---
type: concept
title: S/MIME
tags: ["security", "email", "encryption", "pki", "email-security", "digital-signature"]
related: ["email-zertifikate", "thunderbird-certificate-import", "outlook-certificate-import", "e-mail-sicherheit", "p12-file", "nutzerzertifikate", "gruppenzertifikate", "groupware", "thunderbird-smime-usage", "outlook-smime-usage", "asymmetric-encryption"]
created: 2026-06-30
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_dfn_pki_zertifikate_nutzerzertifikat_thun.md", "output/rz_uni_greifswald_de_dienste_allgemein_e_mail_e_mail_sicherheit_cert.md", "output/rz_uni_greifswald_de_dienste_webdienste_groupware_module_email_smime.md", "output/rz_uni_greifswald_de_dienste_webdienste_groupware_module_email_smime_emails_sign.md", "output/rz_uni_greifswald_de_dienste_webdienste_groupware_module_email_smime_emails_vers.md"]
---
# S/MIME

**S/MIME** (Secure/Multipurpose Internet Mail Extensions) is a cryptographic protocol used to provide authentication, non-repudiation, and confidentiality for electronic mail. It is used for digitally signing and encrypting emails to ensure authenticity, integrity, sender verifiability, and confidentiality.

## Core Components and Functions

- **Digital Signatures**: Used to sign unencrypted messages. This allows the recipient to verify the sender's identity and ensures that the message content has not been altered during transit.
- **Encryption**: 
    - Provides end-to-end encryption so that only the intended recipient (who possesses the corresponding private key) can decrypt and read the message.
    - Uses [[asymmetric-encryption]] to ensure confidentiality.
- **Private Keys**: Stored in [[p12-file]] archives and protected by a password.

### Key Operational Rules
- **Validity**: A digital signature is only valid as long as the underlying certificate has not expired.
- **Private Key Management**: The private key is essential for decrypting messages. Replacing or losing the private key results in the permanent loss of access to all previously encrypted emails.

## Implementation at Universität Greifswald

The [[universitatsrechenzentrum-urz]] provides [[email-zertifikate]] via the DFN-PKI to enable S/MIME.

### General Requirements
The use of S/MIME requires a valid Public Key Infrastructure (PKI) certificate. 
- According to the existing version on disk, users must have their [[nutzerzertifikate]] or [[gruppenzertifikate]] exported as a password-protected [[p12-file]] before they can be imported into an email client.
- According to the newly generated version, specifically a [[nutzerzertifikate]] provided via the DFN-PKI is required.

### Supported Clients and Usage
S/MIME can be configured in various environments:
- **Local Clients**: The [[universitatsrechenzentrum-urz]] supports configuration for [[microsoft-outlook]] (via [[outlook-certificate-import]]) and [[mozilla-thunderbird]] (via [[thunderbird-certificate-import]]).
    - **Mozilla Thunderbird**: Detailed in [[thunderbird-smime-usage]].
    - **Microsoft Outlook**: Detailed in [[outlook-smime-usage]].
- **[[groupware]] Webmailer**: The [[groupware]] web interface provides a centralized way to sign and encrypt emails directly in the browser, provided the certificates are imported.

## Groupware Web Interface Specifics

When using the [[groupware]] E-Mail module, the following constraints and processes apply:

### Configuration and Constraints
- **Import**: Users must import both their private key and their certificate into the module.
- **Capacity**: Only one certificate is permitted per email account.
- **Renewal**: To update a certificate, the previous certificate must be deleted before the new one can be imported.

### Signing Process
1. **Certificate Import**: The user must first import their certificate.
2. **Signing Execution**: 
   - Users can toggle the digital signature in the **Additional Options** (**⋮**) menu when composing a message.
   - The system can be configured to sign emails automatically.
3. **Session Authentication**: To authorize the signing process, the user must enter the password for their private key (from the [[p12-file]]) upon sending the first signed email of a session.

### Encryption Process
1. **Prerequisite**: The user must first import their own [[nutzerzertifikate]].
2. **Key Exchange**: To encrypt a message, the sender must possess the recipient's public certificate. This is typically achieved by the recipient sending a signed email to the sender first.
3. **Execution**: Encryption is enabled via the "Additional Options" menu during email composition.
4. **Best Practice**: The URZ recommends combining encryption with a digital signature to provide both confidentiality and sender verification.