# What Is S/MIME? Definition and Examples

> S/MIME is a standard for signing and encrypting email messages end to end using X.509 certificates and the Cryptographic Message Syntax.

Source: https://ssl.sh/glossary/smime/
Last updated: 2026-11-10

S/MIME (Secure/Multipurpose Internet Mail Extensions) adds digital signatures and encryption to MIME email using X.509 certificates; the current message specification is S/MIME 4.0 in [RFC 8551](https://www.rfc-editor.org/rfc/rfc8551). A sender signs a message with their [private key](https://ssl.sh/glossary/private-key/) so recipients can verify origin and integrity, and encrypts a message with each recipient's [public key](https://ssl.sh/glossary/public-key/) so only those recipients can read it. S/MIME certificates carry the emailProtection extended key usage and the mailbox address in the Subject Alternative Name; publicly trusted ones are issued under the CA/Browser Forum's S/MIME Baseline Requirements, which define mailbox-, organization-, sponsor- and individual-validated types.

## Why it matters
S/MIME protects a message end to end, independently of the mail servers it passes through, and is built into Outlook, Apple Mail and Thunderbird. That makes it common in enterprises and government for signed notifications and confidential mail. To encrypt, you first need the recipient's certificate, usually obtained from a signed message they sent you. Unlike TLS keys, encryption keys must be kept after renewal: losing an old private key means losing access to mail encrypted to it.

## Example
```bash
openssl cms -sign -in message.txt -signer alice.crt -inkey alice.key -out signed.eml
openssl cms -encrypt -aes256 -in message.txt -out encrypted.eml bob.crt
```

## Common misconceptions
- **S/MIME is the same as TLS between mail servers.** [STARTTLS](https://ssl.sh/glossary/starttls/) protects each server-to-server hop; S/MIME protects the message content itself, end to end.
- **Encryption hides everything.** Headers such as Subject, From and To are normally left unencrypted.
- **Old keys can be deleted after renewal.** Keep them, or previously encrypted mail becomes unreadable.

## Related terms

- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [公钥](https://ssl.sh/zh/glossary/public-key/): 公钥是非对称密钥对中可以公开的一半，写在证书里，供他人验证由对应私钥生成的签名。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [EKU](https://ssl.sh/zh/glossary/extended-key-usage/): EKU 即扩展密钥用途，是列出证书可用于哪些目的（如 serverAuth 服务器认证、clientAuth 客户端认证、代码签名）的 X.509 扩展。
- [PKCS#7](https://ssl.sh/zh/glossary/pkcs7/): PKCS#7 是一种用于签名和加密数据的格式，在 .p7b 或 .p7c 文件中常用来打包一组证书，不含私钥。
- [STARTTLS](https://ssl.sh/zh/glossary/starttls/): STARTTLS 是一条协议命令，用于把 SMTP、IMAP、POP3 等协议中已建立的明文连接，在同一端口上升级为 TLS 加密连接。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。