Issue and Manage S/MIME Secure Email Certificates

Abstract

An S/MIME digital certificate is similar to a TLS Client certificate, except that it is used for key exchange and authentication in S/MIME secure E-mail, rather than in TLS. They are used to create and verify digital signatures, as well as to seal and open digital envelopes. There are two fields of an X.509 certificate found in an S/MIME certificate that are not required in a TLS Client certificate. However, an S/MIME certificate with those fields will work fine for TLS Client authentication, so a single certificate can serve both purposes if it contains those two fields. As with TLS Client certificates, each user requires a unique S/MIME certificate that identifies them. Unlike TLS Client certificates, anyone sending an S/MIME encrypted message requires the S/MIME certificate of each recipient of that message (at the time of sending the message). This is simplified by publishing all users’ S/MIME certificates in a shared address book (such as Active Directory).