I know this is a late response, but here it is anyway. Apple doesn't provide a way to manage public certs in iOS for non-enterprise users, other than by using the Mail.app like you tried. Unfortunately, there are limitations as you ran into. The main limitation is that you cannot install an email correspondent's new certificate until his/her old one is removed. But, in order to remove the old certificate you have to have an email from them that is signed with the old certificate, which by clicking on their name in the header of the email and viewing the certificate, you have the option of removing it (the red button). Then, by reading their new email that has been signed with their new certificate you click on their name and then the certificate install process you normally do will be honored (at which time the blue install button will turn into a red remove button, which is how you know it got installed). There is a catch-22 to this process because if your corresnpondent's certificate has expired, then they cannot sign an email with their old certificate, so if you don't have an old signed email from them, you're hosed. At this point the only way is to totally wipe your phone of all data and start over. In my case, since I had access to my team's desktop computers, I set their computer time back to before the old certificate expired (their certificates were still in Keychain), sent a signed email using their old cert, then removing in iOS Mail.app, then setting the date back to the correct date/time (this required turning off Network Time Protocol >> in System Preferences, Set Date & Time, uncheck "Set date and time automatically"). This isn't a good solution, obviously, especially if you have 100's of s/mime correspondents whose certificates expire every year! Apple just hasn't provided support for public certificate management for individuals in iOS other than what I've described above and does not plan to. There are too few s/mime users even in enterprise to make it worth the time and money to do so.
As for enterprise, through Apple Configurator, you can set up MDM (Mobile Device Management) servers to manage hundreds or thousands of iOS devices over the Internet thru secure channels. This would be how the NSA, FBI, or military would configure their user's phones and s/mime settings. But even then, the public certificates would then be between known email correspondents that are trusted and part of the group, not ad-hock unknown ones.
As individual users of s/mime, I suggest either/both of the following:
- Maintain a mail folder and archive at least one signed email from every s/mime correspondent you have received a signed email from. Do not delete because you'll need the old email in order to remove their old certificate once their's expires.
- If all of your s/mime correspondents are on your own team, then setup both their iOS and desktop email accounts to leave s/mime signatures turned on. This presumes you've obtained "real" s/mime certificates from a root CA (certificate authority) such as Comodo (which still offers free s/mime certs for individual use). This will not work very well if you use self-signed s/mime certificates because the signatures will not be trusted outside your team, thus making signed email problematic.
The other option is to use GPG, but it has it's own headaches, especially with iOS ease of use.
