SMTPTransporter: Signing emails with S/MIME

S/MIME (Secure/Multipurpose internet Mail Extensions) is a protocol used to digitally sign emails. An S/MIME signature helps recipients verify two important things: that the message really comes from the claimed sender and that its content has not been altered in transit.

With 4D 21 R5, the SMTPTransporter class makes it easy to add an S/MIME signature to your outgoing emails. Here’s how it works.

What does it mean to “sign an email”? Simply put, it means that a S/MIME part is added to the email. This part contains a CRC encrypted with the private key of the sender. When receiving the email, the server can use the public key of the expected sender to decrypt it. By doing so, it validates both the sender authenticity and the integrity of the email.

To send an S/MIME-signed email, you need a certificate and its associated private key. They are typically bundled together in a PKCS#12 file, usually using the .p12 or .pfx extension. You can either store the certificate in your keystore or load it directly from disk.

Once you have your certificate, signing an email requires only a few additional lines of code:

var $transporter : 4D.SMTPTransporter
var $options ; $result : Object

$options:=New object
//Enter the information for the SMTP server

// Enable S/MIME signing
$options.certificate:=File("myCertificateFile.p12")
$options.certificatePassword:="certificatePasswordOrNothingIfBlank"

$transporter:=4D.SMTPTransporter.new($options)

$email:=New object
//Enter the content of the email

$result:=$transporter.send($email)

It’s as simple as that!

When the recipient opens the message, their email client can detect the S/MIME signature and verify it using the sender’s certificate. If the verification succeeds, the recipient can be confident that the email was signed by the expected sender and has not been modified since it was signed. S/MIME signing is a simple but effective way to strengthen the security and trustworthiness of your email communications, and with 4D 21 R5, enabling it requires very little additional code.

I hope this feature will help you improve the security of your emails. If you have any question, don’t hesitate to reach out to me on the official 4D forum.

PS: Some mail clients don’t provide information about the signing of an email, it’s especially true for webmails. Thunderbird and Mac Mail are showing proper information.

PPS: To sign an email, you’ll need a certificate issued by a certificate authority. You can create one yourself with OpenSSL but it means adding the certificate authority certificate in the trusted certificates of the receiver email software. The simplest solution is to get a certificate from a globally recognized certificate authority. Some even issue such certificates for free (for example Actalis).