It took me quite some effort to set up a PKI in Thunderbird. Most challenging was the inconsistent syntax of openssl and the way you have to import your certificates in Thunderbird.
The script below generates an example PKI tree with
- 1 Root-CA
- 2 Sub-CAs
- 3 Client Certificates for each Sub-CA
What you require:
- Thunderbird (I have used V16.0.0.1 / Win32)
- OpenSSL (I have used V1.0.1 / cygwin)
- Bash (I have used cygwin)
The files:
- Bash Script
Please rename that file after downloading to script.sh
- Configuration File
Please rename that file after downloading to 1.conf. Create a folder called conf and move that file into that folder.
The procedure:
- Adjust the bash script (i.e. the email addresses and the common names)
- Execute the bash script; this generates all the required certificates
- Add certificates to Thunderbird – note the sequence:
- Import root certificate through Tools->Options->Certificates->View Certificates->Authorities
In the trust settings dialog, you should at least enable “mail users” option.
- Import client certificate(s) through Tools->Options->Certificates->View Certificates->Your Certificates
The intermediate CA will be imported automatically (by Thunderbird) because it is part of the client certificate. You can observed that be checking your CAs. The password is set to 5678.
- Select your certificate Account Settings -> Security
- When writing an Email, activate Security -> Digitally Sign This Message
What the script basically does:
The description below explains these 3 steps. The commands have been simplified to improve readability.
- Generate a Root-CA by (which will by nature be self-signed)
The commands below generate a certificate cert_root.crt with a corresponding private key contained in keys_root.pem.
openssl genrsa -out keys_root.pem 2048
openssl req -new -subj "/CN=Whatever Root-CA /emailAddress=whatever@gmail.com" -key keys_root.pem -out csr.pem
openssl x509 -days 3650 -extfile settings.txt -extensions v3_ca -req -in csr.pem -signkey keys_root.pem -out cert_root.crt
- Generate a Sub-CA and sign it with the Root-CA
The commands below generate a certificate file cert_subca1.crt with the corresponding private key file keys_subca1.pem.
openssl genrsa -out keys_subca1.pem 2048
openssl req -new -subj "/CN=Whatever Sub-CA 1/emailAddress=subca1@gmail.com" -key keys_subca1.pem -out csr.pem
openssl x509 -days 3650 -extfile settings.txt -extensions v3_ca -req -in csr.pem -CA cert_root.crt -CAkey keys_root.pem -out cert_subca1.crt -CAcreateserial
- Generate a client certificate and sign it with the Sub-CA
The commands below generate a certificate cert_subca1_user1.crt, a corresponding private key file named keys_subca1_user1.pem and a PKCS#12 file subca1_user1.p12, which allows you to import your certificate including the private key into your browser or Email client.
openssl genrsa -out keys_subca1_user1.pem 1024
openssl req -new -subj "/CN=User Certificate 1.1 for user1@gmail.com /emailAddress=user1@gmail.com" -key keys_subca1_user1.pem -out csr.pem
openssl x509 -days 3650 -req -in csr.pem -extfile settings.txt -extensions v3_usr -CA cert_subca1.crt -CAkey keys_subca1.pem -out cert_subca1_user1.crt -CAcreateserial
openssl pkcs12 -export -in cert_subca1_user1.crt -out subca1_user1.p12 -nodes -inkey keys_subca1_user1.pem -name "User Certificate 1.1 for user1@gmail.com" -certfile cert_subca1.crt -passout pass:5678
Important Notes:
- Ensure that the line ending of the scripts are okay. Especially If you run the script in Windows based on cygwin.
- Thunderbird 16 / Win32 seems to be unable to correctly handle ECC. Therefore I had to use RSA certificates. In the script you can switch between RSA and ECC. Maybe other client support ECC.
- You should follow the import order in Thunderbird as indicated above . Otherwise you may run into problems. I would also recommend to remove all your certificates imported before you add a new set.
