How to Sign and Encrypt Email with S/MIME (Outlook, Apple Mail, Gmail)

What is an S/MIME certificate?

An S/MIME certificate is a digital certificate tied to your email address that lets you sign and encrypt email. A signature proves the message came from your mailbox and was not changed; encryption makes sure only the intended recipient can read it. S/MIME stands for Secure/Multipurpose Internet Mail Extensions, the standard that Outlook, Apple Mail and Gmail (in eligible Google Workspace editions) support.

Each certificate contains your public key (the half you share so others can check your signature and encrypt mail to you) and belongs to a private key (the secret half that stays on your devices). Since 1 September 2023, publicly trusted S/MIME certificates are issued under the CA/Browser Forum S/MIME Baseline Requirements, which define how the certificate authority (CA) validates the mailbox, the person and the organization.

When people search for an “email SSL certificate”, they usually mean an S/MIME certificate. The certificate that secures the connection between mail servers and mail apps is a different product; see SSL for mail servers for that.

Key fact	Detail
What it protects	The message itself, end to end, including stored copies
Bound to	One email address (plus name or organization at higher levels)
Industry rules	CA/Browser Forum S/MIME Baseline Requirements, since 1 Sep 2023
Works in	Outlook (Windows, Mac), Apple Mail, Gmail with hosted S/MIME
File you install	.p12 / .pfx (certificate plus private key, password protected)

Which S/MIME level do I need?

Choose mailbox validation if you only need to prove control of an email address, individual validation if your personal name should appear in the certificate, and organization (or sponsor) validation if recipients should see your company name. All levels use the same encryption; they differ in what the CA checks and what the certificate shows.

The S/MIME Baseline Requirements define four validation types:

Validation type	What the CA checks	Shown in the certificate	Good fit for
Mailbox-validated	Control of the email address	Email address only	Individuals, freelancers, signing on a tight budget
Individual-validated	Mailbox plus the person’s identity	Personal name + email	Professionals who sign as themselves
Sponsor-validated	Mailbox, person and the organization that sponsors them	Personal name + organization + email	Employees signing on behalf of a company
Organization-validated	Mailbox plus the organization	Organization name + email	Shared or role mailboxes such as billing@

For most individuals, the lowest-priced option is a mailbox-validated certificate. Businesses that send invoices, contracts or HR mail usually pick a certificate that shows the organization name, because recipients can check who stands behind the address. Our S/MIME email certificates category lists each product’s validation level.

Tip: Order one certificate per email address. An S/MIME certificate for [email protected] cannot sign mail sent from [email protected].

How do I install an S/MIME certificate in Outlook?

Import the .p12 or .pfx file into Windows, then select it in Outlook’s email security settings. After that, Outlook can sign every message and encrypt messages to contacts whose certificate you have.

Classic Outlook for Windows

1. Double-click the .p12/.pfx file, choose Current User and enter the password. Let Windows place it in the Personal store.
2. In Outlook, open File → Options → Trust Center → Trust Center Settings → Email Security.
3. Under Encrypted email, click Settings, choose your certificate for signing and for encryption, and confirm.
4. Optionally tick Add digital signature to outgoing messages so every email is signed by default.

New Outlook for Windows and Outlook on the web

Go to Settings → Mail → S/MIME, select Import under Digital IDs (Certificates), browse to the file and enter its password. To sign one message, open Options → More Options → Digitally sign this message. Microsoft states that sending S/MIME-encrypted mail in the new Outlook requires a qualifying Microsoft 365 business subscription.

Set up S/MIME in Apple Mail

Double-click the .p12 file on your Mac and enter its password. The certificate appears in Keychain Access → My Certificates; if it does not, drag the file onto the Keychain Access icon. Quit and reopen Mail. When you write a new message from that address, Mail shows a sign icon and, once it has the recipient’s certificate, an encrypt icon in the message header. Install the same .p12 on every Mac you use.

Set up S/MIME in Gmail

Gmail supports S/MIME only in certain Google Workspace editions: as of October 2026, Enterprise Plus, Frontline Plus, and Education Fundamentals, Standard and Plus. Personal Gmail accounts cannot use it. Your Workspace admin first turns on hosted S/MIME; then you upload your certificate in Gmail on the web:

1. Open Settings → See all settings → Accounts.
2. Next to Send mail as, click Edit info, then Upload a personal certificate.
3. Select the .p12/.pfx, enter its password, click Add certificate and save.

The upload works only in Gmail on the web, not in the Gmail app, and each Send mail as address needs its own certificate.

Can recipients read encrypted email without a certificate?

No. To read an encrypted S/MIME message, the recipient needs their own S/MIME certificate and private key, because you encrypt with their public key. Signed but unencrypted email is different: anyone can read it, and any S/MIME-capable mail app can verify the signature without a certificate of its own.

You want to…	You need	The recipient needs
Sign an email	Your S/MIME certificate + private key	Nothing (an S/MIME-aware app shows the signature)
Encrypt an email	The recipient’s certificate (public key)	Their own certificate + private key to decrypt
Receive encrypted email	Your certificate + private key on the device	Your certificate, usually from a signed email you sent

Should you sign every email?

For business mail, yes: turn on signing by default and encrypt only when the content is confidential. A default signature costs the recipient nothing, it lets them spot forged messages that claim to come from you, and it hands every contact your certificate so they can encrypt replies. Encryption is worth the extra step for contracts, payroll, health or legal content, as long as the recipient also has a certificate.

An S/MIME signature is a cryptographic digital signature, not a typed name or a scanned signature image. The legal difference between the two is explained in digital signature vs electronic signature. Encrypted mail can also be harder to scan for malware and archive, so check your company’s mail filtering and retention rules before you encrypt by default.

Common S/MIME problems

Problem	Likely cause	Fix
Encrypt option is greyed out	No certificate for that recipient	Exchange signed emails first
Signature shown as invalid	Sending address differs from the certificate	Send from the exact address in the certificate
Old encrypted mail cannot be opened	Previous private key missing on this device	Import the old .p12 backup as well as the new one
Certificate not offered in Outlook	Imported without private key	Re-import the .p12/.pfx, not a .cer

Tip: Keep every expired S/MIME certificate’s .p12 backup. You need the old private key to read messages that were encrypted to you in the past.

Some S/MIME certificates can also sign documents, but Adobe Acrobat trusts document-signing certificates from its own trust list. To digitally sign PDFs that open without warnings, use a dedicated document signing certificate.