How cara saya menggunakan S/MIME di Linux?

S/MIME memberi email Anda dua hal yang tidak dimiliki surat biasa. Pesan ditandatangani membuktikan itu benar-benar berasal dari Anda dan tiba tanpa perubahan; pesan terenkripsi hanya dapat dibuka oleh orang yang Anda kirimkan. BlueMail untuk Linux mendukung keduanya.

What you need

• A certificate for your address, plus the password protecting it if it is a .p12 or .pfx file. These usually come from your organization's IT team or a certificate authority, and the certificate has to be issued to the same address as the account you are setting up.
• An Enterprise license. S/MIME is part of BlueMail's Enterprise offering. Where it is not yet included, the S/MIME screen shows an Enterprise license required note with a Billing link, so you can see exactly what to ask for.

On Linux, BlueMail reads certificates from the system certificate store, so an identity your distribution or your organization has already installed is available to BlueMail with nothing further to do.

Setting it up

1. Open Settings | Privacy & Security | End-to-End Encryption.
2. Click S/MIME Encryption & Signing.
3. Choose the account you are setting up.
4. Under Certificates for this account, click Select… beside Signing certificate, then do the same for Encryption certificate. Many certificates cover both jobs, in which case you pick the same one twice.

BlueMail then shows each certificate's validity dates and a SHA-256 fingerprint, so you can confirm at a glance that you selected the right one. As the screen notes, "Some certificates may require a private key and password to use for signing or decryption."

If a certificate belongs to a different address, BlueMail says so directly rather than leaving you to hunt for a configuration problem that isn't there.

Managing the certificates themselves

Under Advanced & management, Open certificate manager opens the system's certificate manager, which is where identities are installed, inspected and removed.

Trusting the authority that issued a signature

The Trusted CAs section is what lets BlueMail confirm other people's signatures: "Certificate authorities used to verify signed mail as trusted. Importing a .p12 also trusts its issuing chain."

So your own certificate usually covers colleagues who share its issuer. For anyone outside that chain, click Import CA certificate and select their .pem or .cer file. The section keeps a running count of the authorities you trust.

Choosing what happens to each email

With a certificate in place, a security button appears to the right of the Subject line whenever you compose. Click it and choose how to send this message:

The choice applies to the email in front of you, so you can sign routine mail and encrypt the occasional sensitive one without opening settings.

To set it once instead, use Default behavior for outgoing mail on the S/MIME screen:

• Digitally sign all outgoing messages
• Encrypt messages by default when all recipients support S/MIME: encryption applies whenever BlueMail has a certificate for everyone on the message, and stays off when it would fail
• Send clear-signed copies for compatibility: keeps signed mail readable in apps that do not handle S/MIME signatures

Encrypting to other people

Encryption needs the recipient's certificate, and BlueMail looks these up as you address the message, you may briefly see "Looking up S/MIME certificates for recipients…". If someone has no certificate available, BlueMail names them under Missing S/MIME certificates rather than sending something they could not open, so you can sign instead or ask them for their certificate.

The easiest way to build up certificates is to exchange signed mail: a signed message carries the sender's certificate, so once a contact signs an email to you, you can encrypt to them from then on.

Reading signed and encrypted mail

Incoming S/MIME messages carry a badge in the header showing what BlueMail confirmed: Signed, Encrypted, Signed & Encrypted, or Signed · unverified sender when the signature cannot yet be tied to a trusted authority.

Click the badge for S/MIME Message Information, which shows Signed with, Decrypted with, Your certificate, Encrypted to and the SHA-256 fingerprint.

When a signature shows as unverified, BlueMail gives the reason, and the reason points at the fix:

• "The signer's certificate isn't from a trusted authority. Import its CA to trust it.", add that authority under Trusted CAs above.
• "The certificate's email doesn't match the sender's address."
• "The signer's certificate has expired." or "isn't valid yet."
• "The certificate isn't authorized for email protection." or "for signing."

Rolling it out across an organization

On BlueMail Enterprise, administrators can deliver each user's S/MIME identity with the app itself rather than distributing certificate files; see Can I deploy BlueMail with MDM? for the configuration keys.

Prefer PGP?

BlueMail supports PGP as well, on the same End-to-End Encryption screen, and PGP is completely free, no Enterprise license, nothing to buy. See PGP keys in BlueMail.

Removing a certificate

Click Remove beside a certificate. BlueMail confirms first: "This deletes the S/MIME certificate and its private key from this device. You can re-import it later."

Removing the whole account asks whether to keep the private key. Keeping it means re-adding the account will decrypt your past S/MIME mail without another import; Delete key means you will need the certificate file again.

Also available on iPhone and iPad and Android, and summarized in S/MIME Support.