Create, edit, or delete a key server query

If Secure Email Gateway is operating in FIPS mode, PGP key types will be unavailable, as PGP encryption/decryption is unsupported. The Key Server request will return S/MIME Secure Multipurpose Internet Mail Extensions (S/MIME) is a specification for secure email messages that uses the X.509 format for digital certificates and uses various encryption algorithms such as 3DES. keys only, and you will not be able to modify the Key Type.

When automatic encryption is enabled, Secure Email Gateway searches the certificate A digital means of proving your identity. When you send a digitally-signed message, you are sending your certificate and public key. Certificates are issued by a certification authority and can expire or be revoked. store for a public key The key a sender gives to a recipient so that the recipient can verify the sender's signature and confirm that the message was not altered. Recipients also use the public key to encrypt email messages to the sender. to use for encryption. You can configure the Gateway to query one or more external key servers if a suitable key can't be found in the certificate store.

You can configure the Gateway to query a secure Active Directory certificate server using HTTP, LDAP, HTTPS or LDAPS protocols.

How do I...

• Create a key server query

  1. Point to the System tab.
  2. Under Encryption, click Key Server Queries.

  3. Do one of the following:

     • On the Key Server Queries toolbar, click New.
     • In the Task panel, click New key server query.

     The Gateway creates a new key server query, and then displays the Modify Key Server Query page.

     The new query is populated by default with typical port numbers and query details.

  4. For each group of settings, click Click here to change these settings, and then follow the instructions on screen.

     • You will find extra information about some of the settings later in this topic.

  5. In the Server Connection area, click Click here to change these settings, and then follow the instructions on screen.

     Extra information

     Select a Server type to define the protocol you want to use. The default Port is displayed automatically.

     Server Type	Port
     LDAPS	636
     HTTPS	443
     LDAP	389
     HTTP	11371

     See Firewall Ports for more information.

     You can also enter the Key Server hostname or IP address as well as an authentication User name and Password.

  6. Modify the Key Server Query Details if necessary.

     Extra information

     Select the key type you would like the request to return.

     PGP keys are not available in FIPS mode.

     The settings for the HTTP path and parameters or LDAP search root and filter are displayed automatically. These settings control how the Gateway looks up the given email address in your Active Directory certificate server.

     You can change these parameters if required.

  7. Apply the configuration.
• Edit a key server query

  1. Point to the System tab.

  2. Under Encryption, click Key Server Queries.

     The Key Server Queries page lists any previously-defined key server queries. Queries in use are indicated by the icon.

  3. In the list in the information panel, click a key server query.
  4. On the toolbar, click Edit.

  5. For each group of settings, click Click here to change these settings, and then follow the instructions on screen.

     • You will find extra information about some of the settings later in this topic.

  6. In the Server Connection area, click Click here to change these settings, and then follow the instructions on screen.

     Extra information

     Select a Server type to define the protocol you want to use. The Ports are displayed automatically.

     Server Type	Port
     LDAPS	636
     HTTPS	443
     LDAP	389
     HTTP	11371

     See Firewall Ports for more information.

     You can also enter the Key Server hostname or IP address as well as a User name and Password.

  7. Modify the Key Server Query Details if necessary.

     Extra information

     Select the key type you would like the request to return.

     PGP keys are not available in FIPS mode.

     The settings for the HTTP path and parameters or LDAP search root and filter are displayed automatically. These settings control how the Gateway looks up the given email address in your Active Directory certificate server.

     You can change these parameters if required.

  8. Apply the configuration.
• Delete a key server query

  1. Point to the System tab.

  2. Under Encryption, click Key Server Queries.

     The Key Server Queries page lists any previously-defined key server queries. Queries in use are indicated by the icon.

  3. In the list in the information panel, click a key server query.
  4. On the toolbar, click Delete.
  5. Apply the configuration.
• Copy a key server query

  1. Under Encryption, click Key Server Queries.

     The Key Server Queries page lists any previously-defined key server queries. Queries in use are indicated by the icon.

  2. Point to the System tab.
  3. In the list in the information panel, click a key server query.
  4. On the toolbar, click Copy.
  5. Edit the new key server query.
  6. Apply the configuration.

See also...

• Define an automatic mail encryption endpoint
• Apply the new configuration
• Test a key server query