1. Home
2. /
3. TLS/SSL & S/MIME
4. /
5. FAQ for S/MIME certificates

FAQ for S/MIME certificates

5 min read

How is the encryption and signing of emails implemented?

The signature and encryption of emails can be configured in the settings of the email client. You can find relevant instructions in the installation guide or on the support pages provided by your email client.

How is the exchange of keys carried out?

In order to activate the encryption, a signed email must first be sent to the recipient, who in turn replies with a signed email. Only after this can both contacts mutually send encrypted emails to each other.

Can encryption always be used?

Email encryption can only be used when the recipient is also using an S/MIME certificate and the exchange of keys has taken place.

Do keys only need to be exchanged once?

This procedure is required for each and every contact person to whom encrypted communication should be sent. However, the exchange of keys only needs to be carried out once with each contact within the validity period. Please note that the exchange of keys must be carried out again after each certificate renewal.

Although the keys have been exchanged, the recipient still cannot read the emails. What is the reason for this?

The most likely explanation is that one of the keys is outdated or incorrect. In order resolve this, delete the contact AND the saved certificate in your email client and then add the contact once again. The new key will be saved, after which encrypted emails can once again be exchanged.

Can the recipient see whether an email has been encrypted or signed?

Yes, symbols are displayed in the header of the email client to indicate whether the email has been encrypted and/or signed. An envelope indicates a signature and a padlock stands for encryption. The symbols can vary depending on the email client. By clicking on one of the symbols, you can access detailed information about the certificate used and about the certificate owner.

Why can the recipient not read the emails despite the key exchange?

Why can the recipient not read the emails despite the key exchange?

This can happen if the keys have not yet been exchanged or if the recipient is not using an S/MIME certificate.

What happens after an S/MIME certificate is renewed?

The new certificate must be implemented on the email client again. As a new pair of keys is generated, these must be exchanged with your contacts. Please note: as the old key is no longer valid, encrypted correspondence is not possible until the new keys for this certificate have been exchanged. However, old emails can still be read.

The certificate has expired. Can encrypted emails still be read?

Yes, as long as the key of the sender was saved while the S/MIME certificate was still valid. However, no keys can be exchanged with new contacts and consequently, no further encrypted emails can be received.

How can it be checked whether the certificate has been installed correctly?

If the certificate has been installed correctly, it will be visible in the certificate index of the email client. The S/MIME certificate must be located in the certificate folder “Personal” or “Your certificates”.

The S/MIME certificate is no longer available. What can be done?

If no backup of the certificate is available, it must be reissued. After a reissue, the same procedure must be followed as after a renewal. We strongly recommend making a backup of the certificate. Instructions for this can usually be found on the support pages provided by the email client.

How can the certificate be used on additional devices?

During the first installation of the certificate, the option to allow the export of the private key must be selected.

Is it possible to use the S/MIME certificate on multiple computers, e.g. work station and laptop?

Yes, the certificate can be used on multiple devices. In order to do so, the complete certificate package including the root certificate must be exported and subsequently imported to the other devices. You can find relevant instructions on the support pages provided by your email client.

How long is the period for downloading the S/MIME certificate?

After the S/MIME has successfully been issued, the certificate can be downloaded for up to 30 days. After this, a request for a new download link can be submitted to the CA directly, using the Order ID.

The password for downloading a GlobalSign S/MIME certificate was forgotten. What can be done?

In this case, the existing order must be cancelled and the order must be restarted. Please contact the InterNetX Support Team for assistance.

Please also note that in the case of bulk orders (reissue and renew), the password set once for the registration in each case remains valid and no new passwords can be defined.

However, a new password can be assigned for both order types at any time in Single Mode.

The issued certificate includes data that is not correct. How can I correct this?

As soon as an order has been received by the certificate authority (CA), the data can no longer be changed. The order must be cancelled and restarted again. Please contact the InterNetX Support Team for assistance.

How or where do I receive my S/MIME certificate after it has been issued?

In general, the certificate or the link for certificate download is always sent to the email address for which it was ordered. It is not possible to send the certificate to another email address.

The confirmation/download email was not received. What can be done?

The mail account should be checked for external accessibility. The settings for firewalls and spam filters etc. should also be checked. It is advisable to add the domains or addresses for the relevant CAs to the white lists.

Can the S/MIME certificate be used to sign documents?

Yes. However, please note that the signatures are not classified as trustworthy by e.g. Adobe Reader. For this reason, we recommend the use of a “real” document signing certificate, e.g. from GlobalSign.