Apple Macintosh - Uwe Gradenegger

Basics: Name Constraints

Name restrictions are a part of the X.509 standard and in the RFC 5280 described. They are a tool that can be used within the qualified subordination can be used to control the validity range of a certification authority certificate in a fine-grained manner.

Microsoft Outlook: Signed e-mail messages are rejected by the receiving mail server with error message "Invalid S/MIME encrypted message."

Assume the following scenario:

A user sends an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
The sender uses Microsoft Outlook for Macintosh.
The receiving mail server rejects the message and sends back a Non-Delivery Report (NDR):

550 5.6.0 M2MCVT.StorageError.Exception: ConversionFailedException - , Content conversion: Invalid S/MIME encrypted message.; storage error in content conversion.

Microsoft Outlook: Signed e-mail messages appear invalid with error message "No certificate was found to verify the signature of this message."

Assume the following scenario

A user receives an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
The user (the recipient) uses Microsoft Outlook for Windows.
The sender uses Microsoft Outlook for Macintosh.
The certificate used to sign the message is valid.
The e-mail signature is displayed as invalid. Inspection of the signature reveals that no details about the signature certificate can be displayed.

Error: No certificate was found to verify the signature of this message.
Signed by (certificate subject name unknown) using RSA/SHA256 at 15:44:59 19.05.2021.

Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Internal error." appears.

Assume the following scenario:

A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
The message cannot be opened.
When opening the message, the following error message is displayed:

Unfortunately, there is a problem opening this item. This may be temporary. If this error occurs again, you should restart Outlook. Error in the underlying security system. Internal error.

Chrome and Safari limit SSL certificates to one year validity

Apple recently announced that the Safari browser will only accept certificates with a validity of 398 days in the future, provided they were issued from September 1, 2020.

Mozilla and Google want to implement comparable behavior in their browsers. So the question is whether this change will have an impact on internal certificate authorities - i.e. whether in future internal SSL certificates will also have to follow these rules, as is the case, for example, with the enforcement of the RFC 2818 by Google was the case.

Configuring a Secure Socket Layer (SSL) Certificate Template for Web Server

Below is a guide to configuring a web server template with recommended settings.