If you're using a work account and the option has been turned on by your organization, you can keep your email messages more secure by using Secure/Multipurpose Internet Mail Extensions (S/MIME).
To use S/MIME, you need a S/MIME certificate uploaded to your account. Your Administrator may provide a certificate for you, or you may have to upload a Public-Key Cryptography Standards (PKCS) #12 certificate to Gmail through the Gmail settings. The certificate can be used to sign outgoing messages during transport. Other senders can use the public key to send you encrypted messages.
Manage account certificates
The next section, describes how to generate a PKCS #12 certificate file, sometimes called a “private certificate.” PKCS #12 is a bundle that includes your certificate and your private key. The certificate has your public key and email address, and it should be signed by a Certificate Authority (CA).
To use S/MIME, you or your system administrator have to upload the PKCS #12 file to your Gmail account. This section explains how you can upload certificates from the Gmail settings.
When you receive a message that is digitally signed with S/MIME, Gmail automatically associates the public key with a contact. You don't have to manually create a contact.
When you send a message, if there is a public key associated with the recipient in your contacts, Gmail automatically encrypts the message.
If you add more than one PKCS #12 certificate to your Gmail account, you need to set a default S/MIME certificate that Gmail will use to sign outgoing messages.
Why would you upload more than one certificate?
-
In Gmail, click Settings
See all settings.
-
At the top, click the Accounts and Import or Accounts tab.
-
In the Send mail as section, click edit info next to your work account.
-
Click Upload a personal certificate. A window opens showing the files available on your system.
You might not have this option if your organization doesn’t allow it. -
Select the certificate file.
-
Enter the password and click Add Certificate.
Change the default certificate
-
In the Edit email address window, locate the entry for the certificate.
-
Select the certificate to make it the default.
Remove a certificate
-
In the Edit email address window, locate the entry for the certificate and click remove.
-
Click Remove Certificate.
How do I get certificates?
Your certificate should be signed by a Certificate Authority (CA).
There are 2 primary ways to get a PKCS #12 certificate file:
-
Your system administrator will generate it for you. In this case, they can either directly upload it to Gmail or they can give it to you and you'll upload it using the S/MIME Settings in Gmail.
-
You can use a CA to generate a PKCS #12 file. This section explains what you need to do to create the PKCS #12 file that you'll upload using the S/MIME Settings in Gmail.
To generate a PKCS #12 file that includes your certificate and your private key:
-
First, go to the web site of a trusted CA to request a certificate. Certificates have to adhere to certain public-key cryptography standards to be trusted. When you request a certificate, your browser will generate a public/private key pair and will send the public key to the CA
-
The CA will generate a signed certificate containing your public key and your email address. Most CAs will send you a link with the certificate file to download. This file often has a .pem or .crt extension.
-
Generate the PKCS #12 file on the same machine and browser that you used to request the certificate. The steps are different for each platform:
-
Open the certificate file provided by your CA by double clicking on the file. This opens the Keychain Access utility of the MAC OS. Add the certificate to the keychain ‘login’.
-
Go to chrome://settings.
-
At the bottom, click Show advanced settings.
-
Scroll to the HTTPS/SSL section and click Manage certificates.
-
The Keychain Access utility will open. Chrome uses it to manage digital certificate. Under 'Keychains' on the left, select 'Login' and click 'My Certificates' in the 'Category' column. Then select the certificate that was provided by your CA.
-
On the top menu, click File > Export Items.
-
Select the file format 'Personal Information Exchange (.p12)', enter a name for the file and click the Save button.
-
A window appears, prompting you to enter a password to protect the exported file.
-
Go to chrome://settings.
-
At the bottom, click Show advanced settings.
-
Scroll to the HTTPS/SSL section and click Manage certificates.
-
Click the Import button. Select the certificate file provided by your CA. Click open. The certificate will be added to Chrome.
-
The window will close. Scroll to the HTTPS/SSL section again and click Manage certificates.
-
Click the certificate to select it. Click Export. Select a name and a password for the PKCS #12 file that will contain both your certificate and private key.
-
The CA-provided certificate is saved on the browser's certificate store.
-
Open Internet Explorer.
-
From the menu bar, click Tools or click Settings
at the top.
-
From the drop-down menu, select Internet options.
-
On the Content tab, select Certificates.
-
Click on a certificate to select it.
-
Click Export to open the export wizard and then click Next.
-
Select Yes, export the private key.
Note: If this option doesn’t appear, verify that you selected the correct certificate in the previous steps. -
Click Next.
-
Select .pfx and click Next.
-
Select the Password box, enter and confirm your password, and click Next.
-
Enter the name of the file and click Next.
-
Review settings and click Finish.
Note: Be sure to enter a password when you generate the PKCS #12 file because it will contain your private key. Do not use your Gmail password. You'll need to enter this password when you upload the file to the Gmail settings.
Can I generate a PKCS #12 file on Chrome OS?
No, Generating a PKCS #12 file on Chrome OS is not currently supported.