Use this page when an S/MIME rule marks a message as invalid, does not sign, encrypt or decrypt as expected, or reports smime_error. It explains why signature validation fails and what to check for each S/MIME action.
Check these first
- Find the message in Reports › Email Flow Logs and open the S/MIME event. It shows the result of each action and, for validation, the failure message.
- Check the certificates. In Settings › S/MIME Certificates, confirm the certificate is Active (not expired) and linked to the right email address on the Accounts tab.
-
Check the primary certificate. Signing uses the sender's primary certificate, which must be a
.p12file with a private key. Encryption uses the recipient's primary certificate. -
Check Reports › Notifications for
smime_error.
How S/MIME rules process a message
An S/MIME rule runs its actions in a fixed order: Decrypt, then Validate, then Sign, then Encrypt. Decrypt and Validate run for the recipient's organization. Sign and Encrypt run for the sender's organization.
| Action | Runs when | Needs |
|---|---|---|
| Decrypt | The message is encrypted and the recipient has an account | A certificate with a private key in the recipient's certificate history |
| Validate | The message is signed | Nothing extra; the signer's certificate travels with the message |
| Sign | The message is not already signed | A .p12 primary certificate for the sender |
| Encrypt | The message is not already encrypted | A primary certificate for the recipient (.pem or .p12) |
If the needed certificate is missing, the action is skipped without an error. If no action can run, the Email Flow Logs event reads "No S/MIME certifies managed by organization".
If the S/MIME service fails, the message is still delivered and the error is logged. Messages wrapped in TNEF (winmail.dat) are skipped.
Why a signature fails validation
When validation fails, the rule can add a prefix to the subject. The default prefix is [SMIME INVALID]; you set it in the rule's advanced options. The failure message in Email Flow Logs tells you which case applies.
| Failure message | Cause | What to do |
|---|---|---|
| "Message is not S/MIME signed. MIME type: …" | The message was sent without a digital signature. The sender did not sign it, or signing was turned off in their mail client. | Ask the sender to sign the message. If unsigned mail from this sender is expected, exclude the sender from the validation rule. |
| "No signers found in the message" | The message looks signed but contains no signer information. The signature is incomplete. | Ask the sender to resend. Check their signing software. |
| "Signature verification failed" or "Cryptographic signature verification failed" | The signature is damaged, or the message was changed after it was signed. A server between the sender and mxHERO (for example, one that adds a footer or disclaimer) can cause this. | Find out whether a system on the path modifies messages. Have the sender resend. |
| "Provided certificate does not match the message signer. Expected: …" | The certificate in the message does not belong to the signer. | Ask the sender to check which certificate their client uses for signing. |
| Any other message | The certificate is corrupted, unreadable or malformed, the message format is not a valid signed message, or a processing error occurred. | Send the message to support (see below). |
Signing, encryption and decryption problems
| Symptom | Cause | Fix |
|---|---|---|
| Outgoing messages are not signed | The sender has no primary certificate, or the primary is a .pem (public key only). |
Upload the sender's .p12 certificate with its password and set it as primary on the Accounts tab. |
| Outgoing messages are not encrypted | The recipient has no account with a primary certificate in mxHERO. | Upload the recipient's public certificate (.pem) and create an account for the recipient's address with it as primary. |
| Incoming encrypted messages are not decrypted | The recipient's certificate history does not contain the certificate the message was encrypted for, or that certificate has no private key. | Upload the matching .p12 and add it to the recipient's history. Keep old certificates in the history after a renewal so older messages can still be decrypted. |
| You cannot delete a certificate | The certificate is linked to one or more accounts. | Remove it from those accounts first. The error message lists them. |
| Upload rejected | Only .pem and .p12 files are accepted. |
Convert other formats to .pem or .p12. |
For managing certificates in bulk, see S/MIME API.
Getting help with a specific message
If you believe a message should have passed validation, send it to support. Attach the original message as a .eml file (not forwarded inline, which changes it), and include the Email Flow Logs entry. See Getting Support.
Comments
0 comments
Please sign in to leave a comment.