My government issues certificates for many purposed, including e-mail signing. The government doesn't provide e-mail addresses, but it does declare my e-mail in the certificate.

  1. Can I use this certificate to sign e-mail in S/MIME?
  2. Can I use this certificate to sign e-mails using Microsoft Outlook?
  3. Can I use this certificate to sign e-mails in any system, that's not my own developement?
  • $\begingroup$ This might be better to ask at superUser? $\endgroup$
    – kelalaka
    Oct 11, 2019 at 15:33
  • 1
    $\begingroup$ So, the first question is very much answerable here. The second one is off-topic for us, but on topic for Super User (though for them you'd also need to specify how the certificate and its key are stored). For the third one, what do you mean with "not my own development"? Are you asking whether you need to develop your own E-Mail Client (plugin) to sign emails? This depends on the answers to the clarifications of the second question and you probably need to be somewhat more specific about the country so people can figure out whether standard APIs and stuff like that are implemented. $\endgroup$
    – SEJPM
    Oct 11, 2019 at 17:09
  • $\begingroup$ @SEJPM modify ( remove the off-topic parts) and answer? $\endgroup$
    – kelalaka
    Oct 11, 2019 at 18:13
  • 1
    $\begingroup$ I'm voting to close this question as off-topic because this is a question about using Microsoft Outlook software with some government's PKI, not about cryptography. $\endgroup$ Oct 12, 2019 at 1:51

1 Answer 1


If your email is indeed in the cert and the key usage is there, you would expect that you can sign with it, providing that:

  1. the certificate is compatible with the email client;
  2. the signing generation is compatible with the email client;
  3. that you have the entire certificate chain present (otherwise the receiver may miss an intermediate certificate).

And of course the receiver must have a compatible mail client as well and trust the (root) certificate of that government in his own certificate store.

If the Outlook mail client - or any other mail client - is compatible depends on the details. They can often be made compatible by including specific plugins.

Note that Outlook, like many other Microsoft products, depends on the PKI capabilities of the host operating system, i.e. Windows.

  • $\begingroup$ The number 1 is what confused me - what does "compatible" mean? Can I sign an e-mail letter using any certificate with tools like OpenSSL or with my own programming? Will it who as signed by the receiver? Which field in the certificate must state my e-mail address for the i.e. Outlook/Thunderbird/whichEverclient accept is as a valid certificate for signing? $\endgroup$
    – KrNeki
    Oct 16, 2019 at 7:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.