2

I've got myself an S/MIME certificate from StartSSL, which I have exported from the browser, imported into my keychain and as expected Mail.app is now signing my outgoing messages.

However some clients seem to have problems trusting this certificate. I've tracked the problem down to the fact that the attached smime.p7s is not complete.

A valid smime.p7s for a certificate from startssl has two certificates in it - the complete certificate chain up to the root. Example:

$ cat valid.eml | openssl smime -pk7out | openssl pkcs7 -print_certs

subject=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Client CA
issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

subject=/description=aBcDeFg1234/CN=example@domain.com/emailAddress=example@domain.com
issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Client CA
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

However the smime.p7s that Mail.app attaches to my emails only has the second certificate, the one bound to my own account and misses the other one, which happens to be necessary for many clients in order to verify the signature.

Any ideas how I can fix this?

1

You need to add this http://www.startssl.com/certs/sub.class2.client.ca.crt certificate to your OS X keychain. After that your messages will contains both of certificates.

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • Is there some documentation on this from StartSSL? People might not be willing to just add certificates to their keychain. – nohillside Dec 31 '14 at 12:26
  • Sadly, this does not help. I have tried putting both the class 1 and class 2 SmartCom client certs in my login and System keychains and nothing changed. – ingenious Jan 5 '15 at 13:47
  • 1
    1. In your keychain in login certificates you need to have your certificate and "StartCom Class 2 Primary Intermediate Client CA". 2. In your keychain in System certificate you need to have your certificate and "StartCom Class 2 Primary Intermediate Client CA" too. 3. After inserting certificates – close and open Mail.app and try to send a message. – Wakko Jan 17 '15 at 18:18
1

The problem is that StartCom's PKCS12 certificates are bad. They should be providing a current intermediate CA that is valid, but instead their intermediate CA expired in 2012 and they are telling you to download a different intermediate from their website. StartCom should update their systems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .