How To Install an S/MIME Certificate on Outlook

An S/MIME certificate lets you digitally sign your emails, so recipients can tell the message really came from you and was not altered, and encrypt them, so only the intended recipient can read them. It is an email certificate, not the SSL/TLS certificate that secures a website, and the two are not interchangeable even though both come from a Certificate Authority.

The setup has two halves that guides tend to blur together: getting the certificate into Windows, and telling Outlook to use it. Which Outlook you have decides the second half, because there are now three of them with three different settings screens.

What you need before you start

• The certificate file, with its private key. This is a PKCS#12 file, with a .p12 or .pfx extension. You usually download it from your email certificate vendor’s account after following the activation link, and you set a password during the download.
• That password. Without it the file cannot be imported, and it cannot be recovered from the file.
• A certificate issued to the address you actually send from. Outlook matches the certificate’s email address against the account sending the message. A certificate issued to one address will not sign mail from another, which is a common surprise for people with aliases or several accounts in one profile.

Keep the downloaded file. If you lose it and the private key inside it, you permanently lose the ability to read any message that was encrypted to you with that certificate. Back it up somewhere safe before you go any further.

Step 1: Install the certificate into Windows

Every Outlook variant reads certificates from the Windows certificate store, so this step is the same regardless of which one you use. New Outlook in particular will not do it for you: Microsoft states plainly that it “doesn’t automatically import digital certificates. You must install the certificate manually or ask your administrator to configure policies to automatically install certificates.”

1. Double-click the .p12 or .pfx file. The Certificate Import Wizard opens.
2. Choose Current User as the store location. An email certificate belongs to you, not to the machine, so this is the right hierarchy. Click Next.
3. Confirm the file path and click Next.
4. Enter the password you set when downloading the file. Tick Mark this key as exportable if you will need to move this certificate to another computer or phone later, which for an email certificate you very likely will. Click Next.
5. Choose Place all certificates in the following store and select Personal. Click Next, then Finish.

Verify it landed correctly by opening the Certificate Manager:

certmgr.msc

Under Personal, then Certificates, your certificate should be listed with your email address, and its Intended Purposes should include Secure Email. If that column says something else, you have installed a certificate that is not an S/MIME certificate and Outlook will not offer it.

Classic Outlook can also import the file directly, under Email Security, using the Import/Export button under Digital IDs (Certificates). That works, but it only helps classic Outlook. Importing into Windows once covers all three variants and anything else on the machine that needs the certificate.

Step 2: Tell Outlook to use it

Find your variant below. If you are unsure which you have, look for a File menu in the top left: classic Outlook has one, new Outlook does not.

New Outlook for Windows

1. Open Settings, then Mail, then S/MIME.
2. Turn on Automatically choose the best certificate for digital signing, which picks up the certificate you imported in step 1.
3. Decide on defaults. Add a digital signature to all messages I send is safe to leave on and is how recipients get your certificate. Encrypt contents and attachment for all messages I send is not, because any message to someone whose certificate you do not hold will fail to send.

The same screen offers import and export of digital IDs if you prefer to do it here rather than through Windows.

Classic Outlook

1. Select File, then Options.
2. Select Trust Center, then the Trust Center Settings button.
3. Select Email Security in the left pane.
4. Under Encrypted email, click Settings.
5. Give the profile a name in Security Settings Name.
6. Under Certificates and Algorithms, click Choose next to Signing Certificate and pick your certificate. Do the same next to Encryption Certificate. In most cases it is the same certificate for both.
7. Leave the hash and encryption algorithms at their defaults unless a policy tells you otherwise. Modern Outlook already defaults to SHA-256 and AES, and older guides telling you to change SHA-1 to SHA-256 are describing a version you are not running.
8. Click OK to close each dialog.

Back on the Email Security page you can set defaults with Add digital signature to outgoing messages and Encrypt contents and attachments for outgoing messages. The same caution applies: signing by default is fine, encrypting by default will block messages to anyone whose certificate you do not have.

Outlook on the web

The browser version needs a helper component, because a web page cannot reach your certificate store on its own.

1. Go to Settings, then Mail, then S/MIME.
2. Select the link to install the S/MIME control, and choose Run or Open when prompted.
3. You may then need to allow your work domain in the browser’s S/MIME extension settings before signing and encryption appear.

This route depends on your organisation’s Exchange configuration, so if the S/MIME option is missing entirely, it is an administrator setting rather than something you can fix from the client.

Send a signed or encrypted message

Compose a message, open the Options tab, and switch on Sign or Encrypt for that message. On the first send, Windows asks permission for Outlook to use your private key; approve it.

To confirm it worked, send a signed message to yourself. The received copy carries a signature badge you can click to inspect the certificate, the signer’s address and the validation result. That badge is also the fastest way to diagnose a problem later, because it names what failed rather than just refusing.

Why you cannot encrypt to someone yet

This is the part that stops most people, and it is not a configuration error. Encryption uses the recipient’s public certificate, not yours. Your certificate lets you sign, and lets others encrypt to you. Until you hold a copy of someone’s certificate, Outlook cannot encrypt anything to them and will refuse to send.

The normal way to obtain it is to have them send you a signed message. A digital signature carries the sender’s certificate with it, so once you receive and save that, encryption to that person starts working. In practice:

• Send them a signed message so they have yours.
• Ask them to reply with a signed message so you have theirs.
• In classic Outlook, add the sender to your contacts from that signed message, which stores their certificate against the contact.
• Inside an organisation running Exchange, certificates are usually published in the directory, so encryption to colleagues works without the exchange of signed mail.

Because both sides need certificates, S/MIME works well within an organisation or with a regular correspondent, and poorly for one-off mail to strangers. That is a property of the technology, not something a setting fixes. The underlying idea is standard public key cryptography: encrypt with their public key, they decrypt with the private key only they hold.

Never delete an expired S/MIME certificate

S/MIME certificates expire, and when yours does you get a new one and carry on. The instinct is then to tidy up the old one. Do not.

Every message anyone encrypted to you under the old certificate can only be decrypted with that old private key. Delete it and those messages become permanently unreadable, including ones sitting in your mailbox right now. An expired certificate stops you signing new mail, which is the point of expiry, but it goes on decrypting old mail indefinitely. Leave every retired email certificate in place, and if you migrate to a new computer, export and import them along with the current one. Our guide to removing certificates from Windows covers the export step, which is the one to run before any cleanup.

Troubleshooting

• The Sign or Encrypt button does nothing, or Outlook says no certificate is available. Outlook is not finding a certificate whose email address matches the account you are sending from. Check the address on the certificate in certmgr.msc against the account in Outlook.
• The certificate is not offered in the Choose dialog. Check Intended Purposes in certmgr.msc. It must include Secure Email. A TLS certificate or a code signing certificate will not appear here, and no setting makes it.
• You imported the file but nothing appears. You probably imported into the Local Computer hierarchy rather than Current User. Outlook reads your user store. Import again, choosing Current User.
• Encryption fails for one recipient. You do not have that person’s certificate. Ask them for a signed message.
• Recipients see a warning on your signed mail. The chain is not trusted on their machine, the certificate has expired, or the address on it does not match the one you sent from. The signature badge on the message names which.
• It works on the desktop but not on your phone. The certificate has to be installed on each device separately. There is no synchronisation of private keys between Outlook installations.

Frequently Asked Questions