Is your S/MIME certificate compliant?

What is S/MIME?

S/MIME stands for Secure/Multipurpose Internet Mail Extensions. S/MIME is an internet standard to digitally sign and encrypt email messages. The encryption provided by S/MIME strengthens privacy and data security for electronic messaging, ensuring the message’s integrity remains intact during transmission. S/MIME is supported by all major email applications, including Apple Mail, Microsoft Outlook and Exchange, mobile OS email apps and more.

What is an S/MIME certificate?

An S/MIME certificate is an electronic document that uses public key infrastructure (PKI) to cryptographically bind a public key and an identity to achieve authentication, message integrity and non-repudiation of origin.

How do I get an S/MIME certificate?

You can get an S/MIME certificate from a certificate authority (CA) like DigiCert validate your senders, email addresses and organization, ensuring every email is signed and encrypted to prevent phishing and tampering.

What is PKI?

Public key infrastructure (PKI) is a system of processes, technologies and policies that allows you to encrypt and sign data. You can issue digital certificates that authenticate the identity of users, devices, or services. In S/MIME, public PKI is used to issue public TLS/SSL certificates, a type of digital certificate for public domains or web servers that can be viewed and logged publicly.

Can I run the S/MIME linter on my local computer?

To perform the S/MIME certificate check on your local computer, download the open-source certificate linter on GitHub.

What are the new S/MIME Baseline Requirements
for 2023?

On January 1, 2023, the CA/Browser Forum released the Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates, a set of standards governing the way certificate authorities (CAs) like DigiCert issue S/MIME digital certificates.

The Baseline Requirements apply to all publicly trusted digital certificates that include:

• The Extended Key Usage (EKU) extension for id-kp-emailProtection (OID: 1.3.6.1.5.5.7.3.4). 
  
  
• An email address (as rfc822Name or otherName of type id-on-SmtpUTF8Mailbox) in the subjectAltName extension.