If hosted S/MIME is missing in Gmail or a message cannot be encrypted, first check the account, organization setting, and certificates. Hosted S/MIME requires an eligible managed account and administrator configuration. It is not a feature every personal Gmail user can activate by importing an arbitrary certificate.
Check the account and enabled setting
Confirm that you are using the intended work or school account. Ask the administrator whether the Workspace edition supports hosted S/MIME and whether it is enabled for your organizational unit. Google says administrative changes can take up to 24 hours, though they usually happen sooner; reload Gmail after configuration.
The organization also controls whether users may upload certificates. A missing upload option can reflect that policy rather than a defective browser. Do not move work messages to a personal account or weaken certificate requirements to obtain a compose option.
Verify the sending identity and certificate
Where permitted, Google’s web workflow uses Settings, See all settings, Accounts and Import or Accounts, then edit info beside the relevant Send mail as identity. Upload the approved PKCS #12 certificate and supply its certificate password.
That bundle contains a private key: protect it and use the organization’s approved provisioning route. Do not email the bundle or its password to a recipient. Send-as identities do not inherit the primary account’s S/MIME certificate automatically; the administrator’s guide describes separate setup and web-only send-as support.
Check recipient keys and certificate renewal
Encryption requires a usable public key for the recipient. Google describes exchanging digitally signed messages so Gmail can associate the public key with the contact. Verify the actual recipient address and security details before sending sensitive content.
If certificates have changed, ask the administrator to check validity, trust, and the selected default signing certificate. Keep older decryption requirements in mind: Google’s guidance explains why previously uploaded certificates can remain needed for messages encrypted with an older key.
Do not delete all certificates, allow obsolete algorithms globally, or override trust warnings as a first repair. Provide the administrator with the exact error and affected identities, without private keys or confidential message content.
Browse Gmail & Google Account help
References
- Use hosted S/MIME to keep Gmail messages more secure
- Turn on hosted S/MIME for message encryption | Gmail | Google Workspace Help
- Learn how Gmail encrypts your emails
Reviewed against the linked official and developer guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.