S/MIME support in Gnus is somewhat limited. ExtendSMIME redefines some Gnus functions and adds new ones to include proper support for
The general idea of ExtendSMIME is to store available certificates in files under smime-certificate-directory. The file names under which a certificate is stored are its e-mail addresses. A certificate file is written in two cases: First, if a certificate is received on demand via LDAP. Second, if a signed message containing a certificate is verified successfully then the contained certificate is stored for each of its e-mail addresses.
Signed versions of jl-smime.el and jl-encrypt.el are available over there.
In general, I recommend GnuPG over S/MIME (which is the default for Gnus). Unless you are in a restricted setting, say in a university or corporate setting, the trust model regarding certificate authorities is broken. You may want to recall the recent certificate authority failures concerning DigiNotar and Trustwave. Although the impact of those failures appears to be restricted to SSL certificates, I don’t see any reason why S/MIME certificates should be more trustworthy.
In general, no further configuration should be necessary.
Note that jl-smime.el contains the following:
;; I'm searching for S/MIME certificates via LDAP at DFN-Verein. (require 'ldap) (setq ldap-default-base "O=DFN-Verein,C=DE" ; -x: no SASL authentication, -tt: store result in file ldap-ldapsearch-args '("-x" "-tt") ) ;; Cache S/MIME passphrase for 600 seconds. (Default is 16.) (require 'password-cache) (setq password-cache-expiry 600)
You may want to adjust those settings.