How To Install an S/MIME Certificate on Thunderbird

Thunderbird has supported S/MIME for as long as it has existed, and it handles it differently from Outlook in one way that determines everything else: it keeps its own certificate store. Nothing you install into Windows, macOS or your Linux keyring will show up in Thunderbird, and nothing you import into Thunderbird appears anywhere else.

That is also why the procedure is identical on every operating system. The steps below were checked against the current Thunderbird release, version 154 at the time of writing, and the current extended support release, version 140. Thunderbird now ships a new version every month, so the release number moves; the panels described here have not.

Thunderbird keeps its own certificate store

This is the first thing to understand, because it explains most of the confusion around Thunderbird and certificates.

Outlook reads certificates from the Windows certificate store, so on Windows you install a certificate once and every application that uses that store can see it. Thunderbird does not participate in that. It carries its own store inside your profile, so an email certificate has to be imported into Thunderbird specifically, even if it is already installed in Windows and working in another program.

The practical consequences are worth stating plainly:

• You need the original .p12 or .pfx file and its password. A certificate already installed in Windows is not enough unless you can export it back out to a file.
• The steps are the same on Windows, macOS and Linux, because the store and the interface are Thunderbird’s own.
• Moving to a new computer means importing the certificate into Thunderbird again there. Copying the profile carries it along, but a fresh install does not.

Step 1: Import the certificate

Have the PKCS#12 file ready. It has a .p12 or .pfx extension and contains both your certificate and the private key, protected by the password you set when you downloaded it. If you have lost that password it cannot be recovered from the file; you have to export a fresh copy from somewhere the certificate is still installed, or get the certificate reissued.

1. Open the Thunderbird menu (three horizontal lines, top right) and choose Settings.
2. Select Privacy & Security and scroll down to Certificates.
3. Click Manage Certificates.
4. On the Your Certificates tab, click Import.
5. Select your .p12 or .pfx file and enter its password when prompted.
6. Click OK. The certificate now appears in the list under the issuing CA, showing your email address.

The Your Certificates tab is specifically for certificates you own, meaning the ones you hold the private key for. The neighbouring People tab holds other people’s certificates, which is where correspondents’ certificates accumulate as you receive signed mail from them. Importing your own certificate into the wrong tab is a common misstep and leaves it unusable for signing.

If you have set a Primary Password on the profile, Thunderbird asks for it during the import, because it is what protects the private keys in the store.

Step 2: Select it for your account

Importing puts the certificate in the store. It does not attach it to an email account, which is a separate step and per account.

1. Open the menu (the three-lines button) and choose Account Settings.
2. In the left pane, under the account you want to secure, select End-To-End Encryption. Thunderbird’s own description of this panel says it plainly: to send encrypted or digitally signed messages you configure “either OpenPGP or S/MIME”.
3. Find the S/MIME section, below the OpenPGP one.
4. Next to Personal certificate for digital signing, click Select and choose your certificate.
5. Thunderbird offers to use the same certificate for encryption. Accept unless you were issued separate signing and encryption certificates, in which case set Personal certificate for encryption yourself.
6. Optionally turn on signing by default for this account. Leave encryption by default off, since it blocks messages to anyone whose certificate you do not have.

Only certificates Thunderbird considers valid for the account’s address are offered in the picker. An empty list almost always means the certificate’s email address does not match the account, or the chain to the issuing CA is incomplete.

Test it before you rely on it

Thunderbird has a verification step that almost no guide mentions: a Test button beside each selected certificate in the same S/MIME section. Use it. It is the difference between finding out now and finding out when a signed message bounces.

The messages it returns are specific, which makes them useful for diagnosis rather than just reassurance:

• The certificate passed the test and can be used for email signing. Or the equivalent for encryption. This is what you want.
• The certificate cannot be found. The selection points at something no longer in the store, usually after a profile was moved or a certificate deleted.
• The certificate verification failed with the following error, followed by a description and an error code such as SEC_ERROR_UNKNOWN_ISSUER. That particular code means the chain is incomplete: Thunderbird has your certificate but not the intermediate that connects it to a trusted root. Import the intermediate your CA supplied, into the Authorities tab of the same certificate manager.

If verification fails, Thunderbird offers to use the certificate anyway. Do not take that offer as a fix. It means your recipients will see the same failure you just accepted.

Send a signed or encrypted message

In the compose window, use the Security dropdown to turn signing or encryption on for that message. Thunderbird’s own wording is worth repeating because it removes a common worry: “A digital signature allows recipients to verify that the message was sent by you and its content was not changed. Encrypted messages are always signed by default.”

To check a received message, open its security information. Thunderbird reports the signature algorithm, the signature digest algorithm and the encryption algorithm, shown with the key size, for example AES-GCM at 256 bits. That is also how you confirm a correspondent’s mail is genuinely signed rather than merely claiming to be.

Why you cannot encrypt to someone yet

Encryption uses the recipient’s certificate, not yours. Your certificate signs your outgoing mail and lets others encrypt to you. Until you hold a copy of someone’s certificate, Thunderbird cannot encrypt to them.

The exchange is simple once you know it is required. Send them a signed message, which carries your certificate. Ask them to reply with a signed message, which carries theirs. Thunderbird files the received certificate under the People tab of the certificate manager, and encryption to that address starts working. This is a property of S/MIME rather than a Thunderbird limitation, and it is the same in Outlook and every other client.

No certificate yet? Thunderbird can generate the request

Current Thunderbird can create the key pair and the certificate request itself, which is a route the older guides predate. In its own words: “To obtain a new personal S/MIME certificate, generate a Certificate Signing Request (CSR) and submit it to a Certificate Authority (CA).”

The option sits in the same End-To-End Encryption panel. You choose a location for the CSR file, pick RSA, which Thunderbird marks as recommended, or ECC, and choose a key strength. The private key is generated inside Thunderbird’s own store and never leaves it, which is a real advantage over downloading a PKCS#12 file: there is no file to lose, leak or email to yourself.

The trade-off is the mirror image. Because the key never leaves Thunderbird, putting the same certificate on a phone or a second computer means exporting it from the Your Certificates tab afterwards, and if the profile is lost before you do that, so is the key. Note also that Thunderbird warns the generation step “may take some time and cause temporary unresponsiveness”, so do not assume it has hung.

Do not delete expired certificates

When your certificate expires you get a new one, and the old entry starts looking like clutter. Leave it alone.

Messages that were encrypted to the old certificate can only ever be decrypted with the old private key. Removing it from Your Certificates makes those messages permanently unreadable, including ones already sitting in your mailbox. Expiry stops you signing new mail, which is the whole point of it, but the key goes on decrypting old mail indefinitely. Keep every retired email certificate, and export them along with the current one whenever you move machines.

Troubleshooting

• The certificate picker is empty. Either the certificate is not in Your Certificates, or its email address does not match the account. Both are visible in the certificate manager.
• You installed it in Windows and Thunderbird cannot see it. Expected. Thunderbird uses its own store, so import the PKCS#12 file into Thunderbird as well.
• The Test button reports SEC_ERROR_UNKNOWN_ISSUER. The intermediate certificate is missing. Import it into the Authorities tab.
• The import fails or asks for a password you did not set. Thunderbird is asking for the profile’s Primary Password, not the file’s. They are different passwords and the dialog does not always make that obvious.
• Encryption is greyed out for one recipient. You do not have their certificate. Ask for a signed message.
• You configured the wrong account. The S/MIME settings are per account and per identity, so a profile with several addresses needs the certificate selected under each one it applies to.

Frequently Asked Questions