How to Configure an S/MIME Certificate in Mozilla Thunderbird

A digital signature option that stays unavailable, or an encryption warning when you try to send a message, usually means Thunderbird does not yet have the right personal certificate connected to the email identity you are using. S/MIME setup has two parts: import a certificate that includes your private key, then assign it to the correct account. This guide walks through both the common certificate-file method and Thunderbird’s newer certificate-signing-request route.

S/MIME means Secure/Multipurpose Internet Mail Extensions. It is a standard for signing and encrypting email. A digital signature lets recipients check that a message was signed with your certificate and has not been altered after signing. Encryption scrambles message contents so only intended recipients with matching private keys can read them. These are separate actions: setting a certificate does not automatically mean every message is encrypted.

Before you begin: what certificate file do you have?

A personal S/MIME certificate binds an email identity to a public key. Its matching private key is what lets you sign messages and decrypt mail sent to you. A certificate authority (CA) issues or validates the certificate. Thunderbird needs the certificate and its private key for your own account; a public certificate by itself is not enough to sign or decrypt.

• A .p12 or .pfx file: This is a password-protected PKCS#12 package that commonly carries a certificate and private key together. Get it from your organization’s administrator or certificate provider, and obtain the import password through a trusted channel.
• A .cer, .crt, or .pem file: These often contain a public certificate only. They may be for a recipient, a CA, or the certificate issued after you created a request. Confirm with the issuer whether the matching private key is already stored in Thunderbird or provided separately.
• A CSR: A Certificate Signing Request contains a public key and identifying information for an issuer. It is not a certificate and cannot be used to sign mail. Thunderbird can create one in version 128 and later; the CA returns the signed certificate for you to import.

For work email, check your organization’s certificate policy first. Use a certificate issued for the exact email address or identity you plan to configure. If you have a smart card or hardware token, follow your organization’s instructions; do not import a private key file if the key is meant to remain on that device.

Option 1: Import a .p12 or .pfx certificate

This is the shortest route when your provider gave you a personal certificate package containing its private key. Menu wording may vary slightly by operating system and Thunderbird release, but the certificate manager is available from account settings and from Thunderbird’s certificate settings.

1. Open Thunderbird and select the application menu (≡) > Account Settings. Choose the email account or identity that matches the certificate, then open End-To-End Encryption.
2. Under S/MIME, select Manage S/MIME Certificates or the similarly named certificate-management button.
3. In Certificate Manager, open Your Certificates and choose Import. Select the .p12 or .pfx file from your provider.
4. Enter the password that protects the certificate package. This is not necessarily the same as Thunderbird’s Primary Password. If prompted to set or unlock a Primary Password, read the prompt carefully; it protects locally stored private-key material.
5. Return to Your Certificates and confirm that the personal certificate appears. Select it and choose View if you need to check its email identity, issuer, validity dates, and certificate purposes.

Back up the certificate before relying on it

In Your Certificates, select the certificate and choose Backup or Export to create a protected backup. Store the backup in a secure location separate from the computer, and save its password in a password manager. A backup that contains your private key must be treated like a sensitive credential: do not attach it to email, place it in a public cloud folder, or share it with a recipient. Losing the private key can make older encrypted messages unreadable.

Option 2: Request a certificate using Thunderbird (version 128 or later)

Use this route when you want Thunderbird to create the key pair and your CA accepts a CSR. Mozilla’s current instructions say this feature is available starting with Thunderbird 128. Thunderbird creates the private key locally and saves a request file containing the public key; the CA issues a certificate based on that request. Mozilla does not recommend a particular CA, so choose one appropriate for your personal or organizational requirements.

1. Open Account Settings > the relevant account’s End-To-End Encryption page. Scroll to S/MIME and choose Generate and save a CSR file as….
2. Save the request file somewhere you can find again. If asked about cryptographic settings and you do not have a policy to follow, Mozilla advises using the defaults.
3. Submit the complete CSR text to a CA that accepts CSRs. The first line should read -----BEGIN CERTIFICATE REQUEST-----. Follow the CA’s verification steps and download the issued certificate.
4. Return to Thunderbird’s certificate manager. For a certificate issued for the key created in Thunderbird, import the issued certificate from the People tab as Mozilla’s instructions describe. Then check Your Certificates to confirm Thunderbird has paired it with the locally stored private key.
5. If the CA supplies intermediate certificates, follow its instructions and Mozilla’s guidance for importing them. An intermediate certificate helps build the trust chain; do not mark an unfamiliar CA as trusted without a clear reason. If the CA returns a .p12 or .pfx after you submitted a CSR, ask whether it contains the private key created by Thunderbird. Mozilla notes that this file type may mean the CA generated a different private key, which would not match the request stored in Thunderbird.

Assign the certificate to signing and encryption

Go back to Account Settings > the matching account or identity > End-To-End Encryption. In the S/MIME section, use Select… beside Personal certificate for digital signing, choose your certificate, and confirm. Repeat for Personal certificate for encryption. If Thunderbird asks whether to use the same certificate for both, confirm only if the certificate is intended for both purposes and your organization’s policy allows it.

Leave the default signing and encryption behavior at the setting that matches your needs. Many people begin with “do not sign by default” and “do not encrypt by default,” then choose the action for each message. For a signed test, open a new message and use the Security menu to select Digitally Sign this message. Send a low-risk message to an account you can check, and verify that the received message is marked as signed. Do not send confidential content during this test.

What you need before encrypting to someone else

Your own certificate alone does not let you encrypt to every contact. Thunderbird needs a valid public S/MIME certificate for each recipient in the message, including copied recipients. A common way to obtain a contact’s public certificate is to receive a digitally signed email from that person; you can also import a certificate they share with you through the People tab. For a private exchange, verify that the certificate belongs to the intended address before using it. If a certificate is expired, revoked, untrusted, or issued to a different address, stop and resolve that with the issuer or recipient rather than bypassing the warning.

Common problems to avoid

• The signing option is missing or errors: Confirm the certificate is listed under Your Certificates, includes the matching private key, is not expired, and is selected for the exact sending identity. A public .cer or .pem file alone cannot sign your email.
• Thunderbird keeps asking for a password: Check whether the prompt asks for the .p12/.pfx import password or Thunderbird’s Primary Password. Ask the issuer to confirm the package password if it is rejected; do not repeatedly guess or alter trust settings.
• Encryption is unavailable: Import or obtain a usable public certificate for every recipient. Confirm the certificate is associated with the recipient’s actual email address and that the certificate chain is trusted.
• The certificate is visible but not selectable: Check the address and identity on the certificate, its validity period, and its permitted uses. If you used a CSR, confirm the CA returned a certificate for that specific request and that Thunderbird paired it with the private key.
• You are mixing S/MIME and OpenPGP: They are different email security systems. An OpenPGP key cannot be selected as an S/MIME certificate, and S/MIME certificates do not replace OpenPGP keys.

Final verification checklist

Setup is ready for signing when the correct certificate appears in Your Certificates, is selected for the matching account’s digital-signing field, and a test message arrives with a valid signature indicator. Setup is ready for encryption to a particular person only when Thunderbird also has that recipient’s valid public certificate and allows you to encrypt a message addressed to them. Keep the private-key backup safe, note the certificate’s expiration date, and renew or replace the certificate before it expires.

Official Thunderbird references

• Mozilla’s S/MIME certificate and CSR instructions
• Mozilla’s Thunderbird certificate settings guide
• Mozilla’s prerequisites for sending encrypted messages