Configure the encryption/decryption default settings

Type a maximum of 128 characters.

Double-byte characters are not allowed.

Some zip tools may not support a password of this length: make sure that recipients have a suitable zip tool if you use this setting.

S/MIME signatures are usually detached signatures where the signature information is separate from the text being signed. The MIME type for this is multipart/signed with the second part having a MIME subtype of application/(x-)pkcs7-signature.

It is possible, however, for mailing list software to change the textual part and invalidate the signature.

The secured content in S/MIME messages is actually made up of Multipurpose Internet Mail Extension (MIME) body parts. A plain text message can, therefore, contain an attached signature. This is called a clear-signed message because the message can be read without verifying the signature.

An opaque-signed message contains the message and signature combined in a single part that cannot be read except by verifying the signature.

By default no information is written to the encryption and decryption logs, as these logs can get very large if a lot of messages are being decrypted or encrypted.

We recommend that you only increase the log level temporarily to diagnose decryption or encryption problems.

If an email message meets the following criteria, you can configure the Email Gateway to deliver the original digitally-signed or encrypted message instead of re-encrypting it when applying any relevant encryption endpoints:

• The email message was decrypted by the Email Gateway.
• A delivery disposal action for the message specifies that the message should be encrypted.
• It has not been modified by policy (for example, by adding a disclaimer).

OCSP is used for obtaining the revocation status of an X.509 digital certificate when verifying the signature in the S/MIME layers of a message.

Only certificates provided by Trust Centers supporting the OCSP extension are checked. If an OCSP extension is detected within the certificate, the Email Gateway will attempt to connect to the Trust Center and verify the status of the certificate.

The Trust Center will return a status of unknown, good or revoked. You can configure the Email Gateway (using the Digital Signature Validation clause in a content rule) to react to the returned status.

What else do I need to know?

The OCSP query and reply may require you to make the following changes to your proxy and firewall settings:

• Allow access to the server providing the OCSP service.
• Allow HTTP traffic to and from the OCSP service provider.
• Allow binary data over HTTP.