1Error when importing personal SMIME Certificate  16.02.2024 10:32:42  Certificate ASN.1 Decoding online

As a side note:

We as an organization (had) to change our provider for individual S/MIME certificates recently.

These individual certificates are now provided from the company named Sectigo (see: https://www.sectigo.com/).

When trying to import a newly provided certificate into the Notes/Domino ID file, we ran into the following error from the Notes client:

Wrong ASN.1 type.

Cannot add certificate from the import file.

After some time, we found a solution:

One has to first import the key in Firefox and then export it immediately after. Now you can import the key into the Notes ID using the Notes client (here 12.0.2FP2).

Strange - but a feasible workaround in our case.

Know you (also) know ;-)

Regards,

Uwe

2Daniel Nashed  18.02.2024 12:09:20  Certificate ASN.1 Decoding online

@Uwe, as explained in a private mail, you should provide this type of information to HCL to look into it.

If this is PEM format, you would be able to just provide the certificate data.

The certificate content should not change if imported and exported again.

But it could be that a certificate contains invalid data, which is ignored by Firefox and when exported it works.

I would always double check with OpenSSL as a reference.

You can for example use openssl asn1parse --> https://www.openssl.org/docs/manmaster/man1/openssl-asn1parse.html

It's hard to tell without having a file to look at. If you could get test certificate that is the same type of certificate and shows the same problem, please open a ticket and get it escalated to the security team.

You can also send it to me to have a look .. We can also look at it together in your environment.

--Daniel