Email Signing and File Encryption

Strategy One (December 2025) adds Distribution Services support for the following enhanced security features:

• S/MIME signing and encryption for email subscriptions.

• PGP encryption for File, OneDrive, SharePoint, GCS, Google Drive, and S3 subscriptions.

  The key generation commands in this document create self-signed or unprotected test keys. They are intended for development and validation only. Do not use these keys or commands as-is in a production environment.

S/MIME for Email Subscriptions

S/MIME supports the following two independent capabilities:

• Signing: Verifies the sender identity and message integrity.

• Encryption: Encrypts the email content by using the recipient's public certificate.

Signing and encryption can be enabled independently.

Recommended Customer Practice: Validate S/MIME in Outlook First

Before configuring S/MIME in distribution services, Strategy strongly encourages users to practice and validate the S/MIME setup directly in Outlook.

Validating the S/MIME setup directly in Outlook confirms that the certificate, private key, trust chain, and recipient configuration work correctly before introducing distribution services in the workflow.

Recommended practice:

1. Import the sender identity - Install the signing certificate and private key into Outlook (via File > Options > Trust Center > Trust Center Settings > Email Security) or the OS certificate store.

2. Establish trust on the recipient side - Import and trust the sender's certificate on the recipient machine. This is required for self-signed test certificates; CA-issued certificates are trusted automatically.

3. Import the recipient encryption identity - Install the recipient's .pfx file (private key and certificate) on the recipient machine so it can decrypt incoming encrypted email.

4. Test signing - Send a signed email from Outlook and confirm the recipient sees the signature icon and can verify the signature.

5. Test encryption - Send an encrypted email from Outlook and confirm the recipient sees the lock icon and can decrypt and read the message.

Completing this practice first helps users become familiar with the key S/MIME concepts:

• Sender signing certificate

• Sender private key

• Recipient encryption certificate

• Recipient private key

• Certificate trust

• Signed email verification

• Encrypted email decryption

After you confirm the same certificates work in Outlook, you can proceed with the distribution services configuration with greater confidence.

This step is especially useful when using self-signed certificates for testing, because most S/MIME issues are related to certificate trust, certificate import location, missing private keys, or mismatched recipient email addresses.

Microsoft references:

Encrypt messages by using S/MIME in Outlook — End-user guide for importing certificates and configuring S/MIME settings in Outlook.

S/MIME in Exchange Online — Administrator overview of S/MIME digital signatures and encryption in Exchange Online.

S/MIME Signing

S/MIME signing is used to prove the sender identity and confirm that the email was not modified after signing.

Prepare a Test Signing Key

Double check the email address testuser@mstrdev.com is exactly the same email address as the transmitter sender email.

For test purposes, generate a self-signed signing key pair and export it as a .pfx file:

openssl genpkey -algorithm RSA -out email_signing_key.pem

openssl req -new -x509 \
  -key email_signing_key.pem \
  -out email_signing_cert.pem \
  -subj "/CN=Test User/emailAddress=testuser@mstrdev.com"

openssl pkcs12 -export \
  -out email_signing_identity.pfx \
  -inkey email_signing_key.pem \
  -in email_signing_cert.pem \
  -password pass:changeit

openssl x509 -in email_signing_cert.pem -text -noout

cp email_signing_cert.pem email_signing_cert.crt

Generated files:

Trust the Signing Certificate

For self-signed certificates, the recipient/client must trust the signing certificate before the signature can be verified successfully.

Import the following certificate into the client trust store:

email_signing_cert.crt

• On Windows, import is using the Windows Certificate Manager or Outlook Trust Center.

• On macOS, import it using Keychain Access.

This step is mainly required for self-signed test certificates. In production, use a certificate issued by a trusted CA or enterprise PKI.

Email Signing Configuration

S/MIME signing is controlled by the Enable S/MIME Signing toggle.

To enable S/MIME signing for an email device, the device configuration must include the following:

• A private key in OpenSSL PEM format

• A signing certificate in OpenSSL PEM format

Configure Email Signing

1. Open the Workstation window with the Navigation pane in smart mode.

2. In the Navigation pane, click Environments.

3. Right-click an environment and choose Properties.

4. In the left pane, click Subscription Delivery

5. Click Delivery Device.

6. Right-click your email device and choose Edit.

7. Toggle on S/MIME Signing.

8. Next to Certificate File, click Upload and upload your file.

   Certificate format Use the generated email_signing_cert.pem as the reference format:

   Copy

   -----BEGIN CERTIFICATE-----
   CONTENT HERE...
   -----END CERTIFICATE-----

9. Next to Private key, click Upload and upload your key.

   Private Key Format Use the generated email_signing_key.pem as the reference format:

   Copy

   -----BEGIN PRIVATE KEY-----
   CONTENT HERE...
   -----END PRIVATE KEY-----

10. Click Save.

S/MIME Encryption

S/MIME encryption encrypts an email by using the recipient's public certificate. The recipient must have the corresponding private key installed locally in order to decrypt the email.

Signing and encryption are independent feature. A subscription can be signed, encrypted, both signed and encrypted, or neither, depending on the configuration.

Prepare a Test Recipient Encryption Key

For test purposes, generate a self-signed recipient encryption certificate:

openssl genpkey -algorithm RSA -out recipient_encryption_key.pem

openssl req -new -x509 \
  -key recipient_encryption_key.pem \
  -out recipient_encryption_cert.pem \
  -subj "/CN=Test Recipient/emailAddress=recipient@test.com"

openssl pkcs12 -export \
  -out recipient_encryption_identity.pfx \
  -inkey recipient_encryption_key.pem \
  -in recipient_encryption_cert.pem \
  -password pass:changeit

openssl x509 -in recipient_encryption_cert.pem -text -noout

cp recipient_encryption_cert.pem recipient_encryption_cert.crt

Generated files:

Import the Recipient Identity for Decryption

If S/MIME encryption is enabled, the recipient must import the following .pfx file into the local system certificate store or mail client certificate store:

recipient_encryption_identity.pfx

The file contains the recipient's private key and is required to decrypt encrypted email.

If email encryption is not enabled, you can skip this step.

Email Encryption Configuration

To enable S/MIME encryption, each recipient must have an associated S/MIME encryption certificate in PEM format.

Add Recipient Certificates

You can configure recipient certificates using one of the following methods:

1. User Management tab:

   1. Open the Workstation window with the Navigation pane in smart mode.
   2. In the Navigation pane, click Users and Groups.
   3. Select an Environment from the upper-left drop-down.
   4. In the left pane, click All Users.

   5. Right-click a user and choose Edit.

   6. In the left pane, click Account and Credentials.

   7. Next to Email Address, click the Encryption Key icon.

   8. Click Upload and upload your key.

   9. Click Save.

2. Contact when it is used as the subscription recipient:

   1. Open the Workstation window.

   2. Open the Workstation page.

   3. In the Navigation pane, click Users & Groups.
   4. Select an Environment from the upper-left drop-down list.
   5. Next to Contacts, click Create a New Contact .
   6. Right-click the contact and choose Edit.
   7. In the left navigation, click Delivery Addresses.
   8. Hover over the email and click the Encryption Key icon.

   9. Click Upload and upload your key.

   10. Click Save.

Use REST API to Add Recipient Key

Reference the Library API doc: POST /api/v2/users/{userId}/addresses/{addressId}

See the following sample payload for JSON body:

{
  "name": "New user address",
  "physicalAddress": "test@dev.com",
  "deliveryType": "email",
  "deviceId": "CDF1F22B757C4F6B8BBEE5FB19FCB6CD",
  "isDefault": true,
  "encryptionKey": "-----BEGIN CERTIFICATE-----\nMIIDSzCC...\n-----END CERTIFICATE-----\n"
}

The certificate must match the recipient email address used by the subscription.

Certificate Format

Use the generated recipient_encryption_cert.pem as the reference format:

-----BEGIN CERTIFICATE-----
CONTENT HERE...
-----END CERTIFICATE-----

Device Security Level

The email device security level controls how S/MIME encryption is applied.

Subscription Creation

The subscription creation process remains unchanged.

Distribution Services automatically applies S/MIME signing when the recipient's email device has S/MIME signing enabled.

Distribution Services automatically applied S/MIME encryption when:

• The recipient's email device has S/MIME encryption enabled.

• The recipient's default email address has an associated S/MIME encryption certificate.

• The configured device security level allows or requires encryption.

Verification in Outlook

After email delivery, recipients can verify the applied security features in Outlook:

• A lock icon indicates that the email was encrypted.

• A signature icon indicates that the email was signed.

PGP Encryption for File, OneDrive, SharePoint, Google Drive, GCS, and S3 Subscriptions

PGP encryption can be used to encrypt files generated by the following subscription types:

• File / FTP

• OneDrive

• SharePoint

• s3

• Google Drive

• GCS

Encrypted files are delivered with a .pgp extension, for example: report.csv.pgp

The file must be decrypted with the corresponding private key before the content can be accessed.

Prepare a Test PGP Key

On Linux, install gpg and generate a test key:

gpg --batch --generate-key <<EOF
%no-protection
Key-Type: RSA
Key-Length: 4096
Subkey-Type: RSA
Subkey-Length: 4096
Name-Real: YOUR_CORP_ID
Name-Email: YOUR_CORP_ID@test.com
Expire-Date: 0
%commit
EOF

%no-protection creates a private key without a passphrase. This is convenient for testing, but it must not be used for production keys.

Export the public key in the armored format:

gpg --export --armor YOUR_CORP_ID@test.com > pub.pem

Although the file is named pub.pem, the content is an armored PGP public key block, not an X.509 certificate.

On Windows, install Gpg4win and use Kleopatra to generate and export the PGP public key.

Configure PGP

1. Open the Workstation window with the Navigation pane in smart mode.

2. In the Navigation pane, click Environments.

3. Right-click an environment and choose Properties.

4. In the left pane, click Subscription Delivery

5. Click Delivery Device.

6. Right-click your email device and choose Edit.

7. Toggle on PGP Encryption.

8. Next to Encryption Public Key, click Upload and upload your file.

9. Click Save.

PGP Public Key Format

The uploaded public key must use the following armored PGP format:

-----BEGIN PGP PUBLIC KEY BLOCK-----

CONTENT HERE...
-----END PGP PUBLIC KEY BLOCK-----

Final Delivered Content

When PGP encryption is enabled, generated files are encrypted before delivery.

Example: report.csv

The example is delivered as: report.csv.pgp

The recipient must use the corresponding PGP private key to decrypt the file.

Decrypting PGP Files

Windows

If Gpg4win is installed and the corresponding private key is available in Kleopatra, a double-click the .pgp file or use Kleopatra to decrypt it.

Linux

Use the following command:

gpg --output report.csv --decrypt report.csv.pgp

This command requires that the gpg is installed and that the corresponding private key has already been imported or generated on the machine.