Bodies of signed mails are not displayed correctly

[dev8765]

Rpi4-image grommunio.aarch64-2025.01.2-Build1.12, Leap 15.6, community-repository
grommunio-common-28.1-lp156.9.1.aarch64
gromox-2.48.145.gc40fe13-lp156.66.1.aarch64
grommunio-web-3.14.28.g3861ba1a1-lp156.283.1.noarch

Outlook-clients:
All of signing, crypting and crypting&signing of mails work fine when sent from one Outlook-client to another (both on Win10, Outlook-Version 2108) .

Web-clients:
I stored the same certificates from above in Web/Settings/S/MIME. They were all recognized well and the public and private keys were displayed each in separate lines. But signing/crypting did not work at all. There are error messages and the received mail bodies are displayed as raw text. I used Firefox and Chromium.

Maybe this is an error in Web because it is working fine in Outlook-clients.

[gromandreas]

Hi @dev8765 ,

are there any related errors in /var/log/php-fpm.log? How were the certificates issued?

Regards, Andreas

[dev8765]

Hi Andreas,

many thanks for your quick response, it is very well appeciated, sign/crypt is very important for me.

Errors in /var/log/php-fpm/error.log:
I deleted my appliance-installation already and I'm now trying to get Grommunio to run on AlmaLinux-9. Maybe I can return to the appliance soon and will then answer your question.

How were the certificates issued?
I have created a new own CA-key (Rsa, 4096bit) and then derived a CA-certificate from it (x509), the openssl-config used is below. I copied both into /var/lib/grommunio-admin-api, but I know no way to tell the passphrase to the system. All user-certificates/-keys are derived from them. Import into the clients was done with PKCS-12-files with passphrase and it went well.

openssl-config used for CA-key/-certificate generation:

Default /etc/ssl/openssl.cnf of the appliance, I added this section at the bottom:
[smime]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = emailProtection
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always, issuer
subjectAltName = email:copy

I have still available all commands used on the appliance for key-/certificate-generation and I can tell it.

Regards, Hugh

[gromandreas]

Hi Hugh,

if you could provide all the steps you did to generate the certificates, it would be very helpful to debug the issue.

Judging from the error message "Überprüfung bei der Zertifizierungsstelle fehlgeschlagen", the solution might be as simple as adding your CA-key to 'PLUGIN_SMIME_CACERTS location (default is /etc/ssl/certs). See also comment in /etc/grommunio-web/config-smime.php:

// CA Certificates used to verify client certificates, for custom CA's copy your CA to /etc/ssl/certs/ and call update-ca-certificates.
// Multiple CA locations can be defined by separating them with a semicolon
//
define('PLUGIN_SMIME_CACERTS', '/etc/ssl/certs');

If that doesn't help, I'll have to look into the issue. I'm quite swamped with tasks right now, so at the earliest it would be some time next week though.

[dev8765]

Hi Andreas,

steps for certificate generation (using the newest Rpi4-image):
I followed this tutorial and added first the recommended [smime]-section to /etc/ssl/openssl.cnf
CA:

openssl genrsa -aes256 -out ca-key.key 4096	
openssl req -new -x509 -days 3650 -key ca-key.key -out ca-cert.crt

User "a":

openssl genrsa -aes256 -out a-key.key 4096
openssl req -new -key a-key.key -out a-csr.csr
openssl x509 -req -days 3650 -in a-csr.csr -CA ca-cert.crt -CAkey ca-key.key -set_serial 1 -out a-cert.crt -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout
openssl pkcs12 -export -in a-cert.crt -inkey a-key.key -out a-cert.p12

User "b":
As above

Make them available for Outlook-clients:
Administrator:
Import the CA-cert into the Win10-certificate-store into Trusted root Cert Authorities
User "a":
Import his cert into the Win10-certificate-store
Create a new contact for user "b" with his pub-key
User "b":
Import his cert into the Win10-certificate-store
Create a new contact for user "a" with his pub-key

I just made a fresh install with the Rpi4-image for new tests of Web.
I followed your advice and copied my CA-cert into /etc/ssl/certs and run update-ca-certificates (no output), sadly to no avail.

Sender, Receiver: Import of their user-certs in Web went fine

• Signing
  Sender:
  Clicking "Sign" turned the icon green, it required the correct passphrase, sending was successful
  Receiver:
  The mail arrived, but
  "Überprüfung bei der Zertifizierungsstelle fehlgeschlagen", "Der Überprüfungsdienst der Zertifizierungsstelle, die das Zertifikat des Absenders signiert hat, ist nicht verfügbar. Die Gültigkeit des Zertifikats konnte nicht überprüft werden."
  /var/log/php-fpm.log:
  nothing

• Crypting
  Sender:
  Clicking "Encrypt" turned the icon green, no passphrase required, sending failed: "Missing public certificates for the following recipients: ... Please contact your system administrator for details", the mail is hanging in "Drafts"
  Receiver:
  No mail arrived
  /var/log/php-fpm.log:
  nothing

• Crypting & signing
  Sender:
  Clicking turned both icons green, "Sign" required the correct passphrase, sending failed: "Missing public certificates for the following recipients: ... Please contact your system administrator for details", the mail is hanging in "Drafts"
  Receiver:
  No mail arrived
  /var/log/php-fpm.log:
  nothing

It might be that /etc/ssl/certs is the wrong directory. "... used to verify client certificates ..." might mean that this directory is for users who authenticate at the web application using a user-certificate instead of userid/password.

It might also be that the working Outlook-clients do not query the Grommunio-server at all, they have all required keys/certs available in the operating system or in contacts.

Regards

[dev8765]

I made some progress...
trust anchor --store ca-cert.crt -v imports correctly a CA-certificate
It deploys it to the right location(s), (at least) to /var/lib/ca-certificates/openssl

• Sign
  It works partly, in both directions user-a <-> user-b, the receiver is displayed a green bar with "Signature verified", but the body is displayed as raw text

• Crpyt
  It works partly, user-a -> user-b is perfect, user-b had to enter his passphrase and the received mail is displayed perfectly.
  But user-b -> user-a did not work, "click here to unlock" is displayed correctly again, but after entering the passphrase "Message decryption failed" is displayed

• Crypt & Sign
  It works partly, in both directions a green bar is displayed with "Signature verified", but the body is displayed as raw text

It was nice that user-b imported the pub-key of user-a automatically after he received a mail with it attached.

[dev8765]

I have now downloaded 2 user-certificates from Actalis. Their root-ca-certificate is contained in the operating-system already so it has not to be imported.

Their user-certificates are doing better and there is an improvement, so there might be an issue with certificates created following the tutorial.

• Crypt
  It is fully working
  The improvement with the Actalis-certificates is that they work in both directions user-a <-> user-b

• Sign, (Crypt & Sign)
  Working: Display of a green bar with text "Signature verified" and an icon for "Signed" (and "Crypted"), the body is decrypted and it's content is correct
  Not working: The body content, despite being correct, is displayed as raw unformatted text

 
So It looks that everything is working fine with the exception that signed mail bodies are not displayed correctly

[dev8765]

The above is all Web <-> Web.
The html sources of the wrongly displayed mail bodies are formatted with <pre>...</pre>.
So this might not be a simple error like a missing "css".
It looks more that it is built so intentionally.

<body>
<pre>
MIME-Version: 1.0
Sender: "Aaaa Aaaaaa" <a@ >
To: "Bbbb Bbbbbb" <b@ >
Importance: Normal
Sensitivity: Normal
Date: Mon, 06 Oct 2025 14:40:47 +0200
Subject: =?utf-8?B?U2lnbiDDpMO2w7w=?=
Thread-Topic: =?utf-8?B?U2lnbiDDpMO2w7w=?=
Thread-Index: Ab423AFnqpMik+xe+kOJQQpd86OSx/////+g
Message-ID: <gxZT.v-WjreCn2kSAxIxJsRjUcQ@DCOob7VPyU-TwsMaeqX2sDBgrDk3zERPnvbMjcV9py0.xz>
Content-Language: en-us
Content-ID: <3c9dae970d3ec144b9269ca8730f840d@ >
X-Mailer: gromox-oxcmail 3.0.1.ga0fbdf8
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0005_5A5881C3.AF9159B"

This is a multi-part message in MIME format.

------=_NextPart_000_0005_5A5881C3.AF9159B
Content-Transfer-Encoding: base64
Content-Type: text/plain;
charset="utf-8"

U2lnbiDDpMO2w7wKCg==
------=_NextPart_000_0005_5A5881C3.AF9159B
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset="utf-8"

<!DOCTYPE html><html>=0A<head>=0A <meta name=3D"Generator" content=3D"gr=
ommunio-web v3.15.12.g25f73772d-lp156.325.1">=0A <meta http-equiv=3D"Con=
tent-Type" content=3D"text/html; charset=3Dutf-8">=0A <title>Sign =C3=A4=
=C3=B6=C3=BC</title>=0A</head>=0A<body>=0A<p style=3D"padding: 0; margin:=
0;"><span style=3D"font-size: 11pt; font-family: tahoma, arial, helvetic=
a, sans-serif;">Sign =C3=A4=C3=B6=C3=BC<br></span></p>=0A</body>=0A</html=
>
------=_NextPart_000_0005_5A5881C3.AF9159B--
</pre>
</body>