How to create a user certificate for signing and encrypting in Outlook?

Question

local server

The task is to organize a secure mail exchange in Outlook between employees.
To do this, each user is purchased from a third-party company with a separate certificate for signing and encrypting mail.
How can I independently issue a certificate to the user that is suitable for signing and encrypting mail in Outlook?
On Win2008R2 the domain and the local certificate server are lifted.