I manage a website running on Apache. It has public and private areas. When people apply for an account to access the protected portions of the site, they do a TLS/SSL protected POST containing their information which is saved to a (hopefully) nonpublic directory on the server.

Then I have a python script which takes URL Encoded POSTS with this user information, sends back a plaintext confirmation to the applicant, encrypts their information with a freeware java command-line utility to protect it (specifically this one: http://spi.dod.mil/ewizard.htm), base64 encodes them, puts them in a file as a mime attachment and uses sendmail to forward the file information to my (and several coworkers' scattered around the country) email account(s) on an Exchange server with Outlook clients.

This has worked well for years, but is awkward because it involves manually decrypting the information on a windows box once it is received, using the above mentioned encryption utility. This significantly limits how many can be processed.

I would like to be able to encrypt my information in a format that Outlook/Exchange can inherently understand and display so that these emails can be viewed simply by clicking on them. I do have company provided PKI public certs for all the people I need to send to, and am able to send/receive encrypted emails on Outlook manually, but would like to know how I can send to Outlook from apache/linux/python from the command line using the same PKI certs. Dont need to receive them, just send.

Is there a utility that can do this? I had thought pgp might but I havent been able to figure it out.

1 Answer 1


In Postfix there is an option to require the mail server to only connect to other mail servers using encrypted sessions. If you used this option, then, assuming that Exchange can connect via TLS/SSL to other MTAs and the user connection to the Exchange server is encrypted (I've never used Exchange), the whole chain would be encrypted.

I believe it is smtp_tls_security_level and smtpd_tls_security_level both set to encrypt. However, other parameters may be affected by this and I've never tried it.

You might want to verify that the directory the information is saved to is actually a nonpublic directory on that server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.