<p>When you compose a mail message, you can choose to attach your digital signature to it. A <ahref="glossary.html#digital_signature">digital signature</a> allows recipients of the message to verify that the message really comes from you and hasn't been tampered with since you sent it.
<p>When you compose a mail message, you can also choose to encrypt it. <ahref="glossary.html#encryption">Encryption</a> makes it very difficult for anyone other than the intended recipient to read the message while it is in transit over the Internet.
<li>Obtain one or more <ahref="glossary.html#certificate">certificates</a> (the digital equivalents of ID cards). For details, see <ahref="using_certs_help.html#using_certs_get">Getting Your Own Certificate</a>.</li>
<p>The sections that follow provide a brief overview of how digital signatures and encryption work. For more technical details on this subject, see the online document <ahref="http://developer.netscape.com/docs/manuals/security/pkin/index.htm"TARGET="_blank">Introduction to Public-Key Cryptography</a>.
<p>A digital signature is a special code, unique to each message, created by means of <ahref="glossary.html#public-key_cryptography">public-key cryptography</a>.
<p>A digital signature is completely different from a handwritten signature, although it can sometimes be used for similar legal purposes, such as signing a contract.
<li>A <ahref="glossary.html#signing_certificate">signing certificate</a> that identifies you for this purpose. Every time you sign a message, your signing certificate is included with the message. The certificate includes a <ahref="glossary.html#public_key">public key</a>. The presence of the certificate in the message permits the recipient to verify your digital signature.</li>
<p>Your certificate is a bit like your name and phone number in the phonebook—it is public information that helps other people communicate with you.
<p>Your private key for a signing certificate is protected by your <ahref="glossary.html#master_password">master password,</a> and the Mozilla program does not disclose it to anyone else. The Mail & Newsgroup software uses your private key to create a unique, verifiable digital signature for every message you choose to sign.
<p>To encrypt an email message, you must have an <ahref="glossary.html#encryption_certificate">encryption certificate</a> for each of the message's recipients. The public key in each certificate is used to encrypt the message for that recipient.
<p>Every time you send a digitally signed message, your encryption certificate is automatically included with the message. Therefore, one of the easiest ways to obtain someone else's certificate is for that person to send you a digitally signed message.
<p>When you receive such a message, the person's certificate is automatically stored by the <ahref="certs_help.html">Certificate Manager</a>, which is the part of the browser that keeps track of certificates. This is useful because you need to have a certificate for each recipient of any email message that you want to send in encrypted form.
<p>Another way to obtain certificates is to look them up in a public directory, such as the "phonebook" directories maintained by many companies.
<p>It's also possible to look up certificates automatically. This feature is controlled by <ahref="mail_help.html#PREFERENCES_MAILNEWS_ADDRESSING">Mail & Newsgroups Preferences - Addressing</a> or <ahref="mail_help.html#addressing_settings">Mail & Newsgroups Account Settings - Addressing</a>, which can be configured to look up recipients' email addresses in a directory.
<p>When you are using any account that is configured to look up addresses in a directory, the same directory will be searched for matching certificates when you attempt to send an encrypted message to one or more recipients for whom you don't have certificates on file.
<p>The directory will also be searched for missing certificates when you open the drop-down menu below the Security icon in the Compose window and choose View Security Info.
<p>Once you have obtained an email certificate (or certificates), you must specify the certificates you want to use for signing and encrypting messages.
<p>For information about obtaining email certificates, see <ahref="using_certs_help.html#using_certs_get">Getting Your Own Certificate</a>.
<li>Under Digital Signing, click Select. (You may be asked to provide your <ahref="glossary.html#master_password">Master Password</a> before you can proceed further.)</li>
<li>Follow the same steps under Encryption: click the Select button, select the encryption certificate you want to use, and click OK.</li>
<p>In some cases you may be able to specify the same certificate under Encryption that you specified under Digital Signing; check with your system administrator to find out for sure.
</ol>
<p>Optionally, you can also indicate that you normally want to sign or encrypt all messages sent from a particular account. These account-specific settings are for convenience only; you can override the default settings for individual messages.
<p>To configure your default signing and encryption settings, start from the Security panel for the account (described above) and select your settings as follows:
<ul><li><b>Digitally sign messages:</b> When this checkbox is selected, all the messages you send from this account will be digitally signed unless you indicate otherwise before you send the message. To turn off this default setting, deselect the checkbox. </li></ul>
<ul><li><b>Never:</b> When this option is selected, messages you send from this account will be not be encrypted unless you indicate otherwise before you send them.</li>
<li><b>Required:</b> When this option is selected, all the messages you send from this account will be encrypted—but only if you have valid certificates for each of the message's recipients. If you don't have all the necessary certificates, the message can't be sent unless you turn off encryption for that message. </li>
<p>Before you can digitally sign or encrypt any message, you must obtain at least one email certificate and configure your mail security settings correctly. For background information on these tasks, see <ahref="#about_sigs_encrypt">About Digital Signatures & Encryption</a>.
<p>The settings specified in <ahref="mail_help.html#security_settings">Mail & Newsgroups Account Settings - Security</a> determine the default settings for each new Compose window you open when you set out to write an email.
<p>To open a Compose window, start from the Mail window and click Compose. You can immediately identify the default security settings from the presence or absence of these icons near the lower-right corner of the window:</p>
<table><tr><td> </td><td><imgsrc="chrome://messenger/skin/smime/icons/hdrSignOk.gif"alt="digital signature icon"></td><td>The message will be digitally signed (assuming you have a valid email certificate that identifies you).</td></tr>
<tr><td> </td><td><imgsrc="chrome://messenger/skin/smime/icons/hdrCryptoOk.gif"alt="encryption icon"></td><td>The message will be encrypted (assuming you have valid certificates for all recipients).</td></tr></table>
<p>To turn these settings off or on, click the arrow just below the Security icon in the Mail toolbar near the top of the window. Then select the item you want from the drop-down list:
<li><b>Do Not Encrypt This Message:</b> Choose this to turn off encryption for this message. The message will not be encrypted when it is sent over the Internet.</li>
<li><b>Encrypt This Message:</b> Choose this to turn on encryption for this message. The message will be sent in encrypted form. However, it can't be sent unless you have valid certificates for all recipients.</li>
<li><b>Digitally Sign This Message:</b> Choose this to turn digital signing on or off for this message. A checkmark indicates the message will be signed.</li>
<li><b>View Security Info:</b> Choose this to view detailed information about the security status of this message—to help you determine, for example, whether you need to obtain a certificate for one of the recipients.</li>
<p>To view detailed information about the message's security status, you can also click the key or lock icon as described in <ahref="#compose_security">Message Security - Compose Window</a>.
<p>When you view a signed or encrypted message in the Mail window, these icons near the upper-right corner of the message header indicate the security status of the message:</p>
<table><tr><td> </td><td><imgsrc="chrome://messenger/skin/smime/icons/hdrSignOk.gif"alt="digital signature icon"></td><td>The message is digitally signed and has been validated. If there is a problem with the signature, the pen is broken.</td></tr>
<tr><td> </td><td><imgsrc="chrome://messenger/skin/smime/icons/hdrSignUnknown.gif"alt="unknown icon"></td><td>The message is signed, but it has a large attachment that has not yet been downloaded from the IMAP server. As a result, the signature cannot be validated. Click the icon to download the attachment and validate the signature.</td></tr>
<tr><td> </td><td><imgsrc="chrome://messenger/skin/smime/icons/hdrCryptoOk.gif"alt="encryption icon"></td><td>The message is encrypted. If there is a problem with the encryption, the key is broken.</td></tr>
<p>To see more detailed information about the message's security, click the key or lock icon, or follow the instructions in <ahref="#received_security">Message Security - Received Message</a>.
<p>This section describes the Message Security window that you can open for any message you are composing. If you're not already viewing Message Security, click the Security icon in the toolbar of the Compose window.
<p>The Message Security window describes how your message will be sent:
<ul>
<li><b>Digitally Signed:</b> This line describes whether your message will be signed. There are three possibilities:</li>
<li><b>No:</b> Digital signing has been disabled for this message.</li>
<li><b>Not possible:</b> Digital signing has been enabled for this message. However, a valid <ahref="glossary.html#certificate">certificate</a> identifying you for this purpose is not available, or there is some other problem that makes signing impossible.</li>
<li><b>Yes:</b> Encryption has been enabled for this message, valid certificates for all listed recipients are available, and the message can be encryted.</li>
<li><b>No:</b> Encryption has been disabled or is not possible for this message.</li>
<li><b>Not possible:</b> Encryption has been enabled for this message. However, a valid certificate for at least one of the listed recipients is not available, or no recipients are listed, or there is some other problem that makes encryption impossible.</li>
<p>For more information about obtaining certificates and configuring message security settings, see <ahref="#secure_mail_first">Signing & Encrypting Messages</a>
<p>To indicate your signing or encryption choices for an individual message, click the arrow beside the Security button in the Compose window, then select the options you want.
<p>To indicate your default signing and encryption preferences for all messages, see <ahref="mail_help.html#security_settings">Mail & Newsgroups Account Settings - Security</a>
<p>This section describes the Message Security window that you can open for any message you have received. If you're not already viewing Message Security for a received message, follow these steps:
<p>If validation failed while OCSP was enabled, check the OCSP settings in <ahref="validation_help.html#validation_first">Privacy & Security Preferences - Validation</a>. If you are not familiar with OCSP, confirm the settings with your system administrator. If your settings are correct, there may be a problem with the OCSP service or the certificate used to create the signature is no longer valid. </li>
<p>If the signature is invalid because of a problem with a certificate's trust settings, you can use the <ahref="certs_help.html">Certificate Manager</a> to view or edit those settings.
<li>If the message's contents have been altered during transit, you should ask the sender to resend it. The changes may have been caused by network problems.</li>
<li>If a copy of your own certificate (used by the sender to encrypt the message) is not available on your computer, the private key required to decrypt the message cannot be retrieved. The only solution is to import a backup copy of your certificate and its private key (see <ahref="certs_help.html#My_Certificates">Your Certificates</a> for details.) If you don't have access to a backup certificate, you will not be able to decrypt the message. </li>
