Knowledge Base

How to Generate a CSR for an S/MIME Email Certificate Using certreq

Updated on June 19, 2026

Overview

By the end of this guide, you will have created a Certificate Signing Request (CSR) for a Secure/Multipurpose Internet Mail Extensions (S/MIME) email certificate and submitted it to Sectigo. The procedure uses the built-in Windows certreq command. You will create a request.inf configuration file, run certreq to produce the CSR, submit it to Sectigo, and then install and export the issued certificate.

Prerequisites

A Windows computer where you can run Command Prompt.

A text editor such as Notepad.

Your personal details for the certificate: full name, email address, and two-letter country code.

Steps

Create the request.inf configuration file.

Open a text editor such as Notepad and paste the configuration shown below. Edit only the Subject line to include your details: CN is your full name, E is your email address, and C is your two-letter country code. Save the file as request.inf.

[NewRequest]

;Change the Subject line below so that CN, E, and C reflect your personal details.

Subject = "CN=Your Name, E=your-email-address, C=US" ;<=== edit before saving

KeySpec = 1

KeyLength = 2048

Exportable = TRUE

MachineKeySet = FALSE

SMIME = TRUE

PrivateKeyArchive = FALSE

UserProtected = FALSE

UseExistingKeySet = FALSE

ProviderName = "Microsoft RSA SChannel Cryptographic Provider"

ProviderType = 12

RequestType = PKCS10

KeyUsage = 0xa0

HashAlgorithm = SHA256

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.4 ; secure email

Generate the CSR with certreq.

Create a new folder (for example, C:\CertRequest) and save request.inf inside it. Open Command Prompt, then run:

CD C:\CertRequest

CERTREQ -new request.inf smime.csr

This generates the CSR and saves it as smime.csr in the same folder. Submit smime.csr to Sectigo to request your S/MIME email certificate.

After Sectigo issues your certificate

Install the issued certificate on the same computer where you generated the CSR by running certreq -accept certificate.crt. You can then export the certificate to a Personal Information Exchange (PFX) file.