Thunderbird: Setup End-to-End Encryption

Summary

Description what this documentation is about.

Requirements

• 2 Virtual Machines: Ubuntu 22.04.5 LTS
• 2 Email-Accounts

S/MIME in Thunderbird

Step 1: Creating a Self-Signed Certificate (own CA)

• Generate the CA private key:

openssl genrsa -des3 -out ca.key 4096

• Create a self-signed certificate for the CA:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

• Send ca.crt to both Clients

Step 2: Creating a Certificate for Client1, Signed by Your Own CA

• Generate the private key for Client1:

openssl genrsa -des3 -out cert.key 4096

• Create a Certificate Signing Request (CSR) for Client1:

openssl req -new -key cert.key -out cert.csr

• Sign the CSR with your CA to generate Client1's certificate:

openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

• Export the certificate and private key to a PKCS#12 file:

openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12

Step 3: Creating a Certificate for Client2, Signed by Your Own CA

• Generate the private key for Client2:

openssl genrsa -des3 -out cert.key 4096

• Create a Certificate Signing Request (CSR) for Client2:

openssl req -new -key cert.key -out cert.csr

• Sign the CSR with your CA to generate Client2's certificate:

openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

• Export the certificate and private key to a PKCS#12 file:

openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12

Configuration in Thunderbird

• Open Thunderbird and navigate to:

Settings > Privacy & Security > Certificates > Manage Certificates

• Import the certificates as follows:
  • On Client1:
    • Import the Step 1 certificate (ca.crt) under Authorities.
    • Import the Step 2 certificate (your own, cert.p12) under Your Certificates.
    • Import the Step 3 certificate (from Client2, cert.p12) under People.
  • On Client2:
    • Import the Step 1 certificate (ca.crt) under Authorities.
    • Import the Step 3 certificate (your own, cert.p12) under Your Certificates.
    • Import the Step 2 certificate (from Client1, cert.p12) under People.

By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

References

• https://wikipedia.org
• https://google.com