Set up client-side encryption for Gmail (beta)

Requirement: Your organization uses Google Workspace Enterprise Plus, Education Plus, or Education Standard

Step 1: Set up your environment

1. In Google Cloud Console, create a new GCP project with the Gmail API enabled
   1. Create a new GCP project and make note of the Project ID. Google will grant the project access to non-public, pre-release Gmail API endpoints.
   2. Go the Google API Console and enable the Gmail API for the new project.
   3. Go to the Service accounts page and create a service account.
   4. Save the private key file for the service account to your local system.
2. Grant your service account domain-wide access.
   Learn more about domain-wide delegation
   1. Sign in to your Google Workspace Admin console with a super administrator account.
   2. Go to Security > Access and data control > API controls > Domain-wide delegation.
   3. Add a new API client using the client ID of the service account created during setup

   4. Grant the account use of the OAuth scopes:  gmail.settings.basic, gmail.settings.sharing, gmail.readonly.

3. Create the test group of users for Gmail CSE
   1. Sign in to our Google Workspace Admin console and go to Directory > Groups.
   2. Click Create group.
   3. Add individual users (not groups) to the test group so they can use Gmail CSE beta.  
   4. Make a note of the test group's email address (such as, cse_test@example.com). 

Step 2: Prepare your certificates

1. Generate S/MIME certificates.

You need a S/MIME certificate for each user in the group who will test Gmail CSE. Both senders and recipients require certificates. Go to CA certificates trusted by Gmail for S/MIME.

To use your own test certificate authority, you must explicitly indicate that the root CA is trusted by uploading its certificate to Google Workspace Admin console.

2. Wrap the S/MIME private keys using your key service. Follow the steps in your service provider’s documentation.

Step 3: Configure your key service and IdP

1. Set up your external key service.
   Note: You set up only a primary key service (no secondary key service) for Gmail users.
2. Connect Google Workspace to your key service.
3. Connect Google Workspace to your identity provider (IdP)

When you're ready, submit your Gmail CSE Beta Test Application.

Be sure to include your email address, Project ID,  and test group domain. 

After we receive your application, we'll email you when your account is ready. Then you can set up Gmail CSE beta for your users. 

Requirement: The sender and all recipients must have CSE turned on and valid certificates. If any recipients are missing a valid certificate, the sender can't send the email. 

Send encrypted email

1. In Gmail, click Compose.
2. On the right corner of message, click Message security
3. In the section, Additional encryption, click Turn on. 

4. Add your recipients, subject, and message content as usual.
5. Click Send. If prompted, sign in to your identity provider. 

Receive encrypted email

When you receive a CSE encrypted message, you'll see "Encrypted message" below the sender's name.

Open the encrypted message in your inbox. If prompted, sign in to your identity provider.

The message is automatically decrypted in your Gmail browser window.

Try out Gmail CSE features 

Some tasks and features to try in your account: 

• Send and receive encrypted messages within your organization
• Send emails to external recipients 
• Share digital signatures with external recipients
• Include quoted emails in a thread 
• Receive emails from other mail clients (for example, Microsoft Outlook and Apple Mail)
• Attach a file
• Paste an image
• Forward messages
• Save encrypted drafts
• Undo send