Introduction to S/MIME
Use Secure/Multipurpose Internet Mail Extensions (S/MIME) to make the emails that users send and receive more secure.
This feature is available only in the Premium Edition. For more information about the different editions, see Edition comparison.
What is S/MIME?
S/MIME is a standard protocol for email encryption and digital signatures. It allows users to digitally sign emails to verify that they are the legitimate sender and that the email has not been altered. This makes it an effective defense against many phishing attacks. It also lets you encrypt emails to protect them from unauthorized access.
Basic flow of S/MIME digital signature validation and encryption
S/MIME is primarily used in enterprise applications. To encrypt emails, you must request and purchase an email certificate from a Certificate Authority (CA), install and configure the certificate, and exchange public keys with recipients through digital signatures.
How to use digital signatures for email
Sender side: Upload a digital certificate to generate a private key and a public key. When sending an email, enable the digital signature feature. This action uses the private key to generate a digital signature. The digital signature and the digital certificate, which includes the public key, are sent with the email to the recipient.
The recipient performs the following steps after receiving the email.
The digital certificate is retrieved and its trustworthiness is checked by verifying its validity period, trust chain, and revocation status.
The sender's public key is used to decrypt the digital signature and obtain the original hash. The email's hash is then recalculated and compared with the original. The result of the validation is then provided.
Match: The email has not been altered and the signature is trusted.
Mismatch: The email has been altered or the signature is not trusted.
How to use email encryption
Sender side: You must first receive an email that contains the recipient's digital signature. You can then save the recipient's digital signature, which contains the public key, either automatically or manually. When sending an email to that recipient, encrypt it with their public key.
Recipient side: When you receive an email encrypted with your public key, you can decrypt it with your private key.
For instructions for users, see How do I set up S/MIME signature and encryption features?
Administrator side (configure the S/MIME service)
1. Log on to Alibaba Mail as the postmaster administrator. The Domain Management page opens by default. Click Security Management > Email Encryption (S/MIME).
After you enable Email Encryption and Digital Signature (S/MIME), members of your organization can use S/MIME to verify sender identities and protect emails from being intercepted during transmission.
If this feature is disabled, the following functions are unavailable:
Upload and manage S/MIME personal certificates
Signing and Verifying Digital Signatures
Encrypt and decrypt emails
Trusted root certificates: Add and manage trusted root certificates in this section. Email certificates and digital signatures issued by these root certificates are validated within your organization. This ensures smooth encrypted communication within your organization and with your partners.
Add a certificate
Select a root certificate file in PEM format. The file size cannot exceed 1 MB.
For security purposes, a root certificate must not directly issue an end-entity certificate. You must upload a certificate chain that contains at least one intermediate certificate.
Validation fails if:
The certificate is not a CA root certificate.
The certificate does not contain specific X.509 v3 extension properties.
The uploaded file contains multiple root certificates.
The certificate has expired.
Note:
1. Administrator uploads a PEM certificate: This action establishes a basis of trust and validates whether user certificates are legitimate.
Privacy-Enhanced Mail (PEM) is a Base64-encoded text format that typically has a .pem extension. It contains only the public key certificate and not the private key.
2. User uploads a PFX/P12 certificate: This action provides the private key and certificate to enable email signing and decryption.
Personal Information Exchange (PFX), also known as PKCS#12 (.p12), is a binary format that contains the user's private key.
After the certificate is imported, you must fill in the Applicable Domain Names field. This field is required and specifies the domain names to which the certificate applies. You must enter at least one domain name. If you enter multiple domain names, separate them with commas, such as example1.com,example2.com.
Modify a certificate
In the certificate management list, click Edit. On the certificate editing page, you can edit the Applicable Domain Names field. However, you cannot delete or replace the root certificate file.
Delete a certificate
If you delete a root certificate, user certificates issued by that root certificate will no longer be trusted.