iOS 4 Mail and self-signed certificates

You have to use the iPhone configuration utility to add the certificate to the iOS device's trusted list. The utility is one of the optional installs on the OS install disc. Apple support has instructions for how to do it at
http://support.apple.com/kb/HT1978

This can be solved as others have said. It's not easy though for people not technically inclined nor have access to the appropriate SSL files. Here's how I did it.

The goal is to get the CA (Certificate Authority) SSL Certificate to be installed on to your iPhone. To do this, you need:

- A copy of the CA cert. I run my own mail server on linux, using postfix. My ssl cert was self-created and stored at /etc/pki/CA/cacert.pem. You need to download that file to your Mac, and rename it to end in .cer, as in cacert.cer.

- Download the iPhone Configuration Utility from Apple. This is normally used in corporate environments, but it's easy to do just this one thing:

http://support.apple.com/kb/dl851

After downloading the utility, make sure your iPhone is plugged in via USB to your Mac. Run the iPhone Configuration Utility.

Click on "Configuration Profiles" on the left of the tool. Scroll down to "Credentials", and add one.

Select the cacert.cer file.

Great, you've now got a config profile created, next step is to push it to your iPhone. On the left, select your iPhone, and click the "Install" button. You'll need to make sure your phone doesn't have the passcode currently locking the phone, and then you'll see a prompt on the iPhone itself to accept the configuration profile. Accept it.

Voila! Run Mail on your iPhone and you should no longer be prompted about SSL certs!

Cheers,
-pete

This is also an issue that I've been experiencing since upgrading last night. I called Apple Care, but as my phone is over the 90 days initial phone support period, the person I spoke to couldn't really help. She suggested to delete my accounts (I've got 5 with this issue) and recreate them, which I had done this morning, to no avail. She also suggested to create a new server and turn off SSL, but that didn't work either. Looks like I'm in for a trip to the Apple store. Whether that'll help is another story...

I seem to have found a resolution for this. I had a user name and password in my Outgoing Mail Server info, I have now removed these as they appear to be optional. You will probably still get the verification message a couple of times while setting up your accounts or modifying your settings, but once this is done, go back into Outgoing Mail Server and make sure SSL is turned off. I've recreated all my accounts, and so far, so good.

I do not consider disabling SSL and authentication to be any solution at all. Sure they're optional, but using SSH instead of Telnet is optional too!

Also, you'll still be prompted to accept the self-signed cert on the incoming mail side even after disabling SSL/auth on the outgoing side.

I am not really technical at all, so I am not sure I fully understand the subtlety of it al, but I haven't been getting any message at all since I've done this, either for incoming or outgoing mails, and believe me, I tried sending and receiving emails a few times from each of my accounts before posting on here. Whether this is the solution, I can't say, but it is currently working for me, and thought it might be helpful to others. It looks like it is saving me a trip to the Apple store, which is definitely a plus.

I am having the same issue as well. 3G running 4.2.1. Disabling SSL is not an option for me and, as others have already stated, I'd hate to purchase an SSL cert when what I have is working just fine otherwise.

I am also affected by this. Both my iPhone 4 and my iPad 3G now display the certificate error "Cannot Verify Server Identity" when I wake the device up and send an email. I get it for both incoming and outgoing email.

I can click "Continue" and it works. I can click "Details" and "Accept" and it works. BUT I do not want to have to do this whenever I try to send mail after waking the device up. I know my mail server, I signed the certificates, and I am OK with its level of security. However, there seems to be no way to tell iOS that the certs are OK and safe to use and not bug me about. 😟

This is not good. :/

Hello all,
Can someone please explain (in non-techie terms) why we should or shouldn't use SSL when setting up an exchange account. I had it on, but was continually getting this same error after upgrading to 4.2.1. I just tried turning SSL off as suggested here (thanks Bruno), and I am no longer getting the error. Is my email going to be less secure now?
Thanks.

No. The cert is not expired and has no other errors. ONLY "MobileMail" on iOS 4.2.1 is affected by this. Everything worked fine before the 4.2.1 update.

The exact error is: "Cannot verify server identity. MobileMail can't verify the identity of "my.mail.server". Would you like to continue anyway? Cancel/Details/Continue"

Cancel does the obvious.
Details shows me the hostname of my mail server (which is correct) and says "Not Trusted"
The expiration date is more than a year from now. "More Details" shows me the certificate information, all of which is perfectly valid. Clicking "Accept" lets me send the email. Things work fine until the device locks/sleeps. Then it's back to complaining about the certificate.

I went into Keychain Access and removed ALL certificates related to my mail server and re-accepted them with Mail.app, thinking maybe the problems were related. Mail.app continues to happily do its job while MobileMail fails.

I also grabbed a brand new install of Thunderbird and set it up with no issues. I used Thunderbird to carefully examine each certificate. Since it's my own mail server, I have ultimate control over it, and have been carefully examining log files as well. There are no errors in the logs.

My wife has an iPhone 3GS. I tested on her phone. Worked fine. Could send & receive email with no issues.

Updated to 4.2. Problem now appearing on her phone. This makes it the THIRD device in my household that now has the exact same problem that did NOT exist before we installed 4.2. Ugh. I should have waited. (The wife is especially upset because we had no idea the new SMS tones wouldn't install on the 3GS, but that's another thread entirely..)

Thank you Kevinmoore73 - this obviously makes sense. I guess what I was really wondering is what exactly is the realistic risk in turning SSL off? I understand that communication will be unencrypted, but I assume that since you still need a login and password, that my emails aren't simply floating around in cyberspace, easily accessible to everyone.
Thoughts?
Thanks

I am experiencing this problem on iPhone4 and iPad after upgrading to iOS 4.2.1. This happens on my local and non-local wi-fi and over the 3G AT&T network for both devices. My mail server is in my office and uses a self-signed certificate.

Sending email worked on both devices prior to upgrade. Previously, when server verification failed, only had to accept once and was never asked again. Now happens as described here, virtually every time I send email from either device.

I'm not sure if this will help others, but it solved my problem...

My domains reside on a shared server, and thus all share the same ssl certificate. Instead of setting up my mail accounts as mail.domain.com ive changed them to the server ip address.

Since the shared server ip matches the ssl cert. I'm no longer receiving popups.

You could also set up you account to use the server's actual domain instead of you add on domains.

Hope this helps, as stated before there was no way I was about to purchase 15 individual ssl's

Please note that this is NOT specific to people using Exchange servers. It is affecting users with email on a Mac/Linux server as well.

However, it's not a server issue. This is a new issue with 4.2 that did not occur with 4.1.