Unable to load/decrypt emails stored encrypted-at-rest with S/MIME on Stalwart mailserver

[darrendavid]

Steps to reproduce

1. Configure mail account on Stalwart mailserver to encrypt-at-rest using S/MIME certificate
2. Import S/MIME certificate into Nextcloud Mail
3. Configure Mail account (IMAP) for Stalwart server
4. Connect and attempt to check mail

Expected behavior

Folder(s) should load and use the uploaded S/MIME certificate to decrypt emails

Actual behavior

Folder structure is retrieved successfully, but attempting to load the contents of any folder fails with "Could not load folder" error. Log reports a decryption failure for every email in the folder (example log entry):

{
  "reqId": "aZkxPDJ2HN5gp852rW4MeAAAAAg",
  "level": 3,
  "time": "2026-02-21T04:14:55+00:00",
  "remoteAddr": "xx.xx.xx.xx",
  "user": "xxxxxx",
  "app": "mail",
  "method": "POST",
  "url": "/index.php/apps/mail/api/mailboxes/27/sync",
  "scriptName": "/index.php",
  "message": "Failed to find a suitable S/MIME certificate for decryption",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0",
  "version": "33.0.0.16",
  "exception": {
    "Exception": "OCA\\Mail\\Exception\\SmimeDecryptException",
    "Message": "Failed to find a suitable S/MIME certificate for decryption",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/apps/mail/lib/IMAP/ImapMessageFetcher.php",
        "line": 181,
        "function": "decryptDataFetch",
        "class": "OCA\\Mail\\Service\\SmimeService",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php",
        "line": 327,
        "function": "fetchMessage",
        "class": "OCA\\Mail\\IMAP\\ImapMessageFetcher",
        "type": "->"
      },
      {
        "function": "OCA\\Mail\\IMAP\\{closure}",
        "class": "OCA\\Mail\\IMAP\\MessageMapper",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php",
        "line": 318,
        "function": "array_map"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php",
        "line": 78,
        "function": "findByIds",
        "class": "OCA\\Mail\\IMAP\\MessageMapper",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/Service/MailManager.php",
        "line": 186,
        "function": "find",
        "class": "OCA\\Mail\\IMAP\\MessageMapper",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/Service/Attachment/AttachmentService.php",
        "line": 272,
        "function": "getImapMessage",
        "class": "OCA\\Mail\\Service\\MailManager",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/IMAP/PreviewEnhancer.php",
        "line": 75,
        "function": "getAttachmentNames",
        "class": "OCA\\Mail\\Service\\Attachment\\AttachmentService",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/Service/Sync/SyncService.php",
        "line": 187,
        "function": "process",
        "class": "OCA\\Mail\\IMAP\\PreviewEnhancer",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/Service/Sync/SyncService.php",
        "line": 135,
        "function": "getDatabaseSyncChanges",
        "class": "OCA\\Mail\\Service\\Sync\\SyncService",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/mail/lib/Controller/MailboxesController.php",
        "line": 151,
        "function": "syncMailbox",
        "class": "OCA\\Mail\\Service\\Sync\\SyncService",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 205,
        "function": "sync",
        "class": "OCA\\Mail\\Controller\\MailboxesController",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/base.php",
        "line": 1155,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/nextcloud/apps/mail/lib/Service/SmimeService.php",
    "Line": 521,
    "message": "Failed to find a suitable S/MIME certificate for decryption",
    "exception": "{\"class\":\"OCA\\Mail\\Exception\\SmimeDecryptException\",\"message\":\"Failed to find a suitable S/MIME certificate for decryption\",\"code\":0,\"file\":\"/var/www/nextcloud/apps/mail/lib/Service/SmimeService.php:521\",\"trace\":\"#0 /var/www/nextcloud/apps/mail/lib/IMAP/ImapMessageFetcher.php(181): OCA\\Mail\\Service\\SmimeService->decryptDataFetch()\\n#1 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(327): OCA\\Mail\\IMAP\\ImapMessageFetcher->fetchMessage()\\n#2 [internal function]: OCA\\Mail\\IMAP\\MessageMapper->OCA\\Mail\\IMAP\\{closure}()\\n#3 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(318): array_map()\\n#4 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(78): OCA\\Mail\\IMAP\\MessageMapper->findByIds()\\n#5 /var/www/nextcloud/apps/mail/lib/Service/MailManager.php(186): OCA\\Mail\\IMAP\\MessageMapper->find()\\n#6 /var/www/nextcloud/apps/mail/lib/Service/Attachment/AttachmentService.php(272): OCA\\Mail\\Service\\MailManager->getImapMessage()\\n#7 /var/www/nextcloud/apps/mail/lib/IMAP/PreviewEnhancer.php(75): OCA\\Mail\\Service\\Attachment\\AttachmentService->getAttachmentNames()\\n#8 /var/www/nextcloud/apps/mail/lib/Service/Sync/SyncService.php(187): OCA\\Mail\\IMAP\\PreviewEnhancer->process()\\n#9 /var/www/nextcloud/apps/mail/lib/Service/Sync/SyncService.php(135): OCA\\Mail\\Service\\Sync\\SyncService->getDatabaseSyncChanges()\\n#10 /var/www/nextcloud/apps/mail/lib/Controller/MailboxesController.php(151): OCA\\Mail\\Service\\Sync\\SyncService->syncMailbox()\\n#11 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(205): OCA\\Mail\\Controller\\MailboxesController->sync()\\n#12 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(118): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#13 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#14 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main()\\n#15 /var/www/nextcloud/lib/base.php(1155): OC\\Route\\Router->match()\\n#16 /var/www/nextcloud/index.php(25): OC::handleRequest()\\n#17 {main}\"}",
    "CustomMessage": "Failed to find a suitable S/MIME certificate for decryption"
  },
  "id": "699931438e558"
}

Mail app version

5.7.0

Nextcloud version

33.0.0.16

Mailserver or service

Stalwart

Operating system

Linux

PHP engine version

None

Nextcloud memory caching

No response

Web server

None

Database

None

Additional info

The same S/MIME certificate is being used successfully to decrypt emails in Betterbird and eM Client, as well as Roundcube using the inari007/slime_smime plugin. FWIW I have tried both a pkcs12 cert as well as a separate public/private key with the same issues,

Is the S/MIME certificate only good for signing/encrypting while sending or receiving? I'd assume that given the partnership announced between NextCloud and Stalwart last year that this should be good to go, but I'm new to NextCloud so that may be an errant assumption.

[kesselb]

Thanks for reaching out 👍

I don't have a test setup with encrypted-at-rest yet. The error message is saying that the provided certificate doesn't work to decrypt the given message. If it works in Betterbird, then we need to look into that.

I will see what we can do

[darrendavid]

Excellent. Please let me know if there’s anything I can provide to assist.

…

On Tue, Feb 24, 2026 at 1:28 AM Daniel ***@***.***> wrote: *kesselb* left a comment (nextcloud/mail#12469) <#12469 (comment)> Thanks for reaching out 👍 I don't have a test setup with encrypted-at-rest yet. The error message is saying that the provided certificate doesn't work to decrypt the given message. If it works in Betterbird, then we need to look into that. I will see what we can do — Reply to this email directly, view it on GitHub <#12469 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGVO4FQWQVX6OAKXQYEWR34NQYWVAVCNFSM6AAAAACV3EKD6GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSNJRGA3DAMRWGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[kesselb]

Hi @darrendavid, are you still seeing it with Mail 5.7.6? I made some changes for the error handling for S/MIME encrypted messages.

[darrendavid]

Hi @darrendavid, are you still seeing it with Mail 5.7.6? I made some changes for the error handling for S/MIME encrypted messages.

Afraid I'm still seeing the error, I'm fairly confident I've imported by S/MIME key correctly (at least it shows up under Mail Settings > Security > S/MIME > Manage Certificates) and the cert is still valid. Log shows:

{"reqId":"adAgEdMSVi1j63NAKWakbAAAAAQ","level":3,"time":"2026-04-03T20:16:25+00:00","remoteAddr":"10.0.1.101","user":"darren","app":"mail","method":"GET","url":"/index.php/apps/mail/api/messages/325/body","scriptName":"/index.php","message":"Failed to find a suitable S/MIME certificate for decryption","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0","version":"33.0.2.1","exception":{"Exception":"OCA\\Mail\\Exception\\SmimeDecryptException","Message":"Failed to find a suitable S/MIME certificate for decryption","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/mail/lib/IMAP/ImapMessageFetcher.php","line":182,"function":"decryptDataFetch","class":"OCA\\Mail\\Service\\SmimeService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php","line":328,"function":"fetchMessage","class":"OCA\\Mail\\IMAP\\ImapMessageFetcher","type":"->"},{"function":"OCA\\Mail\\IMAP\\{closure}","class":"OCA\\Mail\\IMAP\\MessageMapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php","line":319,"function":"array_map"},{"file":"/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php","line":81,"function":"findByIds","class":"OCA\\Mail\\IMAP\\MessageMapper","type":"->"},{"file":"/var/www/nextcloud/apps/mail/lib/Service/MailManager.php","line":173,"function":"find","class":"OCA\\Mail\\IMAP\\MessageMapper","type":"->"},{"file":"/var/www/nextcloud/apps/mail/lib/Controller/MessagesController.php","line":233,"function":"getImapMessage","class":"OCA\\Mail\\Service\\MailManager","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":205,"function":"getBody","class":"OCA\\Mail\\Controller\\MessagesController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":118,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":153,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":321,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1155,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":25,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/apps/mail/lib/Service/SmimeService.php","Line":522,"message":"Failed to find a suitable S/MIME certificate for decryption","exception":"{\"class\":\"OCA\\Mail\\Exception\\SmimeDecryptException\",\"message\":\"Failed to find a suitable S/MIME certificate for decryption\",\"code\":0,\"file\":\"/var/www/nextcloud/apps/mail/lib/Service/SmimeService.php:522\",\"trace\":\"#0 /var/www/nextcloud/apps/mail/lib/IMAP/ImapMessageFetcher.php(182): OCA\\Mail\\Service\\SmimeService->decryptDataFetch()\\n#1 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(328): OCA\\Mail\\IMAP\\ImapMessageFetcher->fetchMessage()\\n#2 [internal function]: OCA\\Mail\\IMAP\\MessageMapper->OCA\\Mail\\IMAP\\{closure}()\\n#3 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(319): array_map()\\n#4 /var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php(81): OCA\\Mail\\IMAP\\MessageMapper->findByIds()\\n#5 /var/www/nextcloud/apps/mail/lib/Service/MailManager.php(173): OCA\\Mail\\IMAP\\MessageMapper->find()\\n#6 /var/www/nextcloud/apps/mail/lib/Controller/MessagesController.php(233): OCA\\Mail\\Service\\MailManager->getImapMessage()\\n#7 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(205): OCA\\Mail\\Controller\\MessagesController->getBody()\\n#8 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(118): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#9 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#10 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main()\\n#11 /var/www/nextcloud/lib/base.php(1155): OC\\Route\\Router->match()\\n#12 /var/www/nextcloud/index.php(25): OC::handleRequest()\\n#13 {main}\"}","CustomMessage":"Failed to find a suitable S/MIME certificate for decryption"},"id":"69d02039c1985"}

Please let me know if I can help to debug/test - would love to see this working, and I appreciate your efforts!

[darrendavid]

Did a little more digging, I'm seeing two errors when I attempt to access an encrypted message, the SMIME error from before and this as well:

{
  "reqId": "adMQxNdX8VSDXDRxLH8peAAAAAY",
  "level": 3,
  "time": "2026-04-06T01:47:49+00:00",
  "remoteAddr": "xxx.xxx.xxx.xxx",
  "user": "darren",
  "app": "mail",
  "method": "GET",
  "url": "/index.php/apps/mail/api/messages/337/itineraries",
  "scriptName": "/index.php",
  "message": "OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned in file '/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php' line 567",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0",
  "version": "33.0.2.2",
  "exception": {
    "Exception": "Exception",
    "Message": "OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned in file '/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php' line 567",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
        "line": 153,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/Route/Router.php",
        "line": 321,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/base.php",
        "line": 1155,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
    "Line": 150,
    "Previous": {
      "Exception": "TypeError",
      "Message": "OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned",
      "Code": 0,
      "Trace": [
        {
          "file": "/var/www/nextcloud/apps/mail/lib/Service/ItineraryService.php",
          "line": 76,
          "function": "getHtmlBody",
          "class": "OCA\\Mail\\IMAP\\MessageMapper",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/apps/mail/lib/Controller/MessagesController.php",
          "line": 302,
          "function": "extract",
          "class": "OCA\\Mail\\Service\\ItineraryService",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
          "line": 205,
          "function": "getItineraries",
          "class": "OCA\\Mail\\Controller\\MessagesController",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
          "line": 118,
          "function": "executeController",
          "class": "OC\\AppFramework\\Http\\Dispatcher",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
          "line": 153,
          "function": "dispatch",
          "class": "OC\\AppFramework\\Http\\Dispatcher",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/lib/private/Route/Router.php",
          "line": 321,
          "function": "main",
          "class": "OC\\AppFramework\\App",
          "type": "::"
        },
        {
          "file": "/var/www/nextcloud/lib/base.php",
          "line": 1155,
          "function": "match",
          "class": "OC\\Route\\Router",
          "type": "->"
        },
        {
          "file": "/var/www/nextcloud/index.php",
          "line": 25,
          "function": "handleRequest",
          "class": "OC",
          "type": "::"
        }
      ],
      "File": "/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php",
      "Line": 567
    },
    "message": "OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned in file '/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php' line 567",
    "exception": "{\"class\":\"Exception\",\"message\":\"OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned in file '/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php' line 567\",\"code\":0,\"file\":\"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php:150\",\"trace\":\"#0 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#1 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main()\\n#2 /var/www/nextcloud/lib/base.php(1155): OC\\Route\\Router->match()\\n#3 /var/www/nextcloud/index.php(25): OC::handleRequest()\\n#4 {main}\",\"previous\":{\"class\":\"TypeError\",\"message\":\"OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned\",\"code\":0,\"file\":\"/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php:567\",\"trace\":\"#0 /var/www/nextcloud/apps/mail/lib/Service/ItineraryService.php(76): OCA\\Mail\\IMAP\\MessageMapper->getHtmlBody()\\n#1 /var/www/nextcloud/apps/mail/lib/Controller/MessagesController.php(302): OCA\\Mail\\Service\\ItineraryService->extract()\\n#2 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(205): OCA\\Mail\\Controller\\MessagesController->getItineraries()\\n#3 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(118): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#4 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#5 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main()\\n#6 /var/www/nextcloud/lib/base.php(1155): OC\\Route\\Router->match()\\n#7 /var/www/nextcloud/index.php(25): OC::handleRequest()\\n#8 {main}\"}}",
    "CustomMessage": "OCA\\Mail\\IMAP\\MessageMapper::getHtmlBody(): Return value must be of type ?string, Horde_Mime_Part returned in file '/var/www/nextcloud/apps/mail/lib/IMAP/MessageMapper.php' line 567"
  },
  "id": "69d310d859090"
}```