doc: refine smime guide structure and styling

2026-01-26 05:25:38 +07:00 · 2026-01-08 19:16:47 +07:00
parent caae45eefb
commit b1f061eb5e
3 changed files with 212 additions and 62 deletions
--- a/pages/guide/integrations/smime.mdx
+++ b/pages/guide/integrations/smime.mdx
@@ -1,28 +1,78 @@
+import { Steps, Callout, Tabs } from 'nextra/components'
+import { Mail, BadgeAlert, ShieldCheck } from 'lucide-react'
+
 # S/MIME Email Security

-Secure/Multipurpose Internet Mail Extensions (S/MIME) allows you to **sign** and **encrypt** internal emails.
+Secure/Multipurpose Internet Mail Extensions (S/MIME) allows you to **sign** (prove identity) and **encrypt** (protect content) email messages.

- **Signing**: Proves the email actually came from you (prevents spoofing).
- **Encryption**: Ensures only the intended recipient can read the message.
+<Callout type="warning" emoji={<BadgeAlert className="w-5 h-5" />}>
+  **Internal Use Only:**
+  TrustLab certificates are private. If you send signed emails to **External Recipients** (e.g., Gmail, Yahoo), they will see an "Untrusted/Invalid Signature" warning because they do not trust the TrustLab Root CA.
+  
+  **Use this for internal corporate communication only.**
+</Callout>

-## Prerequisites
- A TrustLab certificate with the **S/MIME** profile.
- Downloaded in **PFX (.p12)** format.
+## Setup Guide

-## Outlook (Windows) Setup
-1. Open Outlook. Go to **File > Options > Trust Center**.
-2. Click **Trust Center Settings > Email Security**.
-3. Under "Encrypted Email", click **Settings**.
-4. Click **Choose** for Signing Certificate and select your TrustLab ID.
-5. Click **OK**.
+## Configure Microsoft Outlook

-## Thunderbird Setup
-1. Go to **Settings > Privacy & Security**.
-2. Scroll to **Certificates** and click **Manage Certificates**.
-3. Under **"Your Certificates"**, click **Import**.
-4. Select your `.p12` file.
-5. Go back to Account Settings > Security.
-6. Select the certificate for **Digital Signing** and **Encryption**.
+<Tabs items={['Classic Outlook (Desktop)', 'New Outlook (Web Style)']}>
+  <Tabs.Tab>
+    **Supported Versions:** Outlook 365, 2019, 2016.
+    
+    <Steps>
+    ### 1. Open Trust Center
+    Go to **File > Options > Trust Center > Trust Center Settings**.
+    
+    ### 2. Email Security
+    Select **Email Security** from the left sidebar.
+    
+    ### 3. Import Certificate
+    Under *Encrypted Email*, click **Settings...**
+    *   **Signing Certificate**: Click 'Choose' and select your TrustLab cert.
+    *   **Encryption Certificate**: Same as above.
+    
+    ### 4. Save
+    Click **OK** to apply.
+    </Steps>
+  </Tabs.Tab>
+  <Tabs.Tab>
+    **Supported Versions:** New Outlook for Windows, OWA.
+    *Note: Requires S/MIME Control extension.*
+    
+    <Steps>
+    ### 1. Open Settings
+    Click the **Gear Icon** (Settings) in the top right.
+    
+    ### 2. S/MIME Menu
+    Navigate to **Mail > S/MIME**.
+    
+    ### 3. Enable
+    Enable **"Encrypt with S/MIME"** and select your certificate.
+    </Steps>
+  </Tabs.Tab>
+</Tabs>
+
+## Configure Thunderbird
+
+**Version Requirement:** v115+ (Supernova) or newer.
+
+<Steps>
+### 1. Account Settings
+Click the **Menu (≡)** button and select **Account Settings**.
+
+### 2. End-to-End Encryption
+Select your email account from the sidebar and click **End-to-End Encryption**.
+
+### 3. Import Certificate
+In the **S/MIME** section, click **Add** (or Manager) to import your `.p12` file.
+
+### 4. Apply Certificate
+Under *Select Certificate*, choose the imported file for both:
+*   **Digital Signing**
+*   **Encryption**
+</Steps>
+
+## How to Test
+Send an email to a colleague who also has the Root CA installed. They should see a verified **Ribbon/Badge** icon indicating the email is trusted and unmodified.

-> [!TIP]
-> To send encrypted email to a colleague, you must first possess their Public Key (usually by receiving a signed email from them first).
--- a/pages/guide/integrations/web-servers.mdx
+++ b/pages/guide/integrations/web-servers.mdx
@@ -1,52 +1,76 @@
+import { Tabs, Callout } from 'nextra/components'
+import { Server, Globe, Shield } from 'lucide-react'
+
 # Web Server Configuration

-Configuring SSL/TLS on internal web servers is the most common use case for TrustLab.
+To enable HTTPS on your internal services, you need to configure your web server to use the certificates issued by TrustLab.

-## Nginx Configuration
+<Callout type="info" emoji={<Shield className="w-5 h-5" />}>
+  **Prerequisite:** Ensure you have downloaded the **PEM Bundle** (for Linux) or **PFX** (for Windows) as described in the [Download Guide](/guide/certificates/download-install).
+</Callout>

-Ensure you have downloaded the **PEM** format bundle (contains `.crt` and `.key`).
+## Configuration Examples

-```nginx
-server {
-    listen 80;
-    server_name internal.app;
-    return 301 https://$host$request_uri;
-}
+Select your web server environment below:

-server {
-    listen 443 ssl http2;
-    server_name internal.app;
+<Tabs items={['Nginx', 'Apache (httpd)', 'IIS (Windows)']}>
+  <Tabs.Tab>
+    ### Nginx Setup
+    Target File: `/etc/nginx/sites-available/default` or `internal.app.conf`
+    
+    ```nginx
+    server {
+        listen 80;
+        server_name internal.app;
+        return 301 https://$host$request_uri;
+    }

-    # SSL Configuration
-    ssl_certificate     /path/to/internal.app.crt;
-    ssl_certificate_key /path/to/internal.app.key;
+    server {
+        listen 443 ssl http2;
+        server_name internal.app;

-    # Recommended Security Settings
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-    ssl_prefer_server_ciphers on;
-}
-```
+        # SSL Configuration
+        ssl_certificate     /etc/ssl/trustlab/internal.app.crt;
+        ssl_certificate_key /etc/ssl/trustlab/internal.app.key;

-## Apache (httpd)
+        # Recommended Security
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_ciphers HIGH:!aNULL:!MD5;
+        ssl_prefer_server_ciphers on;
+    }
+    ```
+  </Tabs.Tab>
+  <Tabs.Tab>
+    ### Apache / HTTPD Setup
+    Target File: `/etc/httpd/conf.d/ssl.conf` or VHost file.

-```apache
-<VirtualHost *:443>
-    ServerName internal.app
-    SSLEngine on
-    SSLCertificateFile "/path/to/internal.app.crt"
-    SSLCertificateKeyFile "/path/to/internal.app.key"
-</VirtualHost>
-```
+    ```apache
+    <VirtualHost *:443>
+        ServerName internal.app
+        DocumentRoot /var/www/html/internal

-## IIS (Windows Server)
-
-For IIS, you must use the **PFX** format.
-
-1. Open **IIS Manager**.
-2. Select the server node.
-3. Open **Server Certificates**.
-4. Click **Import** in the actions pane.
-5. Select your `.pfx` file and enter the password.
-6. Go to your Site -> **Bindings**.
-7. Add **https** binding and select the imported certificate.
+        SSLEngine on
+        SSLCertificateFile      "/path/to/internal.app.crt"
+        SSLCertificateKeyFile   "/path/to/internal.app.key"
+        
+        # Best Practice
+        SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+    </VirtualHost>
+    ```
+  </Tabs.Tab>
+  <Tabs.Tab>
+    ### IIS (Internet Information Services)
+    Requires the **.pfx** file format.
+    
+    1.  **Import Certificate**:
+        *   Open **IIS Manager** > Click Server Node > **Server Certificates**.
+        *   Click **Import...** (Actions pane).
+        *   Select your `.pfx` file and enter the password.
+    
+    2.  **Bind to Site**:
+        *   Go to **Sites** > Select your site (e.g., Default Web Site).
+        *   Click **Bindings...** > **Add...**
+        *   Type: `https` | Port: `443`.
+        *   **SSL Certificate**: Select the certificate you just imported.
+  </Tabs.Tab>
+</Tabs>