Let’s Create! Automated Certificate Management for End-users

The automatic creation of X.509 certificates has helped the Web to make end-to-end encrypted connections the default. Email, however, lacks such a protection as can be seen by most users not encrypting their messages. While multiple standards for encrypted emails exist, none has clearly been established as the standard way of securing messages. One reason for the lack of adoption is arguably the absence of automatic key creation and management. This paper fills this gap by evaluating the automatic provisioning of S/MIME certificates for end-users through an extension of the popular ACME protocol. We automate the key management and implement a full ACME client in a popular cross-platform Email client (Thunderbird). With our method, users can have an S/MIME certificate created from within their mail client and do not need to depend on the Web sites provided by the certificate vendors. We evaluate our method with a study on certificate vendors and measure the time and number of interactions required to obtain and install an S/MIME certificate. With our method, users reduce the time needed to acquire and install a certificate from 165 seconds to 3 seconds. Similarly, the number of interactions required is reduced from 15 to 3. We conclude that our method provides a faster and less error-prone way which may positively impact the uptake on encrypted email communication.