1

where can I find info regarding the proper way to handle expiring mail certificates?

Here's the problem: our certificates for digitally signing mails expire after a year. If, a week before expiry, I revoke a certificate and create a new one, Outlook complains whenever I open an older mail, signed with a now revoked certificate.

I think this shouldn't be so, since the old mail was signed at a time when the certificate hadn't been revoked yet, so I would think the signature is still perfectly valid. The revoke has a date, so signatures made AFTER the revoke should be invalid, others not. Maybe I'm wrong :-).

Do I need to let the certificate expire, and only then create a new one, without revoke, to prevent Outlook warning me about invalid signatures?

Thanks for your help!

2 Answers 2

1

You should not revoke the certificate.

Why?

There is a difference between an expired certificate and a revoked certificate. An expired certificate is just that: expired. It is still regarded valid for signatures before the expiration.

A revoked certificate, on the other hand, is considered invalid, because you normally revoke certificates if they have been abused or could be, for example because their private key has been leaked. Since there is no way to specify since when a certificate has been compromised (which would usually be before the revocation date and often it is not even known), revoked certificates are not considered valid any more at all.

That is why you should not revoke your certificate (there is no need to do so anyway), but rather just let them expire. That does not hinder you from creating a new certificate before the old one has expired. You can do so and just start using it while the old one is still valid.

0

As far as I know, an expired, revoked, or untrusted certificate will remain usable for cryptographic purposes. The emails will be still readable, but the mail client should warn you that the certificate has expired or ask you for confirmation to open it.

Here's a blog on FAQ: Expired S/MIME Certificates for your reference.

1
  • That's not quite correct as far as emails are concerned that have been signed before the expiration of the certificate. Quoted from the FAQ you link to: "As long as you signed an email message within the validity period of your S/MIME certificate, your recipient’s email client software should continue to trust it after the certificate itself expires."
    – not2savvy
    Nov 16, 2022 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .