Thunderbird: Setup End-to-End Encryption - Revision history

AMessner at 10:59, 17 December 2024

2024-12-17T10:59:14Z

← Older revision		Revision as of 10:59, 17 December 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	~~Description what this documentation is about~~.		This article provides a step-by-step guide to integrating S/MIME and OpenPGP into Thunderbird, enabling secure email communication through end-to-end encryption and digital signatures. It explains the processes for setting up both encryption methods, including certificate creation for S/MIME and key pair generation for OpenPGP.

	== Requirements ==		== Requirements ==

AMessner at 19:35, 16 December 2024

2024-12-16T19:35:09Z

← Older revision		Revision as of 19:35, 16 December 2024
Line 71:		Line 71:
	# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.		# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
	# Click '''Add Key''' to create a new OpenPGP key pair.		# Click '''Add Key''' to create a new OpenPGP key pair.
	* Optionally, set an expiration date for the key or leave it as "Never Expires."		#* Optionally, set an expiration date for the key or leave it as "Never Expires."
	* Choose a Key type.		#* Choose a Key type.
	* Click '''Generate Key'''. Thunderbird will create the key pair and associate it with your email account.		#* Click '''Generate Key'''. Thunderbird will create the key pair and associate it with your email account.

	=== Step 2: Exporting Your Public Key ===		=== Step 2: Exporting Your Public Key ===
Line 86:		Line 86:
	=== Step 3: Importing Public Keys from Contacts ===		=== Step 3: Importing Public Keys from Contacts ===
	# When you receive a contact's public key		# When you receive a contact's public key
	#* '''via Message:''' Open the OpenPGP Key Manager in Thunderbird, Save the copied Public Key into a `.asc` File & Import it via OpenPGP Key Manager		#* '''via Message:''' Open the '''OpenPGP Key Manager''' in Thunderbird, Save the copied Public Key into a `.asc` File & Import it via OpenPGP Key Manager
	#* '''via File:''' Open the OpenPGP Key Manager in Thunderbird, Click '''File > Import Keys from File''', then select the `.asc` file you received.		#* '''via File:''' Open the '''OpenPGP Key Manager''' in Thunderbird, Click '''File > Import Keys from File''', then select the `.asc` file you received.
	#* '''via Email:''' double-click the `.asc` file in the email, and Thunderbird will prompt you to import the key		#* '''via Email:''' double-click the `.asc` file in the email, and Thunderbird will prompt you to import the key

AMessner at 19:33, 16 December 2024

2024-12-16T19:33:40Z

← Older revision		Revision as of 19:33, 16 December 2024
Line 71:		Line 71:
	# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.		# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
	# Click '''Add Key''' to create a new OpenPGP key pair.		# Click '''Add Key''' to create a new OpenPGP key pair.
	* Select your Identity.
	* Optionally, set an expiration date for the key or leave it as "Never Expires."		* Optionally, set an expiration date for the key or leave it as "Never Expires."
	* Choose a Key type.		* Choose a Key type.
Line 84:		Line 83:
	#* Export Public Key To File		#* Export Public Key To File
	#* Send Public Key By Email		#* Send Public Key By Email
	~~# Share the Public Key via Email, or other communication, with your Contact~~

	=== Step 3: Importing Public Keys from Contacts ===		=== Step 3: Importing Public Keys from Contacts ===

AMessner at 19:29, 16 December 2024

2024-12-16T19:29:58Z

← Older revision		Revision as of 19:29, 16 December 2024
Line 29:		Line 29:
	* Export the certificate and private key to a PKCS#12 file:		* Export the certificate and private key to a PKCS#12 file:
	<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre>		<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre>
			* Send cert.crt to Client2

	* Example cert:		* Example cert:
Line 42:		Line 43:
	* Export the certificate and private key to a PKCS#12 file:		* Export the certificate and private key to a PKCS#12 file:
	<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre>		<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre>
			* Send cert.crt to Client1

	* Example cert:		* Example cert:
Line 53:		Line 55:
	*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.		*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
	*** Import the '''Step 2 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.		*** Import the '''Step 2 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
	*** Import the '''Step 3 certificate''' (from Client2, ''cert.~~p12~~'') under '''People'''.		*** Import the '''Step 3 certificate''' (from Client2, ''cert.crt'') under '''People'''.
	** '''On Client2''':		** '''On Client2''':
	*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.		*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
	*** Import the '''Step 3 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.		*** Import the '''Step 3 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
	*** Import the '''Step 2 certificate''' (from Client1, ''cert.~~p12~~'') under '''People'''.		*** Import the '''Step 2 certificate''' (from Client1, ''cert.crt'') under '''People'''.

	By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.		By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

AMessner at 19:25, 16 December 2024

2024-12-16T19:25:08Z

← Older revision		Revision as of 19:25, 16 December 2024
Line 42:		Line 42:
	* Export the certificate and private key to a PKCS#12 file:		* Export the certificate and private key to a PKCS#12 file:
	<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre>		<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre>

			* Example cert:
			[[File:Thunderbird-Setup End-to-End Encryption Smime bob cert.PNG]]

	=== Configuration in Thunderbird ===		=== Configuration in Thunderbird ===

AMessner at 19:23, 16 December 2024

2024-12-16T19:23:50Z

← Older revision		Revision as of 19:23, 16 December 2024
Line 17:		Line 17:
	* Send ca.crt to both Clients		* Send ca.crt to both Clients

	Example cert: [[File:Thunderbird-Using end-to-end encryption Smime CA cert.PNG]]		* Example cert:
			[[File:Thunderbird-Using end-to-end encryption Smime CA cert.PNG]]

	=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===		=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===
Line 28:		Line 29:
	* Export the certificate and private key to a PKCS#12 file:		* Export the certificate and private key to a PKCS#12 file:
	<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre>		<pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre>

			* Example cert:
			[[File:Thunderbird-Setup End-to-End Encryption Smime alice cert.PNG]]

	=== Step 3: Creating a Certificate for Client2, Signed by Your Own CA ===		=== Step 3: Creating a Certificate for Client2, Signed by Your Own CA ===

AMessner at 19:21, 16 December 2024

2024-12-16T19:21:53Z

← Older revision		Revision as of 19:21, 16 December 2024
Line 17:		Line 17:
	* Send ca.crt to both Clients		* Send ca.crt to both Clients

	Example cert: [[Thunderbird-~~Using_end~~-to-~~end_encryption_Smime_CA_cert~~.PNG]]		Example cert: [[File:Thunderbird-Using end-to-end encryption Smime CA cert.PNG]]

	=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===		=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===

AMessner at 19:21, 16 December 2024

2024-12-16T19:21:18Z

← Older revision		Revision as of 19:21, 16 December 2024
Line 16:		Line 16:
	<pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre>		<pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre>
	* Send ca.crt to both Clients		* Send ca.crt to both Clients

			Example cert: [[Thunderbird-Using_end-to-end_encryption_Smime_CA_cert.PNG]]

	=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===		=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===

AMessner at 19:17, 16 December 2024

2024-12-16T19:17:42Z

← Older revision		Revision as of 19:17, 16 December 2024
Line 6:		Line 6:

	* 2 Virtual Machines: Ubuntu 22.04.5 LTS		* 2 Virtual Machines: Ubuntu 22.04.5 LTS
	* 2 Email-Accounts		* 2 Email-Accounts for Thunderbird

	== S/MIME in Thunderbird ==		== S/MIME in Thunderbird ==
Line 51:		Line 51:

	By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.		By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

			== Integration of OpenPGP in Thunderbird ==

			OpenPGP enables end-to-end encryption in Thunderbird, ensuring secure communication through encrypted emails and digital signatures. The following steps outline the process for setting up OpenPGP in Thunderbird, creating key pairs, and exchanging public keys.

			=== Step 1: Enable OpenPGP in Thunderbird ===
			# Open Thunderbird.
			# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
			# Click '''Add Key''' to create a new OpenPGP key pair.
			* Select your Identity.
			* Optionally, set an expiration date for the key or leave it as "Never Expires."
			* Choose a Key type.
			* Click '''Generate Key'''. Thunderbird will create the key pair and associate it with your email account.

			=== Step 2: Exporting Your Public Key ===
			# Navigate to '''Account Settings''' and select '''End-to-End Encryption'''.
			# Navigate to the '''OpenPGP Key Manager''':
			# Locate your newly created key in the list.
			# Right-click on your key and '''Select one of these Options to Share your Public Key''':
			#* Copy Public Key
			#* Export Public Key To File
			#* Send Public Key By Email
			# Share the Public Key via Email, or other communication, with your Contact

			=== Step 3: Importing Public Keys from Contacts ===
			# When you receive a contact's public key
			#* '''via Message:''' Open the OpenPGP Key Manager in Thunderbird, Save the copied Public Key into a `.asc` File & Import it via OpenPGP Key Manager
			#* '''via File:''' Open the OpenPGP Key Manager in Thunderbird, Click '''File > Import Keys from File''', then select the `.asc` file you received.
			#* '''via Email:''' double-click the `.asc` file in the email, and Thunderbird will prompt you to import the key

			By following these steps, you can successfully integrate OpenPGP into Thunderbird, enabling secure email communication with encryption and digital signatures.


	== Courses ==		== Courses ==

	* [[~~A course where this documentation was used~~]] (~~2017, 2018)~~		* [[Ausgewählte Kapitel der IT-Security]] (2024)
	* [[Another one]] (2018)

	== References ==		== References ==

	* https://~~wikipedia~~.~~org~~		* https://www.nakivo.com/blog/virtualbox-network-setting-guide/
	* https://~~google~~.com		* https://www.howtoforge.com/how-to-encrypt-mails-with-ssl-certificates-s-mime
			* https://dokuwiki.nausch.org/doku.php/centos:openpgp_beim_mua#openpgp_versus_s_mime

	[[Category:Documentation]]		[[Category:Documentation]]

AMessner at 18:42, 16 December 2024

2024-12-16T18:42:24Z

← Older revision		Revision as of 18:42, 16 December 2024
Line 41:		Line 41:
	<pre>Settings > Privacy & Security > Certificates > Manage Certificates</pre>		<pre>Settings > Privacy & Security > Certificates > Manage Certificates</pre>
	* Import the certificates as follows:		* Import the certificates as follows:
	* '''On Client1''':		** '''On Client1''':
	* Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.		*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
	* Import the '''Step 2 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.		*** Import the '''Step 2 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
	* Import the '''Step 3 certificate''' (from Client2, ''cert.p12'') under '''People'''.		*** Import the '''Step 3 certificate''' (from Client2, ''cert.p12'') under '''People'''.
	* '''On Client2''':		** '''On Client2''':
	* Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.		*** Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.
	* Import the '''Step 3 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.		*** Import the '''Step 3 certificate''' (your own, ''cert.p12'') under '''Your Certificates'''.
	* Import the '''Step 2 certificate''' (from Client1, ''cert.p12'') under '''People'''.		*** Import the '''Step 2 certificate''' (from Client1, ''cert.p12'') under '''People'''.

	By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.		By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.