# Set up S/MIME certificates for your domain

To issue S/MIME certificates, open the admin console, go to Manage Domain(s), expand your domain and click S/MIME / PKI. On the CA Operations tab, click Create Authority and confirm. Your domain then has its own certificate authority that issues S/MIME certificates to your users, with no outside provider.

## How to set up S/MIME certificates for your domain

1. Open **Manage Domain(s)**, expand your domain and click **S/MIME / PKI**.
2. On the **CA Operations** tab, check the profile shown and click **Create Authority**. Confirm the message.
3. Click **Export CA Certificate** and copy the certificate text for anyone who must trust your users' signatures.
4. Click **Export CRL** to generate the list of revoked certificates and copy it.
5. Open the **User Certificates** tab to review certificates or retire one.

## CA Operations

| Item | What it does |
|---|---|
| **Create Authority** | Creates your domain's certificate authority and turns on issuance. It becomes **Enable Issuance** once the domain has an authority that is switched off. |
| **Disable Issuance** | Stops new user certificates being issued. Existing certificates stay valid. |
| **Export CA Certificate** | Shows the authority's certificate text in a window so you can copy it for trust stores. |
| **Export CRL** | Generates the certificate revocation list and shows its text to copy. A message gives the number of revoked certificates and the next update time. |
| **Revoke Authority** | Revokes the active authority and disables issuance. You must type **REVOKE** followed by your domain name to confirm. |
| Profile | Before you create the authority the page shows the issuer name, **Signing Key** (RSA 2048), **CA Validity** (10 Years) and **Key Custody** (encrypted database). |
| Status boxes | **Issuance State** (Issuance Enabled, Issuance Disabled or Not Configured), **Trust Anchor Fingerprint**, **CA Expires** and **Issued User Certificates**. |
| **Authority Details** | Issuer DN, serial, profile version, CRL number, last CRL update, CA issuers URL, CRL distribution URL, subject and authority key IDs, created date and created by. |
| **Authority History** | Every authority your domain has had: CA ID, status, created, expires and fingerprint. |
| **CA Audit Trail** | The latest operations: time, action, status, target, actor and message. |

## User Certificates

| Item | What it does |
|---|---|
| Search email prefix | Finds certificates by the start of the email address. Click **Search** or press Enter. |
| State filter | **All**, **Active**, **Deleted** or **Revoked**. |
| Columns | **User Email**, **Issued On**, **Expires On**, **State**, **SHA-256 Fingerprint**, **Key Action**. |
| **Prev** and **Next** | Move through the list, 50 certificates a page. |
| **Retire Cert** | Shown on active certificates. Revokes the certificate so it is no longer used for new S/MIME mail. Type **DELETE** followed by the user's address to confirm. The old private key is kept so the user can still open earlier encrypted mail. |

## Example

> A department on `dept.example.gov.in` creates its own authority so staff can sign and encrypt mail in webmail. When an officer's laptop is stolen, the admin retires that officer's certificate and exports a fresh CRL the same day.

## Good to know

- Each domain has its own authority. A domain administrator manages the authority for their own domain.
- Creating or enabling the authority asks you to confirm. Nothing changes until you do.
- Retiring a certificate does not delete the user's old key, so earlier encrypted mail stays readable.

## Common questions

**What should I do when a user loses a laptop with their certificate?**

Open **User Certificates**, find the user, click **Retire Cert** and type the confirmation text. The certificate is revoked. Then click **Export CRL** on **CA Operations** to publish a fresh revocation list.

**Can I stop new certificates without revoking existing ones?**

Yes. Click **Disable Issuance**. Existing certificates stay in the list. Click **Enable Issuance** to start again. **Revoke Authority** is the stronger step.

**Why is the User Certificates tab missing?**

It appears only while issuance is enabled. Click **Create Authority** or **Enable Issuance** first.


Source: https://docs.xgenplus.com/admin/smime-certificate-authority/