8

A few years ago I have used S/MIME certs to sign (and encrypt) my mails.

The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It was valid for 1 year. Thus it expired on Jan 1st 2009.

During Jan. 1st 2008 and Dec. 31st 2009 I sent hundreds of mails. Everything worked out fine.

On (just a sample again) Jan. 12th 2009 recipients started to read (maybe read again) mails I had sent end of December 2008. Maybe they were on vacation over new year or they just wanted to read mails already read again.

Anyway, in December 2008 these mails were signed with a valid cert. But when reading these mails on Jan. 12th 2009 the same cert was already expired.

What happened? Well, the recipients received a warning. They contacted me asking what's going on, asking whether I got hacked etc. :) They started to delete my mails and stuff like that.

Is there any way to prevent that this happens again (i.e. to prevent that warnings appear when older mails are being read)?

Thanks!

P.S.: This is my very first question here, hope I obeyed to all rules. I thought it is a good idea to illustrate the problem along a simple example. Anyway, don't deal to severely with me :)

1 Answer 1

2

Let's give it a chance:

  1. If you have a key which expires in a year, all the data sent signed with that key within that year is valid forever (unless the key have been exposed), the problem here is, has the data or the application which uses it the correct information about when it was generated? (date signature stamp).

  2. A different problem may be, hey, you are signing your data with an outdated key, then, the data might be valid but you should have foreseen this problem and you should have already generated a new certificate (let's say, a month before expiring).

A pair of problems somewhat remain. What happens if the data or message is back to life again? Should I leave the old signature with it? Well, this just depends on your Secret Management, but what you could do is sign it again. The other problem is, can I educate the people I communicate with about this certificates thing? This is a hard work and if they are not really into this stuff the warnings will feel like "everything is going fine, no problem" or "everything is wrong, nuke it from orbit".

Maybe (and I have added this after your clarification), your best option here (if you really want to avoid most of this warnings) is to choose a certificate which expires more or less with the information, so, let's say you are in a project that will take a year, then you better check your keys because if it expires within a month maybe you will face this problem again so you better generate a new key for the project (this could be a bit of a PITA if you work with different projects and so on).

After all, it is impossible to know how your client's software is going to behave, you might not even know what software they use so it is impossible to foresee the problems, you will need to educate them and be always aware of when your certificate is going to expire so you can notice your clients beforehand.

4
  • Thanks for your response. Well, the main problem is really about educating my recipients as many of them are non IT users... so what I actually need is really a way to avoid their clients to show such warning; but I understand the problem why this happens (or at least might happen) for sure. Resigning isn't an option I think because the mail has already been sent (in December 2008), right? How should I resign it? I could resent it and sign it again, but, hey, is that reasonable???
    – AnNaSF
    Feb 25, 2014 at 23:05
  • Let me edit my response so I can better answer your problem.
    – kiBytes
    Feb 25, 2014 at 23:07
  • No, you can't definitely resign it if it is an e-mail =). For that you will need to educate your clients. Nevertheless I would really love to read more answers to your question =)
    – kiBytes
    Feb 25, 2014 at 23:14
  • Thanks for your edit. Well, so actually the answer is: There is no magic paths I should have recognized last time. It is just like it is... certs expire and the behavior of clients cannot be foreseen. All I could do is using certs with longer validity and using new certificates ("long") before the current ones time out. Well... unfortunately this is probably yet another reason why all my non IT colleagues always ask me why all these things need to be sooo complicated :) So, now I have the choice: Start signing again or continue mailing without signing... hmpf :)
    – AnNaSF
    Feb 25, 2014 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .