ID: q168726
The information in this article applies to:
This article describes how to configure and use the security features in Outlook Express to digitally sign and encrypt messages.
The following topics are discussed:
To use any of the security features in Outlook Express, you must first configure the program to use your digital ID (certificate). This article does not outline the procedure for obtaining a certificate. For information about obtaining a digital ID certificate, visit VeriSign's digital ID Web page.
After you have your private key (digital ID) installed, you need to configure Outlook Express to use the certificate by following these steps:
1. On the Tools menu, click Accounts.
2. Click the Mail tab, click the mail account in which you want to use a
digital ID, and then click Properties.
messages from <e-mail address>" check box to select it, and then click
Digital ID.
Close.
6. On the Security tab, click Advanced Settings.
7. If you want to send your certificate (public key) with all messages,
click the "Include my certificate with signed messages" check box to
select it. This allows the recipients of your messages to easily
verify your message with your public key. For more information, see
the "Adding a Certificate to the Address Book" section in this article.
click the appropriate option.
10. If you want to automatically digitally sign all outgoing messages,
click the "Add digital signature to all outgoing messages" check box
to select it.
"Encrypt contents and attachments for all outgoing messages" check
box to select it.
To digitally sign a message, you can use either of the following methods:
If you do not have your private key installed on your computer, Outlook Express displays the following message:
The message could not be sent.
You cannot send digitally signed messages because you do not have any
certificates. (OK)
You can include your public key with the message (see step 4 in the section titled "Configuring Security Features in Outlook Express") or you can send your certificate files as an attachment. If the recipient's e-mail client is not S/MIME aware, the public key certificate appears as a file attachment with a .p7s extension. If the e-mail client is S/MIME aware, there is no visible enclosure.
The recipient must have your public key to verify that the digital signature on your message is trustworthy. Others cannot use your public key to send messages with your digital signature.
When you view a digitally signed message and you have the sender's certificate (public key) imported into your address book and marked as Trusted By Me, the message can be viewed as expected.
If you do not have the sender's certificate (public key) imported into your address book, Outlook Express displays the following security warning message:
The certificate used to sign this message is either not listed in your
Address Book or marked as not trusted by you.
Continue to open this message?
You do not trust the certificate used to sign this message.
Continue to open this message?
To be able to verify a sender's digital signature or to send encrypted mail, you must obtain the other person's certificate (public key) and import it into your address book.
There are two ways to obtain a public key:
To add a person's certificate to your address book from a signed message you receive (method 2), follow these steps:
1. Click the message to select it.
2. On the File menu, click Properties, and then click the Security tab.
3. Click "Add the certificate to the address book."
4. Click OK
The default trust relationship for new certificates is Not Trust. To use the certificate, change the trust relationship by following these steps:
1. On the Tools menu, click Address Book.
2. Click the person's entry to select it, and then click Properties.
3. Click the Certificates tab.
4. Click the certificate, and then click Properties.
5. On the General tab, click Trusted By Me in the Trusted box.
6. Click OK, click OK, and then click Close on the File menu to close
the Address Book.
To encrypt a message so that only the recipient can decrypt the message, you need the recipient's certificate (public key) in your address book and the trust relationship set to Trusted By Me. See the section titled "Adding a Certificate to the Address Book" for information about these items.
One way to encrypt a message is to have Outlook Express automatically encrypt all messages each time you compose, reply to, or forward a message (see step 8 in the section titled "Configuring Security Features in Outlook Express").
Another way is to click the Encrypt Message button on the toolbar. This button displays an envelope with a padlock. You can also click Encrypt on the Tools menu.
When a message is encrypted, a round gray icon with a white padlock appears to the right of the Subject line. When you click send, Outlook Express encrypts the message using a secret key, encrypts that key with the recipient's public key, and sends the message.
If you send an encrypted message and you do not have the public key for one or many of the recipients (including yourself, the sender), Outlook Express displays the following security warning message:
You do not have a certificate. If you send this message, it will be
sent properly, but you will not be able to read it in your sent items
folder. Send anyway? (Yes/No)
Your certificate is not listed among those that can decrypt this
message. You cannot read it.
You do not have valid certificates in the Address Book for the
following recipients:
<list of recipients>
You must resolve the certificate problems listed above before you can
send this message (Try Again).
Each time you view a message that has been altered since it was sent, you receive a warning notification. The option to not notify you again applies to the current message only.
Some mail servers rewrite messages before sending them out. These messages are displayed as altered when received; it does not mean that someone has maliciously altered the message. If you receive many altered messages, check with your mail administrator to see if your mail server is causing the problem.
For information about how to contact VeriSign, Inc., see the following article in the Microsoft Knowledge Base:
ARTICLE-ID: Q125217
TITLE : World Wide Web and FTP Servers for Computer-Related Vendors
Keywords : outexw95 outexnt win98 outexw98
Version : WINDOWS:
Platform : WINDOWS
Issue type : kbhowtoLast Reviewed: March 18, 1999