How to encrypt and sign your emails with S/MIME

With S/MIME, emails can be encrypted so that only the intended recipient can read them. The recipient’s public key is used to encrypt the message, and the cor­re­spond­ing private key can decrypt it. S/MIME cer­tifi­cates can be easily imported into mail clients.

What is S/MIME?

In RFC 1847 from 1995, two security en­hance­ments for the email standard MIME (Mul­ti­pur­pose Internet Mail Extension) were specified: the multipart/signed format for signing messages and the multipart/encrypted format for their en­cryp­tion. Four years later, the IETF (Internet En­gi­neer­ing Task Force) released the MIME extension S/MIME—described in RFC 2633—a standard sup­port­ing the afore­men­tioned signature format.

For en­cryp­tion, the method uses its own solution ap­pli­ca­tion/pkcs7-mime. You can freely choose whether an email with S/MIME should only be encrypted, only signed, or if both op­er­a­tions should be applied.

S/MIME en­cryp­tion and signing are possible with all common email clients, such as Microsoft Outlook, Thun­der­bird, or Apple Mail. A well-known al­ter­na­tive that supports both multipart/signed and multipart/encrypted is OpenPGP defined in 2007.

How do S/MIME en­cryp­tion and signing work?

S/MIME is based on an asym­met­ric en­cryp­tion method and therefore utilizes a key pair con­sist­ing of a private key and a public key. While the public key is shared with all email contacts, the private key is only ac­ces­si­ble to the user. It is needed both to send encrypted emails in com­bi­na­tion with the recipient’s public key and to decrypt received messages. With an S/MIME cer­tifi­cate, the email client can generate and exchange keys—this cer­tifi­cate can be obtained from various providers.

For email en­cryp­tion to work, each S/MIME message is prefixed with header in­for­ma­tion that provides the receiving client with the necessary details for capturing and pro­cess­ing the content. This includes, among other things, the content type—such as “enveloped-data” for encrypted data—the cor­re­spond­ing filename (e.g., smime.p7m for signed or encrypted data), or the encoding format. A possible header of an encrypted email might look like this:

Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name=smime.p7m
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=smime.p7m

S/MIME signing, which can be au­to­mat­i­cal­ly attached when composing an email, is practical for several reasons: It provides the recipient with the public key for secure com­mu­ni­ca­tion, allowing them to send you messages with encrypted content. Ad­di­tion­al­ly, the signature proves that the email was actually sent by you. Unlike PGP, adding a signature does not result in cryptic char­ac­ters appearing. If the receiving email client detects in­con­sis­ten­cies when verifying the received signature, the le­git­i­ma­cy of the message is not confirmed, allowing the user to deduce potential data ma­nip­u­la­tion.

How to obtain an S/MIME cer­tifi­cate for your email com­mu­ni­ca­tion?

As already mentioned, using S/MIME requires a cer­tifi­cate (X.509). In principle, it’s possible to create one yourself—however, you first need to generate a root cer­tifi­cate. Ad­di­tion­al­ly, all com­mu­ni­ca­tion partners must import this root cer­tifi­cate before the actual key exchange can begin. The much easier and more straight­for­ward solution is to purchase a cer­tifi­cate from an official cer­ti­fi­ca­tion authority. Typically, the available cer­tifi­cates are clas­si­fied into the following three classes:

• Class 1: The cer­tifi­cate created by the cer­ti­fi­ca­tion authority ensures the au­then­tic­i­ty of the specified email address.
• Class 2: The cer­tifi­cate ensures the au­then­tic­i­ty of the specified email address and the as­so­ci­at­ed name. Ad­di­tion­al­ly, the company is verified if relevant. Ver­i­fi­ca­tion of the in­for­ma­tion happens through third-party databases or ID copies.
• Class 3: Class 3 cer­tifi­cates differ from Class 2 cer­tifi­cates in that the applicant must per­son­al­ly identify them­selves.

If you want to encrypt your emails with S/MIME and are looking for a cer­tifi­cate, you should never lose sight of its core function: It is meant to secure your email com­mu­ni­ca­tion by pre­vent­ing the in­ter­cep­tion and ma­nip­u­la­tion of message content. For this reason, it is of utmost priority to choose a provider known for re­li­a­bil­i­ty and trust­wor­thi­ness.

A rec­om­mend­ed service, whose cer­tifi­cates are re­port­ed­ly trusted by 99 percent of all email clients, is Sectigo (formerly Comodo). The cer­ti­fi­ca­tion authority, primarily known for high-quality SSL cer­tifi­cates, offers cer­tifi­cates for private use (starting at $24.50 per year), enabling secure end-to-end email en­cryp­tion with S/MIME.

How to set up S/MIME in your email program

To integrate the email security procedure into your email client, you’ll logically need the S/MIME cer­tifi­cate first—finding a provider is thus the first step to a secure mailbox. Next, you’ll need to create a per­son­al­ized cer­tifi­cate and install it. While the exact process varies slightly, it is generally similar across providers. After in­stal­la­tion, configure the email program to use S/MIME by accessing the in­te­grat­ed cer­tifi­cate. Typically, the setup process concludes with restart­ing the client, after which specific features for manual or automatic en­cryp­tion and signing of messages are activated.

In the following sections, you will find detailed in­struc­tions for setting up S/MIME on the desktop systems Windows and macOS as well as on the mobile systems iOS and Android.

Setting up S/MIME on Windows

If you want to use S/MIME tech­nol­o­gy on a Windows PC without investing in Outlook or Microsoft Office, you can turn to the free al­ter­na­tive Thun­der­bird, which, like the Firefox browser, comes from Mozilla. If you haven’t installed the client and set up an account yet, you should do so first. Then proceed as follows to activate S/MIME en­cryp­tion and signing for this account:

1. After obtaining your cer­tifi­cate from a provider of your choice, start Thun­der­bird and open the Settings as the first step. Under the menu item “Privacy & Security,” you will find “Cer­tifi­cates.” Click the “Manage Cer­tifi­cates…” button.

Close

2. You will enter the cer­tifi­cate man­age­ment menu. Select the tab “Your Cer­tifi­cates” and import the cer­tifi­cate you received and saved from your provider by clicking “Import…” and selecting it. Then enter the password you received from the provider to complete the process.

Close

3. Now navigate to the account settings of the email account for which you want to set up en­cryp­tion. Click on the menu item “End-To-End En­cryp­tion.” Here, you’ll find an entry for S/MIME and can select the cer­tifi­cate you just imported for signing and en­crypt­ing your emails by clicking the “Select…” button.

Close

4. When you then compose an email, you can in­di­vid­u­al­ly enable or disable the processes through the S/MIME button in the toolbar and also decide whether to use S/MIME for en­crypt­ing, signing, or both:

Close

Re­gard­less of whether en­cryp­tion and signature are added manually or au­to­mat­i­cal­ly in Thun­der­bird, you should keep in mind that the subject line remains readable.

Setting up S/MIME on macOS and iOS

Apple devices come with the built-in mail client, which allows you to encrypt and sign emails with S/MIME right from the start. If you have an email account, you can directly create a cer­tifi­cate with your provider without needing to install another program. The procedure does not differ from that on Windows: you visit your provider’s site, and the cer­tifi­cate is created based on your personal data. Then, proceed as follows to install the cer­tifi­cate and set up S/MIME en­cryp­tion:

1. Open the email sent by your provider and download the cer­tifi­cate to any folder. The received file can be opened directly on macOS with a double click to add it to the Keychain Access. If you want to use S/MIME on your iPhone or iPad, you can send it to your mobile device via email.
2. After in­stal­la­tion, you just need to start or restart Apple Mail to integrate the en­cryp­tion and signing process.
3. You can now test S/MIME by sending yourself an encrypted and signed message. Open Apple Mail and create a new email. Select the email account for which an S/MIME cer­tifi­cate is stored in the Keychain in the “From” field. Two icons will now appear in the email header: a checkmark for the signature and a lock for the en­cryp­tion.

Con­fig­ur­ing S/MIME for your Android device

Android, like Windows, does not have its own client for in­te­grat­ing S/MIME. However, there are various apps that support the method and can be down­loaded from the Google Play Store. Among the free solutions is the open-source app FairEmail (the ad-free Pro version is paid). As in the setup of S/MIME en­cryp­tion and signing on Windows and macOS, you first need a valid cer­tifi­cate, which you can create in the manner already explained. The next steps are as follows:

1. To import your created cer­tifi­cate, first open the “En­cryp­tion” menu in the app settings. Scroll to “S/MIME“ and press “Import private key”.

Close

2. In the same menu, specify which signature algorithm and en­cryp­tion algorithm should be used. Then, at the top of the en­cryp­tion menu (“General”), you can set when your messages should be encrypted—e.g., by default or when replying to a received encrypted message.

Close

3. When you now compose messages, en­cryp­tion and signature are au­to­mat­i­cal­ly added—provided you chose this option in the previous step. Otherwise, you can use the pre­vi­ous­ly mentioned buttons at the end of the message window to activate the pro­tec­tion mech­a­nisms.