Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

S/MIME certificate import stores Common Name instead of email address, causing decryption failure

Open
  • Is something wrong?
#13,379 3 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@kesselb is already working on this.

Since Jul 29, 2026.

Assessment

This issue has not been assessed yet.

Description

0. to triage bug feature:smime needs info stale
Steps to reproduce
  1. Import a valid S/MIME certificate (including the private key) in Nextcloud Mail.
  2. Receive an encrypted S/MIME message (Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data).
  3. Open the message.
  4. The message cannot be decrypted and Mail returns:
    Failed to find a suitable S/MIME certificate for decryption
  5. After investigating the database, the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the recipient email address.
    Example:
    email_address = "[EG] F12013577 RI-C16 0001"
    instead of
    email_address = "[email protected]"
  6. Updating the "email_address" field to the actual recipient email immediately fixes the issue without any other changes.
Expected behavior

The imported S/MIME certificate should store the recipient email address (RFC822Name / emailAddress) instead of the certificate Common Name.

After importing the certificate, Mail should automatically find the correct certificate and decrypt encrypted S/MIME messages without requiring any manual database changes.

Actual behavior

After importing a valid S/MIME certificate (including the private key), encrypted S/MIME messages cannot be decrypted.

Mail returns:

Failed to find a suitable S/MIME certificate for decryption

The server log contains:

OCA\Mail\Exception\SmimeDecryptException:
Failed to find a suitable S/MIME certificate for decryption

After investigating the database, I found that the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the actual recipient email address.

Example:

email_address = "[EG] F12013577 RI-C16 0001"

instead of

email_address = "[email protected]"

Updating this field manually immediately fixes the issue. S/MIME decryption works correctly without any other changes.

The affected certificate is issued by Banco de España and contains a private key. The same certificate decrypts the same messages correctly in SnappyMail, so the certificate itself appears to be valid.

Only the signature verification warning remains.

Mail app version

5.5.17

Nextcloud version

30.0.17.2

Mailserver or service

Dovecot IMAP

Operating system

Ubuntu 24.04

PHP engine version

PHP 8.3

Nextcloud memory caching

memcache.local

Web server

Apache (supported)

Database

MariaDB

Additional info

No response

Dominant language
JavaScript
Stars
1k
Forks
364
Avg merge
1d 4h
Merged PRs (30d)
100

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nextcloud/mail

All issues in nextcloud/mail

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.