{"id":1274,"date":"2020-01-07T03:07:13","date_gmt":"2020-01-07T01:07:13","guid":{"rendered":"http:\/\/itsimple.info\/?p=1274"},"modified":"2024-01-24T17:37:16","modified_gmt":"2024-01-24T15:37:16","slug":"how-to-create-self-signed-smime-certificate-and-install-on-outlook","status":"publish","type":"post","link":"https:\/\/itsimple.info\/?p=1274","title":{"rendered":"How To Create Self Signed S\/MIME Certificate and install on outlook"},"content":{"rendered":"

Email security become major issue as a lot of viruses, spam, fishing attempts use this method as major platform to attack individual and organization, one way is to sign & encrypt you emails so the receiving part can be 100% sure you are the sender and the email content can be trusted . S\/MIME<\/a> stands for Secure\/Multipurpose Internet Mail Extensions .<\/b> The best way is to buy certificate from trusted authority or try getting one for free valid for one year from here : https:\/\/www.actalis.it\/products\/certificates-for-secure-electronic-mail.aspx<\/a><\/p>\n

https:\/\/extrassl.actalis.it\/portal\/uapub\/freemail?lang=en<\/a><\/pre>\n
However in this tutorial I will Show how to create self-signed certificate with self Authority .Lets begin.<\/p>\n
First you will need to install OpenSSL on windows, and you can download it from here :\u00a0 https:\/\/slproweb.com\/products\/Win32OpenSSL.html <\/a>or from here : http:\/\/gnuwin32.sourceforge.net\/packages\/openssl.htm<\/a><\/p>\n
all the command you should run from command prompt under the installation directory in BIN folder. Lets say you have install it to :<\/p>\n
C:\\OpenSSL-Win64\\<\/pre>\n
So run the command from :<\/p>\n
C:\\OpenSSL-Win64\\bin<\/pre>\n
First lets create Private key for our Authority :<\/p>\n
openssl genrsa -aes256 -out ca.key 4096<\/pre>\n
enter password for the key. Next Lets create self-sign certificate for our private authority valid for 3650 (10 years)\u00a0 :<\/p>\n
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt<\/pre>\n
Fill al the information in the wizard in order to create the certificate using the password you have selected before for the private key .<\/p>\n
Next lets create an RSA Private Key for the Personal E-Mail Certificate, again you will have to create password for the private key :<\/p>\n
openssl genrsa -aes256 -out smime_test_user.key 4096<\/pre>\n
We should create a file called smime.cnf in C:\\OpenSSL-Win64\\bin , Create text file->change its name to smime.cnf and enter this content as template for the certificate :<\/p>\n
[req]\ndistinguished_name = req_distinguished_name\n\n[req_distinguished_name]\ncountryName = Country Name (2 letter code)\ncountryName_default = AU\ncountryName_min = 2\ncountryName_max = 2\nstateOrProvinceName = State or Province Name (full name)\nstateOrProvinceName_default = Some-State\nlocalityName = Locality Name (eg, city)\n0.organizationName = Organization Name (eg, company)\n0.organizationName_default = Internet Widgits Pty Ltd\norganizationalUnitName = Organizational Unit Name (eg, section)\ncommonName = Common Name (e.g. server FQDN or YOUR name)\ncommonName_max = 64\nemailAddress = Email Address\nemailAddress_max = 40\n\n[smime]\nbasicConstraints = CA:FALSE\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer\nsubjectAltName = email:copy\nextendedKeyUsage = emailProtection<\/pre>\n
Now we are ready to create CSR; Certificate Signing Request :<\/p>\n
openssl req -new -key smime_test_user.key -out smime_test_user.csr<\/pre>\n
We now ready to create Certificate signed with our Private authority :<\/p>\n
openssl x509 -req -days 3650 -in smime_test_user.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out smime_test_user.crt -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout -extfile smime.cnf -extensions smime<\/pre>\n
Now you have created self signed certificate with the Private authority, Although outlook and outher email client use p12 certificate style, Lets create this kind of certificate :<\/p>\n
openssl pkcs12 -export -in smime_test_user.crt -inkey smime_test_user.key -out smime_test_user.p12<\/pre>\n
Enter the password you have created for the private key before . Now you have all the certificates you will need. in order to trust those certificates you will need to install them on the computer.<\/p>\n
First install the ca.crt under Trusted Root Certificate authority as this will give the certificate validation, to do so :<\/p>\n
run mmc-> file ->add\/remove snap-ins-> select certificate -> computer account -> Local computer -> finish<\/pre>\n
Now Expand certificate and with the left mouse key import ca.crt to Trusted Root Certificate authority -> import smime_test_user.p12 under personal -> make sure the certificate is valid without errors<\/p>\n
You shoud do it for both side computer, sender & receiver , is you have created self-signed on the receiver side this certificates should be install on all side (cert exchange) .<\/p>\n
Installing the certificate on outlook as describe very nicely at\u00a0https:\/\/www.ssl.com\/how-to\/installing-an-s-mime-certificate-and-sending-secure-email-with-outlook-on-windows-10<\/a>\u00a0 :<\/p>\n
\n
    \n
  1. Download your certificate.<\/strong>\n
    Download a PKCS#12 file with your certificate from your\u00a0SSL.com\u00a0account by clicking the link supplied in your Certificate Activation Link email and following the on-screen instructions in your web browser. You will be prompted to create a password before downloading the file. (Keep this password secure \u2013 you will need it later.)\u00a0Make sure to keep track of where you saved your\u00a0PKCS#12 file, and do not lose it.<\/strong>\u00a0If you lose your private key, you will be unable to read messages encrypted with your public key.<\/p>\n
    Note:<\/strong>\u00a0when downloading your certificate it is possible to choose between the RSA and ECDSA algorithms via the\u00a0Algorithm<\/strong>\u00a0drop-down menu. However, ECDSA keys cannot be used for email encryption, so it\u2019s best to leave this set to\u00a0RSA<\/strong>.<\/p>\n<\/li>\n
  2. Open Outlook Options.<\/strong>\n
    In Outlook, select\u00a0File<\/strong>\u00a0from the main menu, then click\u00a0Options<\/strong>.
    \n\"Options\"<\/p>\n<\/li>\n
  3. Open Trust Center.<\/strong>\n
    Select\u00a0Trust Center<\/strong>\u00a0at the bottom of the menu on the left side of the\u00a0Outlook Options<\/strong>\u00a0window.
    \n\"Click<\/p>\n<\/li>\n
  4. Open Trust Center Settings.<\/strong>\n
    Click the\u00a0Trust Center Settings<\/strong>\u00a0button.
    \n\"Click<\/p>\n<\/li>\n
  5. Select Email Security.<\/strong>\n
    Select\u00a0Email Security<\/strong>\u00a0from the left-hand menu of the\u00a0Trust Center<\/strong>\u00a0window.\"Select<\/p>\n<\/li>\n
  6. Click Import\/Export.<\/strong>\n
    Click the\u00a0Import\/Export<\/strong>\u00a0button, under\u00a0Digital IDs (Certificates)<\/strong>.
    \n\"Click<\/p>\n<\/li>\n
  7. Browse for file.<\/strong>\n
    Make sure\u00a0Import existing Digital ID from a file<\/strong>\u00a0is checked, then click\u00a0Browse\u2026<\/strong>
    \n\"Browse<\/p>\n<\/li>\n
  8. Open file.<\/strong>\n
    Navigate to the PKCS#12 file, then click\u00a0Open<\/strong>. The filename extension should be\u00a0.p12<\/code>.
    \n\"Navigate<\/p>\n<\/li>\n
  9. Enter PKCS#12 password.<\/strong>\n
    Enter the password you used when downloading the PKCS#12 file, then click\u00a0OK<\/strong>.
    \n\"Enter<\/p>\n<\/li>\n
  10. Click OK.<\/strong>\n
    Click\u00a0OK<\/strong>\u00a0on the security dialog box that pops up.
    \n\"Click<\/p>\n<\/li>\n
  11. Open encrypted email settings.<\/strong>\n
    Click the\u00a0Settings<\/strong>\u00a0button, under\u00a0Encrypted email<\/strong>.
    \n\"Click<\/p>\n<\/li>\n
  12. Name security settings.<\/strong>\n
    Enter a name for your security settings.
    \n\"Enter<\/p>\n<\/li>\n
  13. Choose signing certificate.<\/strong>\n
    Click\u00a0Choose<\/strong>, next to\u00a0Signing Certificate<\/strong>.
    \n\"Click<\/p>\n<\/li>\n
  14. Confirm or select certificate.<\/strong>\n
    If you have only installed one certificate (as shown here), you can click\u00a0OK<\/strong>\u00a0on the\u00a0Confirm Certificate<\/strong>\u00a0dialog box that pops up. Otherwise, you will have to choose one from a list of installed certificates.
    \n\"Confirm<\/p>\n<\/li>\n
  15. Set hash algorithm.<\/strong>\n
    Set the\u00a0Hash Algorithm<\/strong>\u00a0to\u00a0SHA256.<\/strong>
    \n\"Set<\/p>\n<\/li>\n
  16. Choose encryption certificate.<\/strong>\n
    Click\u00a0Choose<\/strong>, next to\u00a0Encryption Certificate<\/strong>, and click\u00a0OK<\/strong>\u00a0on the\u00a0Confirm Certificate<\/strong>\u00a0dialog box. Again, if you have more than one certificate, select the same one you chose for\u00a0Signing Certificate<\/strong>.
    \n\"Choose<\/p>\n<\/li>\n
  17. Close window.<\/strong>\n
    Click\u00a0OK<\/strong>\u00a0to close the\u00a0Change Security Settings<\/strong>\u00a0window.<\/p>\n<\/li>\n
  18. Set S\/MIME defaults.<\/strong>\n
    Set your desired default options for S\/MIME email via the four checkboxes under\u00a0Encrypted email<\/strong>, then click\u00a0OK<\/strong>\u00a0to close the\u00a0Trust Center<\/strong>\u00a0Window.
    \n\"Set<\/p>\n<\/li>\n
  19. Set S\/MIME options in a new message.<\/strong>\n
    Now that your S\/MIME certificate is installed and configured, you can start sending signed and encrypted messages. Begin by creating a new email message in Outlook. Under\u00a0Options<\/strong>, you can toggle the encryption and\/or digital signature settings for the message.
    \n\"Outlook\"<\/p>\n<\/li>\n
  20. Allow Outlook to use your private key.<\/strong>\n
    After sending, click\u00a0Allow<\/strong>\u00a0in the\u00a0Windows Security<\/strong>\u00a0dialog box that appears, allowing Outlook to use your private key.
    \n\"Security<\/p>\n<\/li>\n
  21. Potential problem with encryption.<\/strong>\n
    Note that if you attempt to send encrypted email and do not have your recipient\u2019s public key, you will get an error message giving the option to send the message unencrypted. You can solve this issue by having them send you a signed email message, then adding them as a contact in Outlook.
    \n\"Error<\/p>\n<\/li>\n
  22. Confirm signature.<\/strong>\n
    When your contact sends you a signed email, you should see a small ribbon icon in the upper right corner of the message. You can confirm the certificate\u2019s details by clicking the icon.
    \n\"Signed<\/p>\n<\/li>\n
  23. Add contact (step 1).<\/strong>\n
    Right-click the sender\u2019s name and select\u00a0Add to Outlook Contacts<\/strong>.
    \n\"Add<\/p>\n<\/li>\n
  24. Add contact (step 2).<\/strong>\n
    Click\u00a0Save and Close<\/strong>\u00a0to save your contact. You will now be able to send encrypted email to this recipient.
    \n\"Save<\/p>\n<\/li>\n<\/ol>\n<\/div>\n
    For more detailed information about S\/MIME email, please see our article,\u00a0Sending Secure Email with S\/MIME<\/a>. You can also check out our blog article,\u00a0Business Email Compromise and S\/MIME Certificates<\/a>, which discusses the pervasive problem of email-based cyber attacks experienced by business owners and how our services offer strong protection against such threats.<\/p>\n
    When trying to send encryped email you might get error : valid certificate :<\/p>\n
    \"\"<\/a><\/p>\n
    To Fix this you can import the certificate smime_test_user.p12 :<\/p>\n
    1. Open control panel, navigate to Network and Internet-> Internet Options<\/strong>.\n2. In prompt Internet Properties Window, select \u201cContent<\/strong>\u201d tab->Click on \u201cCertificates<\/strong>\u201d button.\n3. In prompt Certificate window, select \u201cPersonal<\/strong>\u201d tab->Select the certificate you applied for and issued to your current account.<\/pre>\n
    You can import again from there again the certificate<\/p>\n
    \n
    Good Luck<\/h3>\n","protected":false},"excerpt":{"rendered":"
    Email security become major issue as a lot of viruses, spam, fishing attempts use this method as major platform to attack individual and organization, one way is to sign & encrypt you emails so the receiving part can be 100% sure you are the sender and the email content can be trusted . S\/MIME stands […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,22,4,12,14,15],"tags":[],"class_list":["post-1274","post","type-post","status-publish","format-standard","hentry","category-operating-systems","category-security","category-tech","category-tutorials","category-windows","category-windows-server"],"_links":{"self":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/1274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1274"}],"version-history":[{"count":0,"href":"https:\/\/itsimple.info\/index.php?rest_route=\/wp\/v2\/posts\/1274\/revisions"}],"wp:attachment":[{"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsimple.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}