How to Generate S/MIME Certificates with mkcert for Email Encryption

mkcert automatically generates S/MIME certificates when you provide an email address as an argument, setting the appropriate Extended Key Usage and Subject Alternative Name entries without requiring additional flags.

When you need to secure email communications with S/MIME encryption, mkcert simplifies the process by detecting email addresses and automatically configuring the certificate for Email Protection. This local certificate authority tool, developed by Filippo Valsorda, eliminates the complexity typically associated with generating X.509 certificates for secure email.

How mkcert Detects Email Addresses for S/MIME

The detection logic resides in cert.go, where mkcert parses the list of hosts provided via command-line arguments. When parsing, the tool uses Go's standard library function mail.ParseAddress to identify valid email addresses.

If a name parses successfully as an email address, mkcert adds it to the certificate template's EmailAddresses slice rather than treating it as a DNS hostname. This automatic classification ensures that alice@example.com becomes a Subject Alternative Name (SAN) of type rfc822Name instead of a DNS SAN entry.

Extended Key Usage and Certificate Structure

When the EmailAddresses slice contains one or more entries, mkcert automatically sets the Extended Key Usage (EKU) flag x509.ExtKeyUsageEmailProtection in the certificate template. This EKU is required for S/MIME certificates and indicates that the private key may be used for email encryption and digital signatures.

The certificate generation in cert.go handles this logic conditionally:

• If email addresses are present, the certificate includes ExtKeyUsageEmailProtection
• If only DNS names are provided, the certificate uses ExtKeyUsageServerAuth instead
• Mixed certificates (containing both email and DNS names) receive both EKU flags

Generating S/MIME Certificates: Practical Examples

Basic S/MIME Certificate Generation

To create an S/MIME certificate for a single email address, pass the email as the argument:

mkcert filippo@example.com

This creates two files:

• filippo@example.com.pem — The certificate containing the EmailAddress SAN and EmailProtection EKU
• filippo@example.com-key.pem — The corresponding private key

Multiple Email Addresses in One Certificate

You can generate a single certificate valid for multiple email addresses by providing multiple arguments:

mkcert -cert-file team.pem -key-file team-key.pem alice@example.org bob@example.org

The resulting certificate includes both email addresses in the SAN extension and can be used by either recipient for S/MIME operations.

Exporting to PKCS#12 for Email Clients

Most email clients require certificates in PKCS#12 format (.p12 or .pfx) rather than separate PEM files. Use the -pkcs12 flag to bundle the certificate and private key:

mkcert -pkcs12 -p12-file mycert.p12 alice@example.org

The default export password is changeit. Import mycert.p12 into Thunderbird, Outlook, or Apple Mail to enable S/MIME signing and encryption. The certificate's EmailProtection EKU ensures compatibility with these clients' S/MIME implementations.

Summary

• mkcert automatically detects email addresses using mail.ParseAddress and creates S/MIME certificates without additional flags
• The certificate includes Subject Alternative Names of type rfc822Name for each email address provided
• Extended Key Usage EmailProtection is automatically set when email addresses are present, as implemented in cert.go
• Use the -pkcs12 flag to export certificates for compatibility with email clients like Thunderbird and Outlook

Frequently Asked Questions

Does mkcert require special flags to generate S/MIME certificates?

No. mkcert automatically generates S/MIME certificates when you provide an email address as an argument. The tool detects valid email addresses using Go's mail.ParseAddress function and automatically configures the certificate with the EmailProtection Extended Key Usage. No additional command-line flags are required beyond the email address itself.

What file formats does mkcert output for S/MIME certificates?

By default, mkcert outputs separate PEM-encoded files: a certificate file (.pem) and a private key file (-key.pem). For email client compatibility, you can use the -pkcs12 flag to generate a PKCS#12 file (.p12 or .pfx) that bundles both the certificate and private key together, which most mail applications can import directly.

Can I use mkcert S/MIME certificates with Thunderbird or Outlook?

Yes. The certificates generated by mkcert are standard X.509 certificates with the ExtKeyUsageEmailProtection flag, making them compatible with Mozilla Thunderbird, Microsoft Outlook, Apple Mail, and other S/MIME-capable email clients. Export the certificate using the -pkcs12 flag and import the resulting .p12 file into your email client's certificate manager to enable signing and encryption.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}