Dear Edward, thank you for this detailed bug report.
We examined the very same issue with Debian 9 and I was digging it down to PHP-FPM/Apache2. Unfortunately it is not PHP but Apache2 which behaves unexpected. I just want to bump this issue and hope for a bugfix release of apache 2.4.25. Alexander
smime.p7s
Description: S/MIME Cryptographic Signature
