(1.x) Encryption Settings - S/Notify for Bitbucket
Under this configuration entry, you will find the following configuration options:
Encryption Settings
Encryption Type Priority
In this section of the S/Notify configuration settings, you can select which encryption method to use or prefer.
S/Notify encrypts emails for the recipient, and also for the sender if the sender's public key is available from the server keystore.
S/MIME only
Use only S/MIME encryption, even if a PGP key would be available. This also hides the PGP section in the user profile.
S/MIME preferred
Use S/MIME encryption, if an S/MIME certificate is available. Otherwise use PGP encryption, if possible.
PGP preferred
Use PGP encryption, if a PGP key is available. Otherwise use S/MIME encryption, if possible.
PGP only
Use only PGP encryption, even if an S/MIME certificate would be available. This also hides the S/MIME section in the user profile.
Encryption Fallback
In this section of the S/Notify configuration settings, you can configure how S/Notify should process emails which cannot be sent encrypted for any reason whatsoever.
Note that, independent from what you select here, the reason for the encryption failure is always documented in the Bitbucket log file.
Allow unencrypted notifications
S/Notify will try to encrypt emails, but if encryption fails for any reason, the message will be sent unencrypted.
Note that this option allows unencrypted emails to be sent out without further notice!
We recommend to use this option only until you have fully setup S/Notify and provided all necessary certificates and/or keys required to encrypt notifications for all Bitbucket users.
Do not allow unencrypted notification - send problem report instead
S/Notify will try to encrypt all emails. If the encryption fails for any reason, an unencrypted problem report will be sent to the user instead. In the message, the user will be asked to get in contact with a Bitbucket admin.
Use this option, if you have setup S/Notify with all required certificates, but want to make sure that any encryption problems will be reported via an email, so the user will be warned that he or she has missed a notification.
We recommend to use this option for production.
Do not allow unencrypted notifications - skip entirely
S/Notify will try to encrypt all emails. If the encryption fails for any reason, the email will not be sent out. Note that the user will not know that he or she has missed a notification.
Use this option, if you have setup S/Notify with all required certificates, and you do not even want any encryption problem warnings to be sent unencrypted. Be aware that, in this case, it is strongly advised to monitor the Bitbucket log file for encryption failures, to make sure they do not go undetected.
Signatures
This section allows you to configure how to handle email signatures.
Sign emails
When selected, S/Notify will attempt to sign all outgoing emails using an appropriate PGP key or S/MIME certificate retrieved from the key store(s) provided in Server Key Management. The PGP key or S/MIME certificate must be issued for signing purposes as well as for the sender email address. This is the email address configured under Mail Servers.
S/Notify will sign emails according to the encryption method selected under Encryption Type Priority. If you have configured S/Notify to support both encryption methods, then the email will be signed according to the actual method used for encryption. When an email is sent unencrypted for any reason, the method for signing is selected based on the preference setting for encryption. The PGP key or S/MIME certificate is selected based on each email's sender email address.
For S/MIME, intermediate certificates will be included in the signature if they are available from the server keystore.
Advanced Settings
On the top right, there is a button that takes you to Advanced Settings. Our customer service might ask you to enter specific values here for special customizing or trouble shooting purposes.
Some of these options are explained under (3.x) Advanced Settings.