PKI-based signature and encryption works this way (in email and any other application):
- When signing data, you need access to the private key
- When validating signed data, you need access to the public key
- When encrypting data, you need the public key
- When decrypting data, you need access to the private key.
Now, a (X509) certificate is a set of data that contains (mostly):
- Identity information
- Usage limitation information
- Public key data
- Digital signature of all of the above by a certification authority (for allowing 3rd parties to decide whether or not trust this information).
So:
- For encrypting data all you need is the public key that matches the private key that will be used for decryption. In the case of email, that means access to the certificate of the recipient (an not the private key itself).
- In order to decrypt data you always need access to the private half of the key used to encrypt it. In the case of email, it means that you need access to the private key linked to the public key contained in the recipient's certificate.
In the case of encryption, you do not and never need access to any part of keys belonging to the sending party. In fact, you do not actually need to have your own certificate or key pair to perform email encryption.
A personal certificate is only required when you intend to sign data or allow others to send you encrypted data.
