2

I am having an issue where S/MIME on my iOS 16.6 device is half working. I am able to receive/read encrypted emails and can send signed messages without issue. I am also able to send encrypted emails, but only if it is a reply to another party's signed email. I cannot, for anyone, send a new email that is encrypted, regardless of the fact that I have their certificate installed and their signature trusted. I am even unable to send myself a (new) encrypted email to my own email address (the same as sender) on iOS as it says “Unable to encrypt”.

I tried reinstalling my S/MIME certificate (.p12) as well and the certificates of other parties, but nothing changed.

What makes even less sense is that, provided the other party emails me first (with a signed email), I can reply to their signed message and it will let it encrypt; it also works just fine for if they send me an encrypted message (I can reply, encrypted). It works 100% on macOS (I can send new encrypted mail etc. without it needing to be a reply).

I have tried:

I rebooted between all of these steps just on the off chance it was a caching issue. Still nothing.

Has anyone run into this before? How did you get it working? I am absolutely stumped and have spent hours trying to figure this out.

2 Answers 2

1

The fact that you cannot send yourself an encrypted email points to your own public certificate not having been installed properly.

To fix that, send yourself a signed email. Then, in your inbox, tap on the seal, then view certificate. If Import is displayed, then it was not imported, and you can now do it from here.

Do the same with the other parties‘ certificates.

3
  • That fixed for emailing myself encrypted but the certificates for other parties were already installed. I have removed/installed another party's certificate once again but sadly no change. This is a really bizarre issue. Certs confirmed trusted by iOS (according to iOS) yet no luck sending, unless it's a reply to an already signed/encrypted email from other party.
    – kwilsonmg
    Aug 29, 2023 at 4:11
  • @kwilsonmg Could it be that you have expired certificates installed for these parties? Also, did you check the Mail settings under Account > Extended > Sign/Encrypt? Sometimes it helps to deselect then reselect the certificate.
    – not2savvy
    Aug 29, 2023 at 12:44
  • Figured it out and posted my own answer to this question. Thank you for helping me figure out the emailing myself part! Rather silly how case sensitive it is and how iOS overwrites whatever you enter with your contact....
    – kwilsonmg
    Aug 30, 2023 at 5:53
1

What @not2savvy wrote got me on the right track for getting emails to myself working. After another party, who was not in my contacts, emailed me I discovered what the issue was: the email address must match case-exact. This was a problem as the email addresses were stored in my contacts as all lowercase, and this would overwrite no matter what I input in the "to" field...unless it was a reply. Updated my contacts to make the email addresses case match exactly as they are when I reviewed the address in crafting a reply to an email from them and, sure enough, it made iOS happy. An odd issue that I was unable to replicate on macOS.

TLDR: Anyone who sees something similar, double-check the casing of your contacts/the email addresses you are entering! They must be an exact match as-received or you'll probably run into this.

3
  • Interesting finding! It's worth noting that this absolutely complies with the standard which requires that the local part of an email address must be considered case-sensitive.
    – not2savvy
    Aug 30, 2023 at 7:19
  • @not2savvy I am used to emails being case insensitive. I didn't actually know that the local part had to be case sensitive as a standard! I think this is the first time that I have run across it being required/a problem if not. I guess gmail etc just "makes it work".
    – kwilsonmg
    Aug 30, 2023 at 14:26
  • Nobody is used to think of the local part as case sensitive, because it simply doesn't make a lot of sense. But back in the days, the local part was the mailbox name, which was a file name, which was case-sensitive on Unix, so that's why it still is case-sensitive according to the standard. Google does a lot of "normalizing" for example they also consider dots as non-existent, so to avoid having two different users named "jane.doe" and janedoe".
    – not2savvy
    Aug 31, 2023 at 12:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .