Hello,
do we have to consider that just before an email certificate will expire, there will be no possible renewal? Which means only the possibility to apply for a new one and the obligation to keep the old one in the certificate store in order to be able to still decrypt old mails that use the expired certificate.
Why don’t you use an enrollment procedure like some other companies do even with free email certificates, and the ability to get them trusted either through a Web of Trust (with notaries) or a small fee, as paying with a credit card can authenticate the owner of a mail certificate?
regards
adding: at what moment do you accept to deliver a new certificate with the same email address and name? a couple of days before expiration of the old one, if asking for the revocation of this old one ? or only once it has actually expired?