How To Assign an S/MIME Certificate to a MAPI Profile for Use with Outlook (312900)

MORE INFORMATION

1. Get the hashes for both your signing certificate and your encryption certificate. These hashes are in binary format, and can be retrieved by using the CertGetCertificateContextProperty function of the Cryptography application programming interface (API):

   CertGetCertificateContextProperty(pCert, CERT_HASH_PROP_ID, *lpbHash, cbHash);
   					

2. Generate an ASN1-encoded S/MIME capabilities binary large object (BLOB) for your certificates. For more information, see the Request for Comments (RFC) for S/MIME.
3. Create a BLOB to hold your security settings. Each setting or property is made up of a TAG/LENGTH/DATA combination as follows:
   
   

   TAG	Indicates the property (see list below).	2 bytes
   LENGTH	Indicates total length of property, including tag and length bytes.	2 bytes
   DATA	Contains the data.	Variable length

   
   Here is an example:

   0100 0800 01000000
   Translated:
   TAG = 1
   LENGTH = 8 bytes
   DATA = 1
   						

   Here are the properties that you must include in your BLOB:
   
   

   Property	Numeric Value	Length	Description
   PR_CERT_PROP_VERSION	0x0001	8	Reserved, always 1.
   PR_CERT_MESSAGE_ENCODING	0x0006	8	Type of encoding (S/MIME = 1).
   PR_CERT_DEFAULTS	0x0020	8	Bitmask: 0x1 = Default certificate for S/MIME. 0x2 = Default certificate for all formats. 0x4 = Send certificate with message.
   PR_CERT_DISPLAY_NAME_A	0x000B	Variable	Display name of setting in Outlook user interface (for example, "My S/MIME Settings").
   PR_CERT_KEYEX_SHA1_HASH	0x0022	Variable	Binary hash for encryption certificate. This property can be omitted if you want to allow signing only.
   PR_CERT_SIGN_SHA1_HASH	0x0009	Variable	Binary hash for signing certificate.
   PR_CERT_ASYMETRIC_CAPS	0x0002	Variable	ASN1-encoded S/MIME capabilities BLOB.

   
   Note that the properties are all stored in one continuous byte stream.
4. Use the IProfAdmin interface to open the MAPI profile.
5. Open the GUID_Dilkie profile section, where the security settings are stored. Define GUID_Dilkie as follows:

   const GUID CDECL GUID_Dilkie = {  0x53bc2ec0, 0xd953, 0x11cd, {0x97, 0x52, 0x00, 0xaa, 0x00, 0x4a, 0xe4, 0x0e}  };
   					

6. Step 5 gives you an IProfSect interface. On this interface, set the following property:

   #define PR_SECURITY_PROFILES PROP_TAG(PT_MV_BINARY, 0x355)
   						

   This property is a multivalued binary property. You must set the first binary value on the property with the BLOB that you created in step 3.

   LPPROFSECT          lpProfSect = NULL;
   SPropValue          SecProp;
   LPSPropValue        lpSecProp = &SecProp;
   SBinary             sbCert;
   LPBYTE              lpbCertBlob = NULL;
   ULONG               cbCertBlob = 0;
   
   // Do the work to generate lpbCertBlob (step 3) and open GUID_Dilkie profile section.
   
   // Set up property tag structure for PR_SECURITY_PROFILES.
   SecProp.ulPropTag = PR_SECURITY_PROFILES;
   SecProp.Value.MVbin.cValues = 1;
   SecProp.Value.MVbin.lpbin = &sbCert;
   SecProp.Value.MVbin.lpbin[0].cb = cbCertBlob;
   SecProp.Value.MVbin.lpbin[0].lpb = lpbCertBlob;
   
   // Set properties on the profile section.
   if (FAILED(hRes = lpProfSect->SetProps(1, lpSecProp, NULL)))
   {
       printf("Error setting property on profile.\n");
       goto error;
   }