How to encrypt emails

To benefit from these efforts, however, you need to follow your provider's requirements and guidance when setting up an email account. This already gives you solid protection for your privacy.  

More protection with end-to-end encryption

If you want even greater security or regularly exchange particularly sensitive information by email, there is only one sensible option: encrypting both message text and file attachments. This encryption should be maintained from sender to recipient. That is why it is called end-to-end encryption. This guarantees that unauthorized parties cannot access the contents of your email. After all, administrators can make mistakes, too. And if, for example, the mail server was not configured correctly, encryption may not be complete. It has also long been an open secret that intelligence agencies of all kinds are interested in the content of emails. 

Email communication has become highly diverse. Many people prefer dedicated email programs such as Microsoft Outlook, the Mail app on Mac, or the free Thunderbird. Others deliberately choose not to install an email program and handle their email correspondence in a browser through a free service or commercial email provider. 

There are just as many ways to make emails more secure.

How end-to-end encryption works

Whenever you want to send someone an encrypted message, one question always arises: How do you share with the recipient the key they need to make the encrypted message readable again? 
So-called "asymmetric encryption methods" solve this problem very elegantly. The method is asymmetric because it requires different keys for encryption and decryption. Here's how it works:

• Both people communicating have two keys. The private key must be kept absolutely secure and must never be shared. There is also a public key. You can even publish it on your website or otherwise make it publicly available. 
• If Ms. A wants to send an encrypted message to Mr. B, she looks for Mr. B's public key in her email program. Or she copies it from Mr. B's website. She then encrypts the message with this key and sends the email.
• Mr. B receives the message addressed to him. It can be decrypted in only one way: with his private key. 

This method also offers a practical additional benefit. It lets you "sign" messages, which email programs call "signing." If Mr. B wants to sign his message to Ms. A, he selects "Sign" in his program. His private key is used for this. Ms. A receives the email and verifies the signature with Mr. B's public key. It matches, so the message can only have come from him.

However, because there are so many different ways to use email, different approaches exist for achieving end-to-end encryption.

End-to-end encryption approaches you should know

• Simple transport encryption
  If you or the people you communicate with do not want to or cannot use individual end-to-end encryption, at least use transport encryption between your system and the mail server. Ask your access provider for the address and the so-called port that you need to enter for the servers you use in your email program. For example, you can do this in the account "Settings" in Outlook. With an SSL (or TLS) connection, your message is at least protected from prying eyes on its way from your computer to the mail server.
• E-Mail made in Germany
  In Germany, major email providers have joined forces in the “E-Mail made in Germany” initiative. It currently includes the email services from Telekom, 1&1, GMX, Web.de, Freenet, and Strato. They only accept emails with transport encryption. Customers' messages are automatically encrypted while in transit and across all transmission paths between these providers. However, this form of encryption is ineffective for recipients using other systems or located abroad, because the messages must then also be transferred to other servers, and you cannot expect transport encryption to work properly along the way.
• Encryption via S/MIME
  This method uses a certificate for encryption, which must be obtained from an authorized authority. It is therefore similar to securing the connection to an online store or banking site . A browser is all you need to set up the certificate. Most email programs can use this method without installing additional software. For example, Mac users can also configure S/MIME quickly.
• Encryption using (Open)PGP
  Encrypting messages and files using PGP is not compatible with S/MIME. The sender and recipient of a message must therefore decide which method they want to use. PGP is available in an open-source version. There is no central authority from which to obtain the required keys; instead, each user creates their own keys using the software. However, setup is somewhat more involved overall. An alternative is to use commercial solutions based on PGP, such as „Symantec Desktop Email Encryption“.

However, S/MIME and PGP are primarily designed for traditional email clients. You can also use S/MIME encryption in emails that you read and reply to exclusively in a browser. In that case, however, it is limited to commercial services. For example, personal Google Mail users cannot use S/MIME. If you use the paid „G Suite,“ you can set up such a certificate.

Set up your own encryption with S/MIME

If you want to encrypt your messages quickly without a lengthy software installation, S/MIME is a good option. It is also of interest to all Apple users because encryption is easy to use with Apple's built-in Mail app. 

Setup takes place in two steps:

• Apply for and download the certificate
• Add the certificate to your email program

How to get your S/MIME certificate

Several providers let you apply for an S/MIME certificate, including:

• Certum
• Comodo
• DigiCert
• GlobalSign 

Your internet service provider may also offer this type of solution. A certificate is usually valid for one year, but longer contracts are also available. Complete the ordering process with the provider you choose. Once your order is complete, you can either download the certificate immediately or receive an email with the URL to retrieve it. Follow the provider's instructions exactly. The new certificate will usually be automatically added to your browser. You must then export it from there.

Export the certificate

After you successfully order and receive the certificate, it is usually stored in a dedicated area in your browser. However, your email program cannot access it. So you need to export the certificate first. 

Here is how to do this in Internet Explorer:

1. After starting Internet Explorer, select "Internet Options" from the menu under the "Settings" icon.
2. Then switch to the "Content" tab. Click "Certificates."
3. Next, select the "Personal Certificates" tab. In the list, select the certificate you want to export. There should really only be one entry there. 
4. "Export" starts the Certificate Export Wizard.
5. After the welcome screen, enable the "Export private key" option in the second dialog box. 
6. On the next page, select the following options:
   "Private Information Exchange - PKCS #12 (.PFX)“,
   „Include all certificates in the certification path if possible“ and
   „Export all extended properties“. Select „Next“ to continue.
7. To export the certificate, create a password of your choice. You need this password whenever you import the certificate into other applications. 
8. Confirm by selecting „Next“.
9. Now save the certificate in a folder of your choice. 

Here’s how to do this in Google Chrome:

1. Open „Settings“ in Chrome. 
2. Select „Advanced settings“.
3. Click „Manage certificates …“.
4. In the next window, select the certificate you want under „Personal Certificates“ and click „Export …“.
5. A wizard opens. Be sure to select the option to export the private keys as well. 
6. You also need to confirm options here. You can use step 6 of the Internet Explorer instructions as a guide.
7. Set a password for the certificate and save it in a folder of your choice. 

Add the certificate to your email program

When you finish exporting from the browser, you will have a file with the “.p7s” extension.

On a Mac, double-click the file to add it to the operating system keychain. This automatically integrates the certificate into Apple Mail. You can then use the buttons in the email composition editor to encrypt or sign an email. To use the certificate in Outlook, add it as follows:

1. Open Outlook and select “Options” under “File.” 
2. This opens the “Options” window in Outlook. Select “Trust Center,” then click the “Trust Center Settings” button.
3. In the next window, select “Email Security.”
4. In the right pane of the “Digital IDs (Certificates)” section, select “Import/Export.”
5. A window opens. Use “Browse” to go to the folder where you exported the certificate. Select it and confirm with “OK.”
6. You return to the previous section. Enter the password you specified in the Export Wizard. 
7. Then give the certificate a name and confirm  with “OK.”

This makes the certificate available in Outlook, and you can use the encryption and signing features in the editor when composing a message.