How do I set up S/MIME signing and encryption?

What is S/MIME?

S/MIME is a standard protocol for email encryption and digital signatures. It allows users to digitally sign emails to verify that they are the legitimate sender and that the email has not been altered. This makes it an effective defense against many phishing attacks. It also lets you encrypt emails to protect them from unauthorized access.

Basic flow of S/MIME digital signature validation and encryption

• S/MIME is primarily used in enterprise applications. To encrypt emails, you must request and purchase an email certificate from a Certificate Authority (CA), install and configure the certificate, and exchange public keys with recipients through digital signatures.

  • How to use digital signatures for email

    • Sender side: Upload a digital certificate to generate a private key and a public key. When sending an email, enable the digital signature feature. This action uses the private key to generate a digital signature. The digital signature and the digital certificate, which includes the public key, are sent with the email to the recipient.

    • The recipient performs the following steps after receiving the email.

      • The digital certificate is retrieved and its trustworthiness is checked by verifying its validity period, trust chain, and revocation status.

      • The sender's public key is used to decrypt the digital signature and obtain the original hash. The email's hash is then recalculated and compared with the original. The result of the validation is then provided.

        • Match: The email has not been altered and the signature is trusted.

        • Mismatch: The email has been altered or the signature is not trusted.

  • How to use email encryption

    • Sender side: You must first receive an email that contains the recipient's digital signature. You can then save the recipient's digital signature, which contains the public key, either automatically or manually. When sending an email to that recipient, encrypt it with their public key.

    • Recipient side: When you receive an email encrypted with your public key, you can decrypt it with your private key.

User-side S/MIME certificate management

You can manage your S/MIME certificates and configure the digital signature and email encryption features.

Path: Settings > View more settings > Account and Security > S/MIME Settings

Import a new certificate

You can upload S/MIME user certificates to the Alibaba Mail server for hosting. After you add a certificate, you can use it for email encryption and digital signatures (S/MIME).

The file must be in PKCS#12 format with a .p12 or .pfx extension.

When you import a .pfx or .p12 certificate file that contains a private key, enter the certificate password when prompted.

If the newly imported certificate is the only one hosted for the current mailbox account, the system sets it as the default certificate for digital signatures and encryption.

After a successful import, you can view the certificate details.

Digital signature

When this feature is enabled, your digital signature is attached to outgoing emails. This allows recipients to verify the authenticity of the email source and exchange public keys for email encryption.

Email encryption

When this feature is enabled, outgoing emails are encrypted using the recipient's public key. This ensures that only the recipient can decrypt and read the email.

Sending scenario

If you enable email encryption, a digital signature is automatically attached when you send an email. Encrypted emails must be digitally signed.

During your first interaction with a recipient, you can also choose to send only a digital signature without encrypting the email. This lets you exchange public keys and establish a connection.

If the public key for a specified recipient does not exist, a message is displayed to inform you that the key for that email address is missing.

Receiving scenario

If the digital signature and encryption features are enabled, Alibaba Mail automatically verifies the validity of the signature on incoming digitally signed emails.

Cannot verify the sender's identity

The source of this email's digital signature is not trusted. Therefore, the system cannot confirm the sender's identity. Handle with caution. If you have questions, contact your mailbox administrator.

Autosave: If the sender's certificate meets the conditions for autosaving, such as being issued by a trusted CA, its public key is automatically saved to the local certificate store.

A digital signature can have one of the following three statuses:

• Signature verification passed (The digital signature is valid).

• Signature verification passed but the certificate is not trusted (Cannot verify the sender's identity. The trust chain is incomplete because the certificate was not issued by a trusted CA or the corresponding root certificate for a self-signed certificate was not found).

• The digital signature verification failed because the message body and the signature do not match.

  • Data tampering

    • Message: "The digital signature verification for this email failed. The email body may have been tampered with. Handle with caution."

      • Certificate expired:

        • Message: "The digital signature certificate for this email has expired. The system cannot verify the sender's identity. Handle this email with caution."

      • Certificate revoked:

        • Message: "The digital signature certificate for this email has been revoked. The system cannot verify the sender's identity. Handle this email with caution."

      • Certificate data corruption:

        • Message: "The digital signature data for this email is corrupted and cannot be verified. Handle this email with caution."

FAQ

Page error: "This email is encrypted"

The page displays a message: "You have received an encrypted email, but the encryption feature is not enabled. This email cannot be decrypted because the digital signature and encryption feature (S/MIME) is not enabled for your mailbox. If you have questions, contact your administrator".

Solution: First, your administrator must log on to the mailbox domain management console to enable the S/MIME feature (see S/MIME overview) and import the organization certificate. Then, you must import a personal certificate (see the Import a new certificate section in this topic) and enable the Digital signature and Email encryption features.

References

For information about how administrators can configure the S/MIME service, see S/MIME overview.