So let's say we have a OpenPGP mailing system which all mails are signed and encrypted with OpenPGP keys. And now you bought a CA signed x509 certificate and you want to imement into the mailing system. What should you do is the best?

First option is stripping out the public/private key pair as both system uses RSA. But will this method also take away the fact that the key is certified by a CA? Like I mean how is the x509 system verify the key is certified? Do they confirm the public key with CA (which won't matter)? Or does they also rely on data includes in x509 certificate (which will matter as converting those into asc file might lose them).

Another way is to sign your OpenPGP public key with your x509 private key and send it with the mail. But is this method working as I thought? Supposing the receiver do have the system to verify the public key signed by x509 certificate. Also is there software(s) that can make it an automatic workflow like showing messages "the mail is signed with the public key attached", "the public key is signed by certificate signed by XXX" when the mail is opened.


1 Answer 1


The fact that you bought a certificate from an X.509 certification authority doesn't matter to any OpenPGP implementations I know of: when your friend opens the message you just sent them in their OpenPGP-enabled mailer, it won't care a whit about the X.509 CA a priori.

Not only would you have to shoehorn your certificate into the OpenPGP message format, but you would have to teach their mailer software to interpret it, and teach your friend to accept that particular CA. It might be easier to teach your friend to accept S/MIME, if you really insist on this particular X.509 CA, with the caveat that S/MIME is a dumpster fire of shoddy '90s crypto engineering—or it would be easier to just use OpenPGP, which is also a dumpster fire of shoddy '90s crypto engineering but gets incremental improvements from time to time.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.