Thunderbird: Setup End-to-End Encryption: Difference between revisions

Revision as of 18:37, 16 December 2024

Summary

Description what this documentation is about.

Requirements

2 Virtual Machines: Ubuntu 22.04.5 LTS
2 Email-Accounts

S/MIME in Thunderbird

Step 1: Creating a Self-Signed Certificate (own CA)

Generate the CA private key:

   openssl genrsa -des3 -out ca.key 4096

Create a self-signed certificate for the CA:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Send ca.crt to both Clients

Step 2: Creating a Certificate for Client1, Signed by Your Own CA

Generate the private key for Client1:

   openssl genrsa -des3 -out cert.key 4096

Create a Certificate Signing Request (CSR) for Client1:

   openssl req -new -key cert.key -out cert.csr

Sign the CSR with your CA to generate Client1's certificate:

   openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

Export the certificate and private key to a PKCS#12 file:

   openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12

Step 3: Creating a Certificate for Client2, Signed by Your Own CA

Generate the private key for Client2:

   openssl genrsa -des3 -out cert.key 4096

Create a Certificate Signing Request (CSR) for Client2:

   openssl req -new -key cert.key -out cert.csr

Sign the CSR with your CA to generate Client2's certificate:

   openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

Export the certificate and private key to a PKCS#12 file:

   openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12

Configuration in Thunderbird

Open Thunderbird and navigate to:

   Settings > Privacy & Security > Certificates > Manage Certificates

Import the certificates as follows:

  * On Client1:
    * Import the Step 1 certificate (ca.crt) under Authorities.
    * Import the Step 2 certificate (your own, cert.p12) under Your Certificates.
    * Import the Step 3 certificate (from Client2, cert.p12) under People.
  * On Client2:
    * Import the Step 1 certificate (ca.crt) under Authorities.
    * Import the Step 3 certificate (your own, cert.p12) under Your Certificates.
    * Import the Step 2 certificate (from Client1, cert.p12) under People.

By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

Courses

A course where this documentation was used (2017, 2018)
Another one (2018)

References

@@ Line 11: / Line 11: @@
 === Step 1: Creating a Self-Signed Certificate (own CA) ===
-# Generate the CA private key:
+* Generate the CA private key:
     <pre>
     openssl genrsa -des3 -out ca.key 4096
     </pre>
-# Create a self-signed certificate for the CA:
+* Create a self-signed certificate for the CA:
     <pre>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</pre>
-# Send ca.crt to both Clients
+* Send ca.crt to both Clients
 === Step 2: Creating a Certificate for Client1, Signed by Your Own CA ===
-# Generate the private key for Client1:
+* Generate the private key for Client1:
     <pre>
     openssl genrsa -des3 -out cert.key 4096
     </pre>
-# Create a Certificate Signing Request (CSR) for Client1:
+* Create a Certificate Signing Request (CSR) for Client1:
     <pre>
     openssl req -new -key cert.key -out cert.csr
     </pre>
-# Sign the CSR with your CA to generate Client1's certificate:
+* Sign the CSR with your CA to generate Client1's certificate:
     <pre>
     openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
     </pre>
-# Export the certificate and private key to a PKCS#12 file:
+* Export the certificate and private key to a PKCS#12 file:
     <pre>
     openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12
@@ Line 38: / Line 38: @@
 === Step 3: Creating a Certificate for Client2, Signed by Your Own CA ===
-# Generate the private key for Client2:
+* Generate the private key for Client2:
     <pre>
     openssl genrsa -des3 -out cert.key 4096
     </pre>
-# Create a Certificate Signing Request (CSR) for Client2:
+* Create a Certificate Signing Request (CSR) for Client2:
     <pre>
     openssl req -new -key cert.key -out cert.csr
     </pre>
-# Sign the CSR with your CA to generate Client2's certificate:
+* Sign the CSR with your CA to generate Client2's certificate:
     <pre>
     openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt
     </pre>
-# Export the certificate and private key to a PKCS#12 file:
+* Export the certificate and private key to a PKCS#12 file:
     <pre>
     openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12
@@ Line 56: / Line 56: @@
 === Configuration in Thunderbird ===
-# Open Thunderbird and navigate to:
+* Open Thunderbird and navigate to:
     <pre>
     Settings > Privacy & Security > Certificates > Manage Certificates
     </pre>
-# Import the certificates as follows:
+* Import the certificates as follows:
     * '''On Client1''':
       * Import the '''Step 1 certificate''' (''ca.crt'') under '''Authorities'''.