Topic starter
12/07/2026 12:20 pm
TL;DR: CA/B Forum baseline requirements now standardise S/MIME validation profiles, certificate generations, and organisation identifiers, while limiting how long identity and domain checks remain valid, according to GlobalSign. The practical shift is toward tighter email identity governance, shorter trust windows, and clearer lifecycle controls for sensitive communications.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “¿Estás preparado para los nuevos requisitos básicos de CA/B Forum para S/MIME?”.
Key questions
Q: How should security teams manage S/MIME certificates across issuance, renewal, and revocation?
A: Security teams should treat S/MIME as a lifecycle control, not a one-time setup.
Q: Why do S/MIME baseline requirements matter for email trust?
A: They reduce the time a certificate can continue to assert an identity that may no longer be current.
Q: What breaks when organisation identity data is inconsistent in PKI?
A: Issuance, audit, and revocation all become harder to trust.
Practitioner guidance
- Map S/MIME profiles to identity assurance levels Classify mailbox validated, organisation validated, sponsored, and individual validated certificates by the assurance they actually provide, then standardise issuance rules accordingly.
- Align certificate renewal to evidence expiry Set renewal workflows so identity validation and domain checks are refreshed before the 825-day and 398-day limits become operational risk.
- Normalise organisation identifiers across PKI records Use a single authoritative source for LEI, registration number, or tax ID data so organisation-backed certificates remain auditable and consistent.
Bottom line: S/MIME baseline requirements are tightening the link between email certificates and the identity evidence behind them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
S/MIME is becoming an identity governance control, not just an email encryption format. The baseline requirements move certificate issuance closer to formal identity assurance by specifying mailbox, organisation, sponsor, and individual validation profiles. That matters because sensitive email cannot be governed well if the underlying certificate trust model is vague. Practitioners should treat S/MIME as part of the broader identity control plane for trusted communications.
A question worth separating out:
Q: What should teams do when S/MIME certificates are issued for sponsored users?
A: Require a clear sponsorship approval path and document who is accountable for the identity being represented. Sponsored certificates should not rely on mailbox control alone when organisational authority is part of the trust decision.
👉 Read our full editorial: S/MIME baseline requirements tighten email identity governance