8

After upgrading from Sierra to Mojave (macOS 10.14), Apple mail started to display the warning Unable to verify message signature above all signed and encrypted emails. When clicking on Details, it says:

The digital signature is incorrect. The message may have been tampered with or corrupted since signed by (sender's name).

We are using S/MIME certificates signed by a self-signed root CA, but I doubt that this is the problem. When checking the certificates in the Keychain app, they are reported to be valid and good. However, if in Apple Mail, I get the above message and click on Show Certificate, the root certificate is reported to be valid and trusted, but the S/MIME certificate is nonetheless invalid for no obvious reason.

Note that some report similar problems for emails with attachments only.

Improve this question
1
  • We have the same problem with Catalina and Big Sur with each and every signed email (different Root CA, e.g. QuoVadis). Also in our case, the problem occurs only with attachments.
    – Matteo
    Feb 16, 2021 at 17:27

2 Answers 2

Reset to default
8

This seems to be due to a bug in Apple Mail, at least in macOS 10.14.1, but possibly introduced in macOS 10.13.5 as an attempt to mitigate the EFAIL security hole.

When Mail is set to not automatically load remote content (Preferences > Viewing > Load remote content in messages is not checked), then the warning message Unable to verify message signature is displayed for every S/MIME signed message.

You can get rid of the warning by either

  • Setting Mail to automatically load remote content (set Preferences > Viewing > Load remote content in messages to checked) not recommended
  • Clicking on the "Load Remote Content" button displayed on the right of the warning message

However, for security reasons, it is not recommended to load remote content unless it is from a trusted source.

I consider this a major bug for the following reasons:

  • It makes no sense that the verification of signatures is dependent on loading remote content, because the signature file is an inline attachment
  • There was no such dependency before
  • The warning is strongly misleading

I even consider this a severe security problem because:

  • Loading remote content is considered a security problem that can even lead to the leakage of encrypted content as described by EFAIL
  • The user won't be able to have the message signature verified without loading potentially dangerous remote content

The fix was originally intended to stop the Mail app from loading HTML content without the user's consent. However, the way it is implemented now, this leads to also not loading the signature attachment.

Improve this answer
6
  • And it's still a problem in Mail on 10.15.3. macOS Mail is not built for security (find one that is - even Canary mail has grossly insecure behaviors and it's supposedly security-focused...)
    – Anthony
    Apr 24, 2020 at 18:52
  • We can reproduce the problem on several machines even whit the remote content loaded
    – Matteo
    Feb 16, 2021 at 17:24
  • @Matteo It works here on Big Sur with content loaded. Your problem might be a different one. Is the corresponding root certificate available and trusted?
    – not2savvy
    Feb 16, 2021 at 18:04
  • The certificate is trusted. The problem only occurs when the email has an attachment.
    – Matteo
    Feb 16, 2021 at 19:55
  • @Matteo Does this problem occur with a self-signed root certificate that has been manually trusted? If so, I might have found a solution. I had similar issues which I eventually found to be caused by the root certificate switching back to untrusted for strange reasons. I finally figured out that the root certificate needs to be set to trusted from each and every account on my Mac (even though it was in the system keychain). After that, the problem was gone. Looks like another bug to me. It started to occur after some system update (not sure which).
    – not2savvy
    Mar 27, 2021 at 10:12
0

I had the same issue (Seeing unable to verify message signature).

I recently set up an OCSP server for my email certs, and since then emails are properly showing up as verified in Apple Mail without loading remote contents.

Verified signature without loaded remote contents

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .