S/MIME certificate import stores Common Name instead of email address, causing decryption failure

[pepemadalena]

Steps to reproduce

1. Import a valid S/MIME certificate (including the private key) in Nextcloud Mail.
2. Receive an encrypted S/MIME message (Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data).
3. Open the message.
4. The message cannot be decrypted and Mail returns:
   Failed to find a suitable S/MIME certificate for decryption
5. After investigating the database, the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the recipient email address.
   Example:
   email_address = "[EG] F12013577 RI-C16 0001"
   instead of
   email_address = "correo@autorizado.com"
6. Updating the "email_address" field to the actual recipient email immediately fixes the issue without any other changes.

Expected behavior

The imported S/MIME certificate should store the recipient email address (RFC822Name / emailAddress) instead of the certificate Common Name.

After importing the certificate, Mail should automatically find the correct certificate and decrypt encrypted S/MIME messages without requiring any manual database changes.

Actual behavior

After importing a valid S/MIME certificate (including the private key), encrypted S/MIME messages cannot be decrypted.

Mail returns:

Failed to find a suitable S/MIME certificate for decryption

The server log contains:

OCA\Mail\Exception\SmimeDecryptException:
Failed to find a suitable S/MIME certificate for decryption

After investigating the database, I found that the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the actual recipient email address.

Example:

email_address = "[EG] F12013577 RI-C16 0001"

instead of

email_address = "correo@autorizado.com"

Updating this field manually immediately fixes the issue. S/MIME decryption works correctly without any other changes.

The affected certificate is issued by Banco de España and contains a private key. The same certificate decrypts the same messages correctly in SnappyMail, so the certificate itself appears to be valid.

Only the signature verification warning remains.

Mail app version

5.5.17

Nextcloud version

30.0.17.2

Mailserver or service

Dovecot IMAP

Operating system

Ubuntu 24.04

PHP engine version

PHP 8.3

Nextcloud memory caching

memcache.local

Web server

Apache (supported)

Database

MariaDB

Additional info

No response

[kesselb]

Thanks for your report 👍

Could you check if the actual email address is stored alternative name?

openssl x509 -in CERT.pem -noout -text | grep -A2 "Subject Alternative Name"
openssl x509 -in CERT.pem -noout -subject

[pepemadalena]

Thanks for checking.

The certificate does not contain an email address in the Subject Alternative Name.

Output:

subject=C = ES, O = CAJA RURAL, OU = COMPONENTES, CN = [EG] F12013577 RI-C16 0001

X509v3 Subject Alternative Name:
DirName:/1.3.6.1.4.1.19484.2.3.16=4/...

There is no email: (rfc822Name) entry in the certificate.

However, the certificate is imported for the current mail account (correo@dominio.com), and storing the CN in oc_mail_smime_certificates.email_address prevents Mail from finding the certificate for decryption.

As a workaround, changing email_address in the database to the actual account email immediately fixes the issue and S/MIME decryption works correctly.