1. Introduction Requesting and setting up a certificate Requesting a certificate Creating a certificate...

Transcription

1 Contents 1. Introduction Requesting and setting up a certificate Requesting a certificate Creating a certificate Installing a certificate Setting up the certificate in Outlook Encryption with Outlook Exporting and importing certificates Exporting a certificate Importing a certificate Installing the ALDI Nord root certificate Downloading and providing certificates Uploading a certificate using the certificate portal Searching for certificates Encrypted communication Version 1.6 page 1 of 42

2 1. Introduction This document provides instructions on how to set up encrypted communication with ALDI Nord from the point of view of an external communication partner. If you have questions or queries, please contact your IT administrator. This guide was verified on 02/12/2014. Any changes from the side of the manufacturers can lead to a different behavior as described here. This guideline was developed on the following system: Windows 7 Internet Explorer 8 MS Outlook 2007 On other systems the views and procedures may be different. 2. Requesting and setting up a certificate This section explains how to request and set up a certificate for encrypted communication with ALDI Nord. ALDI Nord currently recommends the Certification Authority (trustcenter) Symantec. This ensures the highest possible compatibility with the encryption mechanisms used by ALDI Nord. As an example, in the following section the product "Digital ID for secure " from Symantec is requested. Please note that the described certificate in this section is issued for a single address and can only be used with this. Access to the address has to be via Outlook and the protocol POP3. The described certificate is valid for one year and entails costs. 2.1 Requesting a certificate Open the website Please choose the topic Products A-Z at Products & Solutions. Encrypted communication Version 1.6 page 2 of 42

3 Please choose Digital IDs for Secure . Now you have to buy the Digital ID by choosing Buy Online. Encrypted communication Version 1.6 page 3 of 42

4 Please enter the address you want to use for the encrypted communication here. Please choose the Validity period and click Next. Pleas fill in all required information and click Next. Encrypted communication Version 1.6 page 4 of 42

5 Please agree with the Symantec Digital ID Subscriber Agreement to save your public key on the symantec website. Due to this ALDI can use this key for the encryption. Then please hit Submit. Please read the licence agreement carefully. If you agree, please hit Accept. Encrypted communication Version 1.6 page 5 of 42

6 In the following half an hour you will get two s. With these s your -address will be confirmed. On the next pages you will find information about how to request a certificate. Depending on your Internet Explorer settings, you might have to follow the steps below to add the Symantec TrustCenter website to your trusted sites. First of all please start the Internet Explorer follow these steps: Choose "Tools", select "Internet Options" Encrypted communication Version 1.6 page 6 of 42

7 At "Internet Options", select the tab "Security" Select the item "Trusted sites" and then click "Sites" Now you can add the website "digitalid.pki.symantec.com" to the zone. Fill in this address and then click Add. To do so, click "Add". Once the website has been added, click "Close" to end the dialogue Encrypted communication Version 1.6 page 7 of 42

8 Once you have closed the Internet Options dialogue, you can continue to process your order. Please note the following before generating the key: Generate the key either with the browser "Mozilla Firefox" or "Internet Explorer". Do not perform any new installations of your system or browser before having received and installed the certificate from Symantec. The private key, which only works with the certificate, will otherwise be lost Creating a certificate You have received two s from Symantec. Please open the first and hit the given link. You will now be forwarded to the following page: Now please open the second from Symantec. There you will find a password which you fill in on this page. Then please login. Encrypted communication Version 1.6 page 8 of 42

9 Click yes After you logged in successfully, you will reach the following page. Please hit Generate. Encrypted communication Version 1.6 page 9 of 42

10 "Please note: The following pages may show some screenshots in german language. As you may receive the same info but in your local language, we suggest you to carefully read the instructions and continue as described." Click OK After generating the certificate must be installed on your computer. To perform this action please hit the button Install certificate. This step may need some minutes. Encrypted communication Version 1.6 page 10 of 42

11 Click yes By hitting the OK-button this step has been finished. You now may logout from the Symantec website. Encrypted communication Version 1.6 page 11 of 42

12 2.3. Installing a certificate This chapter describes how to install the certificate created in the prior steps. You have to do this step to comfortably communicate encrypted with ALDI by using your Outlook. At first, install the Root-CAs of the trustcenter Symatec. For this please open the webpage from Verisgn (a company of Symantec) with the following address: Here you will find the actual rootcertificates. You can download all rootvertificates. In the following it will describe as an example how to download the Symantec Class 1 Public Primary Certification Authority G6. Please right-click on Download Root Now and choose Save As. Encrypted communication Version 1.6 page 12 of 42

13 Save the file with the file-extension.cer. Depending on your Internet browser, you will receive a mask asking you to trust a new certificate authority (CA). Please choose the two options that contain trust to identify websites and trust to identify user or words to that effect and click OK. If you don t get that window please open the.cer -file. You may now get one of the following screens. You have to accept them as described: Click open Click "Allow" Encrypted communication Version 1.6 page 13 of 42

14 After that you must install the certificate: Click "Install Certificate..." Click "Next >" Encrypted communication Version 1.6 page 14 of 42

15 Then select "Place all certificates in the following store" and click "Browse..." Then highlight the entry "Trusted Root Certification Authorities" and click "OK" Finally, click "Finish" Now you may get a security request concerning the installation of a root certificate. Please confirm with Yes : Encrypted communication Version 1.6 page 15 of 42

16 Click "OK" 2.4. Setting up the certificate in Outlook This section explains how to set up your Outlook 2007 to use your certificate as a signature. Start Outlook Select "Tools" in the menu bar in Outlook. Click "Trust Center..." Encrypted communication Version 1.6 page 16 of 42

17 A digital signature in your message allows you to sign your message. The digital signature includes your certificate. Select " Security", match the settings under "Encrypted " and then click "Settings..." For encrypted communication, click "Choose..." Depending on the options previously selected, you may also have to select and store a signature certificate. Now select the requested certificate. Highlight the certificate and then click "OK" Encrypted communication Version 1.6 page 17 of 42

18 You can choose the Security Settings Name yourself. Match the settings and then click "OK" The default settings are now saved. Click "OK". Outlook 2007 is now set up to use your certificate. Encrypted communication Version 1.6 page 18 of 42

19 2.5. Encryption with Outlook This section explains how to correctly create your ALDI communication partner as a contact for encrypted communication. Creating a new contact is also required if for example ALDI Nord customizes the name of an address or if you are asked to do it by an ALDI Nord employee. Furthermore, the buttons required for encryption in Outlook 2007 are explained. Deleting the existing contact: To avoid problems, any contacts of the ALDI Nord communication partner which may already exist must be deleted. Select the category "Contacts" in Outlook. Right-click on the contact and then select "Delete" from the context menu Creating a new contact: To set up encrypted communication correctly, the contact of the ALDI Nord address must be set up as follows. Before you can create the contact using the certificate, there has to be a received signed from your ALDI communication partner. Please upload your public key to the ALDI Nord encryption infrastructure using this address: The ALDI Nord communication partner was therefore able to encrypt the with your public key and attach his/her public key as a signature in the sent to you. Encrypted communication Version 1.6 page 19 of 42

20 Firstly, open the most recent from your ALDI Nord communication partner with a double-click. Right click on the address in the field "From:" and then select "Add to Outlook Contacts" in the context menu A window opens for the new contact. Here you can fill in further information such as phone numbers. Select "Certificates" Encrypted communication Version 1.6 page 20 of 42

21 Check whether a relevant entry has been stored. You can then leave the Contact window by clicking "Save & Close" If you compose s to this contact in the future, always select the recipient from the address book. By previously adjusting the settings and installing the certificate, two buttons have been added to the window for a new message. Encrypted communication Version 1.6 page 21 of 42

22 These buttons show you whether the to be sent is to be signed and/or encrypted. Before you can send encrypted s, you must have received a signed from your ALDI Nord communication partner. It is necessary to publish your public key on the trust center s keyserver (cf. section 2.1) or on the site (cf. section 5.3) to let your communication partner send you an encrypted . In the appendix of an sent by your ALDI Nord contact you will receive the signature and the public key of your communication partner. You can recognize an encrypted and signed as follows: This symbol shows that the is encrypted. This symbol shows that the is digitally signed. 3. Exporting and importing certificates Certificates can be exported and imported so that they can be used on another computer. 3.1 Exporting a certificate If you would like to use the certificate requested and installed in section 2 on another computer for the address mentioned above, you have to export the installed certificate from the browser and import it into the browser of the computer to be used in future. This section explains how to do this. First, open the browser on the computer you have used so far (the browser used in section 2.1 to create the key/certificate). Encrypted communication Version 1.6 page 22 of 42

23 At "Tools", click on "Internet Options" At the tab "Content", click on "Certificates" Encrypted communication Version 1.6 page 23 of 42

24 The certificate to be exported (here Rudi Tester) appears under the tab "Personal". Highlight the certificate to be exported and then click on the button "Export..." Click "Next >" Encrypted communication Version 1.6 page 24 of 42

25 Select "Yes, export the private key" and click "Next >" Select "Include all certificates in the certification path if possible" and "Export all extended properties" and click "Next >" Encrypted communication Version 1.6 page 25 of 42

26 Choose a password, confirm it, and click "Next >" Choose a file name and store location the key will be exported to and click "Next >" Encrypted communication Version 1.6 page 26 of 42

27 Check the selected settings and click "Finish" Click "OK" Click "OK" Encrypted communication Version 1.6 page 27 of 42

28 3.2 Importing a certificate You must import the certificate previously exported on the new computer. Firstly, open Internet Explorer (or another browser). Double click on the key (certificate) to be imported. Click "Next >" Encrypted communication Version 1.6 page 28 of 42

29 At "File name", you usually do not have to make any changes. Click "Next >" Type in the password previously chosen for the private key and then click "Next >" Encrypted communication Version 1.6 page 29 of 42

30 The certificate store can be selected automatically. Click "Next >" Check your settings and then click "Finish" A security warning may then appear. Click "OK" to confirm the message. Finally, click "OK" Encrypted communication Version 1.6 page 30 of 42

31 4. Installing the ALDI Nord root certificate With the so-called "Root certificate (CER)" you can check the trust status of the ALDI Nord group user certificates. This means that the system you use can check if the user certificate is really from the ALDI Nord group and if it is still valid. You have three options for receiving the root certificate: 1. You have already received an from an ALDI employee and thus have access to the web messenger: you can download the root certificate there by clicking "Settings". 2. You can download the root certificate from the website " 3. You already have a certificate from one of the trustcenters supported by ALDI Nord and have published your public key on the keyserver. The from an ALDI Nord employee including the root certificate is sent to you directly. Installing the root certificate from the website is not different from installing it from the web messenger. For points 1 and 2, follow the steps below: Open the website in your Internet Explorer. Please note that the website is german: click on the link "Stammzertifikat" under the heading "Stammzertifikat der Unternehmungsgruppe ALDI Nord", as shown below. You will then be asked whether you would like to open or save the file. Click "Open". Encrypted communication Version 1.6 page 31 of 42

32 A security warning may appear. Click "Allow" to continue. The following messages will then appear: Click "Install Certificate " Encrypted communication Version 1.6 page 32 of 42

33 Click "Next >" Click "Next >" Encrypted communication Version 1.6 page 33 of 42

34 Click "Finish" Finally, the following message appears: For option 3, follow the steps below: You already have a certificate from one of the TrustCenters supported by ALDI Nord and have published your public key on the keyserver. Your ALDI Nord communication partner has then sent you an . Open this with a double-click. Encrypted communication Version 1.6 page 34 of 42

35 Click on this symbol The certificate appears, check the data and click "Trust" You can also display the certificate. Encrypted communication Version 1.6 page 35 of 42

36 Before installation a security warning will appear. The thumbprint of the ALDI Nord root certificate is shown here Finally, click "Yes" After installing the root certificate, you can now communicate encrypted with ALDI Nord. Encrypted communication Version 1.6 page 36 of 42

37 5. Alternative procedures for receiving and providing certificates In section 2 setting up for encrypted communication has been described. Here, the following assumptions were made: - A suitable certificate has been purchased and provided at the trust center. - There is an encrypted from an employee of ALDI Nord, which contains the necessary certificates for encryption in the appendix. This section describes two alternative ways to exchange keys using the ALDI certportal Downloading a certificate of a communication partner If the public certificate of an ALDI employee is needed for encrypting , it can be downloaded from the ALDI certportal. Follow this link: Change the language to English. Insert the address of the required contact person as well as the security code at the bottom. Please confirm with Search. Encrypted communication Version 1.6 page 37 of 42

38 Now you can see all existing certificates of this person. Click on the entry to get more information. By using this button, you can download the certificate of your contact person. Sometimes there is more than one certificate shown for an address. Because of that, please check the area Key Usage. Data Encipherment has to be listed for a key to use it for encryption. Encrypted communication Version 1.6 page 38 of 42

39 5.2. Matching a downloaded certificate to an Outlook contact The following describes the way you set up encryption using the certificate you downloaded from This step differs from the steps described in section 2.5 because here no signed from an ALDI Nord employee is needed. The following screenshots are in german language, please use the respective buttons and options as shown and explained in your client software. If you have already created a contact for your communication partner, lease open it and continue with the next step. If you have not, please create one by choosing new or new element and then contact. Please insert your contact information now. The address has to match to the one of the downloaded public certificate. Afterwards please go to certificates. Encrypted communication Version 1.6 page 39 of 42

40 Please enter Import... Please choose the downloaded certificate and hit Open. Encrypted communication Version 1.6 page 40 of 42

41 Please continue now as described in section Uploading own certificates If you already use certificates for encrypting via S/MIME, but these are not uploaded to the keyserver of the trust center, there is the possibility to upload them to the ALDI certportal. Follow this link: Change the language to English. Choose Publish. Encrypted communication Version 1.6 page 41 of 42

42 Move to user certificate and insert your informations. After that, please confirm with transmit. To finish this process, please contact your ALDI communication partner so that he can release your certificate internally for use. Encrypted communication Version 1.6 page 42 of 42