Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to create a S/MIME signing certificate for Outlook 2010 under Windows 7. I've gone into Options -> Trust Center (see below) to try and set it up but when I attempt to select the signing certificate I get an error message: "No certificate available".

How do you create a self-signed certificate for signing emails?

Trust Center


No Certificate Error

share|improve this question
    
Do you have Visual Studio available or installed? I created my own certificates with makecert and could give you the command line I used. Another point: your certificate must have the right email, it must be for email encryption purpose and you must have the private key available (pfx file, not cer file). –  Werner Henze Oct 18 '13 at 8:13
add comment

3 Answers 3

If you don't need it to be signed by an internal CA or public CA, then you can run the program C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE, which will generated a self-signed certificate.

share|improve this answer
    
I did try that but got a strange error message: "An error occurred during certificate creation". Any ideas? i.imgur.com/IN6rz.png –  Luke Quinane Feb 16 '12 at 23:33
    
I was able to create a certificate, but was unable to add it and received the same No Certificate Error message that @Luke has. –  jidar Feb 17 '12 at 2:49
add comment

I had this same issue and I run the CA for our system. MS CA for Windows 2008 R2.

I issued a valid email certificate and it still did not work. The signing certificate would not show but the encryption certificate did show.

I finally figured out that when you request the certificate you MUST select "Mark keys as exportable."

As soon as I did that, everything worked automatically.

Hope that helps.

share|improve this answer
add comment

I was using the Microsoft tool makecert for this.

First you need to create a CA (Certificate Authority) key:

makecert -pe -n "CN=My Root CA" -ss root -a sha512 -sky signature -len 2048 -h 1 -cy authority -r my_ca.cer
# -pe: Mark private key as exportable - useful for backup.
# -n "CN=My Root CA": The name of the certificate. Please use an individual name and replace the "My" with your full name.
# -ss root: The store where makecert shall place the certificate (Root certificates store).
# -a sha512: The signature algorithm to use. Right now SHA512 is the maximum available.
# -sky signature: The key type (signature, not exchange).
# -len 2048: Key length in bits. You might consider generating a longer key.
# -h 1: Maximum height of the tree below this certificate. I don't use sub-CAs, so I hope that 1 is the correct value.
# -cy authority: Certificate type is CA, not end-entity.
# -r: Create a self signed certificate.
#  my_ca.cer: Name of the file to which the generated public key will be written.

Now you need to create the certificate(s) for mail signing. In your case you will start with only one certificate for you:

makecert -pe -n "E=my.mail@addre.ss,CN=My eMail Signing" -a sha512 -sky exchange -cy end -ss my -eku 1.3.6.1.5.5.7.3.4 -in "My Root CA" -is root -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -len 2048 my_email.cer 
# -pe:Mark private key as exportable - useful for backup.
# -n "E=my.mail@addre.ss,CN=My eMail Signing": Name of the certificate. This must contain your mail address in the E entry and your name in the CN entry. You should give a useful CN, so please replace My with your full name.
# -a sha512: The signature algorithm to use. Right now SHA512 is the maximum available.
# -sky exchange: The key type (exchange, not signature).
# -cy end: Certificate type is end-entity, not CA.
# -ss my: The store where makecert shall place the certificate (My certificates store).
# -eku 1.3.6.1.5.5.7.3.4: Enhanced key usage "E-mail protection"
# -in "My Root CA": Name of the CA used to sign the generated key. Must be the same as given in "-n" in the above call to makecert.
# -is root: Store where the CA key can be found.
# -sp "Microsoft RSA SChannel Cryptographic Provider": Name of the CryptoAPI provider to use.
# -sy 12: Type of the CryptoAPI provider.
# -len 2048: Key length in bits. You might consider generating a longer key.
# my_email.cer: Name of the file to which the generated public key will be written.

The private and public keys will be written to the user's certificate stores (in the registry) and can be used immediately. The public keys will be written to the given files.

On your computer you can immediately select the mail signing certificate in your mail program. To give your public keys to others you can give them a copy of your public keys. For full trust they might need to import your CA key into their certificate store.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.