2

My organization uses S/MIME certificates to digitally sign and encrypt emails. We would like to add a disclaimer at the bottom of our emails, which can be done via the mail flow settings in Office 365.

However, if the message is edited by the server after it has been signed by the sender, the certificate will show as invalid.

Is there a way to add an organizational email footer without affecting S/MIME functionality? Or is the only solution to add the disclaimer to to the client's signature?

Improve this question
1

1 Answer 1

Reset to default
2

Short answer: No, if your message is S/MIME signed you cannot add a footer without invalidating the signature.

Long answer: While an added footer would invalidate the message, it is possible to work around this in a few ways.

  • Fallback Rules to encapsulate the signed message as an attachment with a footer. I'm not sure this is smart enough to understand the footer invalidates S/MIME signatures and not encryption. You'd have to experiment.

  • OME deliver encrypted messages from a middle tier and skip S/MIME (significant change to mail flow, compatiblity, and use).

  • Use PGP instead of S/MIME, which allows you to use PGP inline. However, it's not supported natively in Office 365, so you'd have to manage PGP extensions in browser and on Outlook clients.

  • Third Party encryption or encapsulation equivalents outside of Office 365.

Edit: There is some dispute over PGP Inline and whether it is a sound security process or harmful.

Improve this answer
2
  • 1
    Given that MIME allows arbitrary nesting, couldn't you nest the whole multipart/signed part alongside a separate footer part, much like some mailing lists already do?
    – u1686_grawity
    May 24, 2016 at 5:03
  • 2
    S/MIME nesting is usually ignored by mail clients, however, and poses a security risk (same discussion as PGP Inline). Hence I omitted it as an option, but you are correct the RFC does allow for it, but they leave it up to clients to decide. Most clients I know of do not honor a signature on a nested MIME. See Mozilla Thunderbird's response; bugzilla.mozilla.org/show_bug.cgi?id=578295#c3
    – krondor
    May 24, 2016 at 11:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .