2
I created a GPG keypair with GnuPG on the CentOS 7 command line and I have exported the public key into a .asc
file and successfully used that public key to encrypt emails sent from another email address which have been successfully decrypted using the private key that was created along with that public key.
So how can I generate a public key file that MS Outlook 2010 will accept and be able to successfully use to encrypt emails sent to be encrypted by the same private key?
Here is what I have done so far:
Using putty, I typed
gpg --list-public-keys
at the server terminal. I noted that12321KP4
was the id of the pub key in the results ofgpg --list-public-keys
I next typed
gpg --armor --export 12321KP4 > /path/to/username_pubkey.cer
.I then typed
cat /path/to/username_pubkey.cer
and confirmed that it is in fact a bunch of encrypted content.I downloaded the resulting
username_pubkey.cer
file.I opened “Outlook 2010.”
In “Outlook > Contacts,” I opened the contact form for the contact whose certificate is
username_pubkey.cer
.On the “contact” tab, in the “show group,” I clicked “certificates,” and then clicked Import.
I selected the
username_pubkey.cer
file and clicked “open,” but got the following error dialog:
How can I generate a keyfile that Outlook can import and then successfully use to send encypted emails that can be decrypted on the other end?
Note that Thunderbird is able to do this with a keyfile from this same key. Also note that I want to manually import the key first this way, and wait until later to develop the tools to send the key by email. The private key is on a server that hosts an app, and I would have to write my own code to send out public keys by email. I want to wait to write that code until after getting this approach to work first.
EDIT
As per @JakeGould's suggestion, I typed sudo unix2dos /path/to/username_pubkey.cer /path/to/username_pubkey_dos.cer
, but I got the following in response:
unix2dos: converting file /path/to/username_pubkey.cer to DOS format ...
unix2dos: /path/to/username_pubkey_dos.cer: No such file or directory
unix2dos: Skipping /path/to/username_pubkey_dos.cer, not a regular file.
How can I resolve this?
StartSSL only offers 128/256 bit certificates. My GnuPG cert is 2048 bits. Can you suggest a way I can get 2048 (or 4096?) bit keys to work with outlook? This is a medical app that needs to provide the highest levels of security. – CodeMed – 2015-02-24T17:00:42.533
I think you're confusing the hash sum with RSA key size. StartSSL does not accept any RSA keys smaller 2048 bits. Anyway: if security/confidentiality is crucial for any business (or medical, whatever) application, get (and pay) somebody familiar with the subject. There is an unbelievable number of ways to fail at setting up encryption, far beyond the scope of any tutorial and probably even text book. – Jens Erat – 2015-02-24T17:08:04.513
Can I just use OpenSSL to create the certificate? As in this posting? http://security.stackexchange.com/questions/17583/how-do-i-create-a-valid-email-certificate-for-outlook-s-mime-with-openssl
– CodeMed – 2015-02-24T17:08:16.080I don't think StartSSL accepts certificate requests for client certificates. During the certification process, the key is generated within the browser and never sent to StartSSL (or anybody else). – Jens Erat – 2015-02-24T17:09:50.493