Komorebi
Documentation

Certificate pinning and the encrypted cache

Trust a self-signed or private-CA mail server by its certificate, key or issuing CA, and encrypt the local mail cache with a key only your Windows user can unlock.

On this page

Certificates

Komorebi checks every server certificate with Windows. A password is sent only after the TLS session is up and the certificate passed that check, or is the one you pinned. STARTTLS is never optional: a server that does not offer it never receives the password.

Pinning your own server's certificate

For a self-signed or private-CA server, a check fails on the untrusted certificate and offers Review certificate. It connects to the server without sending any credentials, only to read its certificate, and shows the Trust this certificate? prompt with the full SHA-256 fingerprint and the certificate's details. Compare the fingerprint with the one your server reports: the first trust decision is yours. Nothing is saved until you confirm.

The Trust this certificate? prompt with the SHA-256 fingerprint and certificate details of a made-up server

The prompt offers what to trust:

  • This exact certificate: reviewed again when the server renews it.
  • This server key: the SHA-256 of its public key, so a renewal that keeps the key passes.
  • The issuing CA: offered when the server sends a chain past its own certificate. Windows then checks every certificate against that CA alone, with the host name.

The pin is saved per server (host, port and role) in the local cache and used only to recognise that server. A pinned server that presents another certificate is refused before any password is sent, and the account's status line offers Review certificate, with the saved fingerprint beside the new one. A pin never makes Windows' own trusted roots acceptable for that server. Changing the host, port or security setting clears that server's pin, and Forget certificate on the account's page removes it.

Encrypted cache

Settings > Privacy > Encrypt the mail cache on this computer is off by default. After a question that explains the risk, the next start (or Restart now) converts the cache. The conversion is crash-safe, and turning the setting off converts it back the same way.

Settings, Privacy: remote images, the encrypted cache and data removal

When it is on:

  • Every page of the cache and its write-ahead log is sealed with AES-256-GCM. A changed, swapped or zeroed page is refused rather than read.
  • The key is in cache.sqlite3.key, protected by Windows (DPAPI) so that only your Windows user can unlock it.
  • Copies of draft attachments (cache.drafts) and of opened attachments (cache.open) are not encrypted, and the setting says so. Passwords are in Windows Credential Manager either way.