Thunderbird: Setup End-to-End Encryption: Difference between revisions
No edit summary |
No edit summary |
||
| Line 12: | Line 12: | ||
=== Step 1: Creating a Self-Signed Certificate (own CA) === | === Step 1: Creating a Self-Signed Certificate (own CA) === | ||
* Generate the CA private key: | * Generate the CA private key: | ||
<pre> | <pre>openssl genrsa -des3 -out ca.key 4096</pre> | ||
* Create a self-signed certificate for the CA: | * Create a self-signed certificate for the CA: | ||
<pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre> | <pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre> | ||
| Line 21: | Line 19: | ||
=== Step 2: Creating a Certificate for Client1, Signed by Your Own CA === | === Step 2: Creating a Certificate for Client1, Signed by Your Own CA === | ||
* Generate the private key for Client1: | * Generate the private key for Client1: | ||
<pre> | <pre>openssl genrsa -des3 -out cert.key 4096</pre> | ||
* Create a Certificate Signing Request (CSR) for Client1: | * Create a Certificate Signing Request (CSR) for Client1: | ||
<pre> | <pre>openssl req -new -key cert.key -out cert.csr</pre> | ||
* Sign the CSR with your CA to generate Client1's certificate: | * Sign the CSR with your CA to generate Client1's certificate: | ||
<pre> | <pre>openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt</pre> | ||
* Export the certificate and private key to a PKCS#12 file: | * Export the certificate and private key to a PKCS#12 file: | ||
<pre> | <pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12</pre> | ||
=== Step 3: Creating a Certificate for Client2, Signed by Your Own CA === | === Step 3: Creating a Certificate for Client2, Signed by Your Own CA === | ||
* Generate the private key for Client2: | * Generate the private key for Client2: | ||
<pre> | <pre>openssl genrsa -des3 -out cert.key 4096</pre> | ||
* Create a Certificate Signing Request (CSR) for Client2: | * Create a Certificate Signing Request (CSR) for Client2: | ||
<pre> | <pre>openssl req -new -key cert.key -out cert.csr</pre> | ||
* Sign the CSR with your CA to generate Client2's certificate: | * Sign the CSR with your CA to generate Client2's certificate: | ||
<pre> | <pre>openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt</pre> | ||
* Export the certificate and private key to a PKCS#12 file: | * Export the certificate and private key to a PKCS#12 file: | ||
<pre> | <pre>openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12</pre> | ||
=== Configuration in Thunderbird === | === Configuration in Thunderbird === | ||
* Open Thunderbird and navigate to: | * Open Thunderbird and navigate to: | ||
<pre> | <pre>Settings > Privacy & Security > Certificates > Manage Certificates</pre> | ||
* Import the certificates as follows: | * Import the certificates as follows: | ||
* '''On Client1''': | * '''On Client1''': | ||
Revision as of 18:40, 16 December 2024
Summary
Description what this documentation is about.
Requirements
- 2 Virtual Machines: Ubuntu 22.04.5 LTS
- 2 Email-Accounts
S/MIME in Thunderbird
Step 1: Creating a Self-Signed Certificate (own CA)
- Generate the CA private key:
openssl genrsa -des3 -out ca.key 4096
- Create a self-signed certificate for the CA:
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
- Send ca.crt to both Clients
Step 2: Creating a Certificate for Client1, Signed by Your Own CA
- Generate the private key for Client1:
openssl genrsa -des3 -out cert.key 4096
- Create a Certificate Signing Request (CSR) for Client1:
openssl req -new -key cert.key -out cert.csr
- Sign the CSR with your CA to generate Client1's certificate:
openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
- Export the certificate and private key to a PKCS#12 file:
openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12
Step 3: Creating a Certificate for Client2, Signed by Your Own CA
- Generate the private key for Client2:
openssl genrsa -des3 -out cert.key 4096
- Create a Certificate Signing Request (CSR) for Client2:
openssl req -new -key cert.key -out cert.csr
- Sign the CSR with your CA to generate Client2's certificate:
openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
- Export the certificate and private key to a PKCS#12 file:
openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12
Configuration in Thunderbird
- Open Thunderbird and navigate to:
Settings > Privacy & Security > Certificates > Manage Certificates
- Import the certificates as follows:
* On Client1:
* Import the Step 1 certificate (ca.crt) under Authorities.
* Import the Step 2 certificate (your own, cert.p12) under Your Certificates.
* Import the Step 3 certificate (from Client2, cert.p12) under People.
* On Client2:
* Import the Step 1 certificate (ca.crt) under Authorities.
* Import the Step 3 certificate (your own, cert.p12) under Your Certificates.
* Import the Step 2 certificate (from Client1, cert.p12) under People.
By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.
Courses
- A course where this documentation was used (2017, 2018)
- Another one (2018)