There are different types of digital certificates available from Certificate Authorities (CA). The most basic certificate only verifies that an email address is under the control of the certificate applicant. It is issued in a few minutes.
The next level of assurance includes both email verification and govt ID name verification of the applicant. This takes longer to approve.
A higher level of assurance also verifies the business name, state registration, address, phone number, and employee status. This takes the longest to approve.
Each higher level of assurance provides more reasons to trust the digital certificate since more factors are verified by the CA, at a higher processing cost. Certificates usually expire in 1 to 3 years.
There have been security incidents where hackers have stolen and created false certificates. Once discovered, they are revoked.
If you change your email address, you will need to apply for a new digital certificate that verifies the new email address.
If you continue to use the old email address, you can use the old digital certificate with that email address until the certificate expires.
If a hacker gains control of your email account and certificate, notify the CA to revoke the digital certificate, so the hacker cannot impersonate you. Otherwise, the hacker can use the certificate until it expires.
If you close an email account, be careful. Some providers will retire the email address permanently, but other providers will make your old email address available again for use by a new customer. Read the account terms and conditions.
Certificates are available with different types of user privileges such as signing email, signing e-docs, encrypting email, and digital ID for two-factor authentication (2FA) for account access.
Different CA vendors offer different products at different prices. Some of the lower priced CAs, starting at $12/year, are Sectigo, Comodo, and DigiCert. Italian company Actalis offers a free certificate for personal use.
These Secure/Multipurpose Internet Mail Extensions (S/MIME) digital certificates ensure email security, confidentiality, and integrity. In general, free Big Tech email (snoop mail) does not include support for S/MIME email encryption because they want to be able to read your email for gathering profile and marketing data.
Make sure your email service provider or other application supports S/MIME before buying a digital certificate.
I use paid ProtonMail Plus which can send email in either plain text or encrypted form using PGP (Pretty Good Privacy), not S/MIME. They offer a free account. Some users are requesting the addition of S/MIME support. |
