In order to protect ourselves from NSA-style snooping, we need to start using SMIME encrypted email.
Since I have over 10,000 BYOD devices to update, what is the most effective way to
- Deploy an SMIME certificate to these users
- Configure the corresponding email account to use that certificate on iOS (Enable signing and encryption)
Since these users have many devices, I'm OK with holding the private and public key for the user and sending it as an attachment they can click on. The problem is that the users get prompted to add an unsigned profile, and the email portion is not clicked.
I'm also not using a globally trusted root, I'm using a private one, so the key deployment will need to also include a way to update the root cert while adding the SMIME cert.