6

When I try to send an email using an installed S/MIME certificate on iOS, I get an alert that says:

Unable to Sign: You can't send signed messages because a signing identity for the address could not be found. Go to the advanced settings for this account and choose a signing identity.

I have a signing identity chosen in the S/MIME settings for the account, and I have tried exporting my private key from my Mac's keychain many different times. The certificate/key match the address I'm sending from. Am I doing something wrong?

  • did you actually confirm your email settings as suggested in the message? This is quite hidden I usually use the iPhone configuration utility instead. – bdecaf Jun 27 '14 at 7:43
  • I did confirm the settings multiple times. I have tried adding the key through profiles (installed via the Apple Configurator) and by opening it as an email attachment. When I get the chance, I will try provisioning both the account and the certificate with a profile and see if that makes a difference. – Connor Youngquist Jun 28 '14 at 14:17
  • Reminds me - I was unable to use certificates that are valid for more than one email address. Is your certificate valid for more than one? – bdecaf Jun 30 '14 at 14:10
  • Nope, just one email address. – Connor Youngquist Jun 30 '14 at 14:11
  • I don't see any fault. Maybe it's really a bug and you should contact apple support. – bdecaf Jul 1 '14 at 8:03
3

Not all certificates are supported by iOS, it depends on the encryption method. I had issues with the free Comodo S/Mime certificates and switched to the free S/Mime certificates from Startssl.com, they work fine

|improve this answer|||||
  • Could you take a look at my comment on kopischke's answer? Maybe you have some insights here? – Conrad Feb 3 '16 at 23:50
3

iOS Mail’s S/MIME functions seems to get confused by certificates with the same scope and certification authority being swapped out, as is the case with the free mail certificates, whose time limitations force a swap every year.

If you hit this issue after having swapped out your certificate, follow these steps to get to a clean state:

  1. make sure you have a .p12 file for your certificate at hand, or that you can re-download it from your certification authority;
  2. delete all offending certificates (current or not) from Settings → General → Profiles;
  3. reboot your device (hold the on/off button until the shutdown slider appears on screen, slide that, wait for the shutdown spinner to stop, restart device). This will flush Mail from memory and reset its caches, something that cannot be achieved by force quitting it, as parts of Mail run as a daemon;
  4. import your certificate from step 1;
  5. make sure the newly installed certificate is selected in Settings → Mail, Contacts, Calendar → [your account] → Account → Advanced → Sign.

The certificate should now be recognised correctly.

Related links

|improve this answer|||||
  • I have spent way too long on this now - my Comodo cert was installed but emails were not being signed (using iOS 9.2.1 btw). I followed your instructions and got a cert from StartSSL installed, but I still have the same problem - emails are not being signed with my public key when I have that turned on. (Now I did make my new key 4096 bits - maybe iOS is not liking that key length?) Any suggestions as to how to get this to work? What cert provider(s) are you using? – Conrad Feb 3 '16 at 23:49
  • 1
    @Conrad I am signing with a Comodo free certificate generated with the default settings (2048 bits, I think). – kopischke Feb 4 '16 at 7:38
2

I had the same issues but i fixed them with a different workaround. If you want to install your Private certificate.

First install the Public certificate of the Issuing Certificate Authority then install your private Certificate as the second one.

This worked fine with my self issued Certificates :)

|improve this answer|||||
  • FWIW, this answer from @Marco worked for me, but only AFTER I deleted and re-installed the email account which was not trusting my self-signed certs. On iOS, Apple is clearly caching certs and their trust status within email accounts and even if you delete and re-install new profiles you cannot get rid of those cached certs - even with reboots of the device. The only way to do so seems to be to actually delete and then re-configure the email account. – pjv Dec 22 '17 at 13:55
0

I have a COMODO certificate and was able to get this to work. It is important to delete the previously existing certificates completely and re-start the iPhone / iPad. Then install the new certificate and check it is assigned in Mail settings.

|improve this answer|||||
0

I had such problems too and lost hours on them.

Now I can do it with iOS 13.3.1.

I have installed successfully Actalis SMIME certificate following this steps :

  • send the certificate unzipped and attached to email for which it should be used,

  • in iOS Mail receive the email and install the profile: tap the attachment, enter the code...

  • follow the instructions: go to settings, find your profile with the certificate pending below it, confirm it.

Now you can receive encrypted mail but cannot sign or send encrypted mail. Therefore, you must go to settings, accounts, IMAP, open the account, advanced and select the certificate you have just installed for signing and encrypting.

It should work without removing expired certificates. If you remove expired certificates then you can't read emails that were encrypted for then, so be careful.

There is a warning "certificate not signed". Eventually this does not appear to impede anything. Maybe somebody will explain why, how, by whom the certificate should be signed. I think that this used to be the cause of old problems that were solved around the beginning of year 2019. This could be checked in iOS release notes.

|improve this answer|||||

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .