Set up S/MIME certificates for your domain
To issue S/MIME certificates, open the admin console, go to Manage Domain(s), expand your domain and click S/MIME / PKI. On the CA Operations tab, click Create Authority and confirm. Your domain then has its own certificate authority that issues S/MIME certificates to your users, with no outside provider.
How to set up s/mime certificates for your domain
Where: Admin console › Manage Domain(s) › your domain › S/MIME / PKI
- Open Manage Domain(s), expand your domain and click S/MIME / PKI.
- On the CA Operations tab, check the profile shown and click Create Authority. Confirm the message.
- Click Export CA Certificate and copy the certificate text for anyone who must trust your users' signatures.
- Click Export CRL to generate the list of revoked certificates and copy it.
- Open the User Certificates tab to review certificates or retire one.
CA Operations
| Item | What it does |
|---|---|
| Create Authority | Creates your domain's certificate authority and turns on issuance. It becomes Enable Issuance once the domain has an authority that is switched off. |
| Disable Issuance | Stops new user certificates being issued. Existing certificates stay valid. |
| Export CA Certificate | Shows the authority's certificate text in a window so you can copy it for trust stores. |
| Export CRL | Generates the certificate revocation list and shows its text to copy. A message gives the number of revoked certificates and the next update time. |
| Revoke Authority | Revokes the active authority and disables issuance. You must type REVOKE followed by your domain name to confirm. |
| Profile | Before you create the authority the page shows the issuer name, Signing Key (RSA 2048), CA Validity (10 Years) and Key Custody (encrypted database). |
| Status boxes | Issuance State (Issuance Enabled, Issuance Disabled or Not Configured), Trust Anchor Fingerprint, CA Expires and Issued User Certificates. |
| Authority Details | Issuer DN, serial, profile version, CRL number, last CRL update, CA issuers URL, CRL distribution URL, subject and authority key IDs, created date and created by. |
| Authority History | Every authority your domain has had: CA ID, status, created, expires and fingerprint. |
| CA Audit Trail | The latest operations: time, action, status, target, actor and message. |
User Certificates
| Item | What it does |
|---|---|
| Search email prefix | Finds certificates by the start of the email address. Click Search or press Enter. |
| State filter | All, Active, Deleted or Revoked. |
| Columns | User Email, Issued On, Expires On, State, SHA-256 Fingerprint, Key Action. |
| Prev and Next | Move through the list, 50 certificates a page. |
| Retire Cert | Shown on active certificates. Revokes the certificate so it is no longer used for new S/MIME mail. Type DELETE followed by the user's address to confirm. The old private key is kept so the user can still open earlier encrypted mail. |
Example
A department on
dept.example.gov.increates its own authority so staff can sign and encrypt mail in webmail. When an officer's laptop is stolen, the admin retires that officer's certificate and exports a fresh CRL the same day.
Good to know
- Each domain has its own authority. A domain administrator manages the authority for their own domain.
- Creating or enabling the authority asks you to confirm. Nothing changes until you do.
- Retiring a certificate does not delete the user's old key, so earlier encrypted mail stays readable.
Common questions
What should I do when a user loses a laptop with their certificate?
Open User Certificates, find the user, click Retire Cert and type the confirmation text. The certificate is revoked. Then click Export CRL on CA Operations to publish a fresh revocation list.
Can I stop new certificates without revoking existing ones?
Yes. Click Disable Issuance. Existing certificates stay in the list. Click Enable Issuance to start again. Revoke Authority is the stronger step.
Why is the User Certificates tab missing?
It appears only while issuance is enabled. Click Create Authority or Enable Issuance first.