Get your S/MIME certificate
To get an S/MIME certificate, open Settings › Security › S/MIME Certificates and click Generate Certificate. Your organisation's certificate authority issues it at once, at no extra cost. To use it in Outlook or on a phone, click Export .p12, set a password and import the file there. Your administrator must turn on S/MIME for your domain.
How to get your s/mime certificate
Where: Settings › Security › S/MIME Certificates
- Click your profile picture, choose Settings, open Security and then the S/MIME Certificates tab.
- Click Generate Certificate. The certificate details appear.
- To use it in another mail app, click Export .p12, enter a password of at least 8 characters twice and save the file.
- Download the CA Certificate too, so other apps trust your organisation's certificates.
When to use it
The partners at a law firm sign every client mail with their S/MIME certificate. Clients see a verified-sender mark in Outlook, which makes invoice-fraud impersonation much harder.
Options
| Option | What it does |
|---|---|
| Generate Certificate | Issues your certificate. Shown when you have none. |
| Certificate | Downloads your certificate to share with people who want to encrypt mail to you. |
| CA Certificate | Downloads your organisation's certificate authority, for other apps to trust. |
| CRL | Downloads the list of revoked certificates. |
| Export .p12 | Saves your certificate and private key in one password-protected file for Outlook, Thunderbird, Apple Mail or a phone. |
| Reissue | Revokes the current certificate and issues a new one. Type REISSUE to confirm. Use it if your key may be compromised. |
Install in Outlook or on a phone
- Click Export .p12 and save the file with a strong password.
- Copy the file to the computer or phone securely. Never mail it to an outside address.
- Open the file and enter the password. Outlook, Apple Mail and Thunderbird then offer signing and encryption with your certificate.
Good to know
- The details show the serial number, fingerprint, issue date and expiry date.
- Keep the .p12 password private. Anyone with the file and the password can sign as you.
Common questions
It says "S/MIME PKI is not enabled for this domain". What now?
Your administrator has not turned on S/MIME certificates yet. Ask them to create the domain's certificate authority.
Can I still read old encrypted mail after reissuing?
Yes. When you reissue, XgenPlus keeps your old key for decryption, so mail encrypted to the old certificate stays readable.
How long is a certificate valid?
Up to 5 years, and never longer than your organisation's certificate authority. Valid Until shows the exact date.