Configure Outlook to Send Secure Email

The following steps pertain to Microsoft Outlook 2016, and may also be applicable to newer versions up through Outlook 2021. These steps may not be applicable to cloud email users, but you may find additional configurations below for both Exchange Online and O365 in Other Helpful References.

1. Insert your PIV card in your computer’s smart card reader.
2. Browse to File > Options > Trust Center > Trust Center Settings… and select Email Security.
3. Click Settings… beneath the Encrypted Email heading.
4. Click New to create a new security preference.
5. Assign a Security Settings Name (for example, “Secure Email – PIV”).
6. Click Choose next to Signing Certificate.
   • Select your PIV card’s digital signature certificate and click OK.
   • Select SHA256 as the Hash Algorithm.
7. Click Choose next to Encryption Certificate.
   • Select your PIV card’s digital signature certificate and click OK.
   • Select AES (256-bit) as the Encryption Algorithm.
8. Enable the Send these certificates with signed messages selection box.
9. Click OK three times.

Note: The following screenshot shows an example of a completed security preference configuration.

Publish Your Certificates to the Global Address List

The Global Address List (GAL) is a shared, enterprise-wide contact list in Microsoft Active Directory. Publishing your certificates to the GAL will add your encryption certificate and associated public key to an enterprise address book, making it easier for other internal agency users to send you an encrypted email.

1. Insert your PIV card in your computer’s smart card reader.
2. Browse to File > Options > Trust Center > Trust Center Settings and select Email Security.
3. Click Publish to GAL… beneath the Digital IDs (Certificates) heading.
4. Click OK when warned about Outlook publishing your default security certificates to the Global Address List.
5. Enter your PIV card PIN when prompted.
6. Click OK twice.

Note: The following screenshot shows the location of the Publish to GAL… button.

Send a Signed Email

1. Compose an email.
2. Click the Options tab.
3. Enable the Sign icon (appears as a red ribbon icon).
4. Click Send.
5. Enter your PIV card PIN when prompted.

Note: The following screenshot shows a signed email.

Send an Encrypted Email

1. Compose an email
2. Click the Options tab
3. Enable the Encrypt icon (appears as a yellow lock icon)
4. Click Send.

Note: It is common practice to sign a message when encrypting it below.

Manually Import a User’s Encryption Certificate

When sending an encrypted email, the message is encrypted using the public key in the intended recipient’s certificate. If Outlook cannot find the intended recipient’s public key through the Global Address List, you may need to load it manually.

1. Obtain a copy of the intended recipient’s Key Management certificate (you may need to ask the intended recipient to export and share their certificate with you)
2. Click the Home tab.
3. Click the Address Book.
4. Select File > New Entry.
5. Select New Contact and then click OK.
6. Populate the recipient’s contact information, minimally including name and email address.
7. Click the Certificates icon.
8. Click Import and browse to the intended recipient’s encryption certificate.
9. Click Save & Close and then follow the steps to send an encrypted email.

Note: The following screenshot shows a certificate loaded into a contact entry.