Hoping to clear up some misunderstandings here... Comments inline below...
On Mar 5, 2009, at 1:21 PM, Paul Derby wrote:
We have one user that needs to send encrypted email to another user at Los Alamos Labs.
The Los Alamos user's certificate expired. He sent a new, signed email resulting in the new certificate going to the keychain.
The keychain shows only the new certificate.
Good so far...
As you will see later on, I am assuming that the case of the local part of the email address has a different case than what you are searching for.....
Address Book shows the expired certificate.
Address Book only displays what the OS provides it. Address Book does not contain Certs as part of its data store.
Apple Mail finds the expired certificate and won't encrypt because the cert has expired.
Apple Mail is never allowed (by the OS) to utilize any certificate / identity that does not successfully pass the various tests - including expiration.
The old certificate does not show up anywhere in the keychain.
If the certificate is being used then is MUST be in ONE of the keychains.
Is there somewhere else that Mail and Address Book check for certs?
Mail, Safari, VPN, 802.1X, Address Book, etc all make requests to the OS for the existing of Certificates. No Application stores certificates on their own -- Mac OS X is an OS-based PKI not an Application-based PKI.
How is it that all certs don't appeal in the keychain?
All certs must be in one of the available keychains. If you are not finding it, then there is an issue with your search criteria or an issue with the keychain.
I ran keychain firstaid and no errors are found.
Since you ran "Keychain First Aid" and no errors were reported, all the keychains should be fine from a structural standpoint.
Any idea where to look for the invisible cert?
No such thing as an invisible certificate on Mac OS X. You just need to locate the certificate among your (probably) large number of Keychain Items.
Is there some sort of GREP command where you can find all certs?
The command to use for all of this is:
/usr/sbin/security
For example:
Keep in mind that the search for email address is CASE SENSITIVE.
That means that if I am searching for "
email@hidden", but the certificate has "
email@hidden" then my search will not turn up any results.
More specific help on the command for searching for email address can be obtained by issuing the -h option:
$ security -h find-certificate