CipherMail

CipherMail
Name	CipherMail
Developer	Scandio GmbH
Released	2005
Programming language	Java
Operating system	Cross-platform
Genre	Email encryption gateway, S/MIME, X.509, OpenPGP
License	Open source and commercial editions

CipherMail

CipherMail is an email encryption gateway and filtering solution designed to provide end-to-end message protection, key management, and secure transport for enterprise email systems. It integrates with mail servers, directory services, and webmail portals to offer automated S/MIME and OpenPGP processing, policy-driven encryption, and archival controls. The product targets organizations requiring compliance with data protection frameworks and secure messaging interoperability between heterogeneous environments.

Overview

CipherMail functions as a gateway that processes messages between mail transfer agents and user mailboxes, applying cryptographic operations, signature validation, and policy enforcement. It interoperates with technologies such as S/MIME, OpenPGP, X.509, PKI, and certificate authorities like Let's Encrypt and enterprise CAs used by institutions such as DigiCert and Entrust. The software supports integration with directory services including Microsoft Active Directory, OpenLDAP, and cloud identity providers like Okta and Azure Active Directory to obtain user attributes and certificate mappings. CipherMail is typically deployed alongside mail platforms such as Microsoft Exchange Server, Postfix, Sendmail, Exim, Zimbra Collaboration Suite, and cloud offerings like Microsoft 365 and Google Workspace via SMTP relay or API connectors.

History

Development of CipherMail began in the mid-2000s as demand grew for automated S/MIME gateways in enterprises and government agencies. Early adoption occurred in sectors with stringent confidentiality needs exemplified by organizations similar to NATO, national health services such as NHS England, and financial institutions influenced by regulatory regimes like Sarbanes–Oxley Act and Gramm–Leach–Bliley Act. Over time, CipherMail evolved to address emerging standards from bodies such as the Internet Engineering Task Force and the European Union Agency for Cybersecurity, while adding features for cloud integration and scalability. The software’s roadmap reflected trends set by projects and vendors including OpenSSL, GnuPG, and enterprise email security firms like Proofpoint and Mimecast.

Features and Architecture

CipherMail implements message processing pipelines that perform encryption, decryption, signing, signature verification, and certificate lookup. Core components include connectors for SMTP relays, web-based administration portals, policy engines, and key/certificate stores compatible with PKCS#12 and Java KeyStore. The architecture supports high-availability configurations using clustering and load balancers from vendors such as F5 Networks and HAProxy. Features include automated certificate discovery via LDAP queries, support for multiple cryptographic profiles (RSA, ECC), and interoperability with token and smartcard solutions like YubiKey and SafeNet for private key protection. Message transformation hooks enable integration with content filters such as SpamAssassin, data loss prevention systems like those from Symantec, and archiving solutions exemplified by OpenText and Veritas NetBackup.

Deployment and Integration

CipherMail can be deployed as a virtual appliance, Docker container, or on physical servers running distributions such as Ubuntu, Debian, CentOS, and Red Hat Enterprise Linux. Integration patterns include SMTP relay placement between an edge gateway such as Postfix and internal servers like Microsoft Exchange, or as a cloud connector to relay traffic to services like Microsoft 365 and Google Workspace. Administrative integration leverages LDAP or Active Directory group policies to drive encryption rules, while automation and orchestration can involve tools like Ansible, Puppet, and Kubernetes for containerized environments. Logging and monitoring are designed to work with observability stacks such as ELK Stack and Prometheus.

Security and Compliance

CipherMail’s security model builds on standards from organizations such as the IETF and uses certificate-based trust anchored to X.509 infrastructures. The product supports FIPS-compliant cryptographic modules and can be configured to meet controls referenced by frameworks like ISO/IEC 27001, GDPR requirements from the European Commission, and sector-specific mandates such as HIPAA for healthcare. Key lifecycle operations—issuance, revocation, and renewal—are designed to interoperate with certificate authorities and registration authorities used in enterprise PKI deployments, and audit trails integrate with systems like Splunk for forensic review. Additional safeguards include hardware security module support from vendors such as Thales and integration with token-based multifactor systems used by Duo Security.

Reception and Use Cases

CipherMail has been adopted across public sector, healthcare, finance, and legal organizations that need automated email encryption without requiring end-user cryptographic expertise. Use cases include secure interchange between government agencies analogous to EU INTCEN workflows, clinician-to-clinician communications in environments similar to National Health Service (NHS), and secure client correspondence in law firms modeled on internationally active practices like Baker McKenzie. Analysts comparing gateway-based approaches often cite trade-offs with client-side solutions offered by vendors like Microsoft and open-source tools such as GnuPG, noting that gateway deployments simplify key management and compliance auditing in large-scale environments.

Licensing and Editions

CipherMail is available in open-source and commercial editions; the open-source variant enables inspection and community contributions similar to projects on platforms like GitHub, while commercial editions provide vendor support, advanced features, and enterprise integrations comparable to offerings from vendors such as Cisco and Microsoft. Licensing models include subscription-based support, perpetual licenses for on-premises deployments, and hosted managed-services agreements akin to managed security service providers such as BT Managed Services and Accenture. Editions vary by throughput, high-availability capabilities, and included connectors for enterprise systems.

Category:Email security software