Why can I read encrypted emails (Outlook) from some users but not others?

Question

I just received a new computer ID card with encryption keys, which I published to my organization's GAL. I can send encrypted emails just find. However, when someone tries to send me one, I can read them from half of the others successfully, but the other half result in the "Your digital ID name cannot be found by the underlying security system" message box.

Why wouldn't the problem be "all or nothing"? I am running Office Professional Plus 2016.

Solution

I was getting the error "Your digital ID name cannot be found by the underlying security system", when I was trying to open the encrypted emails from a colleague. I had recently updated my certificate with a new one, and had remove the old one -which had expired - from my system.

The solution was to reinstall also the old one, having both certificates on the system. Then the problem solved.

It seems that messages that had been send to me using my old-certificate signature (public key) are not opening without that old-certificate's private key ("digital ID name can't be found"). It also seems that my colleague is still using my old-signature.

In any case, I have the impression that the solution is to keep all issued digital certificates in backup, in order to be able to access old emails on other systems, and have them all installed in the current system you have.

Comments

[Ramhound]

What does your CSA believe is the problem? You have both the old and new public key installed on your system? (I am extremely familiar with this subject, every single one of my emails at work, is digitally signed and can be encrypted)

[Moab]

knowledge.digicert.com/solution/SO4972.html

[Ramhound]

"The sender of the encrypted email used a public key to encrypt the email for which you do not own the private key needed to decrypt." - What this means is that the sender used your OLD public key, since that no longer is installed automatically by Windows (when you insert your smart card), you will have to go through the recovery process to get that old certificate. There is a process for that, right, otherwise, you can't open ANY old encrypted emails when that certificate was being used. (again I have knowledge as a user (and Admin) on this subject)