How to Install Self-Signed S/MIME Certificates on iOS and Enable Encrypted E-mail

Published

By John Dalesandro

S/MIME allows signed and encrypted e-mail, enhancing privacy and security. Using S/MIME with self-signed certificates on an iOS device requires installing and configuring the certificates for use in the Apple Mail app. This article covers the process step by step.

NOTE: An S/MIME certificate is needed to complete this process. If one is not available, see the companion article covering how to create and package self-signed S/MIME certificates in PKCS12 format using OpenSSL.

Instructions

Step 1: Load the .p12 File on an iOS Device

  1. Upload the .p12 file to iCloud Drive or e-mail it to an address accessible on the iOS device. (E-mail is less secure but used here for simplicity.)
  2. Once the file is available on the device, tap it to start the installation.
  3. If asked to Choose a Device, select the appropriate one and confirm.
  4. The message Profile Downloaded is displayed. Tap Close.

Step 2: Install the Profile

  1. Open Settings and tap Profile Downloaded.
  2. Tap Install (top right).
  3. Enter the device passcode if prompted.
  4. A warning that The profile is not signed. may appear since the certificate is self-signed. Tap Install again.
  5. Confirm the installation by tapping Install at the bottom of the screen.
  6. Enter the password set when creating the .p12 file, then tap Next.
  7. The Profile Installed screen is displayed. Tap Done.
  8. Once installed, the configuration profile appears in Settings > General > VPN & Device Management.

Step 3: Enable S/MIME in Apple Mail

With the certificate installed, the next step is configuring S/MIME in Mail:

  1. Open Settings.
  2. Tap Apps.
  3. Tap Mail.
  4. Tap Mail Accounts.
  5. Select the e-mail account (for example, iCloud).
  6. Tap Signing and Encryption.
  7. Tap Sign and enable it.
  8. Confirm the correct certificate is selected.
  9. Tap Back to return to Signing and Encryption.
  10. Tap Encrypt by Default and enable it.
  11. Confirm the correct certificate is selected.
  12. Tap Back to return to Signing and Encryption.
  13. Tap Done and exit Settings.

S/MIME is now active and ready to use for e-mails sent from this account.

Step 4: Send Encrypted E-mails

Since S/MIME uses public-key encryption, sending encrypted e-mail requires the recipient’s public key. If a sender uses a self-signed certificate, Mail may show the certificate as untrusted. This behavior can be tested with two e-mail addresses, each with its own certificate:

  1. Send a signed (not encrypted) e-mail to a different address without the certificate profile installed. The Mail app displays a warning that the Message is Unencrypted. Tap Send Anyway.
  2. When the e-mail arrives, the sender’s address will appear in red with a question mark icon.
  3. Tap the icon or address to view details.
  4. Tap View Certificate.
  5. Tap Install.
  6. Tap Done twice to exit.
  7. Now, Mail recognizes the public key, and encrypted e-mail is possible. Reply to the signed e-mail. The contact will now show in blue with a lock icon.

Troubleshooting

A No valid certificates found error when enabling S/MIME indicates the certificate may be missing the extendedKeyUsage = emailProtection extension. Double-check the certificate settings during creation.

Summary

Following these steps installs self-signed S/MIME certificates on an iOS device, enables secure e-mail communication, and supports sending encrypted e-mails. Self-signed certificates require extra steps for trust validation, but they are a useful way to test and implement encrypted e-mail solutions. With S/MIME enabled, e-mail exchanges from the account are both signed and encrypted, enhancing security.