S/MIME Public key import fails

[Baiyah7o]

Steps to reproduce

1. Go to mail
2. Mail settings
3. S/MIME
4. Manage certificates
5. Import certificates
6. Select PEM
7. Browse to select PEM certificate containing the private key
8. Error Failed to import the certificate on submit

Expected behavior

The public key has been created with openssl x509 -in INFILE.p12 -pubkey -noout > OUTFILE.pem. The import should have added the public key to the S/MIME certificates.

Actual behavior

On submit the error notification Failed to import the certificate is displayed. Error log is attached.
errorlog.json

The import succeeds if the private key is included in the PEM file with openssl x509 -in INFILE.p12 -pubkey > OUTFILE.pem.

Mail app version

5.10.9

Nextcloud version

34.0.2

Mailserver or service

posteo.de

Operating system

Debian 13.6

PHP engine version

Other

Nextcloud memory caching

Redis via unix socket (php8.4-redis)

Web server

Apache (supported)

Database

PostgreSQL

Additional info

No response

[kesselb]

-pubkey -noout never includes a certificate in the output. -pubkey extracts the SubjectPublicKeyInfo block (-----BEGIN PUBLIC KEY-----), and -noout suppresses the certificate that openssl x509 would otherwise print by default. So the "failing" file only ever contained a bare public key, with no X.509 certificate for Mail to parse (no subject, issuer, validity period, etc.), which is why import fails.

[Baiyah7o]

The import of the public key was done in order to sent encrypted mails to the recipient later. I assumed the Private key (optional) label of the input field below was indication to a public key field above, maybe I was misled.

[kesselb]

For S/MIME, the app needs an actual X.509 certificate (subject, issuer, validity, signature), a bare public key isn't enough, since S/MIME relies on that certificate to verify identity.

To extract just the certificate from your .p12 file is:

openssl pkcs12 -in INFILE.p12 -clcerts -nokeys -out OUTFILE.pem