Knowledge Base
How to Install and Use an S/MIME Certificate in Mozilla Thunderbird
Overview
By the end of this article your Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate will be imported into Mozilla Thunderbird and assigned to your email account, so you can digitally sign and encrypt messages. The article explains what an S/MIME certificate is, lists the prerequisites, then covers three phases:
- Import the certificate into Thunderbird
- Assign the certificate to your email account
- Send a signed or encrypted message
Your certificate must be in Public Key Cryptography Standards number 12 (PKCS#12) format, a single password-protected file with the .p12 or .pfx extension that holds both the certificate and its private key. The article closes with verification steps and common failure points.
What is an S/MIME certificate?
A Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate binds your identity to an email address and contains a key pair used for two purposes.
- Digital signing proves to the recipient that a message came from you and was not altered in transit.
- Encryption scrambles a message so that only the intended recipient can read it.
Signing uses your own certificate, but encryption uses the recipient's certificate, which is why you must receive a signed message from someone before you can send them an encrypted one.
Prerequisites
- Mozilla Thunderbird installed on your device, with your email account already configured.
- An issued Sectigo S/MIME certificate in Public Key Cryptography Standards number 12 (PKCS#12) format, saved as a .p12 or .pfx file.
- The password that was set when the PKCS#12 file was created or exported. This password cannot be recovered; without it the file cannot be imported.
Obtain the PKCS#12 certificate file
Download the Public Key Cryptography Standards number 12 (PKCS#12) file from your Sectigo account. You are prompted to create a password during the download. Store that password securely, because Thunderbird will ask for it during the import. If you hold the certificate on macOS rather than as a downloaded file, export it to PKCS#12 format first using the related article listed at the end of this article.
Import the certificate into Thunderbird
This phase places the Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate into the Thunderbird certificate store so the account can use it.
Step 1 — Open Account Settings
Open Mozilla Thunderbird, then open Account Settings for the email account that will use the certificate.
Figure 1: Thunderbird main window with the Account Settings menu open
Step 2 — Open the End-To-End Encryption tab
In Account Settings, select the End-To-End Encryption tab.
Figure 2: Account Settings with the End-To-End Encryption tab selected
Step 3 — Open the certificate manager
Scroll to the S/MIME section and select Manage S/MIME Certificates. The Certificate Manager opens.
Figure 3:End-To-End Encryption page with the Manage S/MIME Certificates button
Step 4 — Start the import
On the Your Certificates tab, select Import.
Figure 4: Certificate Manager on the Your Certificates tab with Import available
Step 5 — Select your certificate file
Browse to your .p12 or .pfx file and select it.
Figure 5: File browser open to select a .p12 or .pfx certificate file
Step 6 — Enter the certificate password
Enter the password that was set when the Public Key Cryptography Standards number 12 (PKCS#12) file was created, then confirm.
Step 7 — Confirm the import
Confirm that your certificate now appears on the Your Certificates tab of the Certificate Manager, then close the manager.
Assign the certificate to your email account
This phase tells Mozilla Thunderbird which imported certificate to use for signing and for encryption on this account. Importing alone does not enable either function.
Step 8 — Open the certificate selection
Return to the End-To-End Encryption tab in Account Settings. In the S/MIME section, select the Select button for the personal certificate.
Step 9 — Choose the certificate
Choose your imported certificate for digital signing, and again for encryption. Thunderbird uses separate settings for the two functions, so both must be set.
Figure 6: Certificate Manager listing the imported personal certificate
Step 10 — Save the settings
Select OK to apply the settings, then close Account Settings.
Figure 7: S/MIME section of Account Settings with the Select button for the personal certificate
Send a signed or encrypted message
This phase uses the assigned Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate on an individual message.
Step 11 — Sign a message
Open a new message, select Security, then select Digitally Sign This Message. Send the message as usual.
Figure 8: Certificate selection dialog for digital signing and encryption
Figure 9: Message compose window with the Security menu open
Step 12 — Encrypt a message
Open a new message, select Security, then select Encrypt This Message. Encryption is only available for recipients whose certificate Thunderbird already holds, which happens automatically once you receive a digitally signed message from them.
Figure 10: Security menu with Digitally Sign This Message and Encrypt This Message options
How to verify success
The setup is working when all three of the following are true:
- Your certificate is listed under Your Certificates in the Thunderbird Certificate Manager.
- The Digitally Sign This Message and Encrypt This Message options are available in the Security menu when composing a new message.
- A signed test message sent to yourself arrives showing a valid signature indicator in the message header.
Troubleshooting
Issue: The import fails with a password or file error
Cause: The password entered does not match the one set when the Public Key Cryptography Standards number 12 (PKCS#12) file was created, or the file is not a valid PKCS#12 file.
Solution: Confirm the file has a .p12 or .pfx extension and re-enter the password. If the password is lost, the file cannot be recovered; download or export the certificate again and set a new password.
Issue: The signing and encryption options are greyed out when composing a message
Cause: The certificate was imported but not assigned to the account, or it was assigned for signing only.
Solution: Complete Step 8 through Step 10 and confirm a certificate is selected for both digital signing and encryption.
Issue: Encryption is unavailable for a specific recipient
Cause: Thunderbird does not hold that recipient's certificate, so it has no public key to encrypt with.
Solution: Ask the recipient to send you a digitally signed message. Thunderbird stores their certificate when you receive it, after which encryption becomes available for that address.
Frequently Asked Questions
Can I use the same certificate in more than one email client?
Yes. The PKCS#12 file can be imported into other clients as well, provided you have the file and its password.
Why can I sign a message but not encrypt it?
Signing uses your own certificate, which you have imported. Encryption uses the recipient's certificate, which Thunderbird obtains only after you receive a digitally signed message from that person.
Does the certificate cover more than one email address?
An S/MIME certificate is issued to the specific email address in the certificate. Assign it to the matching account in Thunderbird; a different address requires its own certificate.
Related Articles
Image Descriptions for the 10 Screenshots
Replace the existing image descriptions — the current ones are export artifacts such as F,{adf099f4-0c5e-4b44-ab4b-29bb88c7a391}{196},12.458333,3.4583333 and must not reach a published article.
| Step | Alt Text | Caption Line |
|---|---|---|
| 1 | Thunderbird main window with the Account Settings menu open | Thunderbird main window with the Account Settings menu open |
| 2 | Account Settings with the End-To-End Encryption tab selected | Account Settings with the End-To-End Encryption tab selected |
| 3 | End-To-End Encryption page with the Manage S/MIME Certificates button | End-To-End Encryption page with the Manage S/MIME Certificates button |
| 4 | Certificate Manager on the Your Certificates tab with Import available | Certificate Manager on the Your Certificates tab with Import available |
| 5 | File browser open to select a .p12 or .pfx certificate file | File browser open to select a .p12 or .pfx certificate file |
| 6 | Certificate Manager listing the imported personal certificate | Certificate Manager listing the imported personal certificate |
| 7 | S/MIME section of Account Settings with the Select button for the personal certificate | S/MIME section of Account Settings with the Select button for the personal certificate |
| 8 | Certificate selection dialog for digital signing and encryption | Certificate selection dialog for digital signing and encryption |
| 9 | Message compose window with the Security menu open | Message compose window with the Security menu open |
| 10 | Security menu with Digitally Sign This Message and Encrypt This Message options | Security menu with Digitally Sign This Message and Encrypt This Message options |
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
