Mail.app encryption not working in El Capitan

First, after installing an S/MIME certificate, you must quit and relaunch Mail in order for it to become available.

The address associated with the S/MIME public key must exactly match the address to which you're trying to send the encrypted message, or from which you're trying to send a signed message. If the message is both signed and encrypted, both addresses must match. The matching is case-sensitive: "Foo@Bar.com" does not match "foo@bar.com".

The signing and/or encrypting certificates must be valid: not expired, revoked, self-signed, or signed by an unknown CA. You can check the status of the certificate in Keychain Access.

Encryption does not involve your key at all; only the recipient's key. Please double check that the address associated with his or her public key exactly matches the address you're sending to, both as to spelling and case.

Can you encrypt a message to yourself? It's normal for there to be no indication that an incoming message is encrypted. You have to look at the headers to see whether it is.

Hi,

I just posted an independant message regarding missing encrypted and signed tags.

It appears that this in a bug in Mail 9.2. Even though messages are properly encrypted (see raw message!) and signed the tags are missing in the recipient's message window.

This is a very annoying bug.

Regards,

Twistan

Please read this whole message before doing anything.

This procedure is a test, not a solution. Don’t be disappointed when you find that nothing has changed after you complete it.

Step 1

The purpose of this step is to determine whether the problem is localized to your user account.

Enable guest logins* and log in as Guest. Don't use the Safari-only “Guest User” login created by “Find My Mac.”

While logged in as Guest, you won’t have access to any of your documents or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this behavior; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.

Test while logged in as Guest. You'll have to set up an account in Mail and also import your S/MIME key just as you originally did. Same problem?

After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.

*Note: If you’ve activated “Find My Mac” or FileVault, then you can’t enable the Guest account. The “Guest User” login created by “Find My Mac” is not the same. Create a new account in which to test, and delete it, including its home folder, after testing.

Step 2

The purpose of this step is to determine whether the problem is caused by third-party system modifications that load automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

Please take this step regardless of the results of Step 1.

Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

Test while in safe mode. Same problem?

After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of Steps 1 and 2.

As I wrote earlier, you can start up in safe mode. Please post the results of Step 2.

As a test, please go to InstantSSL and request a free S/MIME signing certificate. I've tested their certificates and I know that they work. I haven't tested yours. Install the certificate, remove the one you have now, and see whether you can send yourself a signed, encrypted message.

I guess that if you don't have a valid certificate of your own, Mail won't let you encrypt mail to anyone else. That would make sense, since the recipient would not be able to send you an encrypted reply. As for why your other certificate doesn't work, I don't know what to tell you. The IT staff at work would have to figure that out.