G DATA Mail Protection

Assign a certificate to G DATA Mail Protection.

We recommend using a certificate to secure communication between G DATA Mail Protection and Microsoft Exchange Online. This requires a certificate with a public key and a private key.

The public certificate file is uploaded to your Microsoft Entra admin center for G DATA Mail Protection; the private-key material is stored in your G DATA Web Portal.

Create a self-signed certificate using PowerShell on Windows

Open PowerShell on your local computer with administrator privileges.
Keep PowerShell open throughout the procedure!

Use cd to change to the C:\ directory and enter the following command:

$certname = "MailProtection"
$cert = New-SelfSignedCertificate -Subject "CN=$certname" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256

We have named the certificate MailProtection. You can choose a different name.

Do not combine the command lines. "$cert…" must be entered on a new line; otherwise, problems will occur.

Use the following command to export the public certificate to a location from which you can upload the files later:

Export-Certificate -Cert $cert -FilePath "C:\x-company-Zertifikate\$certname.cer"

In this example, we save the public certificate in the C:\x-company-Zertifikate directory. You can choose any path.

Use the following command to set a password for the private key:

$mypwd = ConvertTo-SecureString -String "MSEMail123" -Force -AsPlainText

In this example, we use the password MSEMail123. Be sure to enter your own password here!

Use the following command to export the private-key material to a location from which you can upload the files later:

Export-PfxCertificate -Cert $cert -FilePath "C:\x-company-Zertifikate\$certname.pfx" -Password $mypwd

In this example, we save the private-key material in the C:\x-company-Zertifikate directory. You can choose any path.

Now use these commands to delete both certificates from your computer’s personal certificate store. The certificate is not needed there.

Retrieve the certificate’s thumbprint from the store:

Get-ChildItem -Path "Cert:\CurrentUser\My" | Where-Object {$_.Subject -Match "MailProtection"} | Select-Object Thumbprint, FriendlyName

If you named the certificate something other than MailProtection, use your chosen name in this command.

This command must return only 2 results. If you see more rows, there are additional certificates in your personal store. In this case, it is preferable to delete the certificates using the Microsoft Management Console (mmc).

Delete the certificate using its thumbprint:

Remove-Item -Path Cert:\CurrentUser\My\{pasteTheCertificateThumbprintHere} -DeleteKey

Replace "{pasteTheCertificateThumbprintHere}" with the thumbprint displayed by the previous command.

Upload the certificate for G DATA Mail Protection to the Microsoft Entra admin center

1.	Make sure that G DATA Mail Protection has already been registered as an enterprise application.
2.	Under Applications→App registrations→G DATA Mail Protection, click Add a certificate or secret. Screenshot
3.	Click Certificates, then Upload certificate. Screenshot
4.	Upload the certificate you created from the location where you saved it during creation. Screenshot
5.	Enter a short description and click `Add`