0
I have client certificates for my email addresses from cacert.org and I have successfully stored themn as PKCS12 files and used them to sign emails in Thunderbird.
However, when someone uses my signed emails to send me an encrypted response, I can't decrypt them. Thunderbird tells me I have no private key, and come to think of it, I never made one in the process. Although, it would seem strange to me if the CA would send me the private key, that seems a bit unlikely.
Since only I can make the private key, and since the CA gives me the certificate, how do I create a matching key for the cert? What strikes me as weird is that I really shouldn't be able to do it this way, I think. Shouldn't I have a private-public key pair and have my public key certified?
I'm on Linux (Ubuntu Precise), and I have used ssh-keygen
and openssl
before, in different contexts. A general explanation that extends to more than just my setup would be appreciated.
How did you generate the certificate requests? You most likely generated the private key at that time. (And it's most likely in the PKCS12 file.) – David Schwartz – 2013-03-20T18:24:27.987
@David Hmmm. That seems plausible, but a) I can't remember doing it, and b) I'm pretty sure if I ever had one, I don't have it anymore. I'll try to create a new certificate and see what happens. If it's in the PKCS12 file, can I verify that? And wouldn't Thunderbird have imported it from the file, like it did with the certificate? – Hanno Fietz – 2013-03-20T18:26:04.420