In 2025, RFC 8823 — ACME for S/MIME was incorporated into the CA/Browser Forum S/MIME Baseline Requirements, providing an open standards foundation for S/MIME certificate automation.
SSL/TLS certificate automation dramatically lowered the barrier to HTTPS deployment and helped drive encryption across the Internet. S/MIME needs the same transformation.
AI is making BEC attacks more scalable, more convincing, and harder to detect with traditional security controls. Trusted email identity, digital signatures, and end-to-end encryption matter more than ever.
The technology exists. The standards exist.
The solutions exist.
But a truly simple, automatic, end-to-end S/MIME experience is still missing.
Inbound: If an encrypted email cannot be decrypted, security inspection fails and the email is delivered directly.
Outbound: If an encrypted email cannot be inspected, security inspection fails and the email is sent directly.
Identity Validation
CAs don't build the email application layer.
Email clients don't operate the certificate lifecycle management.
Certificate Usage
Instead of managing S/MIME certificates mailbox by mailbox, organizations deploy a dedicated cryptographic gateway with a built-in Enterprise CA, organizational SubCA, and HSM-protected SubCA private key, making S/MIME practical at enterprise scale.
ZTmail Gateway Changes the Deployment Model, Making S/MIME ACME From Standard to Infrastructure.
