feat: configure certified mails for smime

REUSE.toml

@@ -356,3 +356,14 @@ path = "core/img/libreoffice.svg"
 precedence = "aggregate"
 SPDX-FileCopyrightText = "2011-2026 The Document Foundation"
 SPDX-License-Identifier = "LicenseRef-TheDocumentFoundationTrademarks"
+
+[[annotations]]
+path = [
+    "tests/lib/Mail/data/smime/cert.pem",
+    "tests/lib/Mail/data/smime/cert_enc.pem",
+    "tests/lib/Mail/data/smime/key.pem",
+    "tests/lib/Mail/data/smime/key_enc.pem",
+]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2026 Nextcloud GmbH and Nextcloud contributors"
+SPDX-License-Identifier = "MIT"

apps/settings/appinfo/routes.php

@@ -19,6 +19,7 @@
 
 		['name' => 'MailSettings#setMailSettings', 'url' => '/settings/admin/mailsettings', 'verb' => 'POST' , 'root' => ''],
 		['name' => 'MailSettings#storeCredentials', 'url' => '/settings/admin/mailsettings/credentials', 'verb' => 'POST' , 'root' => ''],
+		['name' => 'MailSettings#storeSmimeKeyPassphrase', 'url' => '/settings/admin/mailsettings/smimepassphrase', 'verb' => 'POST' , 'root' => ''],
 		['name' => 'MailSettings#sendTestMail', 'url' => '/settings/admin/mailtest', 'verb' => 'POST' , 'root' => ''],
 
 		['name' => 'Users#setDisplayName', 'url' => '/settings/users/{username}/displayName', 'verb' => 'POST' , 'root' => ''],

apps/settings/lib/Controller/MailSettingsController.php

@@ -61,9 +61,29 @@
 		string $mail_smtpport,
 		string $mail_sendmailmode,
 		?bool $mail_noverify = null,
+		string $mail_smime_certificate = '',
+		string $mail_smime_key = '',
+		string $mail_smime_chain = '',
 	): DataResponse {
 		$mail_smtpauth = $mail_smtpauth === true;
 
+		if ($mail_smime_certificate === '') {
+			// the certificate path is the switch: without it the other S/MIME values are cleared
+			$mail_smime_key = '';
+			$mail_smime_chain = '';
+		} elseif ($mail_smime_key === '') {
+			return new DataResponse($this->l10n->t('The S/MIME certificate requires a private key.'), Http::STATUS_BAD_REQUEST);
+		}
+		foreach ([
+			'mail_smime_certificate' => $mail_smime_certificate,
+			'mail_smime_key' => $mail_smime_key,
+			'mail_smime_chain' => $mail_smime_chain,
+		] as $key => $value) {
+			if ($value !== '' && !is_readable($value)) {
+				return new DataResponse($this->l10n->t('The file "%s" for %s does not exist or is not readable.', [$value, $key]), Http::STATUS_BAD_REQUEST);
+			}
+		}
+
 		$configs = [
 			'mail_domain' => $mail_domain,
 			'mail_from_address' => $mail_from_address,
@@ -73,6 +93,9 @@
 			'mail_smtpauth' => $mail_smtpauth,
 			'mail_smtpport' => $mail_smtpport,
 			'mail_sendmailmode' => $mail_sendmailmode,
+			'mail_smime_certificate' => $mail_smime_certificate,
+			'mail_smime_key' => $mail_smime_key,
+			'mail_smime_chain' => $mail_smime_chain,
 		];
 		foreach ($configs as $key => $value) {
 			$configs[$key] = empty($value) ? null : $value;
@@ -119,6 +142,24 @@
 		return new DataResponse();
 	}
 
+	/**
+	 * Store the passphrase of the S/MIME private key in the config
+	 */
+	#[AuthorizedAdminSetting(settings: Mail::class)]
+	#[PasswordConfirmationRequired]
+	public function storeSmimeKeyPassphrase(?string $mail_smime_passphrase): DataResponse {
+		if ($mail_smime_passphrase === '********') {
+			return new DataResponse($this->l10n->t('Invalid S/MIME key passphrase.'), Http::STATUS_BAD_REQUEST);
+		}
+
+		if ($mail_smime_passphrase !== null) {
+			$this->config->setSystemValue('mail_smime_passphrase', $mail_smime_passphrase);
+		}
+		$this->config->setAppValue('core', 'emailTestSuccessful', '0');
+
+		return new DataResponse();
+	}
+
 	/**
 	 * Send a mail to test the settings
 	 * @return DataResponse
@@ -159,7 +200,7 @@
 			}
 		}
 
 		$this->config->setAppValue('core', 'emailTestSuccessful', '0');
 		$this->logger->error('Failed sending test email: User ' . $this->userSession->getUser()->getUID() . ' has no email address configured in their account settings');
 		return new DataResponse($this->l10n->t('You need to set your account email before being able to send test emails. Go to %s for that.', [$this->urlGenerator->linkToRouteAbsolute('settings.PersonalSettings.index')]), Http::STATUS_BAD_REQUEST);
 	}

apps/settings/lib/Settings/Admin/Mail.php

@@ -64,6 +64,11 @@ public function getForm() {
 			$smtpPassword = '********';
 		}
 
+		$smimePassphrase = $this->config->getSystemValue('mail_smime_passphrase', '');
+		if ($smimePassphrase !== '') {
+			$smimePassphrase = '********';
+		}
+
 		$smtpMode = $this->config->getSystemValue('mail_smtpmode', '');
 		if ($smtpMode === '' || $smtpMode === 'php') {
 			$smtpMode = 'smtp';
@@ -81,6 +86,10 @@ public function getForm() {
 			'mail_smtpname' => $this->config->getSystemValue('mail_smtpname', ''),
 			'mail_smtppassword' => $smtpPassword,
 			'mail_sendmailmode' => $this->config->getSystemValue('mail_sendmailmode', 'smtp'),
+			'mail_smime_certificate' => $this->config->getSystemValue('mail_smime_certificate', ''),
+			'mail_smime_key' => $this->config->getSystemValue('mail_smime_key', ''),
+			'mail_smime_chain' => $this->config->getSystemValue('mail_smime_chain', ''),
+			'mail_smime_passphrase' => $smimePassphrase,
 
 			'mail_noverify' => $smtpOptions['ssl']['allow_self_signed'] ?? false,
 		]);

apps/settings/src/views/AdminSettingsMailServer.vue

@@ -39,7 +39,10 @@ const initialConfig = loadState<{
 	mail_smtpname: string
 	mail_smtppassword: string
 	mail_sendmailmode: string
-
+	mail_smime_certificate: string
+	mail_smime_key: string
+	mail_smime_chain: string
+	mail_smime_passphrase: string
 	mail_noverify: boolean
 }>('settings', 'settingsAdminMailConfig')
 const mailConfig = ref({ ...initialConfig })
@@ -72,6 +75,8 @@ const smtpSendmailMode = computed({
 const hasPasswordChanges = computed(() => mailConfig.value.mail_smtppassword !== '********')
 const hasCredentialChanges = computed(() => hasPasswordChanges.value || mailConfig.value.mail_smtpname !== initialConfig.mail_smtpname)
 
+const hasPassphraseChanges = computed(() => mailConfig.value.mail_smime_passphrase !== '********')
+
 const isSaving = ref(false)
 const isSendingTestEmail = ref(false)
 const testEmailError = ref('')
@@ -112,9 +117,16 @@ async function onSubmit() {
 			})
 		}
 
+		if (hasPassphraseChanges.value) {
+			await axios.post(generateUrl('/settings/admin/mailsettings/smimepassphrase'), {
+				mail_smime_passphrase: mailConfig.value.mail_smime_passphrase,
+			})
+		}
+
 		const config: Record<string, string | boolean> = { ...mailConfig.value }
 		delete config.mail_smtppassword
 		delete config.mail_smtpname
+		delete config.mail_smime_passphrase
 		await axios.post(generateUrl('/settings/admin/mailsettings'), config)
 
 		testEmailError.value = ''
@@ -220,6 +232,28 @@ async function onSubmit() {
 				</NcFormBox>
 			</NcFormGroup>
 
+			<NcFormGroup
+				:description="t('settings', 'Optionally sign all outgoing emails with S/MIME. The certificate and private key must be PEM files readable by the web server. Leaving the certificate empty disables signing.')"
+				:label="t('settings', 'S/MIME signing')">
+				<NcTextField
+					v-model="mailConfig.mail_smime_certificate"
+					:label="t('settings', 'Certificate (PEM path)')"
+					name="mail_smime_certificate" />
+				<NcTextField
+					v-model="mailConfig.mail_smime_key"
+					:label="t('settings', 'Private key (PEM path)')"
+					name="mail_smime_key" />
+				<NcTextField
+					v-model="mailConfig.mail_smime_chain"
+					:label="t('settings', 'Certificate chain (PEM path, optional)')"
+					name="mail_smime_chain" />
+				<NcPasswordField
+					v-model="mailConfig.mail_smime_passphrase"
+					:label="t('settings', 'Key passphrase')"
+					:show-trailing-button="hasPassphraseChanges"
+					name="mail_smime_passphrase" />
+			</NcFormGroup>
+
 			<div :class="$style.adminSettingsMailServer__formAction">
 				<NcButton
 					:disabled="isSendingTestEmail"

apps/settings/tests/Controller/MailSettingsControllerTest.php

@@ -68,6 +68,9 @@ public function testSetMailSettings(): void {
 				'mail_smtpauth' => 1,
 				'mail_smtpport' => '25',
 				'mail_sendmailmode' => 'smtp',
+				'mail_smime_certificate' => null,
+				'mail_smime_key' => null,
+				'mail_smime_chain' => null,
 			]],
 			[[
 				'mail_domain' => 'nextcloud.com',
@@ -80,6 +83,9 @@ public function testSetMailSettings(): void {
 				'mail_smtpname' => null,
 				'mail_smtppassword' => null,
 				'mail_sendmailmode' => 'smtp',
+				'mail_smime_certificate' => null,
+				'mail_smime_key' => null,
+				'mail_smime_chain' => null,
 			]],
 		];
 		$this->config->expects($this->exactly(2))
@@ -187,4 +193,146 @@ public function testSendTestMail(): void {
 		$response = $this->mailController->sendTestMail();
 		$this->assertSame(Http::STATUS_OK, $response->getStatus());
 	}
+
+	public function testSetMailSettingsWithSmime(): void {
+		$certificate = tempnam(sys_get_temp_dir(), 'smime_cert');
+		$key = tempnam(sys_get_temp_dir(), 'smime_key');
+		$chain = tempnam(sys_get_temp_dir(), 'smime_chain');
+
+		$this->config
+			->expects($this->once())
+			->method('setSystemValues')
+			->with(self::callback(function (array $values) use ($certificate, $key, $chain): bool {
+				return $values['mail_smime_certificate'] === $certificate
+					&& $values['mail_smime_key'] === $key
+					&& $values['mail_smime_chain'] === $chain;
+			}));
+
+		$response = $this->mailController->setMailSettings(
+			'nextcloud.com',
+			'demo@nextcloud.com',
+			'smtp',
+			'ssl',
+			'mx.nextcloud.org',
+			true,
+			'25',
+			'smtp',
+			null,
+			$certificate,
+			$key,
+			$chain,
+		);
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+
+		unlink($certificate);
+		unlink($key);
+		unlink($chain);
+	}
+
+	public function testSetMailSettingsSmimeCertificateWithoutKey(): void {
+		$certificate = tempnam(sys_get_temp_dir(), 'smime_cert');
+
+		$this->config
+			->expects($this->never())
+			->method('setSystemValues');
+
+		$response = $this->mailController->setMailSettings(
+			'nextcloud.com',
+			'demo@nextcloud.com',
+			'smtp',
+			'ssl',
+			'mx.nextcloud.org',
+			true,
+			'25',
+			'smtp',
+			null,
+			$certificate,
+		);
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+
+		unlink($certificate);
+	}
+
+	public function testSetMailSettingsSmimeFileNotReadable(): void {
+		$this->config
+			->expects($this->never())
+			->method('setSystemValues');
+
+		$response = $this->mailController->setMailSettings(
+			'nextcloud.com',
+			'demo@nextcloud.com',
+			'smtp',
+			'ssl',
+			'mx.nextcloud.org',
+			true,
+			'25',
+			'smtp',
+			null,
+			'/nonexistent/cert.pem',
+			'/nonexistent/key.pem',
+		);
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
+
+	public function testSetMailSettingsSmimeClearedWhenCertificateEmpty(): void {
+		$this->config
+			->expects($this->once())
+			->method('setSystemValues')
+			->with(self::callback(function (array $values): bool {
+				return $values['mail_smime_certificate'] === null
+					&& $values['mail_smime_key'] === null
+					&& $values['mail_smime_chain'] === null;
+			}));
+
+		// without a certificate the remaining S/MIME values are cleared
+		$response = $this->mailController->setMailSettings(
+			'nextcloud.com',
+			'demo@nextcloud.com',
+			'smtp',
+			'ssl',
+			'mx.nextcloud.org',
+			true,
+			'25',
+			'smtp',
+			null,
+			'',
+			'/etc/ssl/private/mail.key',
+			'/etc/ssl/certs/mail-chain.pem',
+		);
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testStoreSmimeKeyPassphrase(): void {
+		$calls = [];
+		$this->config
+			->expects($this->exactly(1))
+			->method('setSystemValue')
+			->willReturnCallback(function (string $key, ?string $value) use (&$calls): void {
+				$calls[] = [$key, $value];
+			});
+
+		$response = $this->mailController->storeSmimeKeyPassphrase('secret');
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+		self::assertEqualsCanonicalizing([
+			['mail_smime_passphrase', 'secret'],
+		], $calls);
+	}
+
+	public function testStoreSmimeKeyPassphraseUnchanged(): void {
+		$this->config
+			->expects($this->never())
+			->method('setSystemValue');
+
+		$response = $this->mailController->storeSmimeKeyPassphrase(null);
+		$this->assertSame(Http::STATUS_OK, $response->getStatus());
+	}
+
+	public function testStoreSmimeKeyPassphraseMasked(): void {
+		$this->config
+			->expects($this->never())
+			->method('setSystemValue');
+
+		$response = $this->mailController->storeSmimeKeyPassphrase('********');
+		$this->assertSame(Http::STATUS_BAD_REQUEST, $response->getStatus());
+	}
 }

apps/settings/tests/Settings/Admin/MailTest.php

@@ -73,6 +73,10 @@ public function testGetForm(bool $sendmail) {
 				['mail_smtpname', '', 'smtp.sender.com'],
 				['mail_smtppassword', '', 'mypassword'],
 				['mail_sendmailmode', 'smtp', 'smtp'],
+				['mail_smime_certificate', '', '/etc/ssl/certs/mail.pem'],
+				['mail_smime_key', '', '/etc/ssl/private/mail.key'],
+				['mail_smime_chain', '', ''],
+				['mail_smime_passphrase', '', 'pass123'],
 			]);
 
 		$initialState = [];
@@ -116,6 +120,10 @@ public function testGetForm(bool $sendmail) {
 				'mail_smtpname' => 'smtp.sender.com',
 				'mail_smtppassword' => '********',
 				'mail_sendmailmode' => 'smtp',
+				'mail_smime_certificate' => '/etc/ssl/certs/mail.pem',
+				'mail_smime_key' => '/etc/ssl/private/mail.key',
+				'mail_smime_chain' => '',
+				'mail_smime_passphrase' => '********',
 				'mail_noverify' => false,
 			],
 		], $initialState);