# How to send/receive encrypted email from Microsoft Outlook
Guide has been updated for Outlook for Office 365/Outlook 2019
### Introduction
This guide will help you with configuring Outlook to send encrypted e-mail using **S/MIME**.
For the purposes of this guide, an **external user** is someone who has their email hosted **outside the domain and control of the Hermes Secure Email Gateway**. For example, an external user would have their email hosted with an email service like Gmail, yahoo etc. Typically, this external user has the need to send/receive encrypted email with an **internal user** i.e. someone who is **inside the domain and consequently the control of the Hermes Secure Email Gateway**.
### Assumptions
This guide assumes you have already received an email with an attached **.pfx** file. A **.pfx** file is nothing more than a password protected certificate that you have to install into your Outlook email client. In order to install the certificate, you must have the password which should had been given to you separately.
### Instructions
- Open the email with the subject **Your PFX Certificate File** with the attached **.pfx** file (**Figure 1**)
**Figure 1**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300232559.png)
- Double-click on the attached **key.pfx** file. If you get an opening attachment warning, click the **Open** button (**Figure 2**)
**Figure 2**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300314384.png)
- On the **Certificate Import Wizard** window, ensure **Current User** is selected and click the **Next** button (**Figure 3**)
**Figure 3**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300376871.png)
- On the **File to Import** window, simply click the **Next** button again (**Figure 4**)
**Figure 4**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300472600.png)
- On the **Private key protection** window, enter the certificate password you were provided in the **Password** field, ensure **Mark this key as exportable** options is **checked and** click the **Next** button (**Figure 5**)
**Figure 5**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300584903.png)
- On the **Certificate Store** window ensure that **Automatically select the certificate store based on the type of certificate** is selected and click the **Next** button (**Figure 6**)
**Figure 6**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300748772.png)
- On the final **Completing the Certificate Import Wizard** window simply click the **Finish** button (**Figure 7**)
**Figure 7**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300799954.png)
- You should get a **The Import was successful** window. Click **OK** to close that window (**Figure 8**)
**Figure 8**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300839975.png)
- Next, back in your Outlook, click on **File --> Options** (**Figure 9**)
**Figure 9**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620300984331.png)
- In the **Outlook Options** window, click on the **Trust Center** option on the left and then click on the Trust Center Settings button (**Figure 10**).
**Figure 10**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620301198279.png)
- In the Trust Center window, click on Email Security a under Encrypted email section click the Settings button (**Figure 11**)
**Figure 11**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620302910234.png)
- In the **Change Security Settings** window, enter a friendly name of your choosing in the **Security Settings Name** field (**Figure 12**).
**Figure 12**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620303101074.png)
- Next, click on the **Choose** button on the **Signing Certificate** section (**Figure 13**).
**Figure 13**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620303241656.png)
- On the **Select a Certificate** window, click on **More choices** (**Figure 14**).
**Figure 14**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620303444269.png)
On the **More choices** list of certificates, select the certificate with your e-mail address, ensuring the **Valid From** field has an end date in the future and then click on the **OK** button (**Figure 15**). It's possible you have more than one certificate installed in your machine, so you must ensure you select the correct certificate. If you are unsure, ask your for help with your IT department.
**Figure 15**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620303744752.png)
- Next, back in the **Change Security Settings** window, the **Signing Certificate** and the **Encryption Certificate** sections should be filled in with your e-mail address. Click the **OK** button (**Figure 16**).
**Figure 16**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620304076999.png)
Next, back in the **Trust Center** window, click the **OK** button to return back to Outlook **(Figure 17**).
**Figure 17**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620304276429.png)
- Next, back in Outlook Home window, click **New Email** to compose a new email message. In the compose message window, click on **Options** and note the **Encrypt** and **Sign** buttons (**Figure 18**).
**Figure 18**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620304646799.png)
- In order to send an encrypted message to someone, you must first have that person's **public** **key**. That's usually accomplished by having that person send you a **signed** e-mail message which you can then import that person and their **public** key into your Outlook contacts.
- Once you receive a signed e-mail message, **double-click it** to open that message and ensure a the digital signature icon on the top-right hand corner of the message (**Figure 19**).
**Figure 19**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620317785780.png)
- Next, right-click on the name of the sender on the message and on the resultant drop-down menu click on **Add to Outlook Contacts** (**Figure 20**)
**Figure 20**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620318144399.png)
- Next, in the **Contact** window, click on the **Certificates** button (**Figure 21**)
**Figure 21**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620318336031.png)
- Ensure that a certificate (**public key**) appears under the **Certificates (Digital IDs)** section and click the **Save & Close** button to save the contact in your Outlook Contacts (**Figure 22**).
**Figure 22**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620318575337.png)
- Since we now have the person's public key, we can now send encrypted e-mails to them. From the Outlook **Home** screen, click **New Email** to compose a new message to that person. In the **To** field, enter the person's e-mail address or select the previously saved contact from your Outlook contacts, click on **Option**s and ensure **Encrypt** is selected and optionally the **Sign** button is selected (Sign is not required in order to send an encrypted e-mail) and then click the **Send** button (**Figure 23**).
**Figure 23**
[](https://docs.deeztek.com/uploads/images/gallery/2021-05/image-1620319133264.png)
- If you did not get an error from Outlook about sending an encrypted e-mail, then you configuration has worked.