S/MIME certificates

S/MIME uses a certificate issued to your address, often by an employer or a certificate authority. Many business mail systems support it. SipherMail handles your certificate in your browser.

Import your certificate#

1. Open Settings > Encryption and find S/MIME certificates.
2. Choose Or choose a file and select your PKCS#12 file (.p12 or .pfx).
3. Enter the File password, then a passphrase to protect the key in your account.
4. Choose Import certificate.

The file is opened in your browser. Only the certificate and your private key, encrypted with your passphrase, are stored. The page shows the issuer, key usage and expiry date, and warns you before the certificate expires. Very old files that use legacy encryption may be refused with an explanation.

Sign and encrypt#

In the composer, open PGP and S/MIME, choose S/MIME, then turn on Sign message, Encrypt message, or both.

• Signing adds a detached signature, so the message stays readable in clients without S/MIME support.
• To encrypt, you need each recipient’s certificate. Add it under Certificates of people you write to. Only RSA certificates can be used.
• Encrypted mail is also encrypted to your own certificate, so you can read your Sent folder.
• If a recipient has no certificate, the message is not sent encrypted unless you choose Send unencrypted instead.
• The subject line is not encrypted. S/MIME cannot be combined with end-to-end encryption, expiring messages or scheduled send.

Read S/MIME mail#

Signed and encrypted messages are verified and decrypted in your browser. The badge tells you how far the signature can be trusted:

A browser cannot check a certificate against a public root store, and SipherMail does not ship one. Trust only comes from certificates you add yourself. Use Trust this certificate on a message from someone you know, or manage the list under Trusted certificates.

Last updated 1 November 2026