CrypTool 1.4.42: Certificate creation fails at af_certify() – bundled CA expired in July 2026 #2

Bug description

When generating a new asymmetric RSA key pair in CrypTool 1.4.42, certificate creation fails with the following error message:

Fehler bei der Zertifikatserstellung(2).
Bitte CrypTool neu installieren.
Interne Fehlermeldung:
(null)

The issue may be related to the expiration of CrypTool's bundled root CA certificate on July 6, 2026.

Environment

• CrypTool version: 1.4.42 (German)
• Operating system: Windows 11
• Date of occurrence: November 1, 2026
• Affected functionality: Digital Signatures/PKI → PKI → Generate/Import Keys → RSA key generation

Steps to reproduce

1. Start CrypTool 1.4.42.
2. Navigate to Digital Signatures/PKI → PKI → Generate/Import Keys.
3. Select RSA and enter the required information.
4. Attempt to generate a new key pair and certificate.
5. Observe the error message shown above.

Troubleshooting performed

The following attempts did not resolve the issue:

• Running CrypTool with administrator privileges.
• Renaming the user-specific PSE directory to force CrypTool to initialize a fresh key store.
• Restarting CrypTool and repeating the key generation.

The PSE directory was successfully recreated, but certificate creation continued to fail.

Source code investigation

The error can be traced to CrypTool/DlgKeyAsymGeneration.cpp.

At approximately line 982, the following call is made:

Zert2 = theApp.SecudeLib.af_certify(
    PseHandle2,
    Zert,
    NULL,
    theApp.SecudeLib.sha1WithRSASignature_aid,
    NULL
);

When this function returns NULL, CrypTool displays the error IDS_STRING_ASYMKEY_ERR_CREATE_CERT_2.

This suggests that the initial key generation and prototype certificate creation succeed, but the subsequent CA certification step fails.

Relevant source code

Potential root cause: Expired CA certificate

The bundled CA database in:

setup/template/pse/pseca/cert.pag

contains the following certificate validity values:

• 060706000000Z – July 6, 2006
• 260706000000Z – July 6, 2026

These dates are also documented in older CrypTool documentation, which states that the built-in CA certificate is valid for 20 years, from July 6, 2006, until July 6, 2026.

The bundled CA files in the repository also match the file sizes of those installed with CrypTool 1.4.42.

Since the error occurs after the CA expiration date and specifically during the af_certify() call, the expired CA certificate appears to be a plausible root cause.

However, this causal relationship has not yet been conclusively verified through a controlled test with an earlier system date.

Expected behavior

CrypTool should successfully generate a new asymmetric key pair and its associated certificate.

Actual behavior

The CA certification step fails, preventing the newly generated key pair from being stored and used through the PKI functionality.

Questions

1. Could the expiration of the bundled CA certificate be responsible for the failure?
2. Is there an existing workaround or a way to renew the internal CA-PSE?
3. Could an updated CA certificate and corresponding PSE/database be provided in a maintenance release?

Thank you for maintaining CrypTool 1!