Steps to reproduce
- Import multiple S/MIME certificates for the same mail account under Settings → Mail → S/MIME (e.g. after rotating keys — old cert(s) plus a new one, all valid and covering the account's email address).
- Receive/have stored mail that was encrypted under an older cert (one of the multiple imported certs, not the most recently added one).
- Attempt to open that message.
Expected behavior
The Mail app should attempt decryption against any of the account's registered certificates whose private key matches the message's recipient info in the S/MIME CMS envelope — not just a single actively-associated one.
Actual behavior
Message displays "Not Found." Server log shows:
OCA\Mail\Exception\SmimeDecryptException: Failed to find a suitable S/MIME certificate for decryption
thrown from SmimeService::decryptDataFetch via ImapMessageFetcher.php.
Mail app version
5.10.12
Nextcloud version
33.0.2
Mailserver or service
Stalwart
Operating system
Debian LXC
PHP engine version
No response
Nextcloud memory caching
No response
Web server
No response
Database
MySQL
Additional info
Confirmed not a key-validity issue: the relevant private key was independently tested by importing the same .p12 into Betterbird, which decrypts the exact same message successfully. All 3 certificates are present and valid in the account's imported S/MIME cert list.
Suspected cause: oc_mail_accounts appears to store a single smime_certificate_id per account (referenced in #8552), suggesting the decryption path may only ever attempt the one currently-associated certificate rather than iterating through all certs imported for the account. If so, this would explain why rotating S/MIME keys — a routine PKI operation — breaks access to previously-encrypted mail even when the old key is still available and correctly imported.
Steps to reproduce
Expected behavior
The Mail app should attempt decryption against any of the account's registered certificates whose private key matches the message's recipient info in the S/MIME CMS envelope — not just a single actively-associated one.
Actual behavior
Message displays "Not Found." Server log shows:
OCA\Mail\Exception\SmimeDecryptException: Failed to find a suitable S/MIME certificate for decryptionthrown from SmimeService::decryptDataFetch via ImapMessageFetcher.php.
Mail app version
5.10.12
Nextcloud version
33.0.2
Mailserver or service
Stalwart
Operating system
Debian LXC
PHP engine version
No response
Nextcloud memory caching
No response
Web server
No response
Database
MySQL
Additional info
Confirmed not a key-validity issue: the relevant private key was independently tested by importing the same .p12 into Betterbird, which decrypts the exact same message successfully. All 3 certificates are present and valid in the account's imported S/MIME cert list.
Suspected cause: oc_mail_accounts appears to store a single smime_certificate_id per account (referenced in #8552), suggesting the decryption path may only ever attempt the one currently-associated certificate rather than iterating through all certs imported for the account. If so, this would explain why rotating S/MIME keys — a routine PKI operation — breaks access to previously-encrypted mail even when the old key is still available and correctly imported.