If the Mozilla profile (Thunderbird/Firefox/Seamonkey) has more than one X.509 certificate for the same email address, the Certificate Chooser shows only one X.509 for that email It's unclear which certificate is being shown. Maybe the one imported into Thunderbird first. Deleting old X.509 certificates from Mozilla isn't a viable option. Outdated X.509 certificates must be kept in Thunderbird to be able to read old encrypted mails. Moved this problem into this new bug from bug 158839 comment 1, because it's actually not GPG related. Fixing this is a little impeded by bug 161872: regression: ODF X.509 signing doesn't work since libxmlsec 1.2.37 -> 1.3.1 (edit) Impedes development of bug 113192: [Digital-Signatures][OpenPGP] There's too few indication of which key is which in the Certificate Chooser