> [EMAIL PROTECTED] - Wed Sep 05 00:05:31 2007]: > > > Dear maintainers, > > In some circumstances, OpenSSL fails to decrypt an S/MIME message > when we generate a key and encrypt a message using OpenSSL. > >
I think the problem in this case is the certificate creation technique. S/MIME uses the issuer name and serial number of a certificate to determine how to decrypt the message. If there are multiple certificates with the same issuer name and serial number it may end up locating and attempting to use inappropriate details. You can check this with: openssl x509 -in cert.pem -noout -issuer -serial The issuer name and serial number is required to be unique so such certificates are a violation of various standards. Most S/MIME clients would have problems with such messages. Older versions of OpenSSL would assign a fixed serial number to a certificate using the commands you used below. Newer versions assign a random serial number to avoid this very issue. ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
