Tag: Secure/Multipurpose Internet Mail Extensions (S/MIME)

Assume the following scenario:

• The certificates were transferred to the smartphone via the Intune Connector .
• Reading encrypted messages works.
• However, when enabling encryption for outgoing messages, the following error message is displayed:

There's a problem with one of your S/MIME encryption certificates. Contact your IT help desk for more info.

Es gibt ein Problem mit einem ihrer S/MIME-Verschlüsselungszertifikate. Wenden Sie sich für weitere Informationen an Ihren IT-Helpdesk.

Continue reading "Sending S/MIME encrypted messages with Outlook for iOS is not possible: "There's a problem with one of your S/MIME encryption certificates.""

For the encryption of email messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with appropriate certificates for this purpose.

An important aspect here is that the users' private keys should be secured centrally - in contrast to the signing certificates that are otherwise mostly used. Incoming messages are encrypted for a specific private key and can only be decrypted again by this key . Thus a backup of these keys must absolutely be available - this is also indispensable for synchronization to mobile devices . For this purpose, the Microsoft Active Directory Certificate Services offer the private key archival function.

But what if private key archival has not been set up and users have already requested corresponding certificates?

Continue reading "Subsequent archiving of private keys"

In a modern networked world, the confidential transmission of messages in the corporate environment is essential for business success. Despite its age , it is still impossible to imagine modern corporate communications without e-mail. However, its use has changed significantly over the decades.

Nowadays, it is common to be able to read and write business e-mails on mobile devices such as smartphones and tablets. Such end devices are usually managed with Mobile Device Management (MDM) systems such as Microsoft Intune.

To encrypt e-mail messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with the corresponding certificates. How do these certificates get to the end devices of the users in a scalable way?

Continue reading "Transferring S/MIME certificates to Microsoft Intune"

Assume the following scenario:

• A user sends an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The sender uses Microsoft Outlook for Macintosh.
• The receiving mail server rejects the message and sends back a Non-Delivery Report (NDR):

550 5.6.0 M2MCVT.StorageError.Exception: ConversionFailedException - , Content conversion: Invalid S/MIME encrypted message.; storage error in content conversion.

Continue reading "Microsoft Outlook: Signed e-mail messages are rejected by the receiving mail server with error message "Invalid S/MIME encrypted message.""

Assume the following scenario

• A user receives an e-mail message signed with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The user (the recipient) uses Microsoft Outlook for Windows.
• The sender uses Microsoft Outlook for Macintosh.
• The certificate used to sign the message is valid.
• The e-mail signature is displayed as invalid. Inspection of the signature reveals that no details about the signing certificate can be displayed.

Fehler: Es wurde kein Zertifikat zum Überprüfen der Signatur dieser Nachricht gefunden.
Signiert von (Name des Zertifikatsbetreffs unbekannt) unter Verwendung von RSA/SHA256 um 15:44:59 19.05.2021.

Continue reading "Microsoft Outlook: Signed e-mail messages appear invalid with error message "No certificate was found to verify the signature of this message.""

Assume the following scenario:

• A user wants to send a signed e-mail
• The operation fails with the following error message:

Diese Nachricht kann von Microsoft Outlook weder verschlüsselt noch signiert werden, da keine Zertifikate für das Senden von Nachrichten von der E-Mail Adresse "rudi.ratlos@adcslabor.de" vorhanden sind. Fordern Sie entweder eine neue digitale ID für dieses Konto an, oder verwenden Sie die Schaltfläche "Konten", um die Nachricht mithilfe eines Kontos zu senden, für das Sie Zertifikate besitzen.

Continue reading "Microsoft Outlook: "This message cannot be encrypted or signed by Microsoft Outlook because there are no certificates for sending messages from the email address [...].""

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Leider besteht ein Problem beim Öffnen dieses Elements. Dies kann vorübergehend sein. Wenn dieser Fehler erneut auftritt, sollten Sie Outlook neu starten. Fehler im zugrunde liegenden Sicherheitssystem. Interner Fehler.

Continue reading "Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Internal error." appears."

If you want to make S/MIME certificates available to your users on the smartphone as well, you may be surprised to discover that this is not possible with the Outlook app unless you also use Microsoft Intune as a management solution for the devices.

Microsoft has now clarified in the article "Sensitivity labeling and protection in Outlook for iOS and Android " that this is due to the respective system architecture.

Continue reading "S/MIME with the Outlook app for Apple iOS and Android only possible with devices managed via Intune"

For troubleshooting e-mail messages encrypted using Secure/Multipurpose Internet Mail Extensions (S/MIME), the encrypted part of a message can be exported. See article "Microsoft Outlook: Extracting an encrypted S/MIME message from an email ".

To find out with which certificates a message has been encrypted, you can proceed as follows...

Continue reading "Microsoft Outlook: Find out recipient certificates for S/MIME encrypted mails"

The encrypted part of an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME) is always contained in a file called "smime.p7m" as an attachment to the mail.

Outlook does not display this attachment, but for analysis purposes it can be extracted from the e-mail with MFCMAPI , which Microsoft provides free of charge.

Continue reading "Microsoft Outlook: Extracting an encrypted S/MIME message from an email"

Assume the following scenario:

• A user receives an e-mail message encrypted with Secure/Multipurpose Internet Mail Extensions (S/MIME).
• The message cannot be opened.
• When opening the message, the following error message is displayed:

Sorry, we're having trouble opening this item. This could be temporary, but if you see it again you might want to restart Outlook. Your digital ID name cannot be found by the underlying security system.

Continue reading "Microsoft Outlook: Emails encrypted with S/MIME cannot be opened. The error message "Your digital ID name cannot be found by the underlying security system" appears."

Assume the following scenario:

• A user has received an email message in the past.
• The message was signed with an S/MIME certificate.
• The sender's signing certificate was issued by a certification authority that is trusted by the recipient.
• Thus, the signature was recognized as valid at the time the message was received.
• The user opens the mail again some time later and finds that the signature is classified as invalid.

Continue reading "Microsoft Outlook: Correctly signed e-mails (S/MIME) are displayed as invalid after the signing certificate expires"

Below is a description of where it is possible to view which symmetric algorithm was used to encrypt an email received, and which hash algorithm was used for a signed email.

Continue reading "Microsoft Outlook: View which algorithm was used for an S/MIME encrypted or signed email"

Microsoft Outlook uses (if available and required) the information in the "S/MIME Capabilities" extension of a certificate. Below is a description of how it is used and which algorithms are selected.

Continue reading "Microsoft Outlook: Control the encryption algorithm used for S/MIME"

Among others, Microsoft Outlook evaluates the extension and uses it to determine the symmetric algorithm for an encrypted email.

Continue reading "The "S/MIME Capabilities" certificate extension"