6

When I try to send an email using an installed S/MIME certificate on iOS, I get an alert that says:

Unable to Sign: You can't send signed messages because a signing identity for the address could not be found. Go to the advanced settings for this account and choose a signing identity.

I have a signing identity chosen in the S/MIME settings for the account, and I have tried exporting my private key from my Mac's keychain many different times. The certificate/key match the address I'm sending from. Am I doing something wrong?

7
  • did you actually confirm your email settings as suggested in the message? This is quite hidden I usually use the iPhone configuration utility instead.
    – bdecaf
    Commented Jun 27, 2014 at 7:43
  • I did confirm the settings multiple times. I have tried adding the key through profiles (installed via the Apple Configurator) and by opening it as an email attachment. When I get the chance, I will try provisioning both the account and the certificate with a profile and see if that makes a difference. Commented Jun 28, 2014 at 14:17
  • Reminds me - I was unable to use certificates that are valid for more than one email address. Is your certificate valid for more than one?
    – bdecaf
    Commented Jun 30, 2014 at 14:10
  • Nope, just one email address. Commented Jun 30, 2014 at 14:11
  • I don't see any fault. Maybe it's really a bug and you should contact apple support.
    – bdecaf
    Commented Jul 1, 2014 at 8:03

5 Answers 5

4

iOS Mail’s S/MIME functions seems to get confused by certificates with the same scope and certification authority being swapped out, as is the case with the free mail certificates, whose time limitations force a swap every year.

If you hit this issue after having swapped out your certificate, follow these steps to get to a clean state:

  1. make sure you have a .p12 file for your certificate at hand, or that you can re-download it from your certification authority;
  2. delete all offending certificates (current or not) from Settings → General → Profiles;
  3. reboot your device (hold the on/off button until the shutdown slider appears on screen, slide that, wait for the shutdown spinner to stop, restart device). This will flush Mail from memory and reset its caches, something that cannot be achieved by force quitting it, as parts of Mail run as a daemon;
  4. import your certificate from step 1;
  5. make sure the newly installed certificate is selected in Settings → Mail, Contacts, Calendar → [your account] → Account → Advanced → Sign.

The certificate should now be recognised correctly.

Related links

2
  • I have spent way too long on this now - my Comodo cert was installed but emails were not being signed (using iOS 9.2.1 btw). I followed your instructions and got a cert from StartSSL installed, but I still have the same problem - emails are not being signed with my public key when I have that turned on. (Now I did make my new key 4096 bits - maybe iOS is not liking that key length?) Any suggestions as to how to get this to work? What cert provider(s) are you using?
    – Brie
    Commented Feb 3, 2016 at 23:49
  • 1
    @Conrad I am signing with a Comodo free certificate generated with the default settings (2048 bits, I think).
    – kopischke
    Commented Feb 4, 2016 at 7:38
3

Not all certificates are supported by iOS, it depends on the encryption method. I had issues with the free Comodo S/Mime certificates and switched to the free S/Mime certificates from Startssl.com, they work fine

1
  • Could you take a look at my comment on kopischke's answer? Maybe you have some insights here?
    – Brie
    Commented Feb 3, 2016 at 23:50
2

I had the same issues but i fixed them with a different workaround. If you want to install your Private certificate.

First install the Public certificate of the Issuing Certificate Authority then install your private Certificate as the second one.

This worked fine with my self issued Certificates :)

1
  • FWIW, this answer from @Marco worked for me, but only AFTER I deleted and re-installed the email account which was not trusting my self-signed certs. On iOS, Apple is clearly caching certs and their trust status within email accounts and even if you delete and re-install new profiles you cannot get rid of those cached certs - even with reboots of the device. The only way to do so seems to be to actually delete and then re-configure the email account.
    – pjv
    Commented Dec 22, 2017 at 13:55
1

I had such problems too and lost hours on them.

Now I can do it with iOS 13.3.1.

I have installed successfully Actalis SMIME certificate following this steps :

  • send the certificate unzipped and attached to email for which it should be used,

  • in iOS Mail receive the email and install the profile: tap the attachment, enter the code...

  • follow the instructions: go to settings, find your profile with the certificate pending below it, confirm it.

Now you can receive encrypted mail but cannot sign or send encrypted mail. Therefore, you must go to settings, accounts, IMAP, open the account, advanced and select the certificate you have just installed for signing and encrypting.

It should work without removing expired certificates. If you remove expired certificates then you can't read emails that were encrypted for then, so be careful.

There is a warning "certificate not signed". Eventually this does not appear to impede anything. Maybe somebody will explain why, how, by whom the certificate should be signed. I think that this used to be the cause of old problems that were solved around the beginning of year 2019. This could be checked in iOS release notes.

1
  • If you install the Actalis CA like you install the S/MIME certificate then the certificate is shown as trusted. The location for actually allowing the use of S/MIME on iOS 16.4 in Apple Mail is Settings -> Apple ID -> iCloud -> iCloud Mail -> iCloud Mail Settings -> Advanced -> Sign
    – Avamander
    Commented Mar 31, 2023 at 19:01
0

I have a COMODO certificate and was able to get this to work. It is important to delete the previously existing certificates completely and re-start the iPhone / iPad. Then install the new certificate and check it is assigned in Mail settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .