Why does Outlook report an invalid S/MIME signature?
Outlook may report that a Penneo email has an invalid S/MIME signature, even though the signing certificate is valid.
This usually happens when the email is modified by a security service or email gateway after it leaves Penneo and before it reaches the recipient.
An S/MIME signature is calculated from the signed email content. If that content is changed, the signature no longer matches the message Outlook receives, and Outlook correctly marks it as invalid.
This is not a certificate problem, so replacing or re-importing the certificate will not resolve it.
What can cause the problem?
Common examples include:
- Microsoft Safe Links rewriting URLs
- Exchange transport rules adding disclaimers or banners
- Secure email gateways such as Mimecast, Proofpoint, or VIPRE modifying the message
- Other security policies changing the message body, MIME structure, or signed headers
Penneo signs both the message headers and body. This provides stronger protection but also means that modifications made in transit can invalidate the signature.
Why does this only affect Penneo emails?
Different senders may sign different parts of an email. Penneo signs the message more comprehensively, so changes that might not affect another sender's signature can invalidate a Penneo signature.
How can it be resolved?
The recipient's IT or email-security team should investigate the mail flow and ensure that signed Penneo emails are not modified after signing.
They should review:
- URL-rewriting and Safe Links policies
- Exchange transport rules and disclaimers
- Secure email gateway settings
- MIME conversion and message-rewriting policies
- Relevant gateway and mail-flow logs
As a test, they can also deliver a Penneo email through a route that bypasses the modifying gateway.
Can Penneo Support fix the signature?
No. If the message was validly signed by Penneo and then modified by the recipient's email infrastructure, the signature cannot be repaired by Penneo.
Penneo Support can help explain the issue, but the recipient's IT or email-security team must correct the configuration causing the message modification.
For more information about enhanced filtering in Microsoft 365 connectors, see VIPRE's documentation.