S/MIME support in Gnus is somewhat limited. ExtendSMIME redefines some Gnus functions and adds new ones to include proper support for
The general idea of ExtendSMIME is to store available certificates in files under smime-certificate-directory. The file names under which a certificate is stored are its e-mail addresses. A certificate file is written in two cases: First, if a certificate is received on demand via LDAP. Second, if a signed message containing a certificate is verified successfully then the contained certificate is stored for each of its e-mail addresses.
Signed versions of jl-smime.el and jl-encrypt.el are available over there.
In general, I recommend GnuPG over S/MIME (which is the default for Gnus). Unless you are in a restricted setting, say in a university or corporate setting, the trust model regarding certificate authorities is broken. You may want to recall some certificate authority failures such as Comodo (2011), DigiNotar (2011), and Trustwave (2012). Although the impact of those failures appears to be restricted to SSL certificates, I don’t see any reason why S/MIME certificates should be more trustworthy.
Customizable variables are
‘jl-smime-negative-cache-dir’. You may want to read their documentation.
I’m using the following code after (load “jl-smime”) in my setup:
;; Allow automatic LDAP queries for certificates within my domain. (setq jl-smime-permit-ldap "@\\(.+\\.\\)?uni-muenster\\.de$") ;; I'm searching for S/MIME certificates via LDAPS at DFN-Verein. ;; Note that ldap.el in Emacs requires a minor workaround to perform ;; encrypted connections via LDAPS. In fact, ldapsearch is being invoked ;; to use unencrypted plaintext LDAP communication with the parameter "-h". ;; Maybe I'm doing something wrong but I only got LDAPS to work with the ;; parameter "-H ldaps://ldap.pca.dfn.de". To get rid of the default ;; parameter -h, I'm passing the empty string as hostname, setting ;; smime-ldap-host-list to '(""). Finally, ldapsearch aborts the ;; connection if it is not told where to find the CA certificate for the ;; LDAPS server (which is a Good Thing). ;; I created ~/.ldaprc with a single line pointing to that CA certificate: ;; TLS_CACERT /path/to/server/cert (require 'ldap) (setq smime-ldap-host-list '("")) (setq ldap-default-base "O=DFN-Verein,C=DE" ; -x: no SASL authentication, -tt: store result in file ; -H: connect to specified URI. ldap-ldapsearch-args '("-x" "-tt" "-H ldaps://ldap.pca.dfn.de") ) ;; Cache S/MIME passphrase for 600 seconds. (Default is 16.) (require 'password-cache) (setq password-cache-expiry 600)
For the record: Previously, I used plaintext LDAP with the following differences to the above setup:
(setq ldap-ldapsearch-args '("-x" "-tt")) (setq smime-ldap-host-list '("ldap.pca.dfn.de"))