from a signed email. However 3DES is very old and I know it is not supported any more for security reasons by some clients since years. Not sure about Thunderbird though. The latest S/MIME 4.0 RFC marks 3DES as historic.
    – not2savvy
    Feb 12, 2020 at 10:13
  • That's correct. Replies usually work, but I frequently have to write new mails to such contacts. Feb 12, 2020 at 11:43
  • 1
    Even for a new mail, in order to encrypt Tbird must have and use the recipient's certificate -- which is usually obtained from a prior email but can also come from other sources like LDAP -- and that certificate normally contains the recipient's capabilities. AIUI Tbird (like Firefox) uses its own cert store; look in there for the cert and look at its SMIMECapabilities extension. Feb 13, 2020 at 1:28
  • While that sounds fantastic, it doesn't work. When I send a mail to said contacts it's encrypted using AES128, which they can not decrypt. Feb 13, 2020 at 6:25
  • 1
    For what it's worth, Outlook does support choosing the cipher, including choosing 3DES (though it defaults to AES).
    – CBHacking
    Jul 16, 2021 at 5:08

1 Answer 1


I tried to find out a little more about how and where Thunderbird stores the ciphers of the communication partner, but it looks like it's not actually stored with the user or his/her certificate. Therefore, Thunderbird uses a default cipher, probably as defined in the S/MIME RFC it implements. There seems to be no way for the user to set the default cipher.

The only way I can think of to make Thunderbird respect the other side's ciphers properly, is not to create new emails, but to always reply to an existing one.

  • Thank you for your input. You're right, replying to emails works fine, but that's not viable. I understand that the mail client/setup chooses a sane default cipher for the user, as most users don't know what would be a good choice, but I am perplexed that there is no option of specifying a certain cipher. Feb 24, 2020 at 6:30
  • 1
    I completely understand that you do not find this viable. However, it looks like it is the only answer you can get (unless you contribute a solution to Thunderbird).
    – not2savvy
    Feb 24, 2020 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .