Secure E-Mail

Hamburg Commercial Bank offers its communications partners the following options for encrypted e-mail communication.

1. Encryption set-up for all e-mail addresses in your domain
   In order to employ encrypted communication with us in future, we offer you the possibility of using encryption with your mail domain, or transmission encryption with standard encryption methods. This ensures that all e-mails exchanged between your e-mail gateway and Hamburg Commercial Bank are encrypted.
   
   In order to establish a shared set-up we require a technical contact person from your IT department and/or your IT provider.
2. Individual encryption for your e-mail address only:
   We offer two alternatives for encrypted communication using a single e-mail address, which you can as a rule use straight after registering:
   1. Registering online in a protected WebMail portal
      You can use Hamburg Commercial Bank’s WebMail portal. This involves registering via your Internet browser on your PC or mobile device with your username and password, and having your own e-mail account for encrypted communication with Hamburg Commercial Bank.
   2. Encryption using own certificate or key
      In order to be able to use your own e-mail programme you require an S/MIME certificate or PGP key issued in your name and for your e-mail address.
      
      Should you have neither an S/MIME certificate or a PGP key, we recommend requesting the issuance of an S/MIME certificate (minimum of class 2) through a certification body .
      
      Such a certificate is only ever issued for a specific person and e-mail address, and enables this person to conduct encrypted e-mail communication with any other communications partner, not just Hamburg Commercial Bank.

1. Encryption set-up for the e-mail addresses of your mail domain
   If you decide on encrypting all addresses within your mail domain, the set-up is done in coordination with your IT contact person / provider and the IT provider for Hamburg Commercial Bank.
   
   When setting up, your IT contact person can get in touch with our IT Service Center directly via the email adress hcob-secure-email@hcob-bank.com, or you can notify your contact person at Hamburg Commercial Bank regarding the contact data of your contact person in IT.
2. Encryption set-up for your e-mail address only:
   The necessary registration process is triggered by an encrypted e-mail, which is sent to you by an employee of Hamburg Commercial Bank.
   
   This e-mail is initially withheld by our e-mail encryption system, and instead a registration e-mail is sent. The original e-mail is then sent after successful registration.
   
   It can occur when the registration e-mail is received that your e-mail programme issues a warning, because the Hamburg Commercial Bank certificate contained in the e-mail is unknown to your system. Further details can be found in the following FAQ (last question).
   
   The registration e-mail received contains information regarding the registration process, and you can choose between the alternatives listed above:
   1. Registering online in a protected WebMail portal
      By choosing the WebMail portal solution, please note that the encrypted e-mails are not made available via your own personal inbox, but rather via the secure access WebPortal of Hamburg Commercial Bank.
   2. Encryption using own certificate or key
      If you are already using an S/MIME certificate, simply respond to the registration e-mail.
      
      If you already have a PGP key, please respond by e-mail to the registration e-mail with your public PGP key in the appendix.
      
      Should you require assistance regarding the potential provision of a registration password, please get in touch with our IT Infrastructure Team: hcob-secure-email@hcob-bank.com.

Either an S/MIME or a PGP key is required.

Then you may use the Secure E-Mail WebPortal provided by Hamburg Commercial Bank. To do so, you require access to the Internet via an Internet browser.

When using the WebMail portal the e-mail remains on Hamburg Commercial Bank’s server, and you authenticate yourself via your Internet browser with your username and password.

If a new e-mail lands in your inbox in the WebMail portal you will receive a notification e-mail from our e-mail encryption system, which contains a link allowing you to access the WebMail portal. File attachments can be stored from the WebMail portal on the local computer drive.

With e-mail encryption that uses a certificate, key or designated domain encryption you will always receive an e-mail and any attachments directly via the e-mail programme you are using. The encryption and decryption of messages takes place automatically between our e-mail system and your e-mail system.

The WebMail portal affords you the opportunity to upload your certificate or your key.
From this moment in time, e-mails can no longer be accessed via the WebMail portal, but rather as encrypted e-mails in your e-mail programme.

As a rule yes. A wide range of privacy settings for certificates have already been installed in our e-mail encryption system, so that many certificates being received are trusted directly. A manual check is conducted by Administration where this is not yet the case. This can be linked with a telephone-based matching of the digital fingerprint stored in the certificate or key. But don't worry, the procedure is for security reasons, key owners are familiar with it and it helps create trust.

Please check the following points:

1. Does your e-mail programme recognise and trust the Hamburg Commercial Bank root certificate? If this is not the case you can download and integrate the root certificate. When doing so you must verify the certificate’s trust setting.
2. Does your e-mail programme require a Certificate Revocation List (CRL), in which up-to-date information is available regarding revoked Hamburg Commercial Bank certificates?
   In this case you can find the CRL at:
   http://secure-email.hcob-bank.com/SecMail/ServiceHandler?service=createCRL