Skip to main content

​
Google S/MIME Setup

1

Enable the Google Admin SDK API

  1. Go to the Google Admin SDK API in Google Console.
  2. Click the Enable button and wait for it to finish.
  3. It will redirect you to the SDK API management page.
    If you see a “Manage” button, this is already enabled.
2

Enable the Gmail SDK API

  1. Go to the Gmail SDK API in Google Console.
  2. Click the Enable button and wait for it to finish.
  3. It will redirect you to the SDK API management page.
    If you already see a “Manage” button, this is already enabled.
3

Enable S/MIME for Gmail

  1. Go to Gmail User Settings in Google Admin.
  2. Click the section at the bottom for “S/MIME”.
  3. Check Enable S/MIME encryption for sending and receiving emails.
  4. Check Allow users to upload their own certificates.
  5. ClickSave.
4

Enable Client-Side Encryption for Gmail (if using CSE with S/MIME)

  1. Go to Client-Side Encryption in Google Admin.
  2. In the “Assignment” section, under “Encryption status by app”, click Edit for Gmail.
  3. Select  On and click Save.

​
Ordering Certificates for Users

  1. Select S/MIME (/flow/smime) in the Qanapi App.
  2. Click the Manage link on the Provider.
  3. Select the non-active users you wish to enable by clicking the checkbox next to each one.
  4. Click the Enable button.
  5. Certificates will be ordered for each selected user, and the status will change to Pending Order.
  6. Once the order has processed in the background, the status will change to Pending Approval and the user will receive an email to verify their email address.
  7. Users will follow the link in the email and click the Approve button.
  8. The status will change to Pending Upload, and the app will attempt to upload the certificate (or CSE Identity) to Gmail. This may take up to 5 minutes.
  9. After a successful upload, the status will change to Active.
You may view a user’s Gmail certificate information by clicking the “Certificate Info” button next to a user on the Qanapi S/MIME management page

​
Cancelling Certificates for Users

  1. Select S/MIME (/flow/smime) in the Qanapi App.
  2. Click the Manage link on the Provider.
  3. Select the active users you wish to disable by clicking the checkbox next to each one.
  4. Click the Disable button.
  5. Users will have their status updated to Pending Cancellation.
  6. The certificate (or CSE Identity) will be removed from Gmail and the status will update to Cancelled.

​
Sending a signed email

  1. In Gmail, open a new draft email by clicking the “Compose” button.
  2. Click the lock icon () in the top right of the email.
  3. Under “Digital Signature”, click the “Sign Message” option.
  4. Draft the email and click “Send”.
  5. Once sent, the email should have a certificate icon () under the sender’s name.

​
Encrypting emails

To send encrypted emails with another email address, both senders must first send signed emails to exchange public certificates.
  1. In Gmail, draft and send a signed email to the desired recipient.
  2. The recipient must do the same, replying to the first email with their own signed email.
  3. Begin a reply to this email and click the lock icon () in the top right of the email.
  4. Under the “Additional encryption” section, click the “Turn on” link. A verification dialog may open a warning about the loss of any existing body to the email.
  5. Draft the email and click “Send”. This may take a few seconds as Gmail encrypts the email.
  6. Once sent, the email should have a green lock icon () or blue shield icon () under the sender’s name.
All future replies to this email chain will now be encrypted with the recipient
A green lock icon denotes Hosted S/MIME, where Gmail uses certificates uploaded from Qanapi.
A blue shield icon denotes CSE-wrapped S/MIME, where Gmail uses Qanapi’s Client-Side Encryption

​
Troubleshooting

The most likely cause is that the user was created recently. Google needs time to replicate its changes. This can take several minutes to several hours.
This happens when using Google’s Client-Side Encryption where the Key Service is set to a different URI than the Provider Configuration.
The most likely cause is failure to exchange signatures before sending encrypted emails. The signature exchange allows Gmail to capture the sender’s public encryption keys in order to properly encrypt emails.