Apr
11

Email encryption in Outlook - how to encrypt some or all messages with digital ID

These days when e-mail has become the main means of personal and business communication and stealing information is what trade secret crimes thrive on, the problems of securing email and safeguarding privacy are on everyone's mind.

Even if your job does not imply sending your company's secrets that need to be protected from unwanted eyes, you may look for a little personal privacy. Whatever your reason is, the most reliable ways to secure your communications with co-workers, friends and family are mail encryption and digital signatures. Outlook email encryption protects the contents of your messages against unauthorized reading, while a digital signature ensures that your original message has not been modified and comes from a certain sender.

Encrypting email it Outlook may sound like a daunting task, but it is actually quite simple. There exist a few methods of sending secure emails in Outlook, and further on in this article we are going to dwell on the basics of each:

Get a Digital ID for Outlook (encryption and signing certificates)

To be able to encrypt important Outlook e-mails, the first thing you need to get is a Digital ID, also known as E-mail Certificate. You can get the digital ID from one of the sources recommended by Microsoft. You will be able to use these IDs not only to send secure Outlook messages, but protect documents of other applications as well, including Microsoft Access, Excel, Word, PowerPoint and OneNote, versions 2013, 2010 and 2007.

Note: Please keep in mind that most of the services are paid and charge either monthly or yearly fee. If you are looking for a free digital ID, check out COMODO, they provide a free Email Certificate (S/MIME) that will protect your Outlook emails both with encrypting and digitally signing.

The process of getting a Digital ID depends on which service you have opted for. Typically, an ID is provided in the form of an executable installation that will automatically add the certificate to your system. Once installed, your digital ID will become available in Outlook and other Office applications.

How to set up your e-mail certificate in Outlook

To verify whether a digital ID is available in your Outlook, perform the steps below. I will explain how this is accomplished in Outlook 2010, though it works exactly in the same way in Outlook 2013 and with slight differences in Outlook 2007. So hopefully you won't have any problems to configure your encryption certificate in any Outlook version.

1. Switch to the File tab, then go to Options > Trust Center and click the Trust Center Settings button.
Go to the File tab > Options > Trust Center and click the Trust Center Settings button.

2. In the Trust Center dialog window, select E-mail Security.

3. On the E-mail Security tab, click Settings under Encrypted e-mail.
On the E-mail Security tab, click Settings under Encrypted e-mail.

Note: If you already have a digital ID, the settings will be automatically configured for you. If you want to use a different e-mail certificate, follow the remaining steps.

4. In the Change Security Settings dialog window, click New under Security Setting Preferences.
Click New under Security Setting Preferences.

5. Type a name for your new digital certificate in the Security Settings Name box.

6. Make sure S/MIME is selected in the Cryptography Format list. Most digital IDs are of SMIME type and most likely this will be the only option available to you. If your certificate type is Exchange Security, choose it instead.

7. Click Choose next to Encryption Certificate to add your digital cert to encrypt e-mails.
Choose your encryption certificate.

Note: To find out whether the certificate is valid for digital signing or encryption, or both, click the View Certificate properties link on the Select Certificate dialog box.

View the Certificate properties to find out whether the certificate is valid for digital signing or encryption.

Typically, a certificate purposed for cryptographic messaging (such as Outlook email encryption and digital signing) says something like "Protects email messages".
An example of the digital certificate purposed for email encryption and digital signing

8. Select the Send these certificates with signed messages check box if you are going to send Outlook encrypted email messages outside of your company. Then click OK and you are done!
Select the 'Send these certificates with signed messages' check box if you are going to send encrypted emails outside of your company.

Tip: If you want these settings to be used by default for all encrypted and digitally signed messages you send in Outlook, select the Default Security Setting for this cryptographic message format check box.

How to encrypt email in Outlook

Email encryption in Outlook protects the privacy of messages you send by converting them from readable text into scrambled enciphered text.

To be able to send and receive encrypted email messages, you need two basic things:

You need to share the certificates with your contacts because only the recipient who has the private key that matches the public key the sender used to encrypt the email can read that message. In other words, you give your recipients your public key (which is part of your Digital ID) and your correspondents give you their public keys. Only in this case you will be able to send encrypted emails to each other.

If a recipient who does not have the private key matching the public key used by the sender tries to open an encrypted e-mail, they will see this message:

"Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your Digital ID name cannot be found by the underlying security system."

So, let's see how sharing digital IDs is done in Outlook.

How to add a recipient's digital ID (public key)

To be able to exchange encrypted messages with certain contacts, you need to share your public keys first. You start by exchanging digitally signed emails (not encrypted!) with the person to whom you want to send encrypted emails.

Once you get a digitally signed email from your contact, you have to add the contact's digital ID certificate to his/ her contact item in your Address Book. To do this, please follow the steps below:

1. In Outlook, open a message that is digitally signed. You can recognize a digitally signed message by a Signature icon Signature icon.

2. Right-click the sender's name in the From fields, and then click Add to Outlook Contacts.

Right-click the sender's name and then click Add to Outlook Contacts.

When the person is added to your Outlook contacts, their digital certificate will be stored with the contact's entry.

Note: If you already have an entry for this user in your Contacts list, select Update information in the Duplicate Contact Detected dialog.

To view the certificate for a certain contact, double-click the person's name, and then click the Certificates tab.

Once you have shared the Digital IDs with a certain contact, you can send encrypted messages to each other, and the next two sections explain how to do this.

How to encrypt a single email message in Outlook

In an email message you are composing, switch to the Options tab > Permissions group and click the Encrypt button. Then send the encrypted email as you usually do in Outlook, by clicking the Send button. Yep, it is that easy : )

To send an encrypted email message, click the Encrypt button.

If you don't see the Encrypt button, then do the following:

1. Go to Options tab > More Options group and click the Message Options Dialog Box Launcher in the lower corner.
Click the Message Options Dialog Box Launcher in the lower corner.

2. In the Properties dialog window, Click the Security Settings button.
Click the Security Settings button.

3. In the Security Properties dialog window, check the Encrypt message contents and attachments check box and click OK.
In the Security Properties dialog window, check the 'Encrypt message contents and attachments' check box.

Note: This process will also encrypt any attachments you send with the encrypted email messages in Outlook.

4. Finish composing your message and send it as usually.

To verify whether the email encryption worked, switch to the Sent Items folder and if your email was encrypted successfully, you will see the Encryption icon Encryption icon next to it.

Note: If you are trying to send an encrypted message to a recipient who has not shared the public key with you, you will be offered the choice to send the message in the unencrypted format. In this case, either share your certificate with the contact or send the message unencrypted:

If you are trying to send an encrypted Outlook message to a recipient that does not have your digital ID certificate, you are offered to send an unencrypted message instead.

Encrypt all email messages you send in Outlook

If you find that encrypting each email individually is quite an onerous process, you can opt to automatically encrypt all email messages you send in Outlook. However, please note that in this case all of your recipients must have your digital ID to be able to decipher and read your encrypted email. This is probably the right approach if you use a special Outlook account to send emails within your organization only.

You can enable automatic Outlook email encryption in the following way:

1. Navigate to the File tab > Options > Trust Center > Trust Center Settings.
Enable automatic email encryption in Outlook.

2. Switch to the Email Security tab, and select Encrypt contents and attachments for outgoing messages under Encrypted email. Then click OK and you are close to finished.
Select 'Encrypt contents and attachments for outgoing messages' under Encrypted email.

Tip: In case you want some additional settings, for example to choose another digital certificate, click the Settings button.

3. Click OK to close the dialog. From now on, all the messages you send in Outlook will be encrypted.

Well, as you can see Microsoft Outlook takes a rather burdensome approach to email encryption. But once configured, it will definitely make your life easier and email communication safer.

However, the email encryption method we have just explored has one significant limitation - it works for Outlook only. If your recipients use some other email clients, then you will need to employ other tools.

Email encryption between Outlook and other email clients

To send encrypted email between Outlook and other non-Outlook email clients, you can use one of the third party mail encryption tools.

The most popular free open source tool that supports both cryptography standards, OpenPGP and S/MIME, and works with multiple email clients including Outlook is GPG4WIn (the full name is GNU Privacy Guard for Windows).

Using this tool you can easily create an encryption key, export it and send to your contacts. When your recipient receives the email with the encryption key, they will need to save it to a file and then import the key to their email client.

I won't be going into much detail on how to work with this tool since it is rather intuitive and easy to understand. If you need the full info, you can find the instructions with screenshots on the official web-site and even more detailed instructions on this blog.

To have a general idea how GPG4OL looks like in Outlook, see the following screenshot:
GPG4Win plug-in in Outlook

Besides the GPG4Win add-in, there is a handful of other tools for email encryption. Some of these programs work with Outlook only, while others support several email clients:

Exchange hosted encryption

If you are working in a corporate environment, you can use the Exchange Hosted Encryption (EHE) service to have your email messages encrypted/decrypted at the server side based on policy rules that your administrator creates.

Outlook users who have ever tried this encryption method have two major complaints.

Firstly, exchange hosted encryption is hard to configure. Besides the digital ID, it also requires a special password, aka token, that your Exchange administrator has assigned to you. If your Exchange admin is responsible and responsive, he will configure your Exchange encryption and set you free from this headache : ) If you are not that lucky, try to follow Microsoft's instructions (Get a digital ID for sending messages using Microsoft Exchange section is near the bottom of the page).

Secondly, the recipients of your encrypted emails should use Exchange hosted encryption too, otherwise it is useless.

The newest Office 365 Exchange Hosted Encryption, available for purchase since the first quarter of 2014, is claimed to have fixed both of the above mentioned problems. To find more information about it, visit the official web-site or this blog.

If none of the email protection techniques covered in this article meets your requirement in full, you can consider using other, more sophisticated methods, such as Steganography. This hard-to-pronounce word means concealing a message or other file within another message or file. There exist various digital steganography techniques, for example concealing the contents of an email within the lowest bits of noisy images, within encrypted or random data and so on. If you are interested to learn more, check out this Wikipedia article.

And this is all for today, thank you for reading!

20 Responses to "Email encryption in Outlook - how to encrypt some or all messages with digital ID"

  1. Robert Bosch says:

    These instructions seem backwards. I thought my public key makes it possible for others to send me encrypted messages. Not to open messages from me. It makes no sense for a public key to be able to open an encrypted file. Conversely, I should need to have the public key of each correspondent to whom I want to send encrypted email.

    Do I have it backwards, or is the Outlook system vulnerable to interception by anyone with my public key?

    • Hello Robert,

      You are absolutely right. You share your public key with others so that they can send you encrypted messages (your private key enables you to read them).

      > Conversely, I should need to have the public key of each correspondent to whom I want to send encrypted email.
      Absolutely so. I couldn't have put it better.

      I've revised the article and made a few corrections to convey exactly this meaning. Thank you very much for your feedback!

  2. T800 says:

    FYI, message encryption is broken in Windows 8, you can send but you can't read received encrypted messages. Message signing works though.

  3. Per Frejvall says:

    Hi all!

    I have two Exchange accounts aimed at two different servers in my profile. In Outlook 2011 for Mac this works as advertised, but in Outlook 2010 for Windows Outlook is never able to distinguish between the two certificates and e-mail addresses. It will always use the last added certificate, regardless of auto select, default select or manual select.

    I have two different named security settings in trust center, each with the correct certificate for the e-mail address. I have seen people do this with Outlook 2013 but I have failed with 2010.

    Any ideas?

    All the best,

    Per

    • Hi Per!
      I am sorry, we have never encountered this problem before. You can probably contact Microsoft support service for assistance or search for a solution on stackoverflow.com or answers.microsoft.com. Really sorry for not being able to help you better.

  4. Per Frejvall says:

    I'd say it's a bug... Simply can't make it work. Will try on 2013 just to verify...

    Thanks,

    Per

  5. Maneesh Massey says:

    Hi Svetlana,

    I'm using Outlook 2013. I would like to know how to work with Outlook 2013 mail client and Gmail. I've set up the Outlook part by installing the Digital certificate from COMODO and then wrote myself an email on my gmail account. The first thing I did was to send an plain text mail attaching my public ID to my gmail account. Then I installed another digital certificate from COMODO for my gmail account and did the same to send my public key to my Outlook account. After this I sent an encrypted email from Outlook 2013 to my Gmail account. The email sure did come, but I cannot see anything written in the mail, except a small attachment called "smime.p7m" of 11 kb size. How do I decrypt the mail sent from my Outlook 2013 and read it in my Gmail account ??

    Thanks for helping.

  6. Maneesh Massey says:

    Hi,

    Please correct me if I'm wrong. In order to communicate between Outlook 2013 and Gmail, I thought I needed to exchange digital ID's. Hence, I went to the COMODO site and filled in the details for my Gmail account and got a success message for the certificate to have been installed. I then opened IE, tools -> options -> Content tab -> certificates. I could see the my Gmail email address listed there. Then I exported the certificate to the desktop and wrote myself an email from Gmail and attached this certificate along with my mail to my Outlook account. After that I right-clicked on my account name in contacts and added the Gmail account into Outlook. I looked in the People group and clicked on Certificates, then imported the Gmail certificate into Outlook and saved the closed the window. Then I wrote myself another email from Outlook to my Gmail account. I clicked on the Encrypt button to encrypt the message and clicked the sent button. But when I do that, I always get a message "Microsoft Outlook had problems encrypting the message ....... because recipients had missing or invalid certificates ... "

    What did I do wrong here ? I tried to follow your instructions exactly, but why does it give me this error ??

    ~Thanks

  7. Maneesh Massey says:

    Hi Svetlana Cheusheva,
    Okay. You have showed how to install the digital ID into Outlook. But you have not shown how to share the digital ID with another person through Outlook. How do we share our digital ID within Outlook with another person ?

  8. Maneesh Massey says:

    Okay, I have another question for you, Svetlana. Above in your article you have described how to exchange the digital ID's with each other by right-clicking on the person's name in Contacts and clicking Add to Contacts. This also adds the digital public key of the recipient with whom we want to send messages to. And if that contact already exists in Outlook contacts, then select "Update information in the Duplicate Contact Detected dialog". I'm using Outlook 2013 and I do not find the Duplicate Contact Detected dialog box anywhere. Where should I look to Update information for the contact that already exists ??
    Thanks.

  9. Suzy says:

    I can find the way to encript everything that you send out but is there a way to have outlook automatically encript all attachments but not every single email?
    thanks!

  10. Anil says:

    Hi Svetlana,
    I have an strange issue,I'm sending mails with signed messages (using comodo email certificate) (without any attachments) to one of the organisation , but the recipients are receiving my mail as an attachment which can not be opened. The recipients have saved my email address in their address book, still they are unable to view my email contents on the body of a email. Could you please help me here?

  11. Abhi Kumar says:

    I too have a lot problems which I would like to discuss with you.Great information about email encryption outlook...Thanks for sharing! A great help to the public.

Post a comment



Ultimate Suite for Excel Professionals
 
 
The best spent money on software I've ever spent!
Patrick Raugh
Ablebits is a fantastic product - easy to use and so efficient.
Debra Celmer
Excel is at its best now
Annie C.
I don't know how to thank you enough for your Excel add-ins
Jennifer Morningstar
Anybody who experiences it, is bound to love it!
Kumar Nepa
It's the best $100 we've ever spent!
Mike Cavanagh
I love the program, and I can't imagine using Excel without it!
Robert Madsen
One word… WOW!
Dave Brown
Love the products!
David Johnston
It is like having an expert at my shoulder helping me…
Linda Shakespeare
Your software really helps make my job easier
Jeannie C.
Thanks for a terrific product that is worth every single cent!
Dianne Young
I love your product
Brad Gibson
Awesome!!!
Sheila Blanchard