--- a/mailnews/extensions/smime/src/nsMsgComposeSecure.cpp
+++ b/mailnews/extensions/smime/src/nsMsgComposeSecure.cpp
@@ -515,20 +515,18 @@ nsresult nsMsgComposeSecure::MimeInitEnc
   PR_Free(s);
   s = 0;
 
   /* Now initialize the crypto library, so that we can filter the object
    to be encrypted through it.
    */
 
   if (!mIsDraft) {
-    uint32_t numCerts;
-    mCerts->GetLength(&numCerts);
-    PR_ASSERT(numCerts > 0);
-    if (numCerts == 0) return NS_ERROR_FAILURE;
+    PR_ASSERT(!mCerts.IsEmpty());
+    if (mCerts.IsEmpty()) return NS_ERROR_FAILURE;
   }
 
   // Initialize the base64 encoder
   MOZ_ASSERT(!mCryptoEncoder, "Shouldn't have an encoder already");
   mCryptoEncoder.reset(
       MimeEncoder::GetBase64Encoder(mime_encoder_output_fn, this));
 
   /* Initialize the encrypter (and add the sender's cert.) */
@@ -773,21 +771,16 @@ FAIL:
  */
 nsresult nsMsgComposeSecure::MimeCryptoHackCerts(const char *aRecipients,
                                                  nsIMsgSendReport *sendReport,
                                                  bool aEncrypt, bool aSign,
                                                  nsIMsgIdentity *aIdentity) {
   nsCOMPtr<nsIX509CertDB> certdb = do_GetService(NS_X509CERTDB_CONTRACTID);
   nsresult res;
 
-  mCerts = do_CreateInstance(NS_ARRAY_CONTRACTID, &res);
-  if (NS_FAILED(res)) {
-    return res;
-  }
-
   PR_ASSERT(aEncrypt || aSign);
 
   /*
    Signing and encryption certs use the following (per-identity) preferences:
    - "signing_cert_name"/"encryption_cert_name": a string specifying the
      nickname of the certificate
    - "signing_cert_dbkey"/"encryption_cert_dbkey": a Base64 encoded blob
      specifying an nsIX509Cert dbKey (represents serial number
@@ -895,21 +888,21 @@ nsresult nsMsgComposeSecure::MimeCryptoH
        message.)
        */
 
       bool isSame;
       if (NS_SUCCEEDED(cert->Equals(mSelfEncryptionCert, &isSame)) && isSame) {
         already_added_self_cert = true;
       }
 
-      mCerts->AppendElement(cert);
+      mCerts.AppendElement(cert);
     }
 
     if (!already_added_self_cert) {
-      mCerts->AppendElement(mSelfEncryptionCert);
+      mCerts.AppendElement(mSelfEncryptionCert);
     }
   }
   return res;
 }
 
 NS_IMETHODIMP nsMsgComposeSecure::MimeCryptoWriteBlock(const char *buf,
                                                        int32_t size) {
   int status = 0;

--- a/mailnews/extensions/smime/src/nsMsgComposeSecure.h
+++ b/mailnews/extensions/smime/src/nsMsgComposeSecure.h
@@ -8,17 +8,16 @@
 
 #include "nsIMsgComposeSecure.h"
 #include "nsCOMPtr.h"
 #include "nsICMSEncoder.h"
 #include "nsIX509Cert.h"
 #include "nsIStringBundle.h"
 #include "nsICryptoHash.h"
 #include "nsICMSMessage.h"
-#include "nsIMutableArray.h"
 #include "nsString.h"
 #include "nsIOutputStream.h"
 #include "mozilla/UniquePtr.h"
 
 class nsIMsgCompFields;
 namespace mozilla {
 namespace mailnews {
 class MimeEncoder;
@@ -72,17 +71,17 @@ class nsMsgComposeSecure : public nsIMsg
   mozilla::UniquePtr<MimeEncoder> mSigEncoder;
   char *mMultipartSignedBoundary;
   nsString mSigningCertName;
   nsAutoCString mSigningCertDBKey;
   nsCOMPtr<nsIX509Cert> mSelfSigningCert;
   nsString mEncryptionCertName;
   nsAutoCString mEncryptionCertDBKey;
   nsCOMPtr<nsIX509Cert> mSelfEncryptionCert;
-  nsCOMPtr<nsIMutableArray> mCerts;
+  nsTArray<RefPtr<nsIX509Cert>> mCerts;
   nsCOMPtr<nsICMSMessage> mEncryptionCinfo;
   nsCOMPtr<nsICMSEncoder> mEncryptionContext;
   nsCOMPtr<nsIStringBundle> mSMIMEBundle;
 
   mozilla::UniquePtr<MimeEncoder> mCryptoEncoder;
   bool mIsDraft;
 
   enum { eBufferSize = 8192 };

--- a/mailnews/mime/public/nsICMSMessage.idl
+++ b/mailnews/mime/public/nsICMSMessage.idl
@@ -13,17 +13,16 @@ interface nsISMimeVerificationListener;
 
 /*
  * At the time the ptr type is eliminated in both interfaces, both should be
  * made scriptable.
  */
 [ptr] native UnsignedCharPtr(unsigned char);
 
 interface nsIX509Cert;
-interface nsIArray;
 
 /**
  * nsICMSMessage
  *  Interface to a CMS Message
  */
 [uuid(c6d51c22-73e9-4dad-86b9-bde584e33c63)]
 interface nsICMSMessage : nsISupports
 {
@@ -31,17 +30,17 @@ interface nsICMSMessage : nsISupports
   void contentIsEncrypted(out boolean aEncrypted);
   void getSignerCommonName(out string aName);
   void getSignerEmailAddress(out string aEmail);
   void getSignerCert(out nsIX509Cert scert);
   void getEncryptionCert(out nsIX509Cert ecert);
   void verifySignature();
   void verifyDetachedSignature(in Array<octet> aDigestData,
                                in int16_t aDigestType);
-  void CreateEncrypted(in nsIArray aRecipientCerts);
+  void CreateEncrypted(in Array<nsIX509Cert> aRecipientCerts);
 
   /* The parameter aDigestType must be one of the values in nsICryptoHash */
   void CreateSigned(in nsIX509Cert scert, in nsIX509Cert ecert,
                     in Array<octet> aDigestData, in int16_t aDigestType);
 
   /**
     * Async version of nsICMSMessage::VerifySignature.
     * Code will be executed on a background thread and

--- a/mailnews/mime/src/nsCMS.cpp
+++ b/mailnews/mime/src/nsCMS.cpp
@@ -8,17 +8,16 @@
 #include "CertVerifier.h"
 #include "CryptoTask.h"
 #include "ScopedNSSTypes.h"
 #include "cms.h"
 #include "mozilla/Logging.h"
 #include "mozilla/RefPtr.h"
 #include "nsArrayUtils.h"
 #include "nsDependentSubstring.h"
-#include "nsIArray.h"
 #include "nsICryptoHash.h"
 #include "nsISupports.h"
 #include "nsIX509CertDB.h"
 #include "nsNSSCertificate.h"
 #include "nsNSSComponent.h"
 #include "nsNSSHelper.h"
 #include "nsServiceManagerUtils.h"
 #include "mozpkix/Result.h"
@@ -466,38 +465,38 @@ class nsZeroTerminatedCertArray {
   CERTCertificate **getRawArray() { return mCerts; }
 
  private:
   CERTCertificate **mCerts;
   PLArenaPool *mPoolp;
   uint32_t mSize;
 };
 
-NS_IMETHODIMP nsCMSMessage::CreateEncrypted(nsIArray *aRecipientCerts) {
+NS_IMETHODIMP nsCMSMessage::CreateEncrypted(
+    const nsTArray<RefPtr<nsIX509Cert>> &aRecipientCerts) {
   MOZ_LOG(gCMSLog, LogLevel::Debug, ("nsCMSMessage::CreateEncrypted"));
   NSSCMSContentInfo *cinfo;
   NSSCMSEnvelopedData *envd;
   NSSCMSRecipientInfo *recipientInfo;
   nsZeroTerminatedCertArray recipientCerts;
   SECOidTag bulkAlgTag;
   int keySize;
   uint32_t i;
   nsresult rv = NS_ERROR_FAILURE;
 
   // Check the recipient certificates //
-  uint32_t recipientCertCount;
-  aRecipientCerts->GetLength(&recipientCertCount);
+  uint32_t recipientCertCount = aRecipientCerts.Length();
   PR_ASSERT(recipientCertCount > 0);
 
   if (!recipientCerts.allocate(recipientCertCount)) {
     goto loser;
   }
 
   for (i = 0; i < recipientCertCount; i++) {
-    nsCOMPtr<nsIX509Cert> x509cert = do_QueryElementAt(aRecipientCerts, i);
+    nsIX509Cert *x509cert = aRecipientCerts[i];
 
     if (!x509cert) return NS_ERROR_FAILURE;
 
     UniqueCERTCertificate c(x509cert->GetCert());
     recipientCerts.set(i, c.get());
   }
 
   // Find a bulk key algorithm //