S/MIME certificate import stores Common Name instead of email address, causing decryption failure

Steps to reproduce

1. Import a valid S/MIME certificate (including the private key) in Nextcloud Mail.
2. Receive an encrypted S/MIME message (Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data).
3. Open the message.
4. The message cannot be decrypted and Mail returns:
   Failed to find a suitable S/MIME certificate for decryption
5. After investigating the database, the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the recipient email address.
   Example:
   email_address = "[EG] F12013577 RI-C16 0001"
   instead of
   email_address = "correo@autorizado.com"
6. Updating the "email_address" field to the actual recipient email immediately fixes the issue without any other changes.

Expected behavior

The imported S/MIME certificate should store the recipient email address (RFC822Name / emailAddress) instead of the certificate Common Name.

After importing the certificate, Mail should automatically find the correct certificate and decrypt encrypted S/MIME messages without requiring any manual database changes.

Actual behavior

After importing a valid S/MIME certificate (including the private key), encrypted S/MIME messages cannot be decrypted.

Mail returns:

Failed to find a suitable S/MIME certificate for decryption

The server log contains:

OCA\Mail\Exception\SmimeDecryptException:
Failed to find a suitable S/MIME certificate for decryption

After investigating the database, I found that the imported certificate is stored with the certificate Common Name in the "email_address" field instead of the actual recipient email address.

Example:

email_address = "[EG] F12013577 RI-C16 0001"

instead of

email_address = "correo@autorizado.com"

Updating this field manually immediately fixes the issue. S/MIME decryption works correctly without any other changes.

The affected certificate is issued by Banco de España and contains a private key. The same certificate decrypts the same messages correctly in SnappyMail, so the certificate itself appears to be valid.

Only the signature verification warning remains.

Mail app version

5.5.17

Nextcloud version

30.0.17.2

Mailserver or service

Dovecot IMAP

Operating system

Ubuntu 24.04

PHP engine version

PHP 8.3

Nextcloud memory caching

memcache.local

Web server

Apache (supported)

Database

MariaDB

Additional info

No response