Solved

sending encrypted emails

Posted on 2004-04-12
4
399 Views
Last Modified: 2010-03-05
Hi all

I have isntalled and configured my own CA on my windows 2003 server and domain. I am also running exchange 2003. I can send encrypted and digitally signed emails to anyone in my own domain, I can also send digitally signed emails to all other recipietns outside my domain, but i cannot encrypt these  emails. When i digitally sign an email, and send it to someone@domainame.com, the recipient adds me (the sender) as one of there contacts. Once they do this my certificate is in the Trusted Root Certificate authorites for the CA and my personal cert is in the trusted People on the recipients local machine. This all looks good to me. Do I also need to publish my companys public CA as well?

Thanks for any help.

skip
0
Comment
Question by:kjman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 10

Expert Comment

by:dstoker509
ID: 10805622
You cannot send an encrypted email to an external user if you use your own CA to encrypt the email.  You must use a 3rd party CA such as Verisign.

To Encrypt an email, you download the end-user's public key and then the end-user uses their private key to decrypt it.
Likewise, to Digitally Sign an email, you use your private key and then the end user uses your public key to verify that you were the one who sent the email.

Realizing that 1) your CA is not visible to external users, and 2) your CA is not trusted by external users, you can see the problem here.

Thanks,

David
0
 
LVL 35

Expert Comment

by:Bembi
ID: 10805625
For decrypting emails, you need a private key as well as a public key. If you send encrypted emails to recipients outside your scope of you public key, the recipient needs access to your public key. This is usually done by a provider, you stores a public key for all receipients outside your domain. That means, you have to buy a public key from one of the providers (like verisign etc.). Another option is, if this is only for point to point encryption, that your public key is also hosted and pouplated on a CA on the other side of your communication (receipient system).
0
 

Author Comment

by:kjman
ID: 10805733
Ok so this wont work because the recipient has no way of trusting my companys CA, or is because the recipient has no way of getting to my companys public CA?

If it is the latter can i publish my companys CA? i.e https:\\domainame.com\certsrv would this allow the recipient to download my companys public certificate?

Thansk again
Skip
0
 
LVL 35

Accepted Solution

by:
Bembi earned 500 total points
ID: 10806148
> Ok so this wont work because...
Yes

>.. can i publish my companys CA?
ÜRG..., the point is, that the receipient has to trust your CA, and this is what usually not happend. As a public certificate is something like an certified identification of your server, publishing your own CA is something like printing your own identity card. As the most common Root-Authorities are already on your machin as trusted CAs, only clients which have accepted your CA as trusted authority would be able to decrypt your mails. As no administrator will really do that, as he would have to add a few thousand companies, which would publish their own Root-CAs and he would have additionally to proof all of them, this is not a realy reliable way.

If the sense of this is, to encrypt mails only between two or a few companies, you can export your Root-CA certificate and the other company can import and publish it and vice versa. To do this with a lot of companies, I would say, hard work and not really a solution.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
AddressList in EXCH2013 6 40
exchange, windows server 2008 4 58
Exchange server take over 4 57
Exchange 2016 CU5 10 35
Utilizing an array to gracefully append to a list of EmailAddresses
After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
This video discusses moving either the default database or any database to a new volume.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question