Thunderbird: Setup End-to-End Encryption

Summary

Description what this documentation is about.

Requirements

2 Virtual Machines: Ubuntu 22.04.5 LTS
2 Email-Accounts

S/MIME in Thunderbird

Step 1: Creating a Self-Signed Certificate (own CA)

Generate the CA private key:

openssl genrsa -des3 -out ca.key 4096

Create a self-signed certificate for the CA:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Send ca.crt to both Clients

Step 2: Creating a Certificate for Client1, Signed by Your Own CA

Generate the private key for Client1:

openssl genrsa -des3 -out cert.key 4096

Create a Certificate Signing Request (CSR) for Client1:

openssl req -new -key cert.key -out cert.csr

Sign the CSR with your CA to generate Client1's certificate:

openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

Export the certificate and private key to a PKCS#12 file:

openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Alice Smith" -out cert.p12

Step 3: Creating a Certificate for Client2, Signed by Your Own CA

Generate the private key for Client2:

openssl genrsa -des3 -out cert.key 4096

Create a Certificate Signing Request (CSR) for Client2:

openssl req -new -key cert.key -out cert.csr

Sign the CSR with your CA to generate Client2's certificate:

openssl x509 -req -days 365 -in cert.csr -CA ca.crt -CAkey ca.key -out cert.crt

Export the certificate and private key to a PKCS#12 file:

openssl pkcs12 -export -in cert.crt -inkey cert.key -name "Bob Builder" -out cert.p12

Configuration in Thunderbird

Open Thunderbird and navigate to:

Settings > Privacy & Security > Certificates > Manage Certificates

Import the certificates as follows:
- On Client1:
  - Import the Step 1 certificate (ca.crt) under Authorities.
  - Import the Step 2 certificate (your own, cert.p12) under Your Certificates.
  - Import the Step 3 certificate (from Client2, cert.p12) under People.
- On Client2:
  - Import the Step 1 certificate (ca.crt) under Authorities.
  - Import the Step 3 certificate (your own, cert.p12) under Your Certificates.
  - Import the Step 2 certificate (from Client1, cert.p12) under People.

By completing these steps, S/MIME will be successfully integrated into Thunderbird, enabling secure email communication with encryption and digital signatures between the two clients.

Courses

A course where this documentation was used (2017, 2018)
Another one (2018)

References