iOS 4 Mail and self-signed certificates

Ok guys, this looks like easy THE SOLUTION is here

1. Next time you see a popup warning about the certificate, click DETAILS
2. In the next window, click ACCEPT (right top corner)
3. Done for this mail server/certificate (I noticed that my mail.xxx.xx server acts like load balancer between many servers, so in such case you will need to Accept once from each server - randomly).
4. Done

Please let me know if this worked for you

Good luck!

Just to quickly throw in some new data points: I just tried the trick of changing the SMTP hostname (in the Mail settings) to the IP address and it seems to have fixed the problem.

When I saved the settings, it did ask me to confirm the certificate again, but that was the last time it asked me. So, either changing it to the IP fixed it, or just changing it caused the iPhone to really save my acceptance of the cert. I don't have time to test that theory out right now.

And, as an aside, I've noticed that, once you accept the cert upon sending, some people have said that it doesn't ask again until you lock/unlock the phone again. I found this not to be the case. Locking and unlocking doesn't cause Mail to complain about the certificate again... presumably because it's still running in the background. Now, terminating Mail from running in the background and re-running it does cause Mail to complain about the certificate. That's how it's working for me, anyway.

And the apple support?.

*I report this error 3 weeks ago.*

It is the world's most expensive phone and no support!.

Already, it was a scam, alert to the problems that still have.

Besides, if the 3G network is slow, sometimes hangs MobileMail waiting validate the certificate, queued emails to send and never does. To fix this is to reboot the terminal, connecting to wifi and give back to MobileMail.

MobileMail is the worst email application I've seen in my life. Already the limitation STUPID to see only 200 emails per folder in an account!. I have 18000 emails I just this year in my inbox.

I'll never buy an apple phone!.

"The only way I have found to do this with iOS 4.2.1 is to email the .pem files from the server to yourself and upon download in MobileMail you get the option to install the cert as you should get when you setup email accounts. "

I have found this to work as well. The device brings up a dialogue that I haven't seen before, asking me to install the certificate. It now shows up as trusted.

I also tested this by generating a new self signed certificate with courier's mkimapdcert tool and am using that same cert for my SMTP server now as well. So, it's mostly resolved.

But Apple really should fix this... :/

ahaaaa.... you are not alone. found this thread after googling the subject all blooming weekend
switched from 3GS to HTC HD7 last week and I have a very similar problem.
the thing that really irritates me is that at least apple have a workaround, whereas microsoft do not!
ironic eh?
i think there's a big conspiracy going on to make everyone use cloud based services or hosted exchange servers.

So I tried the iPhone Configuration Utility and it didn't work for me either. But here's what did-

Go into Mail, Contacts, Calendars and select the account that has the self-signed certificate.
Go into Account Information
Select the Outgoing Mail Server
Change the Server Port from 587 to 25
When you do this, the Settings app will attempt to verify the account settings. If you have port 25 open on your mail server, it will give you the prompt that you're trying to use a self-signed certificate. Accept the certificate. If you don't have port 25 open, it will give you the error that it can't connect using SSL and will give you the option to try connecting without it. Hit cancel and change the port back to 587, then hit done again and you'll get the same prompt to accept the certificate. It should give you check marks on all the settings and then you should be good to go. If you changed the port to 25 and you want it to be 587 for some reason, just go change it back. You shouldn't have to re-accept the certificate. I've verified that this works on my iPhone 4 and my iPad, on WiFi and 3G and after a power cycle of both devices.

Basically it looks like the MobileMail app doesn't have the proper authority to change trust settings for these self-signed certificates. You have to do it through the Settings app. Just a guess though.

And obviously if you're using port 465 or some other port, just substitute that for 587. Changing the port is just an easy way to get the Settings app to re-verify the server connections, and that's when it'll prompt you to accept the certificate. It's just a faster way than having to delete and re-add the whole mail account.

Incidentally, this also works for CalDAV accounts- just change the port, wait for the error, hit cancel, then change the port back to 8443.

Tried this workaround, seemed to work but then it was back to the same errors. Waiting for Apple to fix this...seems enough people are experiencing the same trouble; they really ought to get this taken care of.

Yeah... as I mentioned in an earlier post, I think that, in order to properly test any solution, you need to terminate Mail from your background processes and then launch it again.

I haven't tried shutting the phone down and restarting it, but that would probably be an even more rigorous way of checking.

I just want to restate the solution which worked for me:

I went to the SMTP server settings in Settings and replaced the hostname of my smtp server with the *IP address*. You can find out the IP address by Googling for "nslookup" and using any of the numerous pages that are found.

For the record, my certificate and DNS situation is as follows:
IP Address - Resolves to a name which resolves back to the same IP. That name is not the name in the certificate.
Certificate - Expired and signed by a non-trusted CA (Plesk, specifically)

I've yet to hear from anybody who says that they tried the IP trick and it did not work. Perhaps I'm not paying enough attention. Maybe we need to give standard names to the various solutions being proposed, so that people can clearly indicate what they've tried and haven't and what worked and what hasn't.

I humbly propose:
"IP Address" - Means replacing the hostname with the IP address. Specify if your IP resolves to a name which then resolves back to the IP.
"SSL Disable" - Means disabling the SSL or TLS capability in your SMTP server settings. This should always work, but it's not a tolerable solution for many of us.
"PEM Download" - Means downloading the PEM cert via Safari (and maybe sending it to yourself via mail. Not sure if there's a difference).
"Config Util" - Means installing the certificate, itself, via Apple's configuration utility.
"Config Util CA" - Means installing the CA certificate via Apple's configuration utility.

Any others I've missed? I'm leaving out the "port change" trick where you change the port number to something and then change it back. All this seems to do is try to re-verify the cert at config time, which, although promising, even the original poster said that it ended up not working after he had rebooted his phone. If we get anybody for whom this does work for, then we should add it.

So, to kick things off...
IP Address : Worked. (IP does resolve to a name which resolves to IP)
SSL Disable : Haven't Tried
PEM Download : Haven't Tried
Config Util : Haven't Tried
Config Util CA : Haven't Tried

- Joe

No, the port change worked for me, just not someone else who tried it. I think the reason your IP address trick worked and my port number trick worked are one and the same- it forces the Settings app to re-verify the connection to the server, and if SSL is turned on that means verifying the certificate.

I have to ask those for whom these solutions are not working whether they have tried a restore of the phone with a restore of the backup, and then a restore without restoring the backup. The reason I'm asking is because my co-worker had no issues upgrading his iPhone4 with the same settings for our internal mail system as I have. I even created a new certificate for the mail server yesterday and he was able to authorize it within the MobileMail app and have it stick. So this may all be a matter of a bad install of the update, or just some corrupted settings from the older iOS version gumming up the works. I know everyone hates erasing their phone, but that's what AppleCare will tell you to do (or a Family Room Specialist at your local Apple Store).

Same issues here, with an iPhone 3G and an iPad/WiFi. Changing the SMTP settings as proposed doesn't work for me, even after a restore (with backup). Doesn't matter whether I am using 3G network or local WiFi...same issue. iPad asks for verification of certificate every time I unlock it (assuming here that the mail process is still running and wasn't terminated from the previous session). Apple needs to patch this ASAP with a "Trust Always" option on the warning dialog.

Hi,

Thanks jemenake0 for the solution. Entering the IP address worked for me.

I changed the outgoing mail server to the server IP address and also the port from 25 to 1025 as many ISPs block port 25 because of spamming. I've switched my phone off and on several times and its still working for me.

If you're using IMAP, simply deleting the accounts on the iPhone and setting them up again (on the iPhone) seems to work to solve the certificate issue. For some reason, if I perform an advanced sync and "Replace Information on this iPhone" the problem comes back.

I know it is dangerous to hazard guesses in situations like this, but given all the different things people have tried to solve this problem I'm going to do so anyway: My best guess is that the iOS 4.2.1 update somehow accidentally** broke permissions on an inode somewhere (file, dir, etc). Just in case Apple actually ends up reading this thread, I'll offer my opinion that perhaps MobileMail.app simply doesn't have the right permissions to properly save the certificate file and/or save the trust settings.

I say this because it seems to be that of the solutions tried, the ones that are claimed to work the best involve having a separate process save the necessary cert/trust data, specifically; mailing yourself a PEM file and opening the attachment presumably forces MobileMail to call an iOS hook to open ".pem" files, which in turn runs a process that can properly save the cert/trust*, also, manually deleting all your accounts then re-creating them might actually use a slightly different application to test the initial settings*, thus again getting around the theoretical permissions problems I'm proposing.

*Note: I haven't tried any of these methods personally yet, so this is just conjecture at this point, offered up for community perusal.

**I assume this is an accident as the UI has no explicit discernible changes and there were no warnings of this behavior change, either of which which would generally accompany a fairly major change like this.