A company deploys a system to use device and user certificates for network authentication. Previously, the company only used separate certificates to send/receive encrypted email. Users have begun…

An attestation service misconfiguration affects device trust and certificate validation workflows, not the ability of a mail client to decrypt already-received S/MIME messages.

If device certificates carried the S/MIME attribute, they might appear as candidates for email operations, but this describes a certificate property rather than the client-side key selection error that directly causes decryption failure.

When a recipient has multiple certificates in the directory, the sending mail client may select the public key from the newly deployed network authentication certificate instead of the designated S/MIME encryption certificate. Because the recipient's S/MIME private key does not correspond to the authentication certificate used for encryption, decryption fails entirely. This key mismatch is the most probable cause when new certificates are introduced alongside pre-existing email certificates without updated client configuration.

Associating multiple device certificates with the same network port is a network authentication configuration issue and has no relationship to S/MIME email encryption or decryption.