cPanel's Encryption tool manages GnuPG keys, which let you exchange email that only the intended recipient can read. This is end-to-end encryption of the message content itself - different from, and stronger than, the SSL/TLS that already protects the connection between your device and our servers. This guide explains when it is worth using, how to create and share a key, and the one mistake that makes encrypted mail unrecoverable.
- You generate a key pair: a public key and a private key.
- You give the public key to anyone. They use it to encrypt messages to you.
- Only your private key can decrypt those messages, and it never leaves your control.
- To send them an encrypted message, you need their public key.
Is this the right tool for you?
| Use GnuPG when | You probably do not need it when |
|---|---|
| You exchange genuinely sensitive material - legal, medical, financial - with a specific correspondent | You simply want your mail connection secured - that is already handled by SSL/TLS on ports 993 and 465 |
| Both parties are willing to manage keys | Your recipients are ordinary customers who have never heard of GnuPG |
| A regulation or client contract requires message-level encryption | You want to stop your mail landing in spam - that is SPF, DKIM and DMARC, a different problem entirely |
Creating a key pair
- Log in to cPanel from My Products & Services.
- Under Email, open Encryption.
- Under Create a New Key, fill in:
- Your Name and Your Email - these identify the key to correspondents, so use the address the key is actually for.
- Comment or Nickname - optional label, useful if you hold several keys.
- Key Password - this protects the private key. Use the strength meter and aim high.
- Expiration Date - a number plus days, weeks, months or years, or Do not expire.
- Key Size - 2048, 3072 or 4096 bits.
- Click Generate Key.
Choosing the settings sensibly
- Key size: 3072 is a good balance; 4096 is stronger and slightly slower. 2048 remains acceptable but is the weakest of the three.
- Expiration: set one - one or two years is reasonable. An expiring key limits the damage if it is ever compromised, and you can extend it before it lapses. "Do not expire" means a leaked key is a permanent problem.
Sharing your public key
Your correspondents need your public key to encrypt anything to you.
- In Encryption, find your key in the list.
- Click View beside the public key.
- Copy the whole block, including the
-----BEGIN PGP PUBLIC KEY BLOCK-----and-----END PGP PUBLIC KEY BLOCK-----lines. - Send it to them, publish it on your website, or upload it to a public keyserver.
The public key is meant to be public. There is no risk in distributing it widely - that is what it is for.
Importing someone else's public key
- Ask them for their public key block.
- In Encryption, go to Import Key.
- Paste the entire block into Import Public GPG Key.
- Click Import.
You can now encrypt messages that only they can read.
Using the keys
cPanel manages the keys; the encrypting and decrypting happens where you read your mail. In Webmail, the message composer offers an encryption option once a matching key is present. In a desktop client, use the client's own OpenPGP support - Thunderbird has it built in, and Outlook and Apple Mail need an add-on. You would export your private key from cPanel and import it there.
What GnuPG does and does not protect
| Protected | Not protected |
|---|---|
| The message body | The subject line - it travels in clear text. Never put anything sensitive in a subject. |
| Attachments, when encrypted with the message | Who emailed whom, and when - the metadata is visible |
| Content at rest on the mail server | Anything the recipient does after decrypting it |
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Key generation seems to hang | Generating a 4096-bit key takes time. Let it finish rather than resubmitting, which can create duplicate keys. |
| Import rejects the key | The block is incomplete. It must include both BEGIN and END lines and every character between, with no added line breaks. |
| Recipient cannot decrypt your message | You encrypted with the wrong public key, or an outdated one. Ask for their current key and re-import it. |
| You cannot decrypt an incoming message | It was encrypted with a key you no longer hold, or the wrong one. If the private key is gone, the message cannot be recovered by anyone. |
| Encrypted mail looks like meaningless text to the recipient | Their mail client has no OpenPGP support. They need a client or add-on that understands it - encryption requires both sides to be equipped. |
| Key has expired | Generate a new pair and distribute the new public key. Keep the old private key so you can still read old messages. |
| You forgot the key password | Nothing can be done - not by you, not by us. Generate a new key pair and accept that mail encrypted to the old one is unreadable. |
Frequently asked questions
Is my email already encrypted without this?
The connection is. Using ports 993 and 465 with SSL/TLS encrypts the link between your device and our servers, and delivery between well-configured mail servers is normally encrypted too. GnuPG additionally encrypts the message itself, so that not even a server operator can read it.
Can Fast Hive read my email?
Mail is stored on the server, so in principle a server administrator has access to the files - as is true of any hosting provider. GnuPG removes that possibility for encrypted messages, because the content is unreadable without your private key.
Can I use this with Gmail or Outlook.com recipients?
Yes, provided they have OpenPGP set up on their side. The service does not matter; their software does.
Should I set an expiry date?
Yes. One or two years is sensible, and you can extend it before it lapses. It bounds the risk if the key is ever exposed.
Can I use the same key for several addresses?
A key is tied to the address you entered. For several addresses, generate separate keys, which also keeps them easier to revoke individually.
What if I need to revoke a key?
Generate a revocation certificate when you create the key and store it safely. Without one, you cannot tell the world a compromised key should no longer be trusted.
