Re: S/MIME and encrypted certificates

[Simon Josefsson <jas@extundo.com>]

Martin Christensen <knightsofspamalot-factotum@gvdnet.dk> writes:

> Howdy!
>
> The Info pages about message security describe that when dealing with
> S/MIME, certificates are expected to be stored in PEM format, which is
> also explained to be unencrypted. For all things OpenPGP, it happily
> prompts me for a passphrase for my keyring. The authority that has
> given me this certificate does not allow the certificate to be stored
> unencrypted on disk.

Do you mean the private key?

> Is it not possible to convince the SSL thingy (or whatever handles
> S/MIME) to do the same, or would I have to implement this myself
> (which doesn't look too difficult, at least using OpenSSL)?

Actually smime.el support this now, the documentation is not up to
date.  When you sign a S/MIME message, Gnus asks you for a passphrase.
This passphrase is passed on to OpenSSL via a environment variable and
used to decrypt the PEM file.  If the files aren't encrypted, just
type RET as the passphrase.

(Environment variables may not be the best idea though, improvements
are welcome.  However, if you decide to work on this, please consider
modifying the S/MIME support in Gnus to use something else than
OpenSSL, so the improvements eventually helps free software.)