> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qanapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S/MIME

> Helpful guides and troubleshooting

# Google S/MIME Setup

<Steps>
  <Step title="Enable the Google Admin SDK API">
    1. Go to the [Google Admin SDK API](https://console.cloud.google.com/marketplace/product/google/admin.googleapis.com)
       in Google Console.
    2. Click the <Badge color="blue" shape="pill">Enable</Badge> button and wait for it to finish.
    3. It will redirect you to the SDK API management page.
       <Tip>If you see a "Manage" button, this is already enabled.</Tip>
  </Step>

  <Step title="Enable the Gmail SDK API">
    1. Go to the [Gmail SDK API](https://console.cloud.google.com/marketplace/product/google/gmail.googleapis.com)
       in Google Console.
    2. Click the <Badge color="blue" shape="pill">Enable</Badge> button and wait for it to finish.
    3. It will redirect you to the SDK API management page.
       <Tip>If you already see a "Manage" button, this is already enabled.</Tip>
  </Step>

  <Step title="Enable S/MIME for Gmail">
    1. Go to [Gmail User Settings](https://admin.google.com/ac/apps/gmail/usersettings) in Google Admin.
    2. Click the section at the bottom for "S/MIME".
    3. Check <Icon icon="square-check" color="#3367D6" iconType="solid" />
       <b>Enable S/MIME encryption for sending and receiving emails</b>.
    4. Check <Icon icon="square-check" color="#3367D6" iconType="solid" />
       <b>Allow users to upload their own certificates</b>.
    5. Click<Badge color="blue" shape="pill">Save</Badge>.
  </Step>

  <Step title="Enable Client-Side Encryption for Gmail (if using CSE with S/MIME)">
    1. Go to [Client-Side Encryption](https://admin.google.com/ac/cse/keyservice) in Google Admin.
    2. In the "Assignment" section, under "Encryption status by app", click
       <Badge color="blue" shape="pill">Edit</Badge> for Gmail.
    3. Select <Icon icon="circle-dot" color="#3367D6" iconType="regular" /> <b>On</b> and click
       <Badge color="blue" shape="pill">Save</Badge>.
  </Step>
</Steps>

# Ordering Certificates for Users

1. Select S/MIME (/flow/smime) in the Qanapi App.
2. Click the <Icon icon="users" color="#1A73E8" iconType="solid" /><b>Manage</b> link on the Provider.
3. Select the non-active users you wish to enable by clicking the checkbox next to each one.
4. Click the <Badge color="green" shape="pill">Enable</Badge> button.
5. Certificates will be ordered for each selected user, and the status will change to
   <Badge color="blue" shape="pill">Pending Order</Badge>.
6. Once the order has processed in the background, the status will change to
   <Badge color="blue" shape="pill">Pending Approval</Badge> and the user will receive an email to verify their email
   address.
7. Users will follow the link in the email and click the <Badge color="blue">Approve</Badge> button.
8. The status will change to <Badge color="blue" shape="pill">Pending Upload</Badge>, and the app will attempt to upload
   the certificate (or CSE Identity) to Gmail. This may take up to 5 minutes.
9. After a successful upload, the status will change to <Badge color="green" shape="pill">Active</Badge>.

<Note>
  You may view a user's Gmail certificate information by clicking the "Certificate Info" button next to a user on
  the Qanapi S/MIME management page
</Note>

## Cancelling Certificates for Users

1. Select S/MIME (/flow/smime) in the Qanapi App.
2. Click the <Icon icon="users" color="#1A73E8" iconType="solid" /><b>Manage</b> link on the Provider.
3. Select the active users you wish to disable by clicking the checkbox next to each one.
4. Click the <Badge color="green" shape="pill">Disable</Badge> button.
5. Users will have their status updated to <Badge color="blue" shape="pill">Pending Cancellation</Badge>.
6. The certificate (or CSE Identity) will be removed from Gmail and the status will update to
   <Badge color="red" shape="pill">Cancelled</Badge>.

# Sending a signed email

1. In Gmail, open a new draft email by clicking the "Compose" button.
2. Click the lock icon (<Icon icon="lock" color="gray" iconType="solid" />) in the top right of the email.
3. Under "Digital Signature", click the "Sign Message" option.
4. Draft the email and click "Send".
5. Once sent, the email should have a certificate icon (<Icon icon="award" color="#1A73E8" iconType="solid" />) under
   the sender's name.

# Encrypting emails

To send encrypted emails with another email address, both senders must first send signed emails to exchange public
certificates.

1. In Gmail, draft and send a signed email to the desired recipient.
2. The recipient must do the same, replying to the first email with their own signed email.
3. Begin a reply to this email and click the lock icon (<Icon icon="lock" color="gray" iconType="solid" />) in the top
   right of the email.
4. Under the "Additional encryption" section, click the "Turn on" link. A verification dialog may open a warning about
   the loss of any existing body to the email.
5. Draft the email and click "Send". This may take a few seconds as Gmail encrypts the email.
6. Once sent, the email should have a green lock icon (<Icon icon="lock" iconType="solid" />) or blue shield icon
   (<Icon icon="shield" color="#1A73E8" iconType="solid" />) under the sender's name.

All future replies to this email chain will now be encrypted with the recipient

<Note>
  A green lock icon denotes Hosted S/MIME, where Gmail uses certificates uploaded from Qanapi.<br />A blue shield
  icon denotes CSE-wrapped S/MIME, where Gmail uses Qanapi's Client-Side Encryption
</Note>

# Troubleshooting

<Accordion title="Error on Upload: Feature Not Enabled">
  The most likely cause is that the user was created recently. Google needs time to replicate its changes. This can
  take several minutes to several hours.
</Accordion>

<Accordion title="Error on Upload: KACLS URI Mismatch">
  This happens when using Google's [Client-Side Encryption](https://admin.google.com/ac/cse/keyservice) where the Key
  Service is set to a different URI than the Provider Configuration.
</Accordion>

<Accordion title="Unable to decrypt an email sent by someone else">
  The most likely cause is failure to exchange signatures before sending encrypted emails. The signature exchange
  allows Gmail to capture the sender's public encryption keys in order to properly encrypt emails.
</Accordion>