S/MIME

S/MIME signs and encrypts mail with X.509 certificates — the kind issued by a certificate authority or your organization. It is independent of GPG; use whichever your correspondents use.

Import your identity

Open Settings → S/MIME and choose Import .p12 / .pfx. The file holds your certificate and its private key, protected by the password you enter once at import. The private key is then sealed with your operating system's credential store, the same way account passwords are. Imported identities are listed with their issuer and expiry date, and can be removed.

Swanmail currently handles RSA keys.

Reading

• A signed message shows Signed by … next to the sender when the signature matches the message, the signer's address is the sender's, and the certificate chains to a root your system trusts. Otherwise the badge says why: Invalid signature, Signed by another address, or Signature not trusted.
• An encrypted message is decrypted with your identity for that view only. Nothing is stored in the clear: the database keeps the ciphertext it received, and the cleartext goes through the same sanitizing and the same sandboxed frame as any other body.

Certificates from signed messages you receive are remembered under Known recipients; those are the people you can encrypt to.

Trusting other certificates

Trusted certificates → Import certificate adds a CA or a correspondent's certificate on top of the roots your system already trusts — for an internal company CA, say.

Sending

With an identity imported, the composer shows Sign and Encrypt. Signing uses the identity that matches your From address. Encrypting needs a known certificate for every recipient; if one is missing the message is not sent. The switches keep their setting between messages.