Protocols & Standards
What Is S/MIME (Secure/Multipurpose Internet Mail Extensions)?
S/MIME (Secure/Multipurpose Internet Mail Extensions) is the standard for signing and encrypting email with X.509 certificates. A signed message proves who sent it and that it was not altered; an encrypted message can only be read by the holder of the recipient’s private key. Support is built into Outlook, Apple Mail, iOS and Gmail (Workspace) — no extra software required.
How S/MIME works
Each user holds an S/MIME certificate containing their email address (as a SAN of type rfc822Name) and an Email Protection extended key usage. Signing uses the sender’s private key, and any recipient can verify the signature against the sender’s certificate chain. Encryption uses the recipient’s public key — which is why both parties need certificates, and why encrypted mail requires exchanging or discovering certificates first.
S/MIME versus PGP
S/MIME and PGP solve the same problem with different trust models: S/MIME uses CA-issued certificates and fits organizations with central management (ADCS templates or public S/MIME CAs under the CA/Browser Forum S/MIME Baseline Requirements, in force since 2023); PGP uses a web of trust and suits individuals. In enterprises S/MIME wins because certificates can be issued, escrowed and revoked centrally.
The operational realities
The hard parts are key management, not cryptography: encryption certificates must be escrowed (or mail is unreadable when a laptop dies), expired certificates must remain available to decrypt old mail, and mobile devices need the certificate provisioned via MDM. Plan the lifecycle before rolling out — S/MIME deployments fail on recovery, not on signing.
Try it yourself — free tools
- Certificate Checker — inspect an S/MIME certificate — email SANs, EKU and chain
- CSR Generator — create the CSR for an S/MIME certificate request
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Subject Alternative Name (SAN)The certificate extension that lists every hostname, IP or email address a certificate is valid for.
- Asymmetric Encryption (Public-Key Cryptography)The public/private key-pair mathematics behind every certificate, signature and TLS handshake.
- X.509 Certificate StandardThe standard that defines what a digital certificate is — its fields, extensions and validation rules.
- Browse all terms →