Section_L_Attachment_Eight_Email_Encryption_13Oct10.pdf

Exchanging encrypted email with a non-AF User October 13, 2010

ATTACHMENT L-EIGHT Encryption Methodology

In order to exchange encrypted email, the sender must have the intended recipient’s encryption certificate. There are a couple of different ways to do this:

Automatically retrieve the certificate from the AF GAL

Outlook will automatically retrieve the encryption certificate from the AF GAL as long as the recipient has their current CAC certificate published. If a certificate is not available, you may need to ask the recipient to re-publish their CAC certificates.

If the recipient is not within the AF GAL, you will need to try one of the other options below.

Exchange digitally signed emails

1. Request a digitally signed message from the intended recipient. Outlook should attach the necessary encryption certificate to that signed message.

2. When you receive the signed message, open it.

3. Right-click the person’s name in the From: field.

4. Select Add to Outlook Contacts.

5. Click the Certificates button in the Contacts menu tab, and verify an encryption certificate was found in the digitally signed message. If there is no certificate listed, you will need to verify with the person that their email desktop client is set to send encryption certificates with digitally signed messages, and resend the message. If you are still unable to see a certificate, you will need to move to one of the two remaining options.

6. Click the Save & Close button.

Note: if you already had an Outlook contact with the same email address, Outlook may ask if you want to update the existing contact

7. You should be able to encrypt email to this person now.

Download certificate from an external directory server.

Some certificate authorities may have a directory server that would allow external users to search for and download certificates. The availability of this service would depend on the particular certificate authority that issued the person’s encryption certificate. This information would have to be provided to you from the person you are trying to exchange encrypted email with.

Export and exchange certificates manually via email

This option requires actions to be taken by both the sender and the intended recipient of the encrypted email messages.

Recipient:

1. Open Internet Explorer.

2. Click on Tools from the menu.

3. Click on Internet Options.

4. Click on the Content tab.

5. Click on the Certificates button.

6. Select your encryption certificate within the list of Personal certificates.

a. Expand the Friendly Name column

b. Select the one that indicates “encryption certificate”

c. If you are uncertain, you may need to ask your computer support staff.

7. With your encryption certificate selected, click the Export button.

8. Click Next in the Certificate Export Wizard.

9. Ensure No, do not export the private key is selected, and click Next.

10. Select the DER encoded binary X.509 format, and click Next.

a. If the above does not work, export as a base-64 encoded cert.

11. Chose a file name and location for the file, and click Next.

12. Review the settings, and click Finish.

13. Go to the folder where the certificate file was saved, and rename it from a .CER extension, to a

.TXT extension. This is required so that when the file is emailed (next step) it will not be stripped out by the email gateway servers.

14. Send the renamed certificate file via email to the sender. Note: this file represents the public key of your encryption certificate, so there are no security concerns for sending this in plain text.

Sender:

1. When the recipient’s email arrives, save the attached .TXT to your hard drive.

2. Rename the .TXT file back to .CER.

3. If you haven’t already done so, create an Outlook Contact card with the recipient’s name and email address.

4. In the Outlook Contact window, look for the Certificates button.

5. Click the Import button.

6. Navigate to the .CER file that you received from the recipient, and click Open.

7. The Certificate name should now appear in the Certificates list.

8. Highlight the certificate, and press the Properties button.

9. If the certificate information on the General tab indicates there is a problem validating the certificate (as shown by a yellow exclamation point or red ‘x’ on the certificate icon), continue the steps below. Otherwise, click OK and skip to step 10.

a. Click the Trust tab.

b. Select Explicitly Trust this certificate, and press OK.

10. Click Save & Close.

11. You should now be able to send an encrypted message to the recipient.