I'm testing out a way that myself and a few others could use S/MIME for our email traffic. I'm using Outlook 2016 with Win10. I have generated my test certificate with the following command in PowerShell:

New-SelfSignedCertificate -Subject "CN=IansEmail" -KeyUsage DataEncipherment,KeyEncipherment,NonRepudiation,DigitalSignature -SmimeCapabilities

I then export this certificate to a PFX file using the MMC Certificate snap-in. Then I:

1) Open Outlook

2) Navigate to File -> Options -> Trust Center -> Trust Center Settings -> Email Security

3) Click on Import/Export and select my certificate

4) Enter the password for my PFX file

5) A dialog pops up that says "This app needs to create a cryptographic key". I uncheck the "Require a password with this key" and hit Ok.

6) Still on the Email Security dialog I check "Encrypt contents ... " and "Add digital signature ...". I then click "Settings" under "Encrypted email heading" and click the "Choose" button next to "Signing Certificate". Upon doing so I see a message that says "No certificate available".

enter image description here

What am I missing?

  • Found this Microsoft doc which should help blogs.technet.microsoft.com/pki/2008/12/17/… – user2320464 Jul 28 '17 at 20:17
  • The "New-SelfSignedCertificate" statement seems to be generating an Intermediate Root Cert; at least that's where the certificate ends up when I create it using the parameters you indicated. A Root Cert isn't the right type of cert to sign/encrypt files or email. – Wolske Aug 1 '18 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.