Only one S/MIME certificate per account is used for decryption, even when multiple certs are imported
Maintainers usually reply within 1 day
@kesselb is already working on this.
Since Aug 18, 2026.
Assessment
This issue has not been assessed yet.
Description
Steps to reproduce
- Import multiple S/MIME certificates for the same mail account under Settings → Mail → S/MIME (e.g. after rotating keys — old cert(s) plus a new one, all valid and covering the account's email address).
- Receive/have stored mail that was encrypted under an older cert (one of the multiple imported certs, not the most recently added one).
- Attempt to open that message.
Expected behavior
The Mail app should attempt decryption against any of the account's registered certificates whose private key matches the message's recipient info in the S/MIME CMS envelope — not just a single actively-associated one.
Actual behavior
Message displays "Not Found." Server log shows:
OCA\Mail\Exception\SmimeDecryptException: Failed to find a suitable S/MIME certificate for decryption
thrown from SmimeService::decryptDataFetch via ImapMessageFetcher.php.
Mail app version
5.10.12
Nextcloud version
33.0.2
Mailserver or service
Stalwart
Operating system
Debian LXC
PHP engine version
No response
Nextcloud memory caching
No response
Web server
No response
Database
MySQL
Additional info
Confirmed not a key-validity issue: the relevant private key was independently tested by importing the same .p12 into Betterbird, which decrypts the exact same message successfully. All 3 certificates are present and valid in the account's imported S/MIME cert list.
Suspected cause: oc_mail_accounts appears to store a single smime_certificate_id per account (referenced in #8552), suggesting the decryption path may only ever attempt the one currently-associated certificate rather than iterating through all certs imported for the account. If so, this would explain why rotating S/MIME keys — a routine PKI operation — breaks access to previously-encrypted mail even when the old key is still available and correctly imported.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 369
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 114
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nextcloud/mail
-
1. to develop bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nextcloud/mail#13922 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day
-
1. to develop enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nextcloud/mail#13903 · 1 comment ·
Maintainers usually reply within 1 day
-
[Feature]: Need a close preview button/option in mail viewPossibly taken @steven-mpawulo claimed this 3 days ago. Open1. to develop enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
nextcloud/mail#13841 · 3 comments ·
Maintainers usually reply within 1 day
-
1. to develop enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nextcloud/mail#13828 · 1 comment ·
Maintainers usually reply within 1 day
-
Show email next to name in Search dropdownPossibly taken @vansh-nagar claimed this 27 days ago. Open1. to develop enhancement good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
nextcloud/mail#13703 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
bug needs triage P3
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
pbakaus/impeccable#1143 ·
Maintainers usually reply within 1 day
-
status: waiting for maintainer
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
mui/material-ui#49547 ·
Maintainers usually reply within 1 day
-
next() is called twice when the request closes after busboy fails to startPossibly taken @NgoQuocViet2001 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
[2.x] extension-manager: translation keys that changed meaning keep their old namesPossibly taken A pull request linked to this issue is open or already merged. Opentype/bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day