A Public Key Infrastructure (PKI) provides the basic mechanisms that enable the use of cryptography-based tools in large organizations. In a Microsoft environment, it is possible to set up a Windows PKI with fully automated certificate management. The issuing of certificates is triggered within the framework of a Certification Authority (CA), for example, at user login. The certificates can be published automatically in the Active Directory (AD), via certificate templates key usages and other extensions can be defined. The functions are limited to issuance by an internal Microsoft CA.

Limitations in a pure Windows-PKI

The use cases of the services already provided with this are therefore naturally limited to the purely internal area (such as Wi-Fi encryption, VPN services, …): The use of trusted signatures for e-mails and documents, like encryption, is already the de facto standard in various industries, and in many cases even required by law. The use of services for external communications reaches its limits here, in that participants outside the Windows PKI do not automatically trust the issuer certificate. Encryption is thus not readily possible, and recipients of signed messages receive error messages.

Windows-PKI with publicly trusted certification authority

This results in unnecessary support effort that could easily be avoided. As soon as signed or encrypted information is to be exchanged with external partners, certificates from a publicly trusted CA – such as GLOBALTRUST – are required. The root certificate of this CA is already pre-installed in the recipient’s application. The basis for this are special audit and approval procedures, which public CAs undergo with enormous expenditure of resources and time.

Limitations of a publicly trusted certification authority Windows-PKI

However, requesting certificates from public CAs also requires certificate management and thus an organizational effort that should not be underestimated – both in terms of personnel and finances. Errors in the management of keys and certificates can pose massive risks and cause serious damage. For example, an expired certificate could paralyse the ATMs of an entire banking chain. Apply, install, replace, revoke: not a challenge when used in the double-digit range, but quickly becomes an overload when used by thousands of employees and devices and results in expired certificates, incorrectly deposited keys or still valid certificates from employees who have long since left the company. Monitoring tools on the market are often not up to the task.

Fully automated certificate management: Windows-PKI with a non Microsoft-CA

This is exactly where the product from Secardeo and GLOBALTRUST comes in. The solution is aimed at medium and large organizations. Holders of a GLOBALTRUST COMPANY certificate can be connected to our certificate issuance via an interface with the help of Secardeo certEP. The certEP fully automatically takes over the certificate management during the entire life cycle. The private keys are generated at the user and never disclosed to GLOBALTRUST. The certEP only makes a certificate request. Thus, it requests certificates for persons, services and devices, transports key material to the target and ensures timely renewal. All functions of a pure Windows PKI are available without restrictions (certificate templates, enrollment agents, role separation, key recovery, …).

Certificate characteristics

The certificates are considered S/MIME certificates. They can be used for e-mail signature, encryption, client authentication, VPN, encryption and digital signature of file systems and documents.

The certificates are suitable for producing advanced signatures under the conditions of the eIDAS Regulation.

The solution can be described as technically mature. It enables seamless use of all PKI-relevant security mechanisms, combined with the trust status of a public CA. Compared to building your own solution, the product is a proven, highly secure and cost-effective alternative.

The multiple award-winning Secure E-Mail Gateway from SEPPmail now has an interface to GLOBALTRUST. For the first time, users of the popular Swiss solution for e-mail security have the possibility to retrieve their encryption and signature certificates from an eIDAS-qualified provider in Austria.

The topic “email security” has recently become an ongoing issue for many companies. The Corona pandemic has taken digitization in business one step further. Home offices were established virtually overnight. Physical meetings and face-to-face conversations took a back seat. But not only video conferencing tools, also the good old e-mail experienced a real boom in the everyday business communication.

E-mails will continue to be the most widely used means of communication in the business sector for a long time to come. They were a popular tool for cybercriminals even before the pandemic; In recent months, however, phishing attacks, identity theft and malware have once again increased significantly. For most people, today’s fake emails are factually indistinguishable from an original.

Secure e-mail traffic

Another scenario in which potential threats exist is unsecured transmission. Unencrypted electronic messages can easily be intercepted and read by third parties. It is not only under data protection aspects that sensitive customer, client or patient data should (or must) be protected from unauthorized disclosure – companies are well advised to transmit confidential information exclusively in encrypted form.

Does an e-mail really come from the designated sender? Is a third party reading it? Both of these uncertainties can be resolved immediately by using signature and encryption certificates. If an e-mail is signed, the recipient knows that the message really comes from the designated sender. This is based on a signature key that only the verified sender possesses. This key is inseparably linked to the identity of the sender by a certificate – if necessary, with further attributes, such as affiliation to a company and department. Functions, powers of attorney, or academic degrees can also be entered. The correctness of this information is ensured by a trust service provider, such as GLOBALTRUST, by means of special verification procedures. GLOBALTRUST works on the basis of European legal regulations for trust services and is audited annually. Furthermore, an undamaged signature proves that the content of the e-mail has not been intercepted and modified in transit. If both parties to the communication have a certificate, the message can be encrypted using the latest cryptographic algorithms so that only the – guaranteed genuine – recipient can read it.

Signed e-mails thus form the basis for trustworthy electronic business transactions and contribute enormously to the enhancement of one’s own image. GLOBALTRUST deliberately refrains from using certificates with a low security level, i.e. those where only the e-mail address has been validated. It is known from the SSL area that almost 95% of all phishing attacks are committed with the help of a so-called domain-validated certificate. The same danger situation prevails with S/MIME, i.e. in the e-mail scenario.

Fully automated certificate handling in SEPPmail

The SEPPmail Secure E-Mail Gateway enables the fully automatic encryption, decryption, and signature of e-mails in the usual e-mail program (Outlook, Notes, Mail, Thunderbird etc.). Encrypted e-mail communication is also possible with recipients who have no encryption software and no key (patented GINA procedure). The gateway handles the entire lifecycle of the certificates fully automatically, from request to revocation. With the direct connection to the certification authority of GLOBALTRUST, another publicly trusted CA is now available.

For many companies, the pandemic was the reason to complete digitization initiatives that had been put off for a long time. The demand for corresponding security mechanisms has increased enormously. What is needed are holistic concepts that seamlessly integrate publicly trusted certificates into a central management system and ensure highly convenient and simple use. This is the core requirement of the solution. Because here, you can be sure to communicate confidentially and authentically without the user’s intervention.