How to Setup S/MIME Integration

For development purposes, it's possible to set up S/MIME integration for a local Zammad instance. However, since the approach uses self-generated test certificates, this is considered unsafe for production. You've been warned!

Configure S/MIME Integration

Navigate to the System > Integrations > S/MIME section in GUI, and turn on the toggle switch on top to activate the feature.

Upload Sender Certificate & Private Key

In the same screen, click on the Add Certificate button.

Paste the following text in the Paste Certificate box:

Click on the Add button.
Click on the Add Private Key button.

Paste the following text in the Paste Private Key box:

Leave Enter Private Key Secret box empty.
Click on the Add button.

The test sender certificate above was generated for the following sender email address: zammad@localhost. In case your sender address is different, please see below how to re-generate it.

Upload Recipient Certificate

In the same screen, click again on the Add Certificate button.

Paste the following text in the Paste Certificate box:

Click on the Add button.

The test recipient certificate above was generated for the following customer email address: nicole.braun@zammad.org. In case your recipient address is different, please see below how to re-generate it.

Create a Test Email Ticket with Encrypted & Signed Content

Go to new ticket screen.
Switch to the Send Email article type.
Provide a Title.
Choose a Customer called Nicole Braun.
Provide some Text.
Choose a Group.
Verify that both Encrypt and Sign toggle buttons are now active.
Click on the Create button.
Verify that the first article has a Security field with both Encrypted and Signed flags.

Re-generate Test Certificates

You will need an installation of a recent openssl utility for the following commands.

Generate Sender Certificate & Private Key

Navigate to an empty directory.

Create a text configuration file called sender.conf with the following content:

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req

[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Berlin
stateOrProvinceName_max = 32
localityName = Locality Name (eg, city)
localityName_default = Berlin
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Zammad GmbH
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Development
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_default = Zammad Helpdesk
commonName_max = 64
emailAddress = Email Address
emailAddress_default = zammad@localhost
emailAddress_max = 40

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier = hash
subjectAltName = email:copy
extendedKeyUsage = emailProtection

Adjust all *_default values to match desired settings. The most important is emailAddress_default which must match your sender's email address.

Run the following command in the same directory:

openssl req -x509 -new -nodes -config sender.conf -keyout sender.key -out sender.crt

When prompted, enter the pass phrase of the private key from the previous step.

Confirm each field with a return (the value will be pre-populated from the configuration file).

You can now upload your new test sender certificate & private key. Either upload the actual text files (sender.crt and sender.key) or paste their contents in appropriate boxes. Remember to omit the input for the private key secret since it was not defined during the re-generation, but don't skip the private key upload since the certificate may be used for signing and decryption.

Generate Recipient Certificate & Private Key

Navigate to an empty directory.

Create a text configuration file called recipient.conf with the following content:

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req

[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Berlin
localityName = Locality Name (eg, city)
localityName_default = Berlin
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Zammad Foundation
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Development
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_default = Nicole Braun
commonName_max = 64
emailAddress = Email Address
emailAddress_default = nicole.braun@zammad.org
emailAddress_max = 40

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectKeyIdentifier = hash
subjectAltName = email:copy
extendedKeyUsage = emailProtection

Adjust all *_default values to match desired settings. The most important is emailAddress_default which must match your recipient's email address.