(DC) Client Certificate
Effective July 17, 2026, Client Certificates, also known as Email Certificates, S/MIME Certificates, or Office 365 Certificates, will no longer be offered as a centrally funded or common-good service. Departments that need to digitally sign email or send and receive encrypted email will need to purchase certificates directly from an approved commercial provider. Certificates may be purchased for a single user or in larger quantities for multiple users within a department.
Do not delete old or expired email certificates from your computer or email client. They may still be required to open encrypted messages you previously received or sent. An expired certificate can continue to unlock/decrypt older encrypted email, even though a new certificate is needed for future signing and encryption. If an old certificate is deleted and no backup exists, those encrypted messages may become permanently unreadable.
About / What is a Client Certificate
A Client Certificate (also called a Digital Certificate or Digital ID) is a digital credential that proves your identity online. It is commonly used to digitally sign email, encrypt email containing sensitive information. When you digitally sign an email, recipients can verify that the message genuinely came from you and has not been altered in transit. When you encrypt an email, only the intended recipient can read its contents. Some secure applications and services also require a Client Certificate as part of their authentication process.
Who needs a Client Certificate?
Most university employees do not need a Client Certificate. You may need one if you:
Send or receive Category I or other sensitive information by email and need to encrypt those messages. See the
for examples of what constitutes Category-I data.MultiExcerpt IncludeMust digitally sign email to verify your identity.
Access an application or service that specifically requires certificate-based authentication.
If you are unsure whether you need a Client Certificate, consult your department’s IT support staff before requesting one. Consult with your desktop support staff or the
Client Certificate Caveats
Certificates are issued to individuals only. Shared, departmental, or role-based certificates (for example, Help Desk, Department Chair, or Finance Office) are not supported.
Certificates are intended for individual users. They are not intended for servers or services. For server certificates, see the Server Certificates documentation.
Protect your certificate. Never share your private key or certificate files with another person.
Obtaining a Client Certificate
If you need a client certificate, you will need to contact on of the five organizations below to purchase and obtain certificates:
Rank | Provider | Education fit | Single certificates | Bulk / departmental issuance | Recommendation |
|---|---|---|---|---|---|
1 | CERTInext | Very good | Yes | Excellent | Same CA provider, less confusing. |
2 | InCommon Certificate Service / Internet2 | Excellent | Limited fit for ad hoc purchases | Excellent | Best institution-wide university option |
3 | Sectigo | Very good | Yes | Excellent | Best mixed retail-and-enterprise option |
4 | DigiCert | Good | Yes | Excellent | Premium enterprise choice |
5 | GlobalSign | Very good | Yes | Excellent | Strong for delegated departments and automation |
6 | SSL.com | Good | Yes | Very good | Best budget-conscious and flexible option |
CERTInext (#1) does offer SMIME certs outside of the UT System contract.
if you are interested in this option, you might submit a request to: https://incommonsupport.certinext.io/portal/en/kb/articles/smime-order-flow
There could be value in going with this route, as we might be able to eventually have the product added to the UT System contract.
Once you engage with CERTInext or another vendor – they will provide you with documentation that Legal Affairs will be required to sign. This will be limited to staff in your unit and that's how the contract would be written. You would technically be able to create client (SMIME) certificates for other mailboxes in @austin.utexas.edu, but that would be a contract violation and a violation of university policy -- so it would be important to keep the scope tightly controlled.
If you have questions regarding client (SMIME) certificates, please contact ISO (security@utexas.edu)
Installing the Certificate
You can find instructions for importing/installing the certificate on your computer or device in the (DC) How to … section.
| | | | |
|---|