Generate a personal certificate:
- Validate your CGG e-mail address:
Log in to CAS (https://cas.cuni.cz)
click "Change contact information" in the menu
scroll down to the "Your email addresses" form, click the green "+" there, enter your e-mail address "your_login@cgg.mff.cuni.cz", check the "Validate email addresses" checkbox, submit the form
You should receive e-mail on each of the listed addresses -> click the link in each received message (or at least the one sent to your @cgg address)
- Generate the certificate
Once you have the e-mail(s) validated in your CAS, go to https://tcs.cesnet.cz/en/
choose "Personal certificate" in the menu on the left
choose Charles University (or type "cuni" to the search field)
enter your CAS credentials
CAS may ask you for confirmation of giving CESNET access to your info
Then you should be re-directed back to the CESNET website - you will see a list of e-mail addresses
Tick the checkbox of the the address you want to include in the certificate (your @cgg address)
click "Issue the certificate"
Enter a passphrase twice (you will need to enter the same passphrase when importing the certificate)


Instructions how to use the certificate for authentication with the SMTP server in Thunderbird (https://www.thunderbird.net) follow:

If you don't have your CGG account already set up, add it now:
Open the menu (hamburger icon in the top right) -> Account settings
Account actions -> Add Mail Account
fill in your name and into the "E-mail address" field type "your_login@cgg.mff.cuni.cz"
Press Continue
In case you don't have a full mailbox on the CGG server (only a forwarding to your external address), Thunderbird will fail. Click "Advanced config" and then OK (this will save the "incomplete" configuration)

Import your personal certificate to Thunderbird:
In the hamburger menu -> Options, search "certificates", click Manage Certificates, select the "Your certificates" tab, click Import..., select the certificate file (usercert.p12) you got from CESNET and enter the passphrase from before. The certificate should now show in the list of installed certificates. Press OK.
Back in the "Account settings" choose "Outgoing Server (SMTP)" on the left, click Add...,
"Description" and "Server name": submission.mff.cuni.cz
Port: 587
Connection security: STARTTLS
Authentication method: No authentication
then confirm it with "OK"
The in account settings choose your cgg account (your_login@cgg.mff.cuni.cz on the left) and at the bottom-right change the "Outgoing server (SMTP)" to the one you just added

Sending a message:
Finally make a new message ("Write" button in the top bar in the first tab), fill in any e-mail address you have access to (e.g. your own Gmail) into "To:", fill in any subject/body and press Send.
If everything is set up correctly, a "User identification request" window should pop up. Make sure your just-imported certificate is selected and click OK. The mail will be sent. In case you don't have a mailbox at CGG (only forwarding), after sending the message, Thunderbird will get stuck at "Copying message to Sent folder...". You can just cancel it and close the message without saving.


Notes/tips:
Beware that the certificate validity is limited (typically a few years) - set up a reminder to generate and import a new one.
In case you don't have a CGG mailbox (just forwarding), Thunderbird may ask you for your password on the next launch, just close/cancel the dialog.
To verify the message was really sent, you can add your own address to "Bcc:" or "Cc:" to receive its copy.