Thunderbird: Setup End-to-End Encryption

Summary

Description what this documentation is about.

Requirements

• 2 Virtual Machines: Ubuntu 22.04.5 LTS
• 2 Email-Accounts

S/MIME in Thunderbird

Step 1: Creating a Self-Signed Certificate (own CA)

1. Generate the CA private key:

   openssl genrsa -des3 -out ca.key 4096
   

1. Create a self-signed certificate for the CA:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

1. Send ca.crt to both Clients

Step 2: Creating a Certificate for Client1, Signed by Your Own CA

1. Generate the private key for Client1:

   openssl genrsa -des3 -out cert.key 4096
   

1. Create a Certificate Signing Request (CSR) for Client1:

   openssl req -new -key cert.key -out cert.csr
   

1. Sign the CSR with your CA to generate Client1's certificate:

   openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
   

1. Export the certificate and private key to a PKCS#12 file:

   openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12
   

Step 3: Creating a Certificate for Client2, Signed by Your Own CA

1. Generate the private key for Client2:

   openssl genrsa -des3 -out cert.key 4096
   

1. Create a Certificate Signing Request (CSR) for Client2:

   openssl req -new -key cert.key -out cert.csr
   

1. Sign the CSR with your CA to generate Client2's certificate:

   openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
   

1. Export the certificate and private key to a PKCS#12 file:

   openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12
   

Configuration in Thunderbird

1. Open Thunderbird and navigate to:

   Settings > Privacy & Security > Certificates > Manage Certificates
   

1. Import the certificates as follows:

  * On Client1:
    * Import the Step 1 certificate (ca.crt) under Authorities.
    * Import the Step 2 certificate (your own, cert.p12) under Your Certificates.
    * Import the Step 3 certificate (from Client2, cert.p12) under People.
  * On Client2:
    * Import the Step 1 certificate (ca.crt) under Authorities.
    * Import the Step 3 certificate (your own, cert.p12) under Your Certificates.
    * Import the Step 2 certificate (from Client1, cert.p12) under People.

By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

Courses

• A course where this documentation was used (2017, 2018)
• Another one (2018)

References

• https://wikipedia.org
• https://google.com