The included Chain and Root

The message was marked as digitally signed, so the initial suspicion fell on the signature binary data. After viewing the message with MimeViewer, the blame was put on certificates added to the signature by the sending agent (Outlook Express in this case):

But why did Outlook Express add 8 certificates to the signature? Even more, 3 of them are duplicated in the package, increasing the size withouth any reason. MimeViewer comes to help again showing that there are two main certificates added to the message: signature certificate and preferred encryption certificate mentioned in SMIME-preference signature part.

OE simply put both certificates and all their paths, 4 certificates long, into the signature.

And the winner is ....... Outlook Express TM, with its ability to turn a six-character-long messge into a 13KB nightmare of 8 certificates. What is interesting, OE is equally well able to send the shortest signed message of the mail clients tested. The difference lies in the configuration of the sending application, OE in this case.

Other application allow configuring the number of certificates which will be sent too:

• in OWA the administrator can chose between sending only the signature certificates or all certificates in the chain, with or without the root
• OE can only be configured to send no certificates or all certificates, root inclusive
• other clients will add certificates or not on their discretion

makes 8 certificates altogether. However, both certificates were issued by the same CA, so they share the certification paths, each one 3 certificates long. This explained the "8 certificates, 3 duplicates case", but it raised next questions: what is the largest message that can be produced with real-world certificates and which mail client will produce it?

Although in this extreme case adding signature certificate chain enlarges the message dramatically, it is generally a good idea to include the certificates (without the root certificate) in the message to faciliate verification of the signature. With typical, larger messages the signature binary data, including the certificates, is only a small percent of the message size and does not create any problems.