Outlook S/MIME certificate selection

re: Outlook S/MIME certificate selection

Markus — Thu, 13 Oct 2011 15:04:40 GMT

Is any more insight available, how the "first" is calculated: "If the default certificate is not found, the *first* valid certificate in the store is selected." How is the list ordered exactly?

I need to know this, because we need a alerting, if a user has a functioning S/MME certificate. We need a tool that matches the my store of the users with his AD store and shows possible inconsistencies, introduced by migration of old AD with their own PKI in the central company AD one.

I know how to eliminate invalid certificates (out of life time, no purpose "Secure email") and I have learned that a certificate from a AD integrated PKI is always higher prioritized than that of a non-AD integrated PKI. I had assumed that "first" means either "the first entry in the multivalued ldap attribute" or "the one with the oldest starting time". But exact tests are difficult and my results are not consistente yet. If I would knew the *exact* algorithm to choose the certificate for the S/MIME mail, that would help.

re: Outlook S/MIME certificate selection

Stephen — Tue, 30 Aug 2011 20:04:00 GMT

Interesting and informative... However I'm trying to figure out why Outlook 2010 is choosing an expired certificate as the default, over a new valid certificate, from the offline address book. Both certificates are in usercertificate attribute in AD. I can't figure out if Outlook is blindly selecting the expired certificate without checking its validity period, or if something in the oab is explicitly telling Outlook to use the older certificate as the default. Either way, the behavior is somewhat problematic during the cleanup plus propagation delay for getting expired certificates out of users' oabs.

re: Outlook S/MIME certificate selection

Jack — Wed, 22 Sep 2010 19:42:53 GMT

I have some questions.

S/MIME will use the User Certificate, right?

Can we push all users certificates on Exchange server GAL (global address list)? If yes, how to push them?

Then Outlook will look for user certificate in GAL first; If not find, then outlook will search user certificate in Active Directory user object attributes, correct?

Thanks

re: Outlook S/MIME certificate selection

Jack W — Wed, 22 Sep 2010 19:12:31 GMT

It makes the understanding of S/MIME much easier. Save much time.

Thank you