Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having a bit of an issue here. Bear with me as this may be a case of "not asking the right question".

Background: Using Apple Mail. Want to encrypt/decrypt email but GPGMail (and apparently PGP) isn't supported with Snow Leopard.

Basically I need to create an S/MIME certificate for use in email encryption. I don't want, nor do I care for a Certificate Authority. I simply want a quick-and-dirty certificate. Is this even possible (using OPENSSL, etc) or does the whole process hinge on a higher authority forcing me to either set up a full-scale CA or deal with a company (e.g. Verisign, Thawte) for a cert? My criteria are instant gratification, and free.

Best.

share|improve this question
    
Note that your certificate is used for two purposes in S/MIME. To sign your emails, and to decrypt email sent to you by someone else. To encrypt email to someone else, you'll need their certificate. Typically, email clients are setup out of the box to trust some predetermined set of CAs. If certificates are not signed by one of these, you'll get at least a nasty message and possibly even a non-functioning system. –  GregS Jan 16 '10 at 20:46
    
I know this is an older question, but for future reference, GPGMail plugin does now work on Snow Leopard gpgtools.org/installer/index.html –  Jason Whitehorn May 29 '11 at 14:21

3 Answers 3

up vote 10 down vote accepted

Yeah, it sucks that Apple Mail does not support GPG. :-( I wish it did because I prefer GPG encrypted e-mail too.

I also agree that information surrounding S/MIME and generating your own e-mail certificates is hard to come by. I found Paul Bramscher's webpage has a good description of how to create your own Certificate Authority certificate.

I don't pretend to fully understand the certificate process, but this is what I've been able to piece together. You should consult the openssl manpage for more detailed information about each of the commands shown below.

Create Certificate Authority

The first step is to create your own Certificate Authority (CA). The commands are …

# openssl genrsa -des3 -out ca.key 4096
# openssl req -new -x509 -days 365 -key ca.key -out ca.crt

and follow the prompts.

You will need to issue your CA's certificate (ie the content of ca.crt) to each and every recipient of your encrypted e-mail. The recipients will have to install and trust your CA certificate so that your encrypted e-mail will be trusted. The installation will vary for each mail client used.

In your case, you will need to add your CA's certificate to your Apple Keychain. There are lots of posts on the web about how to import and trust a CA certificate in the Apple Keychain.

Create Personal E-Mail Certificate Request

You now need to create a certificate request. Create one for each e-mail address you wish to send e-mail from. Execute the following commands …

# openssl genrsa -des3 -out humble_coder.key 4096
# openssl req -new -key humble_coder.key -out humble_coder.csr

and follow the prompts.

Certificate Authority Signs Your Certificate Request

Your personal certificate needs to be signed by your CA. In this case, you!

# openssl x509 -req -days 365 -in humble_coder.csr -CA ca.crt -CAKey ca.key \
  -set_serial 1 -out humble_coder.crt -setalias "Humble Coder's E-Mail Certificate" \
  -addtrust emailProtection \
  -addreject clientAuth -addreject serverAuth -trustout

The output is your signed certificate.

Prepare Your Certificate for Importing into Your Mail Application

You need to convert your certificate from .crt (PEM format, I think) to .p12 (PCKS12 format).

# openssl pkcs12 -export -in humble_coder.crt -inkey humble_coder.key \
  -out humble_coder.p12

You can now import your .p12 formatted certificate into your mail client. In your case, import the .p12 file into the Apple Keychain. Once the certificate is installed correctly, Apple Mail will start using your certificate.

There is an Easier Way

Of course, once you've created your own CA there's an easier way of managing certificates created by your own Certificate Authority. openssl comes with a script named …

# /usr/lib/ssl/misc/CA.pl

which simplifies the process of being your own Certificate Authority. There's even a man page for CA.pl!

share|improve this answer
    
In the section Certificate Authority Signs Your Certificate Request. The "-CAKey" argument needs to be "-CAkey" with a lower case 'k' - at least for my version Open SSL 1.0.0a 1 Jun 2010 –  KevM Jan 25 '12 at 20:32
    
I changed -CAKey to -CAkey. This is a really excellent answer, but the side-comment about GPG is unwarrented. S/MIME has many advantages over GPG. Besides wider support, it includes the certificate with each signed message, providing a built-in certificate distribution mechanism. –  vy32 Nov 2 '12 at 0:13
    
Don't forget to set some restrictions to the certificate, see security.stackexchange.com/a/30069/3272 –  Tobias Kienzler Feb 8 '13 at 11:26

Free and signed by a CA: http://www.instantssl.com/ssl-certificate-products/free-email-certificate.html

share|improve this answer
    
Thank you so much for that information. –  yogsototh Oct 6 '10 at 21:39

As others have said, the answer is obviously yes. You can generate it via openssl, or you can use one of the providers that gives a free x509 email cert.

That being said, the most important question is: what do the people you exchange email with use? I'm active in the Free software community, so most of the people I exchange email with use GPG. The only ones I know of that use S/MIME do so on their work email as a matter of corporate policy.

If the people you're emailing don't use S/MIME, you won't be able to encrypt to them, and they won't be able to verify signed emails.

share|improve this answer

protected by Chris S Nov 14 '11 at 16:28

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.