Knowledge Base

Knowledge Base Sectigo Certificate Manager (SCM)

How to Request an S/MIME Client Certificate Using Sectigo Certificate Manager (SCM)

Updated on August 1, 2026

What Is an S/MIME Client Certificate?

An S/MIME client certificate is a certificate issued to an individual user to help secure email communication. It can be used to digitally sign emails so recipients can verify the sender and confirm that the message has not been changed. It can also be used to encrypt emails so only the intended recipient can read the message.

S/MIME certificates are commonly used with email clients such as Outlook, Apple Mail, and Gmail when the email client is configured to support S/MIME.

Prerequisites

An Enrollment Form has been created in SCM.
The user’s Person record exists in SCM.
The user has received the Enrollment Form URL.
The user has any required authentication details, such as a Secret ID, if the enrollment form requires one.

Steps to Request an S/MIME Client Certificate in SCM

Step 1 — Open Enrollment Forms in SCM

Log in to the SCM dashboard and go to Enrollment > Enrollment Forms. This is where administrators create and manage enrollment forms for certificate requests.

Figure 1: The screenshot shows the SCM navigation menu with Enrollment Forms selected under the Enrollment section.

Step 2 — Create a Client Certificate Enrollment Form

Click the Add (+) button to create a new enrollment form. In the Create Enrollment Form window, enter a clear form name and select Client certificate enrollment form as the type. Use a descriptive name that identifies the organization or purpose of the form, such as OrgName Client Certificate.

Figure 2: The screenshot shows the Create Enrollment Endpoint window with fields for Name and Type. The selected type is Client certificate enrollment form.

Step 3 — Generate the Enrollment Endpoint URL
On the Details tab, click Generate to create the Enrollment Endpoint URL. Save this URL because it must be shared with users who need to request an S/MIME client certificate.

Figure 3: The screenshot shows the Details tab for the enrollment form with the generated endpoint URL displayed.

Step 4 — Configure Authentication for the Enrollment Form

Open the Configuration tab and choose the authentication method for the enrollment form. Select Email Confirmation or Secret ID, depending on how users should authenticate before submitting the certificate request. If users need additional help during enrollment, add help instructions or a link to an external help page.

Figure 4: The screenshot shows the Configuration tab with available authentication options including Email Confirmation, Identity Provider, and Secret ID.

Step 5 — Save the Enrollment Form

Click Save to finish creating the enrollment form. After the form is saved, it can be opened again from Enrollment > Enrollment Forms.

Step 6 — Add an Account to the Enrollment Form

Go back to Enrollment > Enrollment Forms and open the form you created. Select the Accounts tab, then click Add (+).

Enter the account details, including:

Name
Organization
Department
Applicable certificate profile
Applicable CSR generation method
Required authorization method such as Secret ID or Access Code

Click Save to add the account.

Figure 5 and 6: The screenshots show the Accounts tab and the Create Client Certificate Enrollment Form Account window where account details, profiles, CSR generation methods, and authorization options are configured.

Step 7 — Add the User as a Person in SCM

In the SCM dashboard, go to Persons and click Add (+).

Enter the required information:

Organization
Department
Domain
First Name
Last Name
Email Address

On the Details tab, configure the Common Name (CN), Validation Type, and Secret ID if Secret ID authentication is used. Click Save when finished.

If multiple users must be added, use the CSV bulk import option.

Figure 7,8 and 9: The screenshots show the Persons menu, Add New Person form, and Details tab used to configure identity and authentication information.

Step 8 — Open the Enrollment Form URL

Open the Enrollment Form URL generated earlier. The user must authenticate using the configured method such as Email Confirmation or Secret ID.

Figure 10: The screenshot shows the enrollment page where users enter authentication details before continuing the request.

Step 9 — Submit the Client Certificate Request

Complete the enrollment form and submit the certificate request. After issuance, download the certificate. The certificate is typically provided in PKCS#12 (PFX) format.

Figure 11: The screenshot shows the client certificate enrollment form with fields for organization, department, email, certificate profile, first name, last name, and comments.

How to Verify the S/MIME Client Certificate Request Was Completed Successfully

The request is complete when the certificate has been issued and the user can download the certificate file from the enrollment workflow. The downloaded certificate is typically available in PKCS#12 (PFX) format.

Troubleshooting

1) Issue: The user cannot access the enrollment form

Cause: The user may not have the correct Enrollment Form URL or required authentication details.

Solution: Confirm that the user has the correct generated Enrollment Form URL and the required authentication method.

2) Issue: The user cannot authenticate during enrollment

Cause: The configured authentication method requires Email Confirmation or Secret ID.

Solution: Verify the selected authentication method in the Configuration tab and provide the necessary details.

3) Issue: The user is not available for certificate enrollment

Cause: The Person record may not exist in SCM.

Solution: Add the user under Persons in SCM before submitting the enrollment request.