Sending Encrypted Emails

[hmdeassis]

Hello-

I currently have Exchange 2007. My boss wants to configure Exchange to send out encrypted emails.

Any ideas on how I can get this going? Where in Exchange do I go to make this change.

All the help would be greatly appreciated.

Thanks

 

[hmdeassis]

Any takers?

There isnt much detailed information out there that gives you exact steps. Any help would be greatly apreciated.

 

[hmdeassis]

Help

 

[58sniper]

Don't bump your post on the same day. You'll get the post red flagged and it will be deleted.

Please define your requirements. Encrypted to who? Internal users? External users? Partners? What client do your users use?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

Oops..sorry

All users currently use Outlook client. All messages sent outbound from the office needs to be encrypted at the massage level and not at the transport level.

 

[58sniper]

What version of Outlook? All messages leaving your environment? That's not going to happen. In order to support message encryption, the sender and recipient must exchange keys. You can't encrypt an email message unless you have the recipient's public key. If that recipient doesn't have a key, you simply can't send them an encrypted message. And since most users don't have encryption keys, you're out of luck.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

Outlook 2003 and 2007. The server is Exchange 2007. How can I setup at the server level encryption? What do I exactly need? A public key from Comodo, Verisign?

What do I excatly need to get this accomplished and the steps.

Thanks for taking the time.

 

[58sniper]

I'm not sure I understand your question. If you want to encrypt the CONNECTION between your server and receiving servers (transport level), you need a publicly trusted certificate such as Digicert for the name presented when your server sends mail (generally the name in the send connector). You can then enable that certificate for SMTP, and servers will use TLS to transmit email messages.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

Not at the transport level.The encryption must be done at the message level. I need to know how can it be done at the message level and not at the transport level.

 

[58sniper]

That's not going to happen.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

What other companies are using for email encryotion?

 

[58sniper]

You can't encrypt mail messages in Exchange without public and private keys. Period. And even then, there is complexity around transport rules being able to look at the content in order to fire appropriate rules. There is complexity around mobile devices, and clients that might not support encryption (think non-IE OWA).

You can encrypt the transport.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

Are there any instructions or steps on how to acomplish this?

 

[58sniper]

Tons of them via Google and Bing.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

Thanks. I have been very helpfull

 

[muckermucker]

Sniper I thought this was possible? however the last time I looked into this it was a while ago on Exchange 2003. I thought you could install a user certificate (public one of course) and Outlook (not exchange) encrypts the message. It only encrypts the content however so the email headers are unencrypted so Exchange knows where to send it etc. This can be unencrypted at the other end using the public key as it was encrypted with the private key.
This would mean the receiver wouldn't need any certs installed.

Am I missing something?

Take a look at my IT blog guides, knowledgebase and technical resources at

http://think-like-a-computer.com

 

[58sniper]

Yes. Outlook won't let you send a message to a recipient unless it has the recipient's key (generally as a the result of you receiving a digitally signed message from that person - it then stores that certificate in the contact for that person). And they will need your key to decrypt. Which means a PKI accessible to the Internet.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

So if we give the recipeint the PKI they should be able to access the encrypted message?

 

[58sniper]

PKI is not something you give a user. It's a Public Key Infrastructure. It's what handles keys for your users. Nothing changes. Keys are required on both sides.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.exchangeblogs.com/

 

[hmdeassis]

My question to be more precise is how will the other users on the other side be able to open the email. How can they obtain a KEY?