I had such problems too and lost hours on them.
Now I can do it with iOS 13.3.1.
I have installed successfully Actalis SMIME certificate following this steps :
send the certificate unzipped and attached to email for which it should be used,
in iOS Mail receive the email and install the profile: tap the attachment, enter the code...
follow the instructions: go to settings, find your profile with the certificate pending below it, confirm it.
Now you can receive encrypted mail but cannot sign or send encrypted mail. Therefore, you must go to settings, accounts, IMAP, open the account, advanced and select the certificate you have just installed for signing and encrypting.
It should work without removing expired certificates. If you remove expired certificates then you can't read emails that were encrypted for then, so be careful.
There is a warning "certificate not signed". Eventually this does not appear to impede anything. Maybe somebody will explain why, how, by whom the certificate should be signed. I think that this used to be the cause of old problems that were solved around the beginning of year 2019. This could be checked in iOS release notes.