2

I created a GPG keypair with GnuPG on the CentOS 7 command line and I have exported the public key into a .asc file and successfully used that public key to encrypt emails sent from another email address which have been successfully decrypted using the private key that was created along with that public key.

So how can I generate a public key file that MS Outlook 2010 will accept and be able to successfully use to encrypt emails sent to be encrypted by the same private key?

Here is what I have done so far:

  1. Using putty, I typed gpg --list-public-keys at the server terminal. I noted that 12321KP4 was the id of the pub key in the results of gpg --list-public-keys

  2. I next typed gpg --armor --export 12321KP4 > /path/to/username_pubkey.cer.

  3. I then typed cat /path/to/username_pubkey.cer and confirmed that it is in fact a bunch of encrypted content.

  4. I downloaded the resulting username_pubkey.cer file.

  5. I opened “Outlook 2010.”

  6. In “Outlook > Contacts,” I opened the contact form for the contact whose certificate is username_pubkey.cer.

  7. On the “contact” tab, in the “show group,” I clicked “certificates,” and then clicked Import.

  8. I selected the username_pubkey.cer file and clicked “open,” but got the following error dialog:

enter image description here

How can I generate a keyfile that Outlook can import and then successfully use to send encypted emails that can be decrypted on the other end?

Note that Thunderbird is able to do this with a keyfile from this same key. Also note that I want to manually import the key first this way, and wait until later to develop the tools to send the key by email. The private key is on a server that hosts an app, and I would have to write my own code to send out public keys by email. I want to wait to write that code until after getting this approach to work first.

EDIT

As per the suggestion in @Giacomo1968's answer, I typed sudo unix2dos /path/to/username_pubkey.cer /path/to/username_pubkey_dos.cer, but I got the following in response:

unix2dos: converting file /path/to/username_pubkey.cer to DOS format ...
unix2dos: /path/to/username_pubkey_dos.cer: No such file or directory
unix2dos: Skipping /path/to/username_pubkey_dos.cer, not a regular file.

How can I resolve this?

Improve this question

4 Answers 4

Reset to default
3

You're confusing two different digital certificate systems. Certificates are not interchangeable between the two systems.

OpenPGP

OpenPGP provides a non-hierarchical trust system, which does not require central certificate authorities. It is the more powerful, but also more complex system. Most mail clients do not support it out of the box, and require add-ons for using it.

Everybody can create his own key, and get it signed by others.

X.509 and S/MIME

The other option for digital certificates is X.509, used in S/MIME for e-mail, but also SSL/TLS for transport encryption of HTTP and other protocols. Here you have a bunch of certificate authorities (actually usually multiple hundred) that you trust in (by default settings of your computer/mail client), and that can vouch for others (issue certifications) which you automatically trust.

This is a good fit for (hierarchically organized) companies, which probably is the reason that it has much more wide-spread implementation. Outlook, Thunderbird and most other (reasonable) mail clients support it by default.

There are lots of certificate authorities where you could buy such a certificate (valid for a given timespan). I'm only listing two especially interesting ones:

  • StartSSL is an Israel-based company issuing free basic certificates for mail and servers, but without validating your real ID (only your mail address). The advantage is that they are trusted by all major browser and operating system vendors. Certificates including your real name are available for a flatrate of around 60$ per year. Be aware revoking a certificate (eg., in case some third got access to it and can now write e-mail in your name) is around 25$ (which is also charged by a lot of other companies).

  • CAcert is a "community driven certificate authority". They verify your identity by other community members agreeing to do so, so you will have to meet others and show your ID to get your name into the certificate (for details, read their website). Issuing certificates and revocations are always free, but the downside is their root certificate is not trusted by major operating systems and mail clients.

    Might be feasible for limited groups or private use, but be aware of this problem if using it commercially.

Improve this answer
5
  • StartSSL only offers 128/256 bit certificates. My GnuPG cert is 2048 bits. Can you suggest a way I can get 2048 (or 4096?) bit keys to work with outlook? This is a medical app that needs to provide the highest levels of security.
    – CodeMed
    Feb 24, 2015 at 17:00
  • I think you're confusing the hash sum with RSA key size. StartSSL does not accept any RSA keys smaller 2048 bits. Anyway: if security/confidentiality is crucial for any business (or medical, whatever) application, get (and pay) somebody familiar with the subject. There is an unbelievable number of ways to fail at setting up encryption, far beyond the scope of any tutorial and probably even text book.
    – Jens Erat
    Feb 24, 2015 at 17:08
  • Can I just use OpenSSL to create the certificate? As in this posting? security.stackexchange.com/questions/17583/…
    – CodeMed
    Feb 24, 2015 at 17:08
  • I don't think StartSSL accepts certificate requests for client certificates. During the certification process, the key is generated within the browser and never sent to StartSSL (or anybody else).
    – Jens Erat
    Feb 24, 2015 at 17:09
  • (since this was necroed already) In 2016 StartSSL/StartCom was sold to WoSign in China, who were caught issuing fradulent certs and within a year distrusted by essentially everybody. LetsEncrypt provided a good (arguably better) gratis substitute for SSL/TLS, but not for S/MIME.
    – dave_thompson_085
    Jul 31, 2022 at 1:54
1

Outlook 2010 can only handle S/MIME out of the box. If you want to use OpenPGP, you need a plugin. For GnuPG there are three options

  1. Outlook Privacy Plugin
  2. gpg4o

The first one is free and open source but is only for the brave. The same applies to the plugin that is part of the gpg4win project. If need a good working one you should try gpg4o, which is not free, but runs hazzle free. All of them should be able to import the key that you have created under your CentOS.

Improve this answer
0

Outlook does NOT use normal (pgp) private keys for signing emails. It uses SSL style certificates and their associated private keys (signed by a trusted third party) to do the work. Outlook needs this certificate to be in pkcs12 format. (the Linux "file" command can confirm this)

This has the advantage/disadvantage that you don't get a 'web of trust' to confirm that the private key belongs to who you think it does and the advantage/disadvantage that you're just trusting the "trusted third party".

The big disadvantage is that you'll have to pay for the Outlook certificate.

Improve this answer
0

Not 100% sure, but if the certificate works elsewhere this could be a simple case of DOS line ending formatting verus Linux line ending formatting mucking up the works in Outlook 2010.

I would recommend installing the unix2dos utility on CentOS like this:

sudo yum install unix2dos

And then from the command line in CentOS running this unix2dos command with the -n flag:

unix2dos -n username_pubkey.cer username_pubkey_dos.cer

Then try importing the username_pubkey_dos.cer into Outlook 2010.

Improve this answer
3
  • I am exploring this now. I will report back with results within 15 minutes. Please note, however, that the Thunderbird version runs on windows despite being created on CentOS and never having been processed by unix2dos.
    – CodeMed
    Feb 24, 2015 at 6:27
  • Please see the EDIT at the end of my OP.
    – CodeMed
    Feb 24, 2015 at 6:37
  • 1
    The correct syntax is unix2dos -n username_pubkey.cer username_pubkey_dos.cer to convert text to dos format. However, this approach still resulted in the same Outlook problem, most likely due to issues raised by others. I am currently researching options proposed in other answers. Thank you for getting me to install unix2dos. I will use it for other things later.
    – CodeMed
    Feb 24, 2015 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .