Snappymail now supports S/MIME - anyone know what to do?

[murgero]

@necrevistonnezr S/MIME certificates you generate on your own, free of course using openssl or other compatible tool.

[luckow]

for a start (free S/MIME certificate) try this -> https://shop.actalis.com/store/it-en/certificati-s-mime

[necrevistonnezr]

@luckow Thanks! I'm new to this - how do I get the pfx file provided by Actalis into Snappymail?

[luckow]

@necrevistonnezr converting from format to format and making it work is new to me too normally I use Thunderbird for all my mail issues. I spent some life time keeping an eye on your question. In the end, here's how it worked in my quick tests:

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [yourfile.key]
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

Enter PEM pass ist your new password for the private key, which is converted into a text file. Inside you see something like

-----BEGIN ENCRYPTED PRIVATE KEY-----
longlinesofalotcharacterstilltheend=
-----END ENCRYPTED PRIVATE KEY-----

This goes into

(taken from here https://www.ibm.com/docs/en/arl/9.7?topic=certification-extracting-certificate-keys-from-pfx-file)

Dont ask why the command from above throws something like

Error outputting keys and certificates .....

It's correct, that there is no working output from the certificate. But that's not a problem. Login into https://extrassl.actalis.it/portal/login and download your Free S/MIME Certificate. The doc type is .cert. Rename it into .txt if no suitable tool opens it for you.
It looks like

-----BEGIN CERTIFICATE-----
longlinesofalotcharacterstilltheend=
-----END CERTIFICATE-----

The text goes into

Click on "Update" and two new buttons will appear in the "New e-mail" modal.

By the way: The "Update identity" modal can be accessed via "Settings -> General -> Identity".

[fbartels]

Looking at the screenshots I sense an implementation issue that they sooner or later need to adress. S/Mime certificates do expire and will need to be replaced multiple times over the lifetime of an email address. But their settings only seem to hold a single certificate. Which means once you rotate your certificate, you no longer can easily access old encrypted mail.

[necrevistonnezr]

@fbartels Thanks for the hint! I hope it’s ok that I posted your comment more or less 1:1 upstream: https://github.com/the-djmaze/snappymail/issues/259#issuecomment-1962726137

[necrevistonnezr]

Answer, https://github.com/the-djmaze/snappymail/issues/259#issuecomment-1962730783:

"you are correct.
In the future this and more are getting solved."

[luckow]

@fbartels and to mention another valid point: actalis.it creates a certificate and additionally a private key including password for you. This is not what I mean by privacy. But I took the chance to play around with format changes and Snappymail. This has been an interesting part of my life to spend with it.

[fbartels]

@luckow s/mime has been broken so many times, I don't think total privacy can be expected anyways

[darrendavid]

So I've got Snappymail talking to my Stalwart email server, where all emails are encrypted at rest. I've got my S/MIME key/cert installed for my identity in Snappymail, but when I click "decrypt" to view a message that's encrypted on the server, nothing happens. I'm not prompted for a passphrase, in fact, there's no response in the UI. Do I need to do something else to get this to decrypt messages? I've got this working correctly in both Thunderbird and Mail.app on iOS so I know it's working in a few other scenarios.