I'm not sure if the question is eligable for this board as I ask for concrete service providers which can be kind of advertisement, but there is also technical issue involved, so I give it a try.
My concrete scenario is as follows:
I want to use S/MIME for EMail encryption. My decision was made in terms of S/MIME as all default E-Mail clients support S/MIME but not PGP without additional plugins. I also want to obtain a trusted certificate and not a self signed one because it will be easier to use with all contacted people in mind.
Now to the problem: I want to be future safe with my EMail archives. As far as I researched, most CAs create their S/MIME certificates with the html < keygen > tag. This lets the browser create a new private public keypair. No problem so far. However, a certificate is usually valid only 1-3 years. If I want to renew my certificate, I have to create a new private/public keypair from the browser. In terms of archiving my emails this leads to a bunch of keys which I have to store/backup and reuse if I want to read an archived email. Furthermore, I will have to try which key is the correct one for decrypting or need the concrete datum and a list at which time which keypair was used.
As far as I understand, this shouldn't be a problem with certificates I receive from CSR requests. I can reuse the CSR every time my certificate expires and keep the same key for all my mails over all years.
So now to the questions: Do you know any CA which offers S/MIME certificates generated by a clients CSR?
Is it even possible to use a default server certificate for S/MIME? (With another email then webmaster, root, ... @mydomain.com but something like [email protected] which is not a default email adress for getting a class 1 domain validated server certificate)
Or do you have other ideas how to obtain long time durability without a mess of keys?