Update planned with respect to latest S/MIME CA/Browser forum guidelines for S/MIME

 2024-09-26 01:17:00

Reason for the Change

In accordance with the most recent CA/B Forum guidelines, starting from July 15th, 2025, Certificate Authorities (CAs) are prohibited from issuing any outdated versions of S/MIME Certificates. Consequently, we will transition to supporting the multipurpose generation of certificates.

Please note that the maximum validity permitted for multipurpose generation is 825 days. Consequently, the availability of a 3-year license will cease in the future.

What's Changing?

We will discontinue support for legacy certificates as of May 26th, 2025.

To support multipurpose, the Subject Distinguished Name (DN) must include either the givenName and surname or pseudonym.

We are aiming to introduce these new fields starting from December 9th, 2024. While these fields will be mandatory for APIs from May 26th, 2025, they will become mandatory for the User Interface from December 9th, 2024.

Furthermore, the validity of certificates will be limited to 2 years for all issued and reissued certificates starting from January 27th, 2025.

Please refer to the Summary of Changes provided below for more details:

Effective Date Impacted Product Name Change planned
December 9th, 2024
  1. Enterprise PKI Lite for Personal Digital ID 
  2. Enterprise PKI Lite for S/MIME  
 New Fields will be introduced
  • New givenName, surname or pseudonym fields will be introduced as optional fields for API based orders, and can be used, if you want your personal name (givenName + surname) Or pseudonym to be in common name.  
  • New givenName, surname or pseudonym fields will be introduced as mandatory fields on our user interface orders.  
December 9th, 2024 Personal Sign 2 Pro New Fields will be introduced
  • New givenName and surname fields will be introduced as optional fields for API based orders, and can be used, if you want your personal name (givenName + surname) to be in commonname.
  • New givenName and surname fields will be introduced as mandatory fields on our user interface orders.
January 27th 2025 Enterprise PKI Lite for Personal Digital ID
  1. Enterprise PKI Lite for Department Digital ID
  2. Enterprise PKI Lite for S/MIME
  • 3-Year License will no longer be supported for S/MIME Profile in EPKI
  • 3-year license, will continue to be supported, if you use it for non-S/MIME profiles under EPKI.
  • Reissue, and renewal will continue to be supported from existing licenses until May 26th for S/MIME Profiles. *
  • No impact on reissue or renewal for Enterprise PKI Lite for Department Digital ID
January 27th 2025
  1. Personal Sign 1
  2. Personal Sign 2 Pro
  3. Personal Sign 2 Department
  • 3-year validity selection will not be supported from January 27th 2025.
May 26th 2025
  1. Personal Sign 2 Pro
  • givenName, and surname fields will be made mandatory in API- based orders.
  • Certificate issued will be of multipurpose generation.
  • Reissue and renewal for existing legacy type will not be supported.
  • Reissue and renewal for new certificates issued after May 26th 2025, will have no impact and will be supported.
May 26th 2025
  1. Enterprise PKI Lite for Personal Digital ID
  2. Enterprise PKI Lite for S/MIME
  • givenName, surname and pseudonym fields will be made mandatory in API based orders.
  • Certificate issued will be of multipurpose generation.
  • Reissue and renewal for existing legacy type will not be supported.
  • Reissue and renewal for new certificates issued after May 26th 2025, will have no impact and will be supported

Please note that in the multipurpose type, in case of Enterprise PKI for S/MIME and Personal Digital ID, the common name can only include a personal name (given name + surname) or pseudonym or an email address. For Personal Sign 2 Pro, Pseudonyms are not supported so common name can only include a personal name (given name + surname) or an email address.

What action needs to be taken?

We request you to start using these fields from their effective dates as indicated and make any necessary changes to your systems well in advance with respect to supporting these fields.

There will be no impact on your current issued certificates, and they will continue to work until their validity date.

< Back to CA/Browser Forum Updates