How should S/MIME email encryption be implemented in ServiceNow

[colin-lucwe]

Hi everyone,

we have a requirement to send certain emails from ServiceNow in encrypted form. We are currently looking into S/MIME, but I am struggling to understand the complete implementation approach and which components need to be provided by ServiceNow vs. our internal PKI/email infrastructure.

Our requirement is roughly:

• ServiceNow sends emails to external/internal recipients.

• The email content and attachments should be encrypted.

• We would like to use S/MIME.

• Emails may be triggered by Notifications, Flow Designer, etc.

• We need to understand how the recipient certificates/public keys are obtained and maintained.

From the ServiceNow documentation, I understand that for outbound S/MIME encryption, recipient email certificates need to be uploaded in PEM format and the CA certificates also need to be configured. For signing, ServiceNow requires an email account key pair in P12 format.

However, I am not clear about the end-to-end setup.

Could someone please explain the recommended architecture/process step by step?

Specifically:

1. Who is responsible for generating/providing the certificates and key pairs?

   • Our internal PKI?

   • ServiceNow?

   • The recipient's mail infrastructure?

   • An external CA?

2. For outbound encryption, does ServiceNow need the public certificate of every recipient?

   • If yes, how is this normally handled at scale?

   • Is there a recommended way to automatically obtain/update recipient certificates?

   • Or does ServiceNow expect administrators to upload/manage the certificates manually?

3. If we have many recipients, what is the recommended approach for certificate management?

4. Once S/MIME is configured globally, can we control which emails are encrypted?
   For example, can a specific Notification or Flow Designer action trigger encryption while other ServiceNow emails remain unencrypted?

5. Does S/MIME encryption work automatically for emails generated through:

   • Email Notifications

   • Flow Designer

   • Business Rules / scripted email sending

   • ServiceNow Email Client

6. Could someone provide a practical implementation example, e.g.:

   ServiceNow → S/MIME configuration → PKI/certificate → recipient → encrypted email

7. What would be the recommended setup for a company where ServiceNow needs to send encrypted emails to a large number of recipients?

Thanks in advance for any guidance.