Knowledge Base

How to Install and Export an S/MIME Email Certificate for Apple Mail and Outlook on OS X

Updated on June 19, 2026

Overview

By the end of this guide, you will have installed your Secure/Multipurpose Internet Mail Extensions (S/MIME) email certificate on your Mac, exported a backup copy, and configured Apple Mail and Outlook for OS X to digitally sign and encrypt email. An S/MIME certificate lets you digitally sign and/or encrypt messages in most email clients. This guide covers installing the certificate in OS X, exporting it for use on other devices, and enabling signing and encryption in Apple Mail and Outlook.

Install the certificate in OS X

Double-click the certificate file you downloaded or exported.

When OS X Keychain Access prompts you for the certificate passphrase, enter the password you created when you exported the certificate from your browser.

The certificate is installed on your Mac and appears in the My Certificates section of Keychain Access, ready for Apple Mail, Outlook, and other apps that use client certificates.

Note: The certificate is only available on the computer and user account where you install it. To use it on another computer or device, export it (see the next section).

Export the certificate

From the Applications folder, open the Utilities folder, then open Keychain Access.

Select the keychain where you installed the certificate — usually the login keychain.

In the Categories section, select Certificates. The right pane lists your installed certificates.

Select the certificate associated with your name. If you have more than one personal certificate, choose the one with the latest expiration date.

Right-click the certificate and select Export (or, from the File menu, select Export Items).

Choose a location such as your Desktop. The file name should end in .p12, and the file format must be Personal Information Exchange (.p12).

Set a strong passphrase for the exported file.

When prompted, enter your login keychain password (usually the same password you use to log in to your Mac). You can then transfer the encrypted .p12 file to another computer using a Universal Serial Bus (USB) drive, email, or another file-sharing method.

Use the certificate with Apple Mail

Enable signing and encryption

If you just installed the certificate, quit and restart Mail.

Start composing a message. A Signed icon (a checkmark) should appear at the lower right of the message header, indicating the message will be signed. If it does not appear, select Customize at the lower left of the header and add the Lock and Signed icons.

Sign a message

Confirm the Signed icon shows a checkmark, not an “x”. If it shows an “x”, the message will not be signed. You may not want to sign messages to mailing lists, because S/MIME signatures are attachments that some lists reject.

Encrypt a message

If you have the public certificate for every recipient, click the open Lock icon at the lower right of the header to lock it; when locked, the message will be encrypted. If you do not have certificates for all recipients, you will be prompted to send the message unencrypted.

Use the certificate with Outlook for OS X

Enable signing and encryption

If you just installed the certificate, quit and restart Outlook.

From the Outlook menu, select Preferences > Accounts. Select your email account, click Advanced, and select the Security tab.

In the Digital signing section, select your certificate from the drop-down menu.

For Signing algorithm, the default Secure Hash Algorithm 256 (SHA-256) is appropriate for most situations.

For best usability, enable Sign outgoing messages, Send digitally signed messages as clear text, and Include my certificates in signed messages.

In the Encryption section, select your certificate from the drop-down menu.

For Encryption algorithm, Advanced Encryption Standard 256 (AES-256) is the best option. You do not have to enable Encrypt outgoing messages — you can encrypt each message individually when composing it.

Leave the Certificate authentication options unset unless your organization requires them.

Click OK to save your changes and exit Outlook Preferences.

Sign a message

By default, your messages are digitally signed; a lock icon with the text “This message will be digitally signed” appears at the lower left of the header. To not sign a message, on the Options tab select Security and uncheck Digitally Sign Message. (Avoid signing mailing-list messages, as S/MIME signatures are attachments some lists reject.)

Encrypt a message

Compose your message, then on the Options tab select Security and check Encrypt Message. If Outlook cannot find certificates for all recipients, you will be prompted to send the message unencrypted.