On August 29, 2023, at 10:00 MDT (16:00 UTC), DigiCert made the changes listed below to our public Secure Email (S/MIME) certificate issuance process to comply with the CA/Brower Forum's new Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates.
These changes will apply to all newly issued certificates containing the emailProtection extendedKeyUsage and at least one email address. If you can use your certificate to sign, verify, encrypt, or decrypt email, then your new, reissued, and renewed certificates will be affected by these new industry requirements starting August 29, 2023, at 10:00 MDT (16:00 UTC).
The DigiCert Certification Practice Statement (CPS) has been updated to reflect the changes we made to comply with S/MIME certificate baseline requirements. To view our CPS and other such documents, visit the DigiCert Legal Repository.
| Important: This is a dynamic article that we will update as new information becomes available. Make sure to save this page and periodically check back for new information. |
Protect your brand and your users with a DigiCert Verified Mark Certificate.
New requirements for public Secure Email (S/MIME) certificates:
New intermediate CA certificates coming in 2024
The new S/MIME certificate baseline requirements also affect the intermediate CA (ICA) certificates used to issue S/MIME certificates. However, to limit the impact of the new requirements, the industry (CA/Browser Forum) allows certificate authorities to continue using the current ICA certificate to issue new S/MIME certificates for one year.
On June 26, 2024, DigiCert began moving the default issuance of public Secure Email (S/MIME) certificates to new industry-compliant public intermediate CA (ICA) certificates. By September 3, 2024, DigiCert must move all our S/MIME certificate issuance to new industry-compliant intermediate CA certificates.
For more information about the new industry-compliant S/MIME intermediate CA certificates and to view the timeline for the change, see our New Secure Email (S/MIME) Intermediate CA certificates 2024 article.
Newly issued S/MIME certificates
Starting August 29, 2023, at 10:00 MDT (16:00 UTC), all newly issued S/MIME certificates, including new, reissued, and renewed certificates, must comply with the CA/Browser Forum's new Baseline Requirements for the Issuance and Management of Publicly-Trusted S/MIME Certificates.
These changes will apply to all newly issued certificates containing the emailProtection extendedKeyUsage and at least one email address. If you can use your certificate to sign, verify, encrypt, or decrypt email, then your new, reissued, and renewed certificates will be affected by these new industry requirements.
Existing S/MIME certificates
The industry changes do not affect S/MIME certificates issued before August 29, 2023, 10:00 MDT (16:00 UTC). You can continue to use these existing certificates until they expire.
Remember, your certificate replacements and renewals will be affected by the industry changes coming to S/MIME certificates.
Get needed Secure Email S/MIME certificates before August 29, 2023
If you have S/MIME certificate renewals, reissues, or new orders scheduled for the end of August and the month of September, do these certificate-related activities early—before August 29. That way, your S/MIME certificate issuance will remain the same, eliminating potential surprises from the modifications to certificate profiles and the validation process. Certificates issued before August 29, 2023, can still contain the organization unit information and email-validated addresses, as needed.
Move to private Secure Email (S/MIME) certificates
DigiCert recommends moving to privately trusted S/MIME certificates if public trust is not required. The rules for public S/MIME certificates do not apply to locally trusted S/MIME certificates. Contact your account representative or DigiCert Support to learn about DigiCert Private Secure Email (S/MIME) certificates.
One of the benefits of the new S/MIME certificate baseline requirements is that it will standardize public S/MIME certificates for all certificate authorities and, more specifically, for all DigiCert platforms.
Learn more about the changes coming to your platform and what you need to do to prepare for the changes to DigiCert's public Secure Email (S/MIME) certificate issuance process coming August 29, 2023, at 10:00 MDT (16:00 UTC):
On August 29, 2023, at 10:00 MDT (16:00 UTC), CertCentral will make changes to their S/MIME certificate issuance process to align with the new Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates.
CertCentral currently offers the following S/MIME-related certificates affected by the new Secure Email (S/MIME) baseline requirements:
By August 29, 2023, CertCentral will change its current offerings to align with three new types of industry-compliant S/MIME certificates:
DigiCert is evaluating offering individual-validated Secure Email (S/MIME) certificates based on customer demand. Contact your account manager if you are interested in S/MIME certificates issued to individuals.
How does this affect my pending Secure Email (S/MIME) certificate orders?
On August 29, we will cancel pending orders submitted prior to August 29, 2023, at 10:00 MDT (16:00 UTC). These requests do not adhere to the new industry requirements and cannot be issued.
To get your canceled S/MIME certificate, resubmit the request. Remember, your new S/MIME certificate will follow the new industry guidelines, such as no longer including an organization unit, etc.
Items to note:
On August 29, 2023, at 10:00 MDT (16:00 UTC), we will remap existing API integrations to issue the new industry-compliant S/MIME certificates without requiring any update on existing S/MIME certificate integrations. These changes do not require updates to your API integrations.
Mailbox-validated S/MIME certificates
To issue industry-compliant mailbox-validated S/MIME certificates, we will do the following:
Organization-validated and sponsor-validated S/MIME certificates
To issue industry-compliant organization-validated and sponsor-validated S/MIME certificates, we will do the following:
Improvements to the CertCentral Services API workflow for managing Secure Email (S/MIME) certificates
As we update our systems to comply with the new Secure Email (S/MIME) baseline requirements, we will need to update the Services API workflows for managing S/MIME certificates in CertCentral:
For organization and organization-sponsored Secure Email (S/MIME) certificates, DigiCert must validate the organization included in the S/MIME certificates before we can issue the certificate.
See Services API updates for client certificate workflows in our developer portal for more detailed information about the API changes. Make sure to save this page and check it frequently, as we will update this article as new information becomes available.
On August 29, 2023, at 10:00 MDT (16:00 UTC), you can no longer get your S/MIME certificates from TrustLink Enterprise. However, you can continue to view and, if needed, revoke your existing S/MIME certificates from your TrustLink Enterprise account until they expire.
To modify, renew, or get new S/MIME certificates, you must upgrade to a CertCentral EU account. Once you've set up your new account and the new S/MIME certificates are available, you can begin ordering these certificates along with other types of certificates (such as TLS and code signing).
Are you using a gateway service?
If using a gateway service, you must also set up a Trust Lifecycle Manager account as follows:
Items to note about the new S/MIME certificate process:
On August 29, 2023, at 10:00 MDT (16:00 UTC), PKI Platform 8 will make changes to its S/MIME certificate issuance process to align with the new Baseline Requirements for the Issuance and Management of Publicly-Trusted S/MIME Certificates.
| Important: No profile migrations are required! |
The PKI Platform 8 backend will check the S/MIME certificate request for a validated email domain. Based on that check, we will issue the correct certificate type: a mailbox-validated S/MIME certificate, an organization-validated S/MIME certificate, or a sponsor-validated S/MIME certificate.
Mailbox-validated S/MIME certificates
The mailbox-validated S/MIME changes affect the following templates:
To issue industry-compliant mailbox-validated S/MIME certificates, we will do the following:
Sponsor-validated and organization-validated S/MIME certificates
The S/MIME changes affect the following templates:
To issue industry-compliant sponsor S/MIME certificates, we will do the following:
| DigiCert is revalidating all Organizations and acquiring their Organization Identifier value to automatically include in the signed certificate. If you are blocked by any validation errors, contact DigiCert Support. |
Certificate renewals
Your certificate renewal process will remain as-is for all S/MIME interfaces, e.g., web-based flows (OS/Browser, CSR, DigiCert Desktop Client) and automated flows (PKI Client / Enterprise Gateway, API).
However, per the new S/MIME Baseline Requirements, your renewed certificates will contain the correct Subject DN and Certificate Policy OIDs based on the renewed certificate type: Mailbox-validated or Sponsor-validated.
PKI Platform 8 API integrations
Update your API integration to ensure your application adheres to the appropriate profile restrictions to meet the new S/MIME baseline requirements. Note that if an API request contains non-supported fields for a sponsor-validated certificate type (e.g., Organization Unit), we will ignore those fields and continue to sign the appropriate certificate type (with its certificate policy OID).
Email domain validation
On August 29, 2023, at 10:00 MDT (16:00 UTC), Trust Lifecycle Manager will make changes to its S/MIME certificate issuance process to align with the new Baseline Requirements for the Issuance and Management of Publicly‐Trusted S/MIME Certificates.
| Important: No profile migration is required! |
Trust Lifecycle Manager relies on PKI Platform 8 to issue its public S/MIME certificates. Thus, PKI Platform 8 will check the S/MIME certificate request submitted via Trust Lifecycle manager for a validated email domain. Trust Lifecycle Manager currently supports sponsor-validated certificate types.
Sponsor-validated S/MIME certificates
The S/MIME changes affect the 'Public S/MIME Secure Email (via PKI Platform 8)' template. This email template only supports the sponsor-validated S/MIME certificate type.
To issue industry-compliant sponsor-validated S/MIME certificates for Trust Lifecycle Manager, PKI Platform 8 will do the following:
| DigiCert is revalidating all Organizations and acquiring their Organization Identifier value to automatically include in the signed certificate. If you are blocked by any validation errors, contact DigiCert Support. |
Certificate renewals
Your certificate renewal process will remain as-is for all S/MIME interfaces, e.g., web-based flows (Browser PKCS12, CSR, DigiCert Trust Assistant) and automated flows via REST API.
However, per the new S/MIME Baseline Requirements, your renewed certificates will contain the correct Subject DN and Certificate Policy OIDs based on the renewed certificate type: Sponsor-validated.
Trust Lifecycle Manager API integrations
Update your API integration to ensure your application adheres to the appropriate profile restrictions to meet the new S/MIME baseline requirements. Note that if an API request contains non-supported fields for a sponsor-validated certificate type (e.g., Organization Unit), we will ignore those fields and continue to sign the appropriate certificate type (with its certificate policy OID).
Email domain validation
The Trust Lifecycle automated workflows, including REST API, check the email domains in public S/MIME certificate requests against an allowlist containing prevalidated email domains.
