HOME

5h-3LL 1.0

DIR: /usr/share/doc/mutt
/usr/share/doc/mutt/

Current File : /usr/share/doc/mutt/README.SMIME

This file describes how to configure mutt to use S/MIME.

This file is almost the same as smime-notes.txt available in mutt upstream
sources, but it contains a few modifications about Debian-specific issues.

Mutt needs some user interaction to get it ready for S/MIME.

1. Make sure, that openssl (must be) and ca-certificates (recommended)
are installed. If not, ask your administrator to do it.

2. Run 'smime_keys init'.

3. If ca-certificates is installed, make a symlink:
ln -s /etc/ssl/certs ~/.smime/ca-bundle.crt
If not, there are some other packages which contain Root CA certificates,
for example: kdelibs-data, libcurl2.
This makes you trust anything that was ultimately signed by one of CA
included in symlinked crt file.

4. Get yourself a certificate. (You can get one for free from www.thawte.com,
or pay for one from VeriSign or one of its competitors). The way the
process generally works: the certificate will be installed "into" your web
browser. If you are asked what application you wish to use the
certificate with, select Netscape. Strangely enough, "mutt" is usually not
an option.

5. Assuming you are using Mozilla, follow the instructions at
www.verisignlabs.com/Projects/smime_docs/linux.html to export the
certificate into a file called cert.p12. If you don't use Mozilla, you're on
your own.

6. Run 'smime_keys add_p12 cert.p12'.
* When the script asks for the "Import password", enter the one you
provided when you exported the certificate
* When it asks for a "PEM pass phrase", make up a new password. Every
time you sign or decrypt a message, mutt will ask for the PEM passphrase
* Finally, when the script asks for a label, enter an easy-to-remember
name for the certificate, such as "me". The script output will include
a line like:
added private key: /home/raldi/.smime/keys/12345678.0 for raldi@verisignlabs.com
The number (including the ".0" at the end) is your keyid. You will
need this number in the next step.

7. Edit your .muttrc file and add a lines:
set smime_default_key=keyid
set smime_sign_as=keyid
Probably you also want to change default values for smime_timeout
and smime_encrypt_with originally set in global /etc/Muttrc

8. Optionally, you can add following line to your ~/.mailcap to view certificate
from mutt:
application/x-pkcs7-signature;openssl pkcs7 -in %s -inform der -noout -print_certs -text | pager; needsterminal

Last updated: Tue, 23 Dec 2003 22:35:40 +0100
Artur R. Czechowski <arturcz@hell.pl>