Hi, I recently got into trouble with S/MIME signing and encryption in claws-mail, which uses gpgme. My old (first) S/MIME certificate is about to expire, so I got a new one. I added the new one to gpgsm's keystore. But after that, claws-mail as well as gpgsm complain about the keys being ambiguous. Clearly, the call
gpgsm -u u...@example.com
aborts because it cannot decide which of the two certificates to use.
It works when I specify a definite key ID (fingerprint) for -u or just
fix the default one. But what if I have multiple mail addresses, each
with old and new keys lying around?
Is there a way to tell gnupg to prefer a certain key for a given
mail address? While I can fix a key ID in claws-mail, too, this
currently breaks altenating usage of S/MIME and PGP, as currently there
is only one configuration field for the key ID to use for both
(hopefully that will change soon).
With the GPG/PGP part, I revoke my old key and all seems fine. I
somehow fail to see the equivalent mechanism for S/MIME.
I even checked the expiration process, advancing my system clock past
the expiration date of the old certificate. Even then, gpgsm complained
about ambiguous keys. Wouldn't it be sensible to
a) always use the newest S/MIME key with non-expired certificate and
b) discard the ones that are expired by default?
This issue even extended to antoher installation of gnupg/claws-mail
suddenly refusing to use the old key, although I did not yet add the
new secret key to it. They just picked up on the new certificate being
published and hence also consider the keys ambiguous (even if there is
only one secret key).
Any pointers? I wonder if I am doing something basic wrong, as regular
expiration of S/MIME certificates is the norm, isn't it? Doesn't anyone
else have issues with the accumulating number of old certificates?
(I am using GnuPG 2.1.21, gpgme 1.9.0., btw.)
Alrighty then,
Thomas
--
Dr. Thomas Orgis
Universität Hamburg
RRZ / Basis-Infrastruktur / HPC
Schlüterstr. 70
20146 Hamburg
Tel.: 040/42838 8826
Fax: 040/428 38 6270
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
