Did you know, the first email was sent in 1971, over half a century ago? Over the years, the way we send emails has changed as the development of technology has evolved. And the importance of securing emails by using S/MIME is to safeguard the confidentiality, integrity, and authenticity of sensitive communication providing a robust defense against unauthorized access and tampering.
S/MIME or Secure/Multipurpose Internet Mail Extension is a widely used protocol and for the first time since its inception, is now included within the Certificate Authority/Browser (CA/B) Forum, which establishes industry standards and guideline to enhance the security and trustworthiness of internet use. The S/MIME changes implemented from the CA/B Forum takes effect from September 1, 2023.
The Baseline Requirements (BR) outline the minimum allowable settings and configurations for S/MIME.
Four Different Validation Types
With this BR comes four different validation types, which contains different information namely:
- Mailbox-validated – that will contain just the email address and/or a serial number
- Organization-validated – is for organizational use with the organization’s name and organization’s email address
- Sponsor-validated – contains the person’s full name and organizational email, as well as the organization they belong to
- Individual-validated – includes a person’s full name and personal email address
GlobalSign already provided these validation processes within the product range PersonalSign.
| PersonalSign1 | PersonalSign2 Pro (EMEA only) | Business Use | Organization or Department Use |
| Certificate represents only the email address of an individual | Certificate represents both the email address and named individual | Certificate represents an employee at an organization and includes the employee’s name, email, and company name | Certificate represents name of an organization or email address of a department with Organizational details |
| Needs video-based verification currently supported only in English for EMEA | Can support one to multiple users in the organization through Enterprise account and have faster turnaround |
Introducing S/MIME Generations
With these certificate types, S/MIME BR introduced Generations to define each certificate profile, namely:
- Legacy – which is the model most similar to what is being used today but will be deprecated as its configurations may become obsolete
- Strict – clearer defined configurations and is geared towards long term usage
- Multipurpose – follows the Strict profile with defined configurations and has additional options to allow flexibility for other usage
GlobalSign will be implementing a new intermediate certificate to adhere to the Baseline Requirements for standard customers, and these will take effect on August 28th, 2023
For more information we encourage you to read the relevant support articles:
If you are using GCC, click here
If you are using Atlas, click here
Changes to EPKI Profiles: Organizational Identifier
Additionally, a field will be added when new customers are submitting an S/MIME profile to be vetted and this affects profiles with organizational information as they will be required to add an Organization Identifier or OID (also called as Legal Entity Identifier or LEI). The organization’s registration number or tax number can be used alternatively.
As an EPKI user with S/MIME certificates you are strongly encouraged to read our support articles which give further details about how this impacts the vetting process.
For Enterprise PKI users, click here
And for Enterprise PKI API users, click here
Other S/MIME Baseline Requirements to Note
S/MIME Baseline Requirements have specified validation methods that should be used to prove the identities of the user and their control over email addresses. These are; validating control of the mailbox via email message, validating authority of the mailbox via domain, and validating the applicant as the operator of the mail server(s).
Further to this, the S/MIME Baseline Requirements have also defined the duration of the of the validation. Organization and individual identity shall not be used for more than 825 days before previous validation. Similarly, validation of the mail server and domain control shall be obtained at least 398 days before issuing the Certificate.
Click here to learn more details about the S/MIME BRs
Or if you are still not using S/MIME certificates and are interested, you may contact us here.
