Attach whole certificate chain when signing e-mails using S/MIME

Hello,


I'd like to sign e-mails using S/MIME and the iOS mail app.


Therefore I installed the certificate containing my private key (issued by certum.eu) as a profile and activated S/MIME in the mail account settings (iOS settings). The certificate is selected there properly and the option to sign e-mails automatically has been enabled.


When I send e-mails now, they get signed - but not correctly: some e-mail clients say the signature was invalid.


When I send and sign e-mails with Outlook for Windows using the same certificate all the e-mail clients recognize the signature as valid.


The problem seems to be that the iOS mail app does not attach the whole certificate chain to the signature. Some e-mail client thus cannot validate it. (Windows for example is enrolled with certum's root CA by default but without the required intermediate certificates.)


The certificate I imported into iOS DOES contain all intermediate certificates (and they are listed in iOS when I retrieve the certificate's details there) and iOS says the certificate is 'trustworthy'. So all information needed should be available on the device.


How can I make the mail app behave like Outlook? Thank you very much in advance.


Best wishes

iPhone 5s, iOS 8.3

Posted on Apr 29, 2015 2:21 AM

Reply
1 reply
Sort By: 

Apr 30, 2015 9:10 AM in response to tque

Hello,


I verified my assumption using the openssl pkcs7 -print_certs command.


smime.p7s files generated by Outlook for Windows do contain three -----BEGIN CERTIFICATE----- parts (one for each certificate in the chain) while those signature files generated by Apple iOS Mail contain my personal certificate only.


I have imported the same key file (.pfx) to Outlook (on five Windows computers) and iOS. Why does iOS Mail behave so differently?

Reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Attach whole certificate chain when signing e-mails using S/MIME

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.