Topic starter
25/06/2026 10:42 pm
TL;DR: A September 2025 study of more than 38 million S/MIME certificates found that over 90% of recent certificates still lack baseline policy identifiers, while many also fail linting checks or are accepted despite weak structure, according to DigiCert. Email certificate governance now hinges on visibility, not just issuance, because enforcement is finally catching up.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Why Most S/MIME Certificates Are Still Missing the Mark”.
Key questions
Q: What breaks when S/MIME certificates do not meet baseline requirements?
A: When S/MIME certificates miss baseline requirements, organisations can lose reliable signing and encryption assurance even though mail appears to work.
Q: When should organisations prioritise S/MIME certificate cleanup over new issuance?
A: They should prioritise cleanup when existing certificates are already in use for regulated or externally trusted communications, because new issuance does not fix the trust gap in circulation.
Q: What are the signs that S/MIME is not being used effectively across an organisation?
A: Common signs include sensitive email sent in plain text, inconsistent certificate use across clients, failed signature verification, and users relying on manual workarounds to exchange confidential information.
Practitioner guidance
- Inventory all active S/MIME certificates Build a current inventory of certificates used for signing and encryption across internal directories, partner workflows, and regulated business units.
- Run baseline linting across the certificate estate Check for missing policy identifiers, malformed fields, invalid authority information access values, and weak cryptography before stricter clients surface the defects for you.
- Prioritise certificates in regulated communications Focus first on teams handling finance, healthcare, legal, and executive mail flows where broken signatures or failed encryption create immediate compliance and trust consequences.
Bottom line: S/MIME baseline requirements have not by themselves eliminated inconsistent certificate deployment or silent trust drift.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 11:21 pm
Certificate governance has become the real control plane for S/MIME trust: the standard itself is not the problem, the absence of coordinated enforcement is. S/MIME only becomes reliable when issuance, validation, client behaviour, and lifecycle oversight move together. Practitioners should stop treating certificate standards as static policy and start treating them as continuously governed trust infrastructure.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: How should teams respond when email clients accept noncompliant certificates?
A: Treat acceptance as a warning, not a validation of correctness. If clients still accept certificates that violate baseline requirements, the organisation needs stronger linting, clearer issuance controls, and better inventory before enforcement tightens. The goal is to remove uncertainty before client behaviour changes and exposes the problem abruptly.
👉 Read our full editorial: S/MIME baseline requirements expose a certificate governance gap
This post was modified 4 days ago by NHI Mgmt Group