Microsoft doesn't allow sending public-key encrypted messages using Outlook 2003-2012 on Windows 7-8x environments without first creating your own Digital ID or private key for signing.

Per Microsoft, before encrypting an email to someone else, "it is required that both parties have valid digital certificates for email signing and encryption at the first place." Why? If I have someone's public key, why do I need to have my own - valid or invalid - certificate? I am not signing the message, just encrypting it so that only the recipient can read it.

  • 1
    strange enough - it's the same with OpenPGP + Enigmail + Thunderbird...
    – SEJPM
    Apr 30, 2015 at 19:32

2 Answers 2


My tought on this is that technically, theres no reason to require the sending party to have a key/certificate to send a encrypted message, but for security reasons, this is enforced because if the recipient then reply to this message, security cannot be ensured unless a public key or certificate is embedded in the message.

This might be builtin the S/MIME protocol or PGP/MIME protocol too. However, for PGP/INLINE it should be possible to encrypt using only recipient's public key. There might be some security setting somewhere in Enigmail that prevents embedding your key into message, thus allowing it to be encrypted without sender key.

About the S/MIME on Outlook, theres no such setting, and what I understand its part of the protocol, because even Apple phones does require a sender+recipient key to encrypt a message.


I think that sender's digital certificate is required since Outlook stores an encrypted copy of message on your side. Then you can open it with your own private key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .