Email encryption - S/MIME protocol

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Email encryption - S/MIME protocol

    Secure/Multipurpose Internet Mail Extensions (S/MIME) is an end-to-end email encryption protocol that enables digitally signed and encrypted emails. It ensures data confidentiality, authenticity, and integrity by allowing secure email communication between senders and recipients through digital signatures and encryption.

    Show full answer Show less

    ServiceNow administrators with the appropriate privileges can enable and configure S/MIME for their instance to enhance email security.

    Key Features

    • Digital Signatures and Verification: S/MIME verifies the sender’s identity by digitally signing emails, ensuring messages are authentic and unaltered, and confirming the sender’s legitimacy.
    • Message Encryption and Decryption: Emails are encrypted so that only intended recipients can decrypt and read the content, maintaining confidentiality and data integrity.
    • Public Key Cryptography: S/MIME uses asymmetric cryptography with key pairs—each user has a private key (kept secret) and a public key (shared). Public keys enable secure signing, verification, encryption, and decryption of emails.
    • Digital Certificates: Certificates issued by trusted Certification Authorities (CAs) deliver public keys and validate identities. These certificates have a defined validity period. ServiceNow does not provide these certificates; users must obtain them from third-party providers.
    • S/MIME in ServiceNow Email Flows:
      • Outbound Emails: ServiceNow uses the sender’s private key to sign emails and recipients use their public keys to verify signatures. For encryption, ServiceNow encrypts emails using recipients’ public keys, which recipients decrypt with their private keys.
      • Inbound Emails: ServiceNow verifies signatures using the sender’s public key and decrypts messages using the instance’s private key.
    • Activation and Setup: The S/MIME Email plugin (com.glide.email.smime) can be activated by administrators to enable S/MIME for notifications and email processing within ServiceNow.

    Key Outcomes

    • Protection of email content through encryption, ensuring only intended recipients can access sensitive information.
    • Assurance of email sender authenticity and message integrity via digital signatures, reducing risks of spoofing and tampering.
    • Improved trust and compliance in email communications by leveraging established cryptographic standards and trusted digital certificates.
    • Integration of S/MIME encryption and signing within ServiceNow’s email infrastructure, enhancing security without disrupting workflows.

    Secure/Multipurpose Internet Mail Extensions (S/MIME) is an end-end encryption protocol for sending digitally signed and encrypted emails that support data confidentiality, authenticity, and integrity.

    Introduction to S/MIME

    An administrator with privileges can enable and configure S/MIME. Understanding of the following is required when using the full capabilities of S/MIME:
    • Digital signatures and signature verification
    • Message encryption and decryption
    • Public key
    • Digital certificates

    Digital signatures and verification

    With digital signature, S/MIME verifies the identity of the sender of the email. This verification ensures the following:
    • Message in the email is the exact message sent by the sender.
    • Message is received from the right sender and not someone pretending to be the sender.

    Message encryption and decryption

    S/MIME uses encryption to protect the content of the email, which ensures that only the receiver can decrypt the content. Encryption creates coded information so that it cannot be read or understood until it is decoded and readable. Message encryption helps with the two key security factors of confidentiality and data integrity.

    Public key

    S/MIME uses key pairs and asymmetric cryptography. A private key in a key pair belongs only to the sender. If the private key has been used, the owner of that key has used it.

    Public key cryptography ensures secure communication between the sender and the receiver. Both have a key-pair, with one being private and the other public​.

    Public keys are shared between the sender and the receiver. A public key is paired to only one private key. The corresponding public key is used to identify its paired private key and only its paired private key. A public key can be used by multiple recipients.

    A key pair can be used to
    • Sign and verify a signature
    • Encrypt and decrypt the content of an email

    S/MIME digital signatures and encryption require each sender and recipient to have it enabled. They also need to send or exchange public keys though digital certificates to identify each other.

    For more information about key management and cryprographic module, see Key Management Framework Reference.

    Digital certificates

    Digital certificates help in delivering the public key in the key pair. A digital certificate is a digital credential that provides information about the identity, validity, and any other required information. Digital certificates are issued by a certification authority (CA) and are valid for only a specific period of time.
    Note:
    ServiceNow® does not provide S/MIME certificates for ServiceNow mail infra users. Users should get their S/MIME certificates issued from the third party S/MIME certificate solution providers.

    S/MIME outbound emails

    Signing outbound​ mails

    The ServiceNow AI Platform uses the private key of the sender (instance email account)​ and the receiver uses the public key to verify signatures.

    Encrypting outbound​ mails

    The ServiceNow AI Platform uses public keys of the recipients to encrypt the emails and every recipient uses their private key to decrypt the email.

    S/MIME for inbound email

    Sign verification for inbound​ mails

    The sender uses a private key to sign the email and the ServiceNow AI Platform uses the public key of the sender to verify the signature.

    Decrypting inbound​ mails

    The sender uses the public key to encrypt the email and the ServiceNow AI Platform uses the private key to decrypt the email.