[Day 9] 2. Secure Email Connection in Thunder Bird Using PKI

Pre-requisite: A mail server configured to send emails between accounts.

Setup Overview

1. Install Thunderbird.
2. For the two users, use POP3:
   • Ports: 110 (incoming) and 25 (outgoing).
   • User accounts:
     • Copy

       userone@shuharilabs.local

     • Copy

       usertwo@shuharilabs.local

3. Clear any testing emails.
4. Test email sending between the two accounts to ensure basic functionality.

Task: Secure Email Communication

Objective: Create certificates for each user, bind them to private keys, and configure secure email communication.

Naming Conventions

User

Copy

userone

1. 004-001-DB-one.xdb – Database for
   Copy

   userone

   .
2. 004-003-CSR-one.pem – Certificate Signing Request.
3. 004-003-CRT-one.crt – Certificate.
4. 004-004-CRT_CHAIN_KEY-one.pfx – Certificate + Private Key.

User

Copy

usertwo

1. 005-001-DB-two.xdb – Database for
   Copy

   usertwo

   .
2. 005-003-CSR-two.pem – Certificate Signing Request.
3. 005-003-CRT-two.crt – Certificate.
4. 005-004-CRT_CHAIN_KEY-two.pfx – Certificate + Private Key.

Steps

1. Create Private Keys

• Generate private keys for both
  Copy

  userone

  and
  Copy

  usertwo

  in their respective databases.

2. Configure Certificates for

Copy

userone

1. Create a certificate in

   Copy

   userone

   :
   • Enter Common Name:
     Copy

     userone@shuharilabs.local

     .
   • Enter Email:
     Copy

     userone@shuharilabs.local

     .
   • Click OK and export the certificate to the
     Copy

     userone

     folder.

2. Go to Sub CA:

   • Import the CSR from
     Copy

     userone

     .
   • Create a new certificate:
     • Verify details under Subject.
     • Go to Extensions:
       • Add the email to the certificate. You should see a green tick confirming the email.
     • Configure Key Usage:
       • Select:
         Copy

         Digital Signature

         ,
         Copy

         Non-Repudiation

         ,
         Copy

         Key Encipherment

         ,
         Copy

         Data Encipherment

         .
     • Configure Critical Section:
       • Select:
         Copy

         E-mail Protection

         .
     • Double-check settings in the Advanced Tab.
     • Click OK.

3. Export the certificate with the appropriate name to the

   Copy

   userone

   folder.

4. Go back to the

   Copy

   userone

   database:
   • Import certificates from Root CA and Sub CA.

5. Export the final certificate:

   • Bind the private key with the
     Copy

     .pfx

     extension.
   • Save it in the
     Copy

     userone

     folder.

3. Configure Certificates for

Copy

usertwo

Repeat the same steps for

usertwo

4. Configure Thunderbird for Secure Email

1. Import Certificates:

   • Root CA Certificate:
     • Go to Settings -> Account Settings -> End-to-End Encryption -> Manage S/MIME Certificates -> Authorities -> Import.
     • Select the Root CA certificate, check both checkboxes, and click OK.
   • User Certificates:
     • Go to Your Certificates -> Import -> Select Certificate -> Enter Password -> OK.
     • Return to the settings and select the imported certificate.

2. Perform these steps for both

   Copy

   userone

   and
   Copy

   usertwo

   .

5. Send and Verify Emails

Digitally Signed Email

1. Send an email from
   Copy

   userone

   to
   Copy

   usertwo

   :
   • Select S/MIME -> Digitally Sign.
   • Send the email.
2. Open the email in
   Copy

   usertwo

   :
   • Verify that the email is signed, ensuring Authentication and Integrity.

Digitally Signed and Encrypted Email

1. Send another email from
   Copy

   userone

   to
   Copy

   usertwo

   :
   • Select S/MIME -> Digitally Sign and Encrypt.
   • Send the email.
2. Open the email in
   Copy

   usertwo

   :
   • Verify that the email is encrypted and signed, ensuring Confidentiality, Authentication, and Integrity.