Skip to main content
paweco
Participant
February 28, 2023
Question

Outlook flags S/MIME signatures from CFMAIL as invalid

  • February 28, 2023
  • 1 reply
  • 601 views

Hello,

I am trying to send out signed emails with an S/MIME signature through CFMAIL, and I have been able to get it working. However, when the emails are received in Outlook, the signature is flagged as invalid. On other mail clients, such as the Apple Mail App, the signature is flagged as valid. What's more, after inspecting the certificate / signature in Outlook, the signature is suddenly valid and any incoming messages with this signature are no longer flagged (See attached image. After clicking the Button marked Red, the Cert becomes valid).

 

I have tested this on many different versions of CF from 11 to 2021 with the same result. I have also tried converting the signature to other formats, such as .jks.

 

I imported the certificates used into different mail clients such as Thunderbird and Outlook to test if the certificates are really invalid. However, when sending emails directly from these mail clients and signing them, I did not get any messages that the certificates were invalid.

 

This makes me believe that the problem is related to how CFMAIL is signing the mail, as the certificates work as expected in other software.

 

Below is the code I used for testing:

<cfmail
from="some@mail.com"
to="other@mail.com"
subject="Mail with Digital Signature"

sign="true"
<!--- Also tried converting to .jks format --->
keystore="#(ExpandPath("cert_file.p12"))#"
keystorepassword="SecurePassword"

<!---
encrypt="true"
encryptionalgorithm="AES256_CBC"
keyalias="crypto"
keypassword="SecurePassword"
--->

username="some@mail.com"
password="SecurePassword"
server="mailspool.mail.com"
port="25"> <!--- Also tried secure connections (465, SSL etc.) --->

Hello there!

</cfmail>

 

I am looking for any advice on how to solve this issue, and would appreciate any help.
Thank you!

    This topic has been closed for replies.

    1 reply

    BKBK
    Community Expert
    Community Expert
    March 20, 2023

    Any luck with a .cer file?

    paweco
    pawecoAuthor
    Participant
    March 21, 2023

    Thank you for your response. I have successfully converted my certificate to an .cer file, however, when I attempt to use the certificate, it does not send at all. The documentation only mentions Java Key Store (.jks) and PKCS12. Is it necessary for me to provide an attribute for encryption algorithm in order for this to work?

    Community Expert
    March 22, 2023

    I'm not sure using a .cer file gets you any closer to solving your problem. It's just a file extension. You need to use PEM or DER certificate formats I think. DER is binary. PEM is DER converted to base64. A PEM certificate looks like this:

     

    https://www.ietf.org/archive/id/draft-dkg-lamps-samples-02.html#name-alices-end-entity-certifica

     

    You may have a PKCS12 file, containing certificate chain info, like this:

     

    https://www.ietf.org/archive/id/draft-dkg-lamps-samples-02.html#name-pkcs12-object-for-alice

     

    I don't think your problem is file format or extensions. It sounds like a certificate validation problem, and is probably more about what's in your certificates than what file format they're using. If you're able to send to other mailboxes with S/MIME, but you have a problem with Outlook/Exchange, that's probably related to how Exchange or Outlook are seeing if your certificates are valid. Maybe they're having trouble talking to intermediate or root certificate authorities. And then when you reload the email in Outlook, the problem goes away! But you didn't send a second email from CF, so clearly the message itself is correctly assembled. My more specific guess is that you don't have the entire certificate chain in your PKCS12 file, or your PEM certificate list. You don't need the root, but you do need every intermediate certificate. Or, maybe Outlook isn't able to validate the list quickly enough the first time you load the email into the view pane, but is able to validate the list by the time you reload it.

     

    Dave Watts, Eidolon LLC

     

     

    Dave Watts, Eidolon LLC