{"id":6685,"date":"2018-07-09T14:33:01","date_gmt":"2018-07-09T18:33:01","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=6685"},"modified":"2023-05-17T11:49:32","modified_gmt":"2023-05-17T15:49:32","slug":"email-security-part-1-certificate-signed-emails","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/email-security-part-1-certificate-signed-emails\/","title":{"rendered":"Email Security \u2013 Part 1: Certificate Signed Emails"},"content":{"rendered":"

How and why to install an email signing certificate<\/h2>\n

Long before Twitter or even SMS (Short Message Service), email was a dominant force in communication spanning from global business reach to the next cubicle over. It still is a highly utilized method of communication, but it brings many complications with it.<\/p>\n

For example, the junk-mail game of the traditional stamp and drop method of the postal service was easily carried over into the digital space and renamed as spam. Some of this spam could be confusing to wade through. While some spam is as obvious as African royalty in a financial conundrum, some spam may be sourced as slight variances of trusted domain names. Does Amazon have a Customer Tracking and Assistance department and why are they asking for password verification through a poorly worded and logo-less email?<\/p>\n

Conversely, how can one ensure that their legitimate outbound email communication is not flagged or mistaken as something insidious? In a 2015 study, Return Path reported<\/a> that only 79% of (legitimate) commercial emails actually make it to the intended destination. 1 in 5 commercial emails gets filtered out or flagged one way or another. There are many ways in which this can happen and many points in an email\u2019s lifecycle of WHERE filtering\/flagging can happen.<\/p>\n

We are going to kick off my venture into the world of commercial blogging with a series about email security. Not only will we be reviewing methods to identify bad emails coming in and how to protect oneself, but we will also be looking into methods to successfully delivering emails and establishing a trusted and reputable brand.<\/span><\/p>\n

Will Anyone Vouch For This Person?!<\/h2>\n

Verification of identity can be seen all over the world:<\/p>\n

Police officer? \u201cLet me see your badge number so I can phone it in.\u201d<\/em><\/p>\n

Knock on the door? Let\u2019s have a look through the peephole to see if it is someone recognizable. Don\u2019t recognize them? \u201cWho are you?… Show me your girl scout license number so I can phone it in.\u201d<\/em><\/p>\n

Technical support for your account? \u201cWould you confirm your mother\u2019s maiden shoe size?<\/em>\u201d<\/p>\n

Besides intuition, there are no basic human sense cues that can help verify the origins of an email so it is a little more of a challenge. \u00a0The display name, source email address and writing style would be the best indications as to whether the email is legitimate or was composed by a spoofer. One could also follow the cumbersome mail headers and follow the route the email took to see if it makes some sense. However, the email sender is able to make this scrutinization a little laxer.<\/p>\n<\/span><\/span>\n

Coupled with intuition, signing certificates via S\/MIME (Secure\/Multipurpose Internet Mail Extensions) assist in establishing trust between sender and receiver. The little red Outlook ribbon (green check in Gmail) on a signed email carries with it a hierarchy of root certificates from whichever issuing authority.<\/p>\n

In a sense, a signing certificate tells the receiver, \u201cI went out of my way to get a CA (certificate authority) to vouch for me. Also, I paid for it\u2026..\u201d For a recipient that one might be in frequent contact with, this can bring peace of mind at a glance.<\/p>\n

Let\u2019s Certify Some Emails<\/h2>\n

Now that we have gone over the generic overview of email certificates, let\u2019s apply a certificate in practice. Despite the fact that it only accounts for a smallish percentage of total mail origination<\/a>, this tutorial will go over the application of email certificates to Outlook 2016 on a Windows-based machine.<\/p>\n

Assumptions:<\/strong><\/p>\n