Sun Java System Communications Express Sun logo
  Contents     Index

Signing and Encrypting Messages (S/MIME)

Mail supports the Secure/Multipurpose Internet Mail Extension (S/MIME). To use the S/MIME features to sign or encrypt a message, you must meet all of the following requirements:

The Purpose of Keys and Certificates

Your private key is used to sign your S/MIME messages and to decrypt incoming encrypted messages. Your public key is used by other mail users to encrypt messages intended for you.

To assure other mail users that you are the true owner of a private or public key, information is associated with your keys that identifies them as only belonging to you. This information is referred to as a certificate. Keys and their certificates are issued from within your organization or purchased from a third-party vendor. Regardless of how the keys and certificates are issued, the issuing organization is referred to as a certificate authority (CA).

Is the Key’s Certificate Valid?

Before Mail uses a private or public key, it must locate the key and check its expiration date in the certificate against the current date. If the key has expired, you receive a message in a pop-up window, and no further S/MIME messages are created with that key. Depending on how your system is configured, a key’s certificate is further checked against a certificate revocation list (CRL) and if it matches a certificate on the CRL, Mail may or may not use the key, depending on how your system is configured.

After a key’s certificate is determined to be valid, the key is used when sending, reading, forwarding, or replying to messages. A message can be:

Where are Keys and Certificates Stored?

You typically have one private-public key pair, but multiple ones are permitted. Your keys and their certificates are stored in one of the two ways:

Changing the S/MIME Settings

There are initial S/MIME settings for Mail, set by your system administrator, that control whether all your outgoing messages are automatically signed, automatically encrypted, or automatically signed and encrypted. The initial settings also control whether the S/MIME checkboxes at the bottom of a Messenger Express window and in the Option - Settings window are displayed as checked (feature selected) or unchecked (feature deselected).

Table 7 summarizes the use of these checkboxes.

Table 7  S/MIME Checkboxes

Text for Checkbox

Location

What You Do

Sign Message

At the bottom of the window used for composing, forwarding, or replying to a message.

  • Check the box to sign the current message.
  • Uncheck the box not to sign the current message.

Encrypt Message

At the bottom of the window used for composing, forwarding, or replying to a message.

  • Check the box to encrypt the current message.
  • Uncheck the box not to encrypt the current message.

Sign all outgoing Messages

In the Options - Settings window, under the Secure Messaging option.

  • Check the box to sign all your messages automatically.
  • Uncheck the box not to sign all your messages automatically.

Note: You can override the setting of “Sign all outgoing Messages” on a message-by-message basis with the “Sign Message” checkbox.

Encrypt all outgoing Messages

In the Options - Settings window, under the Secure Messaging option.

  • Check the box to encrypt all your messages automatically.
  • Uncheck the box not to encrypt all your messages automatically.

Note: You can override the setting of “Encrypt all outgoing Messages” on a message-by-message basis with the “Encrypt Message” checkbox.

Example of Changing a Setting for All Your Messages

In this example, the initial S/MIME settings for your messages cause all your messages to be automatically encrypted but not automatically signed. You want all your messages automatically signed too. To do that, you perform the following steps:

  1. Click the Options tab.
  2. Click Settings.
  3. Under the Secure Messaging, select the checkbox next to Sign all outgoing Messages.
  4. Click Save.

Example of Changing a Setting for One Message

In this example, the current S/MIME settings cause all your messages to be signed and encrypted automatically. You want to send a new message as signed but not encrypted. To do that, you perform the following steps:

  1. Access the New Message window.
  2. Compose a message.
  3. Click the checkbox next to Encrypt Message at the bottom of the New Message window to deselect it.
  4. Click Send to send the message as signed but not encrypted.

All subsequent outgoing messages are signed and encrypted because you temporarily changed the encryption setting for only one message.

What Can I Do With S/MIME?

S/MIME allows you to exchange signed or encrypted email messages with other Mail users who have S/MIME privileges. You can also exchange messages with Microsoft Outlook users who have S/MIME privileges. The S/MIME checkboxes located at the bottom of a Mail window and in the Options - Settings window are used to request a signature or encryption for an outgoing message. For more information about the checkboxes, refer to Changing the S/MIME Settings.

An S/MIME message, whether signed or encrypted or both, appears in your Inbox folder with a small icon at the end of the Subject line to indicate that it is an S/MIME message. For more information about the icons, refer to What Do the S/MIME Icons Mean?

Table 8 is a summary of the mail actions you can do with S/MIME.

Table 8  Allowed S/MIME Actions

Mail Action

Description

Send a signed message, with or without attachments

When you send a message as signed, a signature is added to the message which ensures that the message is from you. Your private key is used to create the signature.

For more information, refer to The Purpose of Keys and Certificates and What Do the S/MIME Icons Mean?

Send an encrypted message, with or without attachments

When you send a message as encrypted, it is specially coded using the recipient’s published public key. When the message arrives at its destination with an S/MIME icon that indicates it is properly encrypted, the recipient is assured that no tampering occurred before receiving your encrypted message.

For more information, refer to The Purpose of Keys and Certificates and What Do the S/MIME Icons Mean?

Read a signed or encrypted message, with or without attachments

A signed or encrypted message carries a special S/MIME icon at the end of the message’s Subject line.You can read a signed or encrypted message from any of these mail folders for your account:

  • Inbox folder
  • Sent folder
  • Drafts folder
  • Trash folder
  • A mail folder that you created and named

For more information about the icons, refer to What Do the S/MIME Icons Mean?

Forward a signed or encrypted message, with or without attachments

When you forward an S/MIME message, it is sent with the S/MIME features currently in effect for your outgoing messages, not with the S/MIME features it might have arrived with. It is up to you to ensure that the forwarded message is properly signed or encrypted.

For example, you receive an encrypted message from user A and want to forward it to user C as encrypted. The current S/MIME setting for your outgoing messages is always to sign but not encrypt them. Without overriding those settings, you forward the message to user C. User C receives the forwarded message as only a signed message. The message that you received as encrypted is no longer encrypted when it reaches user C.

For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.

Reply to a signed or encrypted message, with or without attachments

When you reply to an S/MIME message, it is sent with the S/MIME features currently in effect for your outgoing messages. The message you are replying to, which is part of your response, is not automatically sent with the S/MIME features it might have arrived with. It is up to you to ensure that your response and the original message is properly signed or encrypted.

For example, you receive an encrypted message from user A and want to reply to it as an encrypted message. The current S/MIME setting for your outgoing messages is always to sign but not encrypt them. Without overriding those settings, you reply to the encrypted message. User A receives your reply and the original message they authored as only a signed message. The message that you received as encrypted from user A is no longer encrypted when it returns to user A.

For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.

Save a draft message

If you need to save a draft of a new S/MIME message, it is stored in the Drafts folder as encrypted if that feature was selected. Ensure that the S/MIME features are set as desired before you eventually send the message.

For more information about overriding the S/MIME settings, refer to Changing the S/MIME Settings.

What Do the S/MIME Icons Mean?

An S/MIME message carries an icon at the end of its Subject line to indicate whether it is signed or encrypted. Table 9 describes the icons.

Table 9  S/MIME Icons

Icon Image

Description

Pen over a sheet of paper

This message is signed with a valid private key.

Broken pen over a sheet of paper

There is something wrong with the private key used to sign the message. Do not trust the signature.

Key over a lock

This message is encrypted with a valid public key.

Broken key over a lock

There is something wrong with the public key used to encrypt the message. Do not trust the contents of the encrypted message.

Viewing the Java Console Messages

A variety of operating messages can be written to the Java Console by the S/MIME applet as you process signed and encrypted messages. These messages are written to the console only if your system administrator has enabled the Java Console for you.

To view the console messages:

  1. Navigate to the Windows Control Panel.
  2. Double click the Java Plug-in 1.4 icon.
  3. Click the Basic tab.
  4. Click the radio button for Show Console.
  5. Click Apply.


  Contents     Index