Hi,

I have s/mime configured. That is, in Account Setup the account End to
End encryption has the certificates for signing and encryption selected.

I write a post, I select sign.

Thunderbird can not save the draft, nor send. It says:

+++--------------------
Sending of the message failed.
You specified that this message should be digitally signed, but the
application either failed to find the signing certificate specified in
your Mail & Newsgroup Account Settings, or the certificate has expired.
--------------------++-

The certificate is certainly there, the configuration found it, and it
expires in 2026.

So, what is really going on? What can I do to solve this?

I have not been able to sign for years, since the Thunderbird enigmail
was dropped.

--
Cheers,
Carlos E.R.

On 11/17/23 14:57, Carlos E. R. wrote:
> Hi,

Hi,

> I have s/mime configured. That is, in Account Setup the account End to
> End encryption has the certificates for signing and encryption selected.

Okay....

> I write a post, I select sign.
>
> Thunderbird can not save the draft, nor send. It says:
>
> +++--------------------
> Sending of the message failed.
> You specified that this message should be digitally signed, but the
> application either failed to find the signing certificate specified in
> your Mail & Newsgroup Account Settings, or the certificate has expired.
> --------------------++-

That is unexpected.

> The certificate is certainly there, the configuration found it, and it
> expires in 2026.

Something seems to be causing Thunderbird to have indigestion.

The 1st trick is finding out what it is and the 2nd trick is fixing it.

> So, what is really going on?  What can I do to solve this?

I have no idea.

I've not yet tried to configure S/MIME in really new Thunderbird.

> I have not been able to sign for years, since the Thunderbird enigmail
> was dropped.

I've been using S/MIME (on another computer with Thunderbird 102) for
years with very little problem. I've been signing everything and
encrypting when I communicate with someone that I have a public key for.

Grant. . . .

On 2023-11-17 23:41, Grant Taylor wrote:
> On 11/17/23 14:57, Carlos E. R. wrote:
>> Hi,
>
> Hi,
>
>> I have s/mime configured. That is, in Account Setup the account End to
>> End encryption has the certificates for signing and encryption selected.
>
> Okay....
>
>> I write a post, I select sign.
>>
>> Thunderbird can not save the draft, nor send. It says:
>>
>> +++--------------------
>> Sending of the message failed.
>> You specified that this message should be digitally signed, but the
>> application either failed to find the signing certificate specified in
>> your Mail & Newsgroup Account Settings, or the certificate has expired.
>> --------------------++-
>
> That is unexpected.
>
>> The certificate is certainly there, the configuration found it, and it
>> expires in 2026.
>
> Something seems to be causing Thunderbird to have indigestion.
>
> The 1st trick is finding out what it is and the 2nd trick is fixing it.
>
>> So, what is really going on?  What can I do to solve this?
>
> I have no idea.
>
> I've not yet tried to configure S/MIME in really new Thunderbird.
>
>> I have not been able to sign for years, since the Thunderbird enigmail
>> was dropped.
>
> I've been using S/MIME (on another computer with Thunderbird 102) for
> years with very little problem.  I've been signing everything and
> encrypting when I communicate with someone that I have a public key for.

Before when enigmail was in the picture, it worked. I did not use it
often, but it worked. Since they changed it all to internal support, it
stopped. I heard other people having similar problem, no solution.

--
Cheers,
Carlos E.R.

On Fri, 17 Nov 2023 21:57:34 +0100, "Carlos E. R."
<robin_listas@es.invalid> wrote:

>Hi,
>
>I have s/mime configured. That is, in Account Setup the account End to
>End encryption has the certificates for signing and encryption selected.
>
>I write a post, I select sign.
>
>Thunderbird can not save the draft, nor send. It says:
>
>+++--------------------
>Sending of the message failed.
>You specified that this message should be digitally signed, but the
>application either failed to find the signing certificate specified in
>your Mail & Newsgroup Account Settings, or the certificate has expired.
>--------------------++-
>
>The certificate is certainly there, the configuration found it, and it
>expires in 2026.
>
>So, what is really going on? What can I do to solve this?
>
>I have not been able to sign for years, since the Thunderbird enigmail
>was dropped.

Would this be of any help?

<https://blog.thunderbird.net/2023/10/thunderbird-115-and-signatures-using-the-obsolete-sha-1-algorithm/>

On 11/17/23 16:51, Carlos E. R. wrote:
> Before when enigmail was in the picture, it worked. I did not use it
> often, but it worked. Since they changed it all to internal support, it
> stopped. I heard other people having similar problem, no solution.

I've not tried PGP signing since Enigmail was integrated.

I chose S/MIME over PGP for various reasons years ago.

Grant. . . .

On 2023-11-18 00:45, Grant Taylor wrote:
> On 11/17/23 16:51, Carlos E. R. wrote:
>> Before when enigmail was in the picture, it worked. I did not use it
>> often, but it worked. Since they changed it all to internal support,
>> it stopped. I heard other people having similar problem, no solution.
>
> I've not tried PGP signing since Enigmail was integrated.
>
> I chose S/MIME over PGP for various reasons years ago.

I'm not talking of PGP signing. I say that at the tie that enigmail
(which did PGP) was removed, S/MIME signing broke for me.

--
Cheers,
Carlos E.R.

On 11/17/23 18:02, Carlos E. R. wrote:
> I'm not talking of PGP signing. I say that at the tie that enigmail
> (which did PGP) was removed, S/MIME signing broke for me.

I thought that was the case, but I wanted to confirm.

I'm successfully using S/MIME signing / encryption in Thunderbird and
have been.

On 2023-11-18 00:24, Nobody wrote:
> On Fri, 17 Nov 2023 21:57:34 +0100, "Carlos E. R."
> <robin_listas@es.invalid> wrote:
>
>> Hi,
>>
>> I have s/mime configured. That is, in Account Setup the account End to
>> End encryption has the certificates for signing and encryption selected.
>>
>> I write a post, I select sign.
>>
>> Thunderbird can not save the draft, nor send. It says:
>>
>> +++--------------------
>> Sending of the message failed.
>> You specified that this message should be digitally signed, but the
>> application either failed to find the signing certificate specified in
>> your Mail & Newsgroup Account Settings, or the certificate has expired.
>> --------------------++-
>>
>> The certificate is certainly there, the configuration found it, and it
>> expires in 2026.
>>
>> So, what is really going on? What can I do to solve this?
>>
>> I have not been able to sign for years, since the Thunderbird enigmail
>> was dropped.
>
> Would this be of any help?
>
> <https://blog.thunderbird.net/2023/10/thunderbird-115-and-signatures-using-the-obsolete-sha-1-algorithm/>

Nope.

«Changing the setting will have no effect on the messages that
Thunderbird sends. Thunderbird uses SHA-256 when sending digitally
signed S/MIME email messages, and has been doing so for several years
already.»

The article refers to messages signed by other parties using an ancient
algorithm. My problem is that Thunderbird refuses to sign, claims I have
no key or is expired.

--
Cheers,
Carlos E.R.

Am 18.11.23 um 00:45 schrieb Grant Taylor:
> On 11/17/23 16:51, Carlos E. R. wrote:
>> Before when enigmail was in the picture, it worked. I did not use it
>> often, but it worked. Since they changed it all to internal support, it
>> stopped. I heard other people having similar problem, no solution.
>
> I've not tried PGP signing since Enigmail was integrated.

OpenPGP works perfectly. Unfortunately hardly anybody uses it.

--
"Gutta cavat lapidem." (Ovid)

On 17 Nov 2023 21:57:34 +0100 Carlos E. R. wrote:
>Hi,
>
>I have s/mime configured. That is, in Account Setup the account End to
>End encryption has the certificates for signing and encryption selected.
>
>I write a post, I select sign.
>
>Thunderbird can not save the draft, nor send. It says:
>
>+++--------------------
>Sending of the message failed.
>You specified that this message should be digitally signed, but the
>application either failed to find the signing certificate specified in
>your Mail & Newsgroup Account Settings, or the certificate has expired.
>--------------------++-
>
>The certificate is certainly there, the configuration found it, and it
>expires in 2026.
>
>So, what is really going on? What can I do to solve this?
>
>I have not been able to sign for years, since the Thunderbird enigmail
>was dropped.
>

Subject says 'mail' put you wrote 'a post'. Which?

Is this bug the same message - original was in German?
<https://bugzilla.mozilla.org/show_bug.cgi?id=1848336>

There are some other bugs concerning certain types of certificate. Have
you ever been able to sign using this certificate?
--
(Remove numerics from email address)

Some other s/mime signing bugs

<https://bugzilla.mozilla.org/buglist.cgi?resolution=---&short_desc_type=allwordssubstr&list_id=16797626&product=Thunderbird&query_format=advanced&short_desc=s%2Fmime%20sign>

--
(Remove numerics from email address)

On 2023-11-18 07:54, Dave Royal wrote:
> On 17 Nov 2023 21:57:34 +0100 Carlos E. R. wrote:
>> Hi,
>>
>> I have s/mime configured. That is, in Account Setup the account End to
>> End encryption has the certificates for signing and encryption selected.
>>
>> I write a post, I select sign.
>>
>> Thunderbird can not save the draft, nor send. It says:
>>
>> +++--------------------
>> Sending of the message failed.
>> You specified that this message should be digitally signed, but the
>> application either failed to find the signing certificate specified in
>> your Mail & Newsgroup Account Settings, or the certificate has expired.
>> --------------------++-
>>
>> The certificate is certainly there, the configuration found it, and it
>> expires in 2026.
>>
>> So, what is really going on? What can I do to solve this?
>>
>> I have not been able to sign for years, since the Thunderbird enigmail
>> was dropped.
>>
>
> Subject says 'mail' put you wrote 'a post'. Which?

Email.

>
> Is this bug the same message - original was in German?
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1848336>

Yes.

I can not read the text in the photo, but the description fits. And my
certificate has a p12 extension.

But there are no comments on the bug?

> There are some other bugs concerning certain types of certificate. Have
> you ever been able to sign using this certificate?

No, I haven't.

I found <https://github.com/polhenarejos/acme_email/issues/10>, but I
don't understand it.

--
Cheers,
Carlos E.R.

On 2023-11-17 21:57, Carlos E. R. wrote:
> Hi,
>
> I have s/mime configured. That is, in Account Setup the account End to
> End encryption has the certificates for signing and encryption selected.
>
> I write a post, I select sign.
>
> Thunderbird can not save the draft, nor send. It says:
>
> +++--------------------
> Sending of the message failed.
> You specified that this message should be digitally signed, but the
> application either failed to find the signing certificate specified in
> your Mail & Newsgroup Account Settings, or the certificate has expired.
> --------------------++-

Log (Tools / Developer Tools / Error console)

window.controllers/Controllers is deprecated. Do not use it for UA
detection. 2 blank

mailnews.send: NS_ERROR_FAILURE: Component returned failure code:
0x80004005 (NS_ERROR_FAILURE) [nsIMsgComposeSecure.beginCryptoEncapsulation]
_startCryptoEncapsulation resource:///modules/MimeMessage.jsm:503
_writePart resource:///modules/MimeMessage.jsm:549
MessageSend.jsm:136:32

mailnews.send: Sending failed; , exitCode=2147500037,
originalMsgURI=imap-message://MAIL_ADDRESS@imap.telefonica.net/Drafts#153

--
Cheers,
Carlos E.R.

Carlos E. R. wrote:

> Hi,
>
> I have s/mime configured. That is, in Account Setup the account End to
> End encryption has the certificates for signing and encryption selected.
>
> I write a post, I select sign.
>
> Thunderbird can not save the draft, nor send. It says:
>
> +++--------------------
> Sending of the message failed.
> You specified that this message should be digitally signed, but the
> application either failed to find the signing certificate specified in
> your Mail & Newsgroup Account Settings, or the certificate has expired.
> --------------------++-
>
> The certificate is certainly there, the configuration found it, and it
> expires in 2026.
>
> So, what is really going on? What can I do to solve this?
>
> I have not been able to sign for years, since the Thunderbird enigmail
> was dropped.

This doesn't help with your problem except that it confirms that it is
probably your system that is at fault, not Thunderbird - but I have just
tested again to make sure that Thunderbird 115.4.3 works fine sending email
signed by both an X.509 certificate or by OpenPGP. I have never had a
Thunderbird version that didn't (albeit it was a lot more versatile with
Enigmail).

--
Bob
Tetbury, Gloucestershire, England

You don't stop laughing because you grow old, you grow old because you stop
laughing!!!

On 18 Nov 2023 12:02:44 +0100 Carlos E. R. wrote:
>On 2023-11-17 21:57, Carlos E. R. wrote:
>> Hi,
>>
>> I have s/mime configured. That is, in Account Setup the account End to
>> End encryption has the certificates for signing and encryption selected.
>>
>> I write a post, I select sign.
>>
>> Thunderbird can not save the draft, nor send. It says:
>>
>> +++--------------------
>> Sending of the message failed.
>> You specified that this message should be digitally signed, but the
>> application either failed to find the signing certificate specified in
>> your Mail & Newsgroup Account Settings, or the certificate has expired.
>> --------------------++-
>
>
>
>Log (Tools / Developer Tools / Error console)
>
>
>window.controllers/Controllers is deprecated. Do not use it for UA
>detection. 2 blank
>
>mailnews.send: NS_ERROR_FAILURE: Component returned failure code:
>0x80004005 (NS_ERROR_FAILURE) [nsIMsgComposeSecure.beginCryptoEncapsulation]
> _startCryptoEncapsulation resource:///modules/MimeMessage.jsm:503
> _writePart resource:///modules/MimeMessage.jsm:549
>MessageSend.jsm:136:32
>
>mailnews.send: Sending failed; , exitCode=2147500037,
>originalMsgURI=imap-message://MAIL_ADDRESS@imap.telefonica.net/Drafts#153
>

Same error code as this bug:
<https://bugzilla.mozilla.org/show_bug.cgi?id=1756413>
It seems RSA-PSS certificates are not supported.

There's also this:
<https://bugzilla.mozilla.org/show_bug.cgi?id=1364339>

Who is the certificate issuer?
--
(Remove numerics from email address)

On 2023-11-18 18:08, Dave Royal wrote:
> On 18 Nov 2023 12:02:44 +0100 Carlos E. R. wrote:
>> On 2023-11-17 21:57, Carlos E. R. wrote:
>>> Hi,
>>>
>>> I have s/mime configured. That is, in Account Setup the account End to
>>> End encryption has the certificates for signing and encryption selected.
>>>
>>> I write a post, I select sign.
>>>
>>> Thunderbird can not save the draft, nor send. It says:
>>>
>>> +++--------------------
>>> Sending of the message failed.
>>> You specified that this message should be digitally signed, but the
>>> application either failed to find the signing certificate specified in
>>> your Mail & Newsgroup Account Settings, or the certificate has expired.
>>> --------------------++-
>>
>>
>>
>> Log (Tools / Developer Tools / Error console)
>>
>>
>> window.controllers/Controllers is deprecated. Do not use it for UA
>> detection. 2 blank
>>
>> mailnews.send: NS_ERROR_FAILURE: Component returned failure code:
>> 0x80004005 (NS_ERROR_FAILURE) [nsIMsgComposeSecure.beginCryptoEncapsulation]
>> _startCryptoEncapsulation resource:///modules/MimeMessage.jsm:503
>> _writePart resource:///modules/MimeMessage.jsm:549
>> MessageSend.jsm:136:32
>>
>> mailnews.send: Sending failed; , exitCode=2147500037,
>> originalMsgURI=imap-message://MAIL_ADDRESS@imap.telefonica.net/Drafts#153
>>
>
> Same error code as this bug:
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1756413>
> It seems RSA-PSS certificates are not supported.

Mmm.

I don't know how to see if I have that type of certificate.

>
> There's also this:
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1364339>
>
> Who is the certificate issuer?

subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios

Same certificate works in Firefox. It is an official certificate used to
identify against the administration, tax forms and such. To get one, we
have to go in person to their offices and get properly identified by
some official, but otherwise it is gratis IIRC.

--
Cheers,
Carlos E.R.

On 19 Nov 2023 02:54:47 +0100 Carlos E. R. wrote:
>
>Mmm.
>
>I don't know how to see if I have that type of certificate.
>
>subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>
>Same certificate works in Firefox. It is an official certificate used to
>identify against the administration, tax forms and such. To get one, we
>have to go in person to their offices and get properly identified by
>some official, but otherwise it is gratis IIRC.

If it 'works' in Firefox my guess is it's not an email-signing
certificate. Do you have any reason to suppose you can send S/MIME email
with it?

I no longer have any certificates in TB but ISTR that they included
'Purpose' in their details. Purposes include website encryption, code
signing, ...

--
(Remove numerics from email address)

On Sun, 19 Nov 2023 07:28:22 +0000, Dave Royal wrote:

> On 19 Nov 2023 02:54:47 +0100 Carlos E. R. wrote:
>>
>>Mmm.
>>
>>I don't know how to see if I have that type of certificate.
>>
>>subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>
>>Same certificate works in Firefox. It is an official certificate used to
>>identify against the administration, tax forms and such. To get one, we
>>have to go in person to their offices and get properly identified by
>>some official, but otherwise it is gratis IIRC.
>
> If it 'works' in Firefox my guess is it's not an email-signing
> certificate. Do you have any reason to suppose you can send S/MIME email
> with it?
>
> I no longer have any certificates in TB but ISTR that they included
> 'Purpose' in their details. Purposes include website encryption, code
> signing, ...

I found and imported my saved cerificates into TB - the newest expired in
2014. If I look at the details (settings, manage certs, your certs, view)
I see:
Organisation StartCom Ltd.
Organisational Unit: Secure Digital Certificate Signing
Key Usages
Purposes: Digital Signature, Key Encipherment, Data Encipherment
Extended Key Usages
Purposes: Client Authentication, E-mail Protection

I can also see details of a certificate I collected recently from a signed
email.
--
(Remove any numerics from my email address.)

Dave Royal wrote:

> Carlos E. R. wrote:
>
>> I don't know how to see if I have that type of certificate.
>> subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>
>> Same certificate works in Firefox. It is an official certificate used to
>> identify against the administration, tax forms and such. To get one, we
>> have to go in person to their offices and get properly identified by
>> some official, but otherwise it is gratis IIRC.
>
> If it 'works' in Firefox my guess is it's not an email-signing
> certificate. Do you have any reason to suppose you can send S/MIME email
> with it?

<https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1200-cuales-son-las-aplicaciones-cliente-de-correo-electronico-seguro-compatibles-con-los-certificados-de-usuarios-rcm-fnmt-para-linux-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530768&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530768>

I think the URL may be longer than the page content!

On 19 Nov 2023 08:58:41 +0000 Andy Burns wrote:
>Dave Royal wrote:
>
>> Carlos E. R. wrote:
>>
>>> I don't know how to see if I have that type of certificate.
>>> subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>>
>>> Same certificate works in Firefox. It is an official certificate used to
>>> identify against the administration, tax forms and such. To get one, we
>>> have to go in person to their offices and get properly identified by
>>> some official, but otherwise it is gratis IIRC.
>>
>> If it 'works' in Firefox my guess is it's not an email-signing
>> certificate. Do you have any reason to suppose you can send S/MIME email
>> with it?
>
>
><https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1200-cuales-son-las-aplicaciones-cliente-de-correo-electronico-seguro-compatibles-con-los-certificados-de-usuarios-rcm-fnmt-para-linux-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530768&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530768>
>
>I think the URL may be longer than the page content!

https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1123-si-tengo-un-certificado-sin-direccion-de-correo-electronico-asociada-que-debo-hacer-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530795&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fen%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530795

Si el certificado no tiene ninguna dirección de correo asociada, y si Ud.
desea utilizar las ventajas que ofrece el certificado en el uso del correo
electrónico seguro, deberá solicitar la revocación del mismo y
solicitar otro certificado mediante los procedimientos habituales, es
decir, solicitando un nuevo código de solicitud, acreditándose en una
oficina de registro comunicando al registrador que le incluya la
dirección de correo electrónico en el certificado para poder firmar
correos y posteriormente descargando el certificado.

Google translate
If the certificate does not have any associated email address, and if you
wish to use the advantages offered by the certificate in the use of secure
email, you must request its revocation and request another certificate
through the usual procedures, that is, requesting a new application code,
accrediting yourself at a registry office, informing the registrar to
include the email address in the certificate to be able to sign emails and
subsequently downloading the certificate.

So it looks like they intend it to be used for email. Maybe the email
address is wrong/missing - the cert details should show it. (And don't use
mixed case - as I discovered once.)

--
(Remove numerics from email address)

On 2023-11-17 21:57, Carlos E. R. wrote:
> Hi,
>
> I have s/mime configured. That is, in Account Setup the account End to
> End encryption has the certificates for signing and encryption selected.
>
> I write a post, I select sign.
>
> Thunderbird can not save the draft, nor send. It says:
>
> +++--------------------
> Sending of the message failed.
> You specified that this message should be digitally signed, but the
> application either failed to find the signing certificate specified in
> your Mail & Newsgroup Account Settings, or the certificate has expired.
> --------------------++-
>
> The certificate is certainly there, the configuration found it, and it
> expires in 2026.
>
> So, what is really going on?  What can I do to solve this?
>
> I have not been able to sign for years, since the Thunderbird enigmail
> was dropped.

I just realized something.

Despite the certificate information saying it is valid for email, it
does not contain my email address inside.

Can still TB use it for signing email when told to use that certificate,
or will it fail?

(Yes, I did tell the authorities which email to associate with the
certificate. They didn't).

--
Cheers,
Carlos E.R.

On 2023-11-19 08:28, Dave Royal wrote:
> On 19 Nov 2023 02:54:47 +0100 Carlos E. R. wrote:
>>
>> Mmm.
>>
>> I don't know how to see if I have that type of certificate.
>>
>> subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>
>> Same certificate works in Firefox. It is an official certificate used to
>> identify against the administration, tax forms and such. To get one, we
>> have to go in person to their offices and get properly identified by
>> some official, but otherwise it is gratis IIRC.
>
> If it 'works' in Firefox my guess is it's not an email-signing
> certificate. Do you have any reason to suppose you can send S/MIME email
> with it?

The certificate information says it is valid for email. Account
settings, S/MIME, manage certficates, View:

Key usages:
Purposes: Digital Signature, Non-Repudiation, Key Encipherment

Extended key usages:

Purposes: E-mail Protection, Client Authentication

>
> I no longer have any certificates in TB but ISTR that they included
> 'Purpose' in their details. Purposes include website encryption, code
> signing, ...

However, I just realized today that my email is not listed in the
information, despite me telling the authorities to include it.

--
Cheers,
Carlos E.R.

On 2023-11-19 09:58, Andy Burns wrote:
> Dave Royal wrote:
>
>> Carlos E. R. wrote:
>>
>>> I don't know how to see if I have that type of certificate.
>>> subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>>
>>> Same certificate works in Firefox. It is an official certificate used to
>>> identify against the administration, tax forms and such. To get one, we
>>> have to go in person to their offices and get properly identified by
>>> some official, but otherwise it is gratis IIRC.
>>
>> If it 'works' in Firefox my guess is it's not an email-signing
>> certificate. Do you have any reason to suppose you can send S/MIME email
>> with it?
>
> <https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1200-cuales-son-las-aplicaciones-cliente-de-correo-electronico-seguro-compatibles-con-los-certificados-de-usuarios-rcm-fnmt-para-linux-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530768&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530768>
>
> I think the URL may be longer than the page content!

Yes, that's the one.

--
Cheers,
Carlos E.R.

On 2023-11-19 11:01, Dave Royal wrote:
> On 19 Nov 2023 08:58:41 +0000 Andy Burns wrote:
>> Dave Royal wrote:
>>
>>> Carlos E. R. wrote:
>>>
>>>> I don't know how to see if I have that type of certificate.
>>>> subject=C = ES, O = FNMT-RCM, OU = Ceres, CN = AC FNMT Usuarios
>>>>
>>>> Same certificate works in Firefox. It is an official certificate used to
>>>> identify against the administration, tax forms and such. To get one, we
>>>> have to go in person to their offices and get properly identified by
>>>> some official, but otherwise it is gratis IIRC.
>>>
>>> If it 'works' in Firefox my guess is it's not an email-signing
>>> certificate. Do you have any reason to suppose you can send S/MIME email
>>> with it?
>>
>>
>> <https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1200-cuales-son-las-aplicaciones-cliente-de-correo-electronico-seguro-compatibles-con-los-certificados-de-usuarios-rcm-fnmt-para-linux-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530768&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530768>
>>
>> I think the URL may be longer than the page content!
>
>
> https://www.sede.fnmt.gob.es/en/preguntas-frecuentes/uso-de-los-certificados-con-correo-electronico/-/asset_publisher/GdbJTn10oevS/content/1123-si-tengo-un-certificado-sin-direccion-de-correo-electronico-asociada-que-debo-hacer-?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId=10530795&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_redirect=https%3A%2F%2Fwww.sede.fnmt.gob.es%2Fen%2Fpreguntas-frecuentes%2Fuso-de-los-certificados-con-correo-electronico%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_cur%3D0%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_GdbJTn10oevS_assetEntryId%3D10530795
>
> Si el certificado no tiene ninguna dirección de correo asociada, y si Ud.
> desea utilizar las ventajas que ofrece el certificado en el uso del correo
> electrónico seguro, deberá solicitar la revocación del mismo y
> solicitar otro certificado mediante los procedimientos habituales, es
> decir, solicitando un nuevo código de solicitud, acreditándose en una
> oficina de registro comunicando al registrador que le incluya la
> dirección de correo electrónico en el certificado para poder firmar
> correos y posteriormente descargando el certificado.
>
> Google translate
> If the certificate does not have any associated email address, and if you
> wish to use the advantages offered by the certificate in the use of secure
> email, you must request its revocation and request another certificate
> through the usual procedures, that is, requesting a new application code,
> accrediting yourself at a registry office, informing the registrar to
> include the email address in the certificate to be able to sign emails and
> subsequently downloading the certificate.
>
> So it looks like they intend it to be used for email. Maybe the email
> address is wrong/missing - the cert details should show it. (And don't use
> mixed case - as I discovered once.)

Yes, the address is missing, I realized that this morning, despite my
providing them with my email in the appropriate part of the form.

Requesting a new certificate (the explanation you translated) is a
nightmare. As a result of Covid, most government offices demand you
reserve an appointment with them at a web page. Most offices are booked
full. I got my appointment many days in advance at a location some two
hours distant by car.

And they neglected to include my email.

That time I did the procedure because the previous certificate had
expired before my renewal attempt. My fault. Doing it in purpose for
getting my email written sends some shivers down my spine.

Well, thank you all for finding what was the problem.

--
Cheers,
Carlos E.R.

On 2023-11-17 21:57, Carlos E. R. wrote:
> Hi,
>
> I have s/mime configured. That is, in Account Setup the account End to
> End encryption has the certificates for signing and encryption selected.
>
> I write a post, I select sign.
>
> Thunderbird can not save the draft, nor send. It says:
>
> +++--------------------
> Sending of the message failed.
> You specified that this message should be digitally signed, but the
> application either failed to find the signing certificate specified in
> your Mail & Newsgroup Account Settings, or the certificate has expired.
> --------------------++-
>
> The certificate is certainly there, the configuration found it, and it
> expires in 2026.
We found that the issue is that the certificate doesn't list any email.

I found a workaround:

Write the text to certify in LibreOffice writer, then export to PDF, and
in the dialog add a certificate.

Finally, just attach the resulting signed (certified) PDF to the email,
and indicate this information in the text of the email.

--
Cheers,
Carlos E.R.