# How to Generate S/MIME Certificates with mkcert for Email Encryption > Learn how mkcert generates S/MIME certificates for email encryption automatically. Discover how to set up email encryption with mkcert effortlessly, ensuring secure communication for your email addresses. - Repository: [Filippo Valsorda/mkcert](https://github.com/FiloSottile/mkcert) - Tags: how-to-guide - Published: 2026-03-05 --- **mkcert automatically generates S/MIME certificates when you provide an email address as an argument, setting the appropriate Extended Key Usage and Subject Alternative Name entries without requiring additional flags.** When you need to secure email communications with S/MIME encryption, mkcert simplifies the process by detecting email addresses and automatically configuring the certificate for **Email Protection**. This local certificate authority tool, developed by Filippo Valsorda, eliminates the complexity typically associated with generating X.509 certificates for secure email. ## How mkcert Detects Email Addresses for S/MIME The detection logic resides in [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go), where mkcert parses the list of hosts provided via command-line arguments. When parsing, the tool uses Go's standard library function `mail.ParseAddress` to identify valid email addresses. If a name parses successfully as an email address, mkcert adds it to the certificate template's `EmailAddresses` slice rather than treating it as a DNS hostname. This automatic classification ensures that `alice@example.com` becomes a **Subject Alternative Name (SAN)** of type `rfc822Name` instead of a DNS SAN entry. ## Extended Key Usage and Certificate Structure When the `EmailAddresses` slice contains one or more entries, mkcert automatically sets the **Extended Key Usage (EKU)** flag `x509.ExtKeyUsageEmailProtection` in the certificate template. This EKU is required for S/MIME certificates and indicates that the private key may be used for email encryption and digital signatures. The certificate generation in [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go) handles this logic conditionally: - If email addresses are present, the certificate includes `ExtKeyUsageEmailProtection` - If only DNS names are provided, the certificate uses `ExtKeyUsageServerAuth` instead - Mixed certificates (containing both email and DNS names) receive both EKU flags ## Generating S/MIME Certificates: Practical Examples ### Basic S/MIME Certificate Generation To create an S/MIME certificate for a single email address, pass the email as the argument: ```bash mkcert filippo@example.com ``` This creates two files: - `filippo@example.com.pem` — The certificate containing the EmailAddress SAN and EmailProtection EKU - `filippo@example.com-key.pem` — The corresponding private key ### Multiple Email Addresses in One Certificate You can generate a single certificate valid for multiple email addresses by providing multiple arguments: ```bash mkcert -cert-file team.pem -key-file team-key.pem alice@example.org bob@example.org ``` The resulting certificate includes both email addresses in the SAN extension and can be used by either recipient for S/MIME operations. ### Exporting to PKCS#12 for Email Clients Most email clients require certificates in **PKCS#12** format (`.p12` or `.pfx`) rather than separate PEM files. Use the `-pkcs12` flag to bundle the certificate and private key: ```bash mkcert -pkcs12 -p12-file mycert.p12 alice@example.org ``` The default export password is `changeit`. Import `mycert.p12` into Thunderbird, Outlook, or Apple Mail to enable S/MIME signing and encryption. The certificate's `EmailProtection` EKU ensures compatibility with these clients' S/MIME implementations. ## Summary - **mkcert automatically detects email addresses** using `mail.ParseAddress` and creates S/MIME certificates without additional flags - The certificate includes **Subject Alternative Names** of type `rfc822Name` for each email address provided - **Extended Key Usage EmailProtection** is automatically set when email addresses are present, as implemented in [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go) - Use the **`-pkcs12`** flag to export certificates for compatibility with email clients like Thunderbird and Outlook ## Frequently Asked Questions ### Does mkcert require special flags to generate S/MIME certificates? No. mkcert automatically generates S/MIME certificates when you provide an email address as an argument. The tool detects valid email addresses using Go's `mail.ParseAddress` function and automatically configures the certificate with the `EmailProtection` Extended Key Usage. No additional command-line flags are required beyond the email address itself. ### What file formats does mkcert output for S/MIME certificates? By default, mkcert outputs separate **PEM-encoded files**: a certificate file (`.pem`) and a private key file (`-key.pem`). For email client compatibility, you can use the `-pkcs12` flag to generate a **PKCS#12** file (`.p12` or `.pfx`) that bundles both the certificate and private key together, which most mail applications can import directly. ### Can I use mkcert S/MIME certificates with Thunderbird or Outlook? Yes. The certificates generated by mkcert are standard X.509 certificates with the `ExtKeyUsageEmailProtection` flag, making them compatible with **Mozilla Thunderbird**, **Microsoft Outlook**, **Apple Mail**, and other S/MIME-capable email clients. Export the certificate using the `-pkcs12` flag and import the resulting `.p12` file into your email client's certificate manager to enable signing and encryption.