Sign with certificate from windows certificate store

[pk1234]

Hi Gary,

this problem has been discussed already. Here are some quotes:

@Gary

S/MIME functions on a system of a central authority that maintains the validity of the keys. eM Client will check with the authority if the key has been revoked pretty much every time the key is used. If the key has been revoked, or it can’t be verified, you will not be able to use it.

It’s done through the system API, so there may be some issue with your OS, or access to the S/MIME authority is being blocked on your connection.

and

@Gary

@metis-it

It would be great to have a option in settings to skip CRL check / ignore fail.

It is not possible. S/MIME certificates are managed by a central authority and need to be checked before they can be used. Otherwise there is no knowing if it has been revoked or not.

PGP on the other hand doesn’t have the same process, as they are not managed in that way. So that may be an option if you don’t want to allow access to the S/MIME authority.

We produce our certificates with our own CA. They neither contain a revocation-URL nor is a OCSP server available. We cannot revoke our certificates and hence windows cannot check whether they were revoked.

Could you please tell me what function from the windows cryptographic API is returning the error message “Die Sperrprüfung konnte keine Sperrprüfung für das Zertifikat durchführen.” when eM Client uses this function to create the S/MIME signature. Is it a function that will select a certificate? Or is it a function that will create a signature? Is eM Client using some kind of cryptographic library that is available on different platforms or is eM Client using the windows cryptographic API directly?

I understand that eM Client cannot be configured such that this error message will be avoided. So I must change the behavior of the windows OS and this will be a lot easier if I know what exact routine from the cryptographic API is used by eM Client.

I nothing helps we must add a revocation-URL to our certificates or add an empty revocation list to windows somehow or create an OCSP-server that will return an empty revocation list.

Kind regards

Peter