I have recently started using S/MIME since we got a certificate from our school and are advised to use it when possible. I am using El Capitan 10.11.4.

The encryption and decryption process ITSELF works fine, i.e. I can send and receive encrypted and/or signed mails and decrypt them correctly when I have the corresponding certificate.

However, if I receive mails that are encrypted or signed and encrypted, it doesn't show in the security header. It's just not there. If I receive mails that are only signed using S/MIME, it will show correctly however (Signed (John Doe))

Again, I can read the mail just fine, it just doesn't give me any indication that it's encrypted or signed.

On my iPhone it works fine, i.e. it will show the little lock and the "signed symbol".

What could be causing this?

PS: The "security header" I'm talking about should be this: http://res.cloudinary.com/dhtjbz6ht/image/upload/v1419405517/9_ijmqqg.png

  • I suggest reporting to bugreport.apple.com. – cortices May 3 '16 at 5:36

It is most certainly a bug that needs to be addressed in future versions of OS X.

I have the same problem and have found out the following curiosities:

  • When I added a rule to change the color of encrypted emails to give at least a visual indication in the list view, it worked fine, so there's really no reason not to show the lock icon.
  • The moment I added the rule and applied it to existing mails, both the signed and encrypted indications showed properly on the conversation
  • Upon restarting Apple Mail however, the signed indicator stopped working again on mails that were both signed and encrypted
  • Furthermore, both indicators stopped working on mails which I have sent
  • Based on a rough guess, about 50-60% of the encrypted mails now have the proper visual indicator, but only those I've received and not those I have sent.

All in all it's very weird, non-deterministic behavior that I can't explain other than being a bug. It persists in 10.11.5. Mails that are only signed always show properly unless they're also encrypted.

Furthermore, my iPhone seems to have no problem at all, tagging all signed and/or encrypted conversations properly.

I suggest filing a bug report with Apple (which I am about to do now).

  • This is my experience as well. iPhone Mail app works fine and Mac Mail does not. – Ian Lee Jun 16 '16 at 17:37
  • Exactly same behaviour for me. Two thoughts: Apple don't want users to use encryption, Apple don't test encryption properly. – Nik Jun 23 '16 at 9:35

For me, this issue has been solved with macOS Sierra 10.12.2.

However, note that macOS Sierra obviously checks some certificate constraints defined in RFC2312 S/MIME Version 2 Certificate Handling that former OS X versions seemed to handle more generously. Restrictions I found are:

  • Extension "Key Usage" MUST have been marked "critical" (this wasn't required in earlier OS X versions)
  • Extension "Basic Constraints" MUST NOT be marked "critical"
  • the recipient e-mail address should occur in the "alternate name" section as "RFC 822 name", as all clients MUST use it there, while not all use the owner e-mail address of the certificate

HOWEVER, Apple mail still does not show the encryption symbol for some messages we encrypt with openssl using the same certificates that work otherwise. I have not been able to find the cause for this yet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .