G DATA 365 | Mail Protection

Assign a certificate to G DATA 365 | Mail Protection.

To secure communication between G DATA 365 | Mail Protection and Microsoft Exchange Online, we recommend using a certificate. For security, a certificate with a public key and a private key is required.

The file containing the public key is stored in your Microsoft Entra Admin Portal for G DATA 365 | Mail Protection; the private key is stored in your G DATA Web Portal.

Creating a self-signed certificate with PowerShell on Windows

On your local computer, open PowerShell with administrative privileges.
Keep PowerShell open throughout the procedure!

Use cd to switch to the C:\ directory and enter the following command:

$certname = "MailProtection"
$cert = New-SelfSignedCertificate -Subject "CN=$certname" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256

We have given the certificate the name MailProtection. You can change this name, as it can be freely assigned.

Do not merge the commands. "$cert…" must be written on a new line; otherwise, problems will occur.

Export the public key to a location from which you can upload the files later using the following command:

Export-Certificate -Cert $cert -FilePath "C:\x-company-Zertifikate\$certname.cer"

In our example, we save the public key in the C:\x-company-Zertifikate directory. You can choose the path freely.

Assign a password for the private key using the following command:

$mypwd = ConvertTo-SecureString -String "MSEMail123" -Force -AsPlainText

In our example, we used the password MSEMail123. You must specify your own password here!

Export the private key to a location from which you can upload the files later using the following command:

Export-PfxCertificate -Cert $cert -FilePath "C:\x-company-Zertifikate\$certname.pfx" -Password $mypwd

In our example, we save the private key in the C:\x-company-Zertifikate directory. You can choose the path freely.

Now use these commands to delete the two certificates from your computer’s personal certificate store. The certificate is not required here.

Retrieve the thumbprint of the certificate in the store:

Get-ChildItem -Path "Cert:\CurrentUser\My" | Where-Object {$_.Subject -Match "MailProtection"} | Select-Object Thumbprint, FriendlyName

If you named the certificate something other than MailProtection, use the name you used in this command.

This command must output only 2 results. If you see more lines, there are additional certificates in your personal store. In this case, it is better to delete the certificates via the Microsoft Management Console (mmc).

Delete the certificate using the thumbprint:

Remove-Item -Path Cert:\CurrentUser\My\{pasteTheCertificateThumbprintHere} -DeleteKey

Replace "{pasteTheCertificateThumbprintHere}" with the thumbprint displayed by the previous command.

Upload the certificate for G DATA 365 | Mail Protection in the Microsoft Entra Admin Portal

1.	Ensure that G DATA 365 \| Mail Protection has already been registered as an enterprise application.
2.	Under Applications > App registrations > G DATA Mail Protection, click Add a certificate or secret. Screenshot
3.	Click Certificates and then click Upload certificate. Screenshot
4.	Upload the certificate you created from the location where you saved it when you created it. Screenshot
5.	Enter a short description and click `Add`