# Get your S/MIME certificate

To get an S/MIME certificate, open **Settings › Security › S/MIME Certificates** and click **Generate Certificate**. Your organisation's certificate authority issues it at once, at no extra cost. To use it in Outlook or on a phone, click **Export .p12**, set a password and import the file there. Your administrator must turn on S/MIME for your domain.

## How to get your S/MIME certificate

1. Click your profile picture, choose **Settings**, open **Security** and then the **S/MIME Certificates** tab.
2. Click **Generate Certificate**. The certificate details appear.
3. To use it in another mail app, click **Export .p12**, enter a password of at least 8 characters twice and save the file.
4. Download the **CA Certificate** too, so other apps trust your organisation's certificates.

## When to use it

> The partners at a law firm sign every client mail with their S/MIME certificate. Clients see a verified-sender mark in Outlook, which makes invoice-fraud impersonation much harder.

## Options

| Option | What it does |
|---|---|
| **Generate Certificate** | Issues your certificate. Shown when you have none. |
| **Certificate** | Downloads your certificate to share with people who want to encrypt mail to you. |
| **CA Certificate** | Downloads your organisation's certificate authority, for other apps to trust. |
| **CRL** | Downloads the list of revoked certificates. |
| **Export .p12** | Saves your certificate and private key in one password-protected file for Outlook, Thunderbird, Apple Mail or a phone. |
| **Reissue** | Revokes the current certificate and issues a new one. Type `REISSUE` to confirm. Use it if your key may be compromised. |

## Install in Outlook or on a phone

1. Click **Export .p12** and save the file with a strong password.
2. Copy the file to the computer or phone securely. Never mail it to an outside address.
3. Open the file and enter the password. Outlook, Apple Mail and Thunderbird then offer signing and encryption with your certificate.

## Good to know

- The details show the serial number, fingerprint, issue date and expiry date.
- Keep the .p12 password private. Anyone with the file and the password can sign as you.

## Common questions

**It says "S/MIME PKI is not enabled for this domain". What now?**

Your administrator has not turned on S/MIME certificates yet. Ask them to create the domain's certificate authority.

**Can I still read old encrypted mail after reissuing?**

Yes. When you reissue, XgenPlus keeps your old key for decryption, so mail encrypted to the old certificate stays readable.

**How long is a certificate valid?**

Up to 5 years, and never longer than your organisation's certificate authority. **Valid Until** shows the exact date.


Source: https://docs.xgenplus.com/security/get-smime-certificate/