ExtendSMIME

Note: As of June 2019, DefaultEncrypt and ExtendSMIME are maintained on GitLab.

ExtendSMIME enhances DefaultEncrypt to support S/MIME. Moreover, it allows to retrieve certificates via LDAP and to import them into gpgsm.

Preliminaries

I use, but do not recommend, S/MIME. I recommend GnuPG. Here is what I think about the “trust” model of S/MIME: https://blogs.fsfe.org/jens.lechtenboerger/2013/12/23/openpgp-and-smime/

Functionality

The general idea of ExtendSMIME is to enhance S/MIME support in Gnus for

Note that version 3 of ExtendSMIME introduces a major change: Previous versions used openssl for cryptographic operations while version 3 uses gpgsm (part of gnupg-2). In particular, certificates are no longer maintained by ExtendSMIME but are imported into gpgsm. In fact, gpgsm manages certificates on its own and automatically extracts certificates from signed messages, which simplifies the code of ExtendSMIME a lot.

The general idea of ExtendSMIME is to search for missing certificates via LDAP before an e-mail is sent. Resulting certificates are imported into gpgsm. LDAP search is customizable (and documented) via ‘jl-smime-permit-ldap’.

In addition to this automatic LDAP search, the command ‘M-x jl-smime-key-available-p’ allows manual searches. It asks for an e-mail address (an address at point is used as default value). If no certificate is available, an LDAP search is started (ignoring negative caching and ‘jl-smime-permit-ldap’). If a certificate is found, it is imported into gpgsm; otherwise, a negative cache entry is created.

Documentation concerning S/MIME with GNU Emacs is mostly targeting openssl but not gpgsm. See installation instructions below.

Installation

Signed versions of jl-smime.el and jl-encrypt.el as well as versions for Emacs 24.x and earlier are available over there.

Message security (as described in Info node `(message) Security') automatically prefers EasyPG with gpgsm over openssl if EasyPG is loaded first. Thus, place jl-smime.el and jl-encrypt.el into your load-path and add the following to ~/.emacs.

(require 'epa-file)
(load "jl-smime")

Optionally and unrelated to e-mail, you may also want:

(setq epa-file-encrypt-to "<your-key-id>")
(setq epg-debug t)

Customizable variables of ExtendSMIME are jl-smime-permit-ldap, jl-smime-negative-cache-dir, and jl-smime-negcache-maxage. You may want to read their documentation.

I’m using the following code after (load “jl-smime”) in my setup:

;; Allow automatic LDAP queries for certificates within my domain.
(setq jl-smime-permit-ldap "@\\(.+\\.\\)?uni-muenster\\.de$")

;; I'm searching for S/MIME certificates via LDAPS at DFN-Verein.
;; Note that ldap.el in Emacs requires a minor workaround to perform
;; encrypted connections via LDAPS.  In fact, ldapsearch is being invoked
;; to use unencrypted plaintext LDAP communication with the parameter "-h".
;; Maybe I'm doing something wrong but I only got LDAPS to work with the
;; parameter "-H ldaps://ldap.pca.dfn.de".  To get rid of the default
;; parameter -h, I'm passing the empty string as hostname, setting
;; smime-ldap-host-list to '("").  Finally, ldapsearch aborts the
;; connection if it is not told where to find the CA certificate for the
;; LDAPS server (which is a Good Thing).
;; I created ~/.ldaprc with a single line pointing to that CA certificate:
;; TLS_CACERT /path/to/server/cert
(require 'ldap)
(setq smime-ldap-host-list '(""))
(setq ldap-default-base "O=DFN-Verein,C=DE"
      ; -x: no SASL authentication, -tt: store result in file
      ; -H: connect to specified URI.
      ldap-ldapsearch-args '("-x" "-tt" "-H ldaps://ldap.pca.dfn.de")
      )

If you used openssl previously, you need to import your keys and certificates into gpgsm. Here are three-and-a-half steps, which worked for me.

First, import the private key.

$ gpgsm --import my-private-key.p12

Second, the CA signing my certificate is unknown to gpgsm (gpg-agent, in fact). Thus, gpgsm refuses to use that key pair. I added the option ‘allow-mark-trusted’ to ~/.gnupg/gpg-agent.conf. Then I tried again to sign a file. This time, gpg-agent displayed the root CA’s fingerprint and asked whether I trust it. Saying “yes” added that fingerprint to ~/.gnupg/trustlist.txt, and the key became usable. (Note that you must “trust” the root CA; adding an intermediate CA’s fingerprint does not work. You read my article on “trust”, didn’t you?)

Third, import (a subset of) your old certificates. With ExtendSMIME before version 3, those were stored in files under ‘smime-certificate-directory’, ~/Mail/certs, by default. In that directory, execute: $ gpgsm --import <certfiles>

Finally, decide how you ensure that you can decrypt your own e-mails. See comments for DefaultEncrypt in jl-encrypt.el and note that, similarly to gpg, gpgsm understands the option “--encrypt-to” (which is not mentioned in the man page). I have the following line in gpgsm.conf: encrypt-to <colon-separated-fingerprint-of-own-key>


CategoryGnus EncryptingMail