If the Mozilla profile (Thunderbird/Firefox/Seamonkey) has more than one X.509 certificate for the same email address, the Certificate Chooser shows only one X.509 for that email It's unclear which certificate is being shown. Maybe the one imported into Thunderbird first. Deleting old X.509 certificates from Mozilla isn't a viable option. Outdated X.509 certificates must be kept in Thunderbird to be able to read old encrypted mails. Moved this problem into this new bug from bug 158839 comment 1, because it's actually not GPG related. Fixing this is a little impeded by bug 161872: regression: ODF X.509 signing doesn't work since libxmlsec 1.2.37 -> 1.3.1 (edit) Impedes development of bug 113192: [Digital-Signatures][OpenPGP] There's too few indication of which key is which in the Certificate Chooser
I did not confirm this in Select Certificate dialog which used Thunderbird with two cetificates from the same issuer, one expired and one valid.
(In reply to Timur from comment #1) > I did not confirm this in Select Certificate dialog which used Thunderbird > with two cetificates from the same issuer, one expired and one valid. Moritz: per this comment, do you still see the issue?
Yes, it's still broken. tested: PDF signing and ODF signing build: 2025-11-17, 26.2.0.0.alpha0+ https://git.libreoffice.org/core/+/31f7e5adee4dc599987d169493bd260f84554203 OS: Debian-13 freshly created Mozilla profile by: Thunderbird 1:140.5.0esr-1~deb13u1 If someone likes to work on this, send me an email and I can share my screen to demonstrate the issue. Unfortunately there's another bug interfering. After selecting another Mozilla profile for certificates via Tools => Options => Security => Certificate LibreOffice should ask for a restart. But it only does so if at least one document was opened (and optionally closed) before. Without a restart, even without a document opened, LibreOffice will continue to use the previously selected Mozilla profile until restart.
Can you try with bibisect repos, if this is a bibisectable regression?
The bug showing only one X.509 certificate per email address exists at least since LibreOffice-4.0.6.2. I didn't test older versions. The restart dialog (when not opening a document) is missing since: https://git.libreoffice.org/core/+/b1d0d0cf866ac7235cd23ff862a8f2e9085148d8%5E%21/ [API CHANGE] Move NSS profile handling into NSS service Hint: Old LibreOffice versions like 4.0 seem to have an additional bug, showing only the most recently created Thunderbird profile. And I used Thunderbird-17.0.11esr to create the Mozilla profile. https://archive.mozilla.org/pub/thunderbird/releases/17.0.11esr/linux-x86_64/en-US/