How to Verify a Certificate From a Secure Email

Download a PGP authentication program. This can take the form of a plugin for your e-mail client that can process signatures or downloading a command-line-based tool, such as PGP or GPG. All these can be found by doing a Web search.

Obtain the public key for the individual who sent you the secure e-mail. PGP's protection is based on each user creating a unique cypher for encrypting documents. In the process, two keys are created: a private key, then a public key. The public key is distributed to the world. The private key must be closely guarded by its owner. If you have downloaded a user's public key, it means you will be able to encrypt files that can only be opened by the private key's owner, and lets you verify that a signature does indeed come from that user.

Load the public key into your chosen authentication method: be it the command line or a Web browser plugin. Instructions for how exactly to do this vary from program to program, but the process for doing so can be found in your program's documentation.

Download the signature from the e-mail. If you have a plugin for your e-mail client this step is unnecessary, as the plugin will automatically verify a signature against the user's public key and display a message telling you whether it's valid. If not, take note of the directory to which you downloaded the signature, then open your command-line tool. Type in the appropriate command to verify a signature (again, it depends on your tool, but they can be found in your documentation), and the directory in which the signature is sitting. The program will then display to you whether the signature is valid or not.