After much research, I've finally determined the following rules of how to properly set an S/MIME certificate's properties, which may be useful:
This extension may be critical or non-critical, but PKIX Part 1 recommends that it should be marked critical if it is used.
- to allow key usage for encryption: keyEncipherment
- to allow key usage for signing: use digitalSignature
Include both keys to allow key usage for both purposes.
The extension is used to limit the usage of a key; if the extension is either not present or non-critical, all types of usage are allowed.
It is usually recommended to use different certificates for signing and encrypting, so the encryption key can be deposited, for example to be able to decrypt an employee's messages after they have left the company.
Extended Key Usage
If this extension is marked critical, the certificate must be used for one of the indicated purposes only. If it is not marked critical, it is treated as an advisory field that may be used to identify keys but does not restrict the use of the certificate to the indicated purposes.
I've found that most S/MIME certificates use NO in this field. That's probably because it is not really critical to restrict the usage to email.
Subject Alternate Name
Email addresses may be provided in the Subject Alternative Name extension, the certificate subject name field, or both. However, if the certificate's subject field is empty, this extension must be marked critical=YES.
1..n additional email addresses, separated by a space character
Software that supports S/MIME must be able to read an email address from either the Subject Alternative Name extension or from the subject name field. However, it is recommended to repeat the email address in the Subject Alternative Name in this field.