GnuPG in cPanel: manage keys to encrypt email

cPanel's Encryption option lets you generate, import, export and delete GnuPG keys. You share the public key with anyone who needs to encrypt messages for you; the private key is kept secret and used to decrypt them or to sign.

The cPanel interface manages the keys, but it does not automatically encrypt every message sent from webmail, IMAP or SMTP. You need a compatible client or add-on, and you must verify the identity and fingerprint of the public key through an independent channel.

Protect the private key with a passphrase, keep a secure recovery copy and prepare a revocation certificate. If you lose the private key or its passphrase, the provider cannot decrypt your messages for you.

Prepare an encryption test

1. Decide which compatible application you will use and where you will keep the private key. If you need the server to be unable to decrypt the content, do not store that key there.
2. In cPanel > Email > Encryption, you can create or import keys when the feature is available. Check the identity and expiry before confirming.
3. Install the necessary keys in your email client and verify the recipient's public fingerprint through another channel.
4. Send a test message with no sensitive information and confirm that the recipient can decrypt it. Also test how to recover access from your secure copy.

Encrypting and signing are different actions: a signature helps verify origin and integrity, but it does not hide the content. TLS protects transport between connections; it is not the same as encrypting the message with the recipient's key either.

Do not delete an old private key just because it has expired: you may still need it to decrypt older messages. Keep its copy and review the revocation process before replacing it. cPanel tool.