Front cover - IBM Redbooks

274 Lotus Security Handbook
Interoperability with other S/MIME-compliant software
The PKCS #12 standard specifies the format for certificate export and import.
This permits the users, among other things, to make backup copies of their
private key. Also, if the user needs to send S/MIME e-mails from a different
machine or from a different messaging client that provides S/MIME functionality,
this provides a simple way for them to take their public/private key pair with them
and install it in the new messaging client.
Thus, the purpose of the PKCS #12 standard is to provide interoperability of the
private/public key pair and certificates with other S/MIME-capable messaging
clients. This is quite important, since otherwise, if a user requested a certificate
with Internet Explorer from a Web CA like VeriSign, that user would only be able
to use it in conjunction with Outlook Express. Similarly, if a user requested a
certificate with Netscape Navigator, that user would only be able to use it in
conjunction with Netscape Messenger.
Obtaining a client certificate for S/MIME
For a client to be able to send signed and encrypted e-mails using S/MIME, it is
necessary to have an X.509 certificate for it to use. The current generation of
S/MIME-capable messaging clients provide the ability to generate a certificate
request with a Web-based CA. Once a client certificate has been requested (and
approved), it is installed in the S/MIME-capable messaging client so that the
client can sign and encrypt any e-mail messages.
It is also necessary to make the user’s certificate available to anybody who wants
to send encrypted e-mails to that user. Encrypted e-mail messages addressed to
the user are encrypted with that user’s public key.
Figure 6-28 on page 275 is a high-level representation of the process of
requesting and acquiring certificates, as well as sending signed and encrypted
e-mails, as implemented in the current generation of SMIME-capable messaging
clients.