Best S/MIME email certificate (2026)

For most people the best S/MIME certificate is a mailbox-validated one; the cheapest we verified on 10 November 2026 was SSL.com Basic S/MIME at $14.00 for one year. To sign for a company or a shared address such as invoices@example.com, choose an organization-validated certificate; Sectigo's was $38.25 at GoGetSSL.

Paying more does not make the encryption stronger; it buys identity in the certificate and the brand of the CA. Prices were copied from the sellers' own pages on 10 November 2026. They change often, so the seller's checkout page is authoritative. We rank by price and features only; commissions never change the order.

Verified S/MIME prices

SSL.com Basic S/MIME at $14.00 was the cheapest mailbox certificate, and Sectigo Organization Validated at $38.25 the cheapest organization certificate.

GoGetSSL also lists a cheaper "Strict" profile of its Sectigo mailbox certificate; the price is shown on the certificate page. The same Sectigo organization certificate cost $38.25 at one seller and $69.00 at another, so compare the identical product first.

The four S/MIME certificate types

Since 1 September 2023 publicly trusted S/MIME certificates follow the CA/Browser Forum S/MIME Baseline Requirements, which define four types by what goes into the certificate subject:

• Mailbox-validated: only the email address (and optionally a common name or serial number). The CA checks that you control the mailbox, typically by sending a confirmation email. Cheapest and fastest.
• Organization-validated: only organization attributes, no personal name. Good for shared or functional addresses.
• Sponsor-validated: a person's name together with the organization they belong to. Suits employees signing on behalf of a company.
• Individual-validated: a person's verified name, no organization.

SSL.com sells individual-, organization- and sponsor-validated tiers in addition to Basic S/MIME. Pick the lowest level that shows what your recipients need to see.

Profiles and validity

Strict and Multipurpose S/MIME certificates may be valid for up to 825 days. The S/MIME Baseline Requirements define three generations of profiles: Strict limits the certificate to email protection and is the long-term target; Multipurpose allows additional extended key usages; Legacy was a transitional profile, and issuing new certificates with it has not been allowed since 15 July 2025.

That makes S/MIME different from website certificates. The TLS schedule (at most 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029) does not apply to S/MIME. Still, a multi-year S/MIME plan can outlast one certificate: SSL.com's 3-year Basic S/MIME plan at $11.90 per year covers more than 825 days, so expect at least one reissue during the term.

What validation looks like

Mailbox validation is an automated email check; organization validation takes days. For a mailbox certificate the CA confirms that you control each address in the certificate, usually through an automated email. For organization certificates Sectigo describes more steps: verifying the organization's legal existence through government or tax sources, an automated phone callback to a verified business number, and an automated Video ID check of the person requesting the certificate.

Email client support

Outlook, Apple Mail and Thunderbird support S/MIME once a certificate is installed; Gmail supports it only in some Google Workspace editions.

• Outlook: Microsoft's guide says you first need a digital ID (certificate) installed, then choose it under the Trust Center's email security settings. To encrypt to someone you need their certificate; Microsoft suggests asking the recipient to send you a signed message and saving them as a contact.
• Apple Mail: you need a certificate for each address you sign from, imported into Keychain Access. If the recipient's certificate is not in your keychain, the message is sent unencrypted.
• Thunderbird: has supported S/MIME for years; since Thunderbird 78 added built-in OpenPGP, you choose between the two technologies in the account's encryption settings.
• Gmail: hosted S/MIME is available only in the Frontline Plus, Enterprise Plus and Education editions of Google Workspace, and an administrator must enable it.

Private keys: generate and back up

Generate the private key yourself if you can, and back it up in every case. The S/MIME Baseline Requirements allow a CA to generate the key pair for you and to escrow a copy, as long as it says so in its policies and tells you; generating the key through a CSR keeps it under your control. Back up the private key: without it you cannot read old encrypted messages after the certificate expires or is replaced. Keep the backup as a password-protected PKCS#12 file; our SSL converter explains the formats.

Which one should you buy?

SSL.com Basic S/MIME at $14.00 suits most individuals; companies need an organization- or sponsor-validated certificate.

• Personal signing and encryption at the lowest price: SSL.com Basic S/MIME, $14.00.
• You prefer a DigiCert certificate: DigiCert S/MIME Class 1, $19.00 at The SSL Store.
• You already buy Sectigo certificates from GoGetSSL or Trustico: Sectigo Mailbox Validated, from $28.25.
• Company, department or shared mailbox: Sectigo Organization Validated, $38.25 at GoGetSSL.
• Employees who must show both their name and the company: a sponsor-validated certificate.

For signing software rather than email, see best code signing certificate; for showing your logo in Gmail, see VMC and BIMI.