Google CSE support for Google's end-to-end encrypted email

Google Workspace can use the Key ACL Service (KACLS) to encrypt and decrypt Gmail messages. Google's end-to-end encrypted email ("Send to anyone") allows enterprise Gmail users to send end-to-end encrypted messages to any email address, without needing to configure S/MIME certificates for users.

Before enabling this client-side encryption, complete the prerequisites.

Prerequisites

The prerequisites include the following.

1. Create an environment and enroll it with Google.

2. Enable Google Workspace CSE for intended Gmail users (senders and recipients).

   1. Open the Google Admin console, http://admin.google.com.

   2. Log on to the user domain as a super admin.

   3. Navigate to CSE settings: Data > Compliance > Client-Side Encryption.

      

   4. Scroll down to the Apps section and click the Gmail link.

   5. Select an organizational unit or group for which you want to enable Gmail CSE.

   6. Under User access, select ON.

   7. Save the settings.

3. The Assured Controls or Assured Controls Plus add-on is required. End-to-end encrypted email is only available when hardware key encryption is not used.

Enable Send to anyone

To enable "Send to anyone" from the Google Admin console:

1. Open the Google Admin console.

2. Log on to the user domain as a super admin.

3. Navigate to Data > Compliance > Client-Side Encryption > Gmail.

4. Under Encryption with guest accounts, click the Edit icon.

5. Enable Allow users to send client-side encrypted messages to recipients who aren't using S/MIME.

6. Click Save.

   Note

   External recipients are granted guest accounts. These accounts:

   • Reside within a dedicated organizational unit (OU) or group.

   • Are fully owned by the customer's organization.

   • Must adhere to the customer's organization's policies.

   Admin controls allow Gmail users to access their accounts.

To enable "Send to anyone" for external Gmail domains and guests on CCKM:

1. When creating a new KACLS endpoint or updating an existing one, ensure to set the value of allow_guest_access to true. Refer to Creating KACLS Endpoints and Updating a KACLS Endpoint for details.

2. Set the value of the authenticationAud parameter to the Client ID of the Guest Identity Provider that has been configured in your Google Admin Console. Refer to Additional Configurations for Guest Access on Google Admin Console for details.