An S/MIME certificate signs every email you send. In Apple Mail, Outlook and Gmail your customer sees the tick; anywhere, they have proof that it was you and that the invoice, the proposal or the contract arrived exactly as it left.
From €25 a year. For businesses, Organisation: €45 a year per address.
Apple Mail, iPhone and Mac
Outlook, Windows and Mac
Illustrations. The exact look varies between versions and email clients.
Email was designed with no way to prove who wrote a message or whether the text is the original. Anyone can send a message “from” you. An S/MIME signature closes that door, one email at a time.
Your customer receives your invoice, the same as always, but with another IBAN. They pay. The money goes to whoever intercepted or imitated the email. It is the most common fraud affecting small businesses.
With S/MIME: the invoice goes out signed; if someone alters it, the signature breaks and the customer sees a warning.“I need an urgent transfer, I’m in a meeting, sort it out and we’ll talk later.” It comes from the right name, with the right text signature. It does not come from the right person.
With S/MIME: the rule becomes simple. A request from the CEO without a digital signature is not carried out.You sent a proposal or a contract; weeks later, the customer produces a version with another price or another clause and says it is the one they received. Your word against theirs.
With S/MIME: the signed email proves what you sent, when you sent it and that it was not altered.All four sign and encrypt in the same way. What changes is the identity confirmed in the certificate: just the address, the person, the person and the company, or the company. For most businesses, Organisation is the right choice.
For you if you want to sign an address today, with no paperwork.
Confirms the email address. Includes no person’s or company name.
2 years: €45 (€22.50/year)
Renewal: €20/year
For you if you work on your own account: lawyer, accountant, doctor, architect.
Includes your name, confirmed by an identity document.
2 years: €65 (€32.50/year)
Renewal: €30/year
For you if you want to sign shared addresses: info@, billing@, support@.
Issued in the company’s name, without a person’s name, and works for whoever uses the mailbox.
2 years: €85 (€42.50/year)
Renewal: €40/year
For you if you have a team and want each person to sign with their name and the company’s.
Includes the person’s name and the company name. It is what the recipient wants to see.
2 years: €105 (€52.50/year)
Renewal: €50/year
Prices per certificate, excluding VAT, paid once for the chosen term. Issuance times count from delivery of the documents requested by the Certification Authority.
They see the signature. Gmail, including the free version, checks it and shows a seal next to the recipients; clicking it shows who signed and with which certificate. Outlook, Apple Mail and Thunderbird show it too. And the signature travels inside the email and stays there: anyone can verify it, even outside the email client. Only Gmail’s blue tick comes from somewhere else: BIMI with a VMC certificate.
On iPhone, iPad and Mac, messages with a valid signature show a blue tick next to the sender’s address.
On Windows, Mac and the web with Microsoft 365 accounts, it shows the signature seal and the name confirmed in the certificate.
Shows the valid signature icon in the header and lets you view the sender’s certificate.
Checks the signature and shows a seal next to the recipients, including on free accounts. Click it to see who signed and with which certificate.
The four certificates side by side.
| Mailbox | Individual | Organisation Recommended | Sponsored | |
|---|---|---|---|---|
| What the certificate confirms | The email address | The person | The company | The person and the company |
| Name in the certificate | None | Person’s name | Company name | Person’s and company name |
| How it is validated | Confirmation email | Identity document, online | Company’s business register | Company’s business register; each person’s document and proof of employment |
| Issuance time | Minutes | A few business days | A few business days | A few business days |
| Tick in Apple Mail, seal in Outlook and Gmail | Yes | Yes | Yes | Yes |
| Best for | One address, no paperwork | Self-employed professionals | Businesses: info@, billing@, support@ | Teams signing with a person’s name |
| Price, 1 year | €25 | €35 | €45 | €55 |
| Price, 2 years | €45 (€22.50/year) | €65 (€32.50/year) | €85 (€42.50/year) | €105 (€52.50/year) |
| Renewal, per year | €20 | €30 | €40 | €50 |
Prices per mailbox, excluding VAT. The types correspond to the Mailbox-validated, Individual-validated, Sponsor-validated and Organization-validated profiles in the CA/Browser Forum S/MIME requirements.
Save the email as a file (.eml) and drop it here, or paste its source. We tell you whether it is signed, by whom, and whether the signature is valid. Nothing is stored: the file is analysed and deleted.
In Apple Mail: File, Save As, format Raw Message Source. In Outlook: drag the message to the desktop. In Gmail: message menu, Show original, Download.
Tell us the certificate type and the addresses. Depending on the type, the Certification Authority confirms the address by email, the identity with an identity document, or the company against the business register. We prepare everything and follow the process.
Once the certificate is issued, install it with our guide on iPhone, iPad, Mac or Outlook, or book a remote session and we install it with you. You keep a backup of the key and test the first signed email.
Every email goes out signed without you doing anything. We remind you before the certificate expires and handle the renewal. If you change devices, install the backup; if you lose one, we revoke it immediately.
SMIME.PT is a service of Sooma.com Web Services, a European email and hosting provider based in Portugal. The certificate is issued by a European Certification Authority; validation, installation, renewal and support are ours, from people who deal with email every day.
Sister products: BIMI.PT, your brand’s logo in every email, and Registered Email, with legal proof of sending, delivery and reading.
It works, and it shows. Gmail, including free accounts, checks the signature and shows a seal next to the recipients; clicking it shows who signed and with which certificate. On top of that, the signature travels inside the email: anyone, including an expert witness or a court, can verify it from the message file, with or without Gmail.
No, it complements them. SPF, DKIM and DMARC protect the domain while the email travels and stop counting once the message is forwarded, archived or printed. S/MIME signs the message itself: it proves the person or the company and the content, at the recipient, for good. BIMI puts the logo next to the email; S/MIME puts the tick there. A well-protected business has DMARC, BIMI and S/MIME.
To see that the email is signed, no: an email client that supports S/MIME is enough. To receive encrypted email, yes: encryption uses the recipient’s certificate, so both sides need one.
No. It is one certificate per email address, installed on every device where you use it. The guide covers all of them, and the backup lets you install it on a new device.
Anyone who opens the signature details sees what the certificate confirms. With Mailbox, they see the email came from that address. With Individual, they see the person’s name, confirmed by a document. With Sponsored, they see the person’s name and the company’s. With Organisation, they see the company name. For most businesses, Organisation is the starting point: it signs the company’s addresses in the company’s name, regardless of who works there. Sponsored adds the person’s name, for people who sign in their own name and the company’s.
Partly. The certificate signs Word, Excel and PowerPoint files, with the name in the certificate, at no extra cost. It also signs PDFs, but Adobe Acrobat only validates the signature automatically with certificates on its trust list (AATL), and S/MIME certificates are not on it: the recipient sees the signature, not the confirmation. If you need to sign PDFs with automatic validation in Acrobat, there is a dedicated certificate for that; let us know.
It is not a qualified electronic signature like those made with the Portuguese Citizen Card or Chave Móvel Digital. It is an electronic signature made with a certificate issued by an audited Certification Authority, which proves the origin and integrity of the message and, for the types with a name, identifies who signed. For contracts where the legal weight of the signature is decisive, take legal advice on the level required. If you need legally valid proof of sending, delivery and reading, see Sooma’s Registered Email.
It depends on what happened. If you changed devices, install the backup on the new one and you are done; without a backup, a new certificate is issued. If the device was lost or stolen, revoke the certificate: tell us and we do it immediately, at no cost. From then on no one can sign emails in your name with that key, and the emails you signed before remain valid as of the date they were sent. Then we issue a new certificate. The backup is what lets you read old encrypted emails, which need the key they were encrypted with; keep it somewhere you will find it in two years’ time, and never on the same device.
No. The key is generated for you and stays on your devices and in your backup. Sooma helps with issuance and installation; it does not keep the key.
One or two years, your choice. We remind you before it expires and handle the renewal, at the renewal price, which is lower than the first issuance. Emails signed before keep showing the signature as valid as of the date they were sent.
X.509 certificates compliant with the CA/Browser Forum Baseline Requirements for S/MIME, Multipurpose or Strict profile, in the Mailbox-validated, Individual-validated, Sponsor-validated and Organization-validated types. RSA 2048, 3072 or 4096-bit key (or ECC 256/384, signing only) generated on the client side, emailProtection EKU, chain of trust from a European Certification Authority, WebTrust-audited and trusted by Apple, Microsoft and Google systems, status checkable via CRL and OCSP. Delivered as a password-protected PKCS#12, or via CSR if you prefer to generate the key on your own system. For many mailboxes, centralised issuance and management.
We reply on the next business day with the validation steps and the installation guide. If you are not sure which type to choose, leave “advise me” and we will tell you.
Prefer to talk? +351 210 205 164, business days, 9:00 to 18:00 Lisbon time, or support@sooma.com.
Got the tick? Now add the logo. BIMI puts your brand’s logo next to every email, in Gmail and Apple Mail, with the blue tick in Gmail.
Discover BIMI.PT