by These days when e-mail has become the main means of personal and business communication and stealing information is what trade secret crimes thrive on, the problems of securing email and safeguarding privacy are on everyone's mind.
Even if your job does not imply sending your company's secrets that need to be protected from unwanted eyes, you may look for a little personal privacy. Whatever your reason is, the most reliable ways to secure your communications with co-workers, friends and family are mail encryption and digital signatures. Outlook email encryption protects the contents of your messages against unauthorized reading, while a digital signature ensures that your original message has not been modified and comes from a certain sender.
Encrypting email it Outlook may sound like a daunting task, but it is actually quite simple. There exist a few methods of sending secure emails in Outlook, and further on in this article we are going to dwell on the basics of each:
Get a Digital ID for Outlook (encryption and signing certificates)
To be able to encrypt important Outlook e-mails, the first thing you need to get is a Digital ID, also known as E-mail Certificate. You can get the digital ID from one of the sources recommended by Microsoft. You will be able to use these IDs not only to send secure Outlook messages, but protect documents of other applications as well, including Microsoft Access, Excel, Word, PowerPoint and OneNote.
The process of getting a Digital ID depends on which service you have opted for. Typically, an ID is provided in the form of an executable installation that will automatically add the certificate to your system. Once installed, your digital ID will become available in Outlook and other Office applications.
How to set up your e-mail certificate in Outlook
To verify whether a digital ID is available in your Outlook, perform the steps below. We explain how this is accomplished in Outlook 2010, though it works exactly in the same way in Outlook 2013 - 365, and with insignificant differences in Outlook 2007. So hopefully you won't have any problems to configure your encryption certificate in any Outlook version.
- Switch to the File tab, then go to Options > Trust Center and click the Trust Center Settings button.
- In the Trust Center dialog window, select E-mail Security.
- On the E-mail Security tab, click Settings under Encrypted e-mail.
Note: If you already have a digital ID, the settings will be automatically configured for you. If you want to use a different e-mail certificate, follow the remaining steps.
- In the Change Security Settings dialog window, click New under Security Setting Preferences.
- Type a name for your new digital certificate in the Security Settings Name box.
- Make sure S/MIME is selected in the Cryptography Format list. Most digital IDs are of SMIME type and most likely this will be the only option available to you. If your certificate type is Exchange Security, choose it instead.
- Click Choose next to Encryption Certificate to add your digital cert to encrypt e-mails.
Note: To find out whether the certificate is valid for digital signing or encryption, or both, click the View Certificate properties link on the Select Certificate dialog box.
Typically, a certificate purposed for cryptographic messaging (such as Outlook email encryption and digital signing) says something like "Protects email messages".
- Select the Send these certificates with signed messages check box if you are going to send Outlook encrypted email messages outside of your company. Then click OK and you are done!
Tip: If you want these settings to be used by default for all encrypted and digitally signed messages you send in Outlook, select the Default Security Setting for this cryptographic message format check box.
How to encrypt email in Outlook
Email encryption in Outlook protects the privacy of messages you send by converting them from readable text into scrambled enciphered text.
To be able to send and receive encrypted email messages, you need two basic things:
- Digital ID (encryption email certificate). We have discussed how to get a digital ID and set up the certificate in Outlook in the first part of the article.
- Share your public key (which is part of the certificate) with the correspondents you wish to receive encrypted messages from. See the step-by-step instructions on how to share public keys.
You need to share the certificates with your contacts because only the recipient who has the private key that matches the public key the sender used to encrypt the email can read that message. In other words, you give your recipients your public key (which is part of your Digital ID) and your correspondents give you their public keys. Only in this case you will be able to send encrypted emails to each other.
If a recipient who does not have the private key matching the public key used by the sender tries to open an encrypted e-mail, they will see this message:
"Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your Digital ID name cannot be found by the underlying security system."
So, let's see how sharing digital IDs is done in Outlook.
How to add a recipient's digital ID (public key)
To be able to exchange encrypted messages with certain contacts, you need to share your public keys first. You start by exchanging digitally signed emails (not encrypted!) with the person to whom you want to send encrypted emails.
Once you get a digitally signed email from your contact, you have to add the contact's digital ID certificate to his/ her contact item in your Address Book. To do this, please follow the steps below:
- In Outlook, open a message that is digitally signed. You can recognize a digitally signed message by a Signature icon
. - Right-click the sender's name in the From fields, and then click Add to Outlook Contacts.
When the person is added to your Outlook contacts, their digital certificate will be stored with the contact's entry.
Note: If you already have an entry for this user in your Contacts list, select Update information in the Duplicate Contact Detected dialog.
To view the certificate for a certain contact, double-click the person's name, and then click the Certificates tab.
Once you have shared the Digital IDs with a certain contact, you can send encrypted messages to each other, and the next two sections explain how to do this.
How to encrypt a single email message in Outlook
In an email message you are composing, switch to the Options tab > Permissions group and click the Encrypt button. Then send the encrypted email as you usually do in Outlook, by clicking the Send button. Yep, it is that easy : )
If you don't see the Encrypt button, then do the following:
- Go to Options tab > More Options group and click the Message Options Dialog Box Launcher in the lower corner.
- In the Properties dialog window, Click the Security Settings button.
- In the Security Properties dialog window, check the Encrypt message contents and attachments check box and click OK.
Note: This process will also encrypt any attachments you send with the encrypted email messages in Outlook.
- Finish composing your message and send it as usual.
To verify whether the email encryption worked, switch to the Sent Items folder and if your email was encrypted successfully, you will see the Encryption icon
next to it.Note: If you are trying to send an encrypted message to a recipient who has not shared the public key with you, you will be offered the choice to send the message in the unencrypted format. In this case, either share your certificate with the contact or send the message unencrypted:
Encrypt all email messages you send in Outlook
If you find that encrypting each email individually is quite an onerous process, you can opt to automatically encrypt all email messages you send in Outlook. However, please note that in this case all of your recipients must have your digital ID to be able to decipher and read your encrypted email. This is probably the right approach if you use a special Outlook account to send emails within your organization only.
You can enable automatic Outlook email encryption in the following way:
- Navigate to the File tab > Options > Trust Center > Trust Center Settings.
- Switch to the Email Security tab, and select Encrypt contents and attachments for outgoing messages under Encrypted email. Then click OK and you are close to finished.
Tip: In case you want some additional settings, for example to choose another digital certificate, click the Settings button.
- Click OK to close the dialog. From now on, all the messages you send in Outlook will be encrypted.
Well, as you can see Microsoft Outlook takes a rather burdensome approach to email encryption. But once configured, it will definitely make your life easier and email communication safer.
However, the email encryption method we have just explored has one significant limitation - it works for Outlook only. If your recipients use some other email clients, then you will need to employ other tools.
Email encryption between Outlook and other email clients
To send encrypted email between Outlook and other non-Outlook email clients, you can use one of the third party mail encryption tools.
The most popular free open source tool that supports both cryptography standards, OpenPGP and S/MIME, and works with multiple email clients including Outlook is GPG4WIn (the full name is GNU Privacy Guard for Windows).
Using this tool you can easily create an encryption key, export it and send to your contacts. When your recipient receives the email with the encryption key, they will need to save it to a file and then import the key to their email client.
I won't be going into much detail on how to work with this tool since it is rather intuitive and easy to understand. If you need the full info, you can find the instructions with screenshots on the official web-site.
To have a general idea how GPG4OL looks like in Outlook, see the following screenshot:
Besides the GPG4Win add-in, there is a handful of other tools for email encryption. Some of these programs work with Outlook only, while others support several email clients:
Exchange hosted encryption
If you are working in a corporate environment, you can use the Exchange Hosted Encryption (EHE) service to have your email messages encrypted/decrypted at the server side based on policy rules that your administrator creates.
Outlook users who have ever tried this encryption method have two major complaints.
Firstly, exchange hosted encryption is hard to configure. Besides the digital ID, it also requires a special password, aka token, that your Exchange administrator has assigned to you. If your Exchange admin is responsible and responsive, he will configure your Exchange encryption and set you free from this headache : ) If you are not that lucky, try to follow Microsoft's instructions (Get a digital ID for sending messages using Microsoft Exchange section is near the bottom of the page).
Secondly, the recipients of your encrypted emails should use Exchange hosted encryption too, otherwise it is useless.
The Office 365 Exchange Hosted Encryption is claimed to have fixed both of the above mentioned problems. To find more information about it, visit the official web-site or this blog.
If none of the email protection techniques covered in this article meets your requirement in full, you can consider using other, more sophisticated methods, such as Steganography. This hard-to-pronounce word means concealing a message or other file within another message or file. There exist various digital steganography techniques, for example concealing the contents of an email within the lowest bits of noisy images, within encrypted or random data and so on. If you are interested to learn more, check out this Wikipedia article.
And this is all for today, thank you for reading!
54 comments
Hi. To encrypt (encryption only - not signed) a single mail in Outlook I then need the public cert of the recipient. Do I also need my own certificate to perform this function or it can be done by any email sender account (with or without a certificate)? Thanks.
Well, I have just found out it is not possible to send an encrypted message if you don't have a certificate. The PKI is not designed that way. In other words you can't just simply encrypt a message with the recipient's public key if you don't have a certificate of your own.
The link at the top of the article (sources recommended by Microsoft) is dead.
For anyone looking, here's a currently (2022) active livnk to a Microsoft page showing how/where to get a certificate.
https://support.microsoft.com/en-us/office/get-a-digital-id-0eaa0ab9-b8a2-4a7e-828b-9bded6370b7b
Hi Amy,
The link is fixed. Thank you for pointing that out!
Hi,
I have the same issue, I installed a personnel certificate and assigned the cert to my account successfully.But while I sending mail, the error massage "If you are trying to send an encrypted Outlook message to a recipient that does not have your digital ID certificate..." will pop out. How to resolve this? Thanks.
Hi,
I have the same issue, I installed a personnel certificate and assigned the cert to my account successfully.But while I sending mail, the error massage "If you are trying to send an encrypted Outlook message to a recipient that does not have your digital ID certificate..." will pop out. How to resolve this? Thanks.
Thanks for that! Helped alot!
I work for the Air Force and I'm trying to set my exchange server up to be able to send and receive encrypted emails from the AF domain. We are on a different domain still managed by the AF. We can pull down a cert for one user at a time but this is time consuming and we would like to be able to have it configured for all users. We can send encrypted emails internally but not outside of the domain. Any ideas on how to fix this?
Hi
i have multiple accounts and i don't want to digital certificate for all my emails ..so which option i can disable for multiple accounts
Regards
Krishna
Hi Svetlana
i have installed personnel sign from official source. But im unable to encrypt my email. While sending it shows error massage "If you are trying to send an encrypted Outlook message to a recipient that does not have your digital ID certificat...". Could you please suggest how to resolve my issue.
Jut got a Comodo free email cert, got it installed via FireFox on my Mac. Having a heck of a time trying to get MS Outlook 2016 to use this certificate. Other than getting off the Mac, what do you suggest?
Yes, me too Steve. Outlook 2016 does just not see the crt.
What about the newest and updated outlook.com ?
Hi Svetlana,
I have a question, if I get an encrypted/signed email is there anyway I can force the settings so I can't forward this message without decrypting or at least keeping the encryption as the only option to send it, disable the "Send unencrypted" option?.
Thanks.
I have followed all the steps and we have done the digital "handshake" and I can see the certificate in the contract's address card but we can't exchange encrypted messages. Would appreciated some assistance.
Hi,
I have downloaded a digital certificate via Comodo.I received the confirmation email and downloaded through the Microsoft website link which suggested comodoo. The details include the "securing e-mails" descriptions and it says that "the certificate is ok". I follow all the steps through to trust centre etc, clicking on settings and then new, entering a name and then choosing. When I click the choose button, I get the dialogue box come up saying "No certificates avaliable: No certificates meet the application". Perhaps I need a public key - in which case I'm not sure if I have one already/how to get one. My certificate manager also says that I have a certificate by Comodo. Another reason could be the storing of my certificate which by default named as "user". I chose to automatically choose the location - which put it in downloads. This saved the file type as "security certificate", however when I install it via the above instructions the file type specifies "security information" which i change to all files - as this is the only way the certificate shows.
Would appreciate the help :)
thank you so much! this was driving me nuts and now it's resolved thanks to you!
Hi Svetlana
The article is great... I have a client who needs emails encrypted from a particular set of users. How do I get about the encryption only for a set of users, also the same set of users would need to communicate with other clients and users etc without the encryption.
Thanks
Hi Svetlana,
How can I send encrypted mail to a contact group in Outlook?
Per Frejvall says:
August 14, 2014 at 8:01 am
Hi all!
I have two Exchange accounts aimed at two different servers in my profile. In Outlook 2011 for Mac this works as advertised, but in Outlook 2010 for Windows Outlook is never able to distinguish between the two certificates and e-mail addresses. It will always use the last added certificate, regardless of auto select, default select or manual select.
I have two different named security settings in trust center, each with the correct certificate for the e-mail address. I have seen people do this with Outlook 2013 but I have failed with 2010.
Any ideas?
All the best,
Per
In the above example, do you have both accounts on the same Outlook profile? If so, you need to have separate profiles. Security certificates are 1 per Outlook profile if I remember correctly.
What controls which encryption algorithms are displayed. Many of the users in my environment have AES as a choice some have 3DES as the highest level algorithm.
Please advise. Thank you for your kind consideration and assistance in this matter.
A user can read some encrypted emails but not others. All from the same CA.
Looking at the users profile in ADUC, we noticed that the users has multiple certificates published that have email encryption enabled.
How does Outlook/Active Directory which public key certificate to use?