This problem occurred after a user's computer was replaced. He reapplied for a new personal certificate from the CA, which is our SBS2003 server. Ever since, he cannot decrypt emails we send him.
Here's what I've done so far.
- I've deleted the user's certificate from the contact info in my Outlook.
- The certificate was removed from the cert store on my computer both by removing it from the "other people" container in crtmgr.msc and also by removing it from IE (tried both methods).
- I've had him delete his personal certificate from the cert store on his machine.
- I've gone into ADUC and removed the certificate from AD (user, properties, published certs tab)
- I've gone into the CA on SBS 2003 and actually revoked all certs ever issued to this user.
- After removing any traces of any certificates, I had him apply for a new certificate. I had him ensure that the cert was selected under "Certificates and Algorithms" in Outlook's Trust Center. I had him publish it to the GAL. I ensured that the hashing algorithms matched those set on my computer. He sent me a signed email. I added it to his contact information in Outlook.
- I sent him an encrypted email. He couldn't open it. The error listed in the title reappeared.
I have checked the properties of his certificate on my computer, his computer, the one in AD and the one listed in the CA and all are the same. They all have same serial number, the same fingerprint, etc. His email address in the cert is the same email address I'm sending to. He can send himself an encrypted and signed email and decrypt it. I can decrypt encrypted emails from him.
I've spent most of the day today trying to figure out what the heck is going on here. I've tried about everything I could find online, but nothing has worked.
I've even exported the cert from his pc and imported it on my pc and no luck.
A number of people have pointed others to this Microsoft KB article. I've tried resolutions 1, 3 and 4 to no avail (not surprising as it's related to Outlook 2000).
I've exhausted all possibilities that I can think of. What do you all think?
Is there another place on SBS or on a PC that is storing certificate data that I need to delete? It seems as if I am using the proper public key to encrypt the mail, but maybe I'm missing something super simple.