4. Can I use CATool certificates to encrypt email?
Yes. Heres how one of our correspondents did it:
I created a certificate for "Demo User" with email address "demo@xyz.com".
I generated a Demo_User-cert.pem and a Demo_User.p12 file.
I imported the Demo_User.p12 into Outlook Express 6 on a system set up to
be an email client for demo@xyz.com, and instructed Outlook Express to
use this certificate for signing and encrypting email.
Then I built up a small shell script on a Linux machine to construct an
email message, feed it through openssl smime -encrypt, then into
/usr/sbin/sendmail.
The email was sent by the linux machine, received encrypted by Outlook
Express, successfully decrypted, and the original message content displayed.
What I wanted this for: I have a number of websites which collect
information from site visitors, including credit card information. We don't
store that information on the web server, but do send the information
encrypted to the web site owner. To date we've been using PGP to implement
this, but it's messy to implement, and to explain to users.
CATool permits the use of S/MIME for this, and it works really well.
I expect the certificates would work just as well for sending email between
users of S/MIME capable mail programs (Outlook, Outlook Express, Netscape,
Mozilla).
My very simple script for testing from Linux is below. It assumes the
source email is in ml.txt.
#!/bin/bash
openssl smime -in ml.txt -encrypt \
-from someuser@somewhere.com -to demo@xyz.com \
-subject "Signed and Encrypted message" -des3 Demo_User-cert.pem | \
/usr/sbin/sendmail demo@xyz.com
