I want the ability to lookup an encryption certificate for SMIME in Outlook for recipients who have SMIME certs, but I just don't have their public key.

I noticed the keychain has a directory feature. Can I use this to add a compatible directory to lookup their public key for SMIME encryption?

3 Answers 3


According to the Apple TS article "Using Keychain Access to search directory services for certificates", if your Mac

  • is configured to use a directory service,

  • has the CA signing certificate trusted in either your login or the system keychains,

  • has a valid signed user certificate with the appropriate attributes,

then Keychain Access can be configured (Preferences → General → Search directory services for certificates) to search for certificates on the configured directory service. Mail.app will also automatically search for certificates as well.

Unfortunately, I haven't done this personally, so I can't vouch for how well it works or have any advice on any issues. This reads to me like a feature designed to be used with a centrally-managed IT infrastructure with directory and certificate services. It does not sound like it is designed to work outside that sort of environment.


If your question were about PGP, then the answer would be you could download the recipient's public key from pgp.mit.edu , for example.

But as for S/MIME, the keystores are scattered.

It is weird, since it is straight-forward to publish 1 your S/MIME certificate .

But the idea does not seem to have taken off. Case in point, here 2 is an announcement from 6/2/2011 , about 3, which today (2014), seems to have 140 users.


1 Sharing SMIME certs

2 from google groups

3 https://kuix.de/smime-keyserver/


Not sure if this would help, but yes, you can create and retrieve certificates to save in your keychain.

enter image description here

You might also try this system:

Retrieved a free certificate from COMODO


Please ensure, that you always select "United States" as you country of residence. Otherwise, you will not get a proper private key embedded into you certificate.

Alternatively, you can look up the public key: Using WWW or email methods.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .