Як використовувати S/MIME на Android?

S/MIME дає вашій пошті дві речі, яких звичайна пошта не має. підписане повідомлення доводить, що воно дійсно надійшло від вас і не було змінене; зашифроване повідомлення може відкрити лише людина, якій ви його надіслали. BlueMail підтримує обидва на Android.

What you need

• A certificate for your address, as a .p12 or .pfx file, plus the password protecting it. These usually come from your organization's IT team or a certificate authority, and the certificate has to be issued to the same address as the account you are setting up.
• An Enterprise license. S/MIME is part of BlueMail's Enterprise offering. Where it is not yet included, the S/MIME screen shows an Enterprise license required note with a Billing link, so you can see exactly what to ask for.

Save the .p12 somewhere your phone can reach, Downloads, Google Drive, or an attachment you sent yourself. BlueMail imports from the file itself, so a certificate already installed in Android's own credential store is not what it reads; keep the .p12 to hand.

Once imported, the private key is kept in BlueMail's own secure storage on that device.

Importing your certificate

1. Go to Settings | Privacy & Security | End-to-End Encryption.
2. Tap S/MIME Encryption & Signing.
3. Choose the account you are setting up.
4. Under Certificates for this account, tap Select… beside Signing certificate.
5. Pick your .p12 or .pfx file in Android's file picker.
6. Enter the file's password at the Certificate password prompt and tap Import.

You will see Certificate imported, and the certificate then shows its validity dates and a SHA-256 fingerprint so you can confirm you loaded the right one. Repeat for Encryption certificate, many certificates cover both jobs, in which case you import the same file twice.

If the file belongs to a different address, BlueMail says so directly, which saves you hunting for a configuration problem that isn't there.

Rolling certificates out across a fleet

For managed Android devices, nobody needs to handle certificate files by hand. BlueMail supports Android Enterprise managed configurations, so your IT team can deliver each user's S/MIME identity with the app: staff open BlueMail and their certificate is already in place, signing and decrypting from the first launch.

BlueMail matches a pushed certificate to the right account using the email address inside the certificate, so it lands on the correct mailbox without per-device setup. The import runs once and is then skipped, so reopening the app never repeats it, while publishing a replacement, at renewal, for instance, rolls the new certificate out on its own.

Android has a real advantage here: it broadcasts restriction changes to the app, so BlueMail picks up a new or updated configuration as soon as your EMM applies it, rather than waiting for the next launch.

For administrators. Three keys in the managed configuration do the work:

• smimeP12: the identity itself, as a base64-encoded .p12
• smimeP12Password: the password protecting that .p12
• enableSmime: grants the S/MIME entitlement, so a managed device needs nothing arranged separately

Android's advantage is timing: it broadcasts restriction changes, so BlueMail picks up a new or updated configuration as soon as your EMM applies it rather than waiting for the next launch. The wider set of managed settings is in Can I deploy BlueMail with MDM?.

For iPhone and iPad, the equivalent is iOS Managed App Configuration; see How do I use S/MIME on iPhone and iPad?.

Trusting the authority that issued a signature

The Trusted CAs section is what lets BlueMail confirm other people's signatures: "Certificate authorities used to verify signed mail as trusted. Importing a .p12 also trusts its issuing chain."

So importing your own certificate usually covers colleagues who share your issuer. For anyone outside that chain, tap Import CA certificate and pick their .pem or .cer file. The section keeps a running count of the authorities you trust.

Choosing what happens to each email

With a certificate in place, a security button appears to the right of the Subject line whenever you compose. Tap it and choose how to send this message:

The choice applies to the email in front of you, so you can sign routine mail and encrypt the occasional sensitive one without visiting settings.

To set it once instead, use Default behavior for outgoing mail on the S/MIME screen:

• Digitally sign all outgoing messages
• Encrypt messages by default when all recipients support S/MIME: encryption applies whenever BlueMail has a certificate for everyone on the message, and stays off when it would fail
• Send clear-signed copies for compatibility: keeps signed mail readable in apps that do not handle S/MIME signatures

Encrypting to other people

Encryption needs the recipient's certificate, and BlueMail looks these up as you address the message, you may briefly see "Looking up S/MIME certificates for recipients…". If someone has no certificate available, BlueMail names them under Missing S/MIME certificates rather than sending something they could not open, so you can sign instead or ask them for their certificate.

The easiest way to collect certificates is to exchange signed mail: a signed message carries the sender's certificate, so once a contact signs an email to you, you can encrypt to them from then on.

Reading signed and encrypted mail

Incoming S/MIME messages carry a badge in the header showing what BlueMail confirmed: Signed, Encrypted, Signed & Encrypted, or Signed · unverified sender when the signature cannot yet be tied to a trusted authority. You may see Verifying signature... or Decrypting... briefly while it works.

Tap the badge for S/MIME Message Information, which shows Signed with, Decrypted with, Your certificate, Encrypted to and the SHA-256 fingerprint.

When a signature shows as unverified, BlueMail gives the reason, and the reason points at the fix:

• "The signer's certificate isn't from a trusted authority. Import its CA to trust it.", add that authority under Trusted CAs above.
• "The certificate's email doesn't match the sender's address."
• "The signer's certificate has expired." or "isn't valid yet."
• "The certificate isn't authorized for email protection." or "for signing."

Prefer PGP?

BlueMail supports PGP as well, on the same End-to-End Encryption screen, and PGP is completely free, no Enterprise license, nothing to buy. See PGP keys in BlueMail.

Removing a certificate

Tap Remove beside a certificate. BlueMail confirms first: "This deletes the S/MIME certificate and its private key from this device. You can re-import it later."

Removing the whole account asks whether to keep the private key on the device. Keeping it means re-adding the account will decrypt your past S/MIME mail without another import; Delete key means you will need the .p12 again.

Also available on iPhone and iPad, Windows, Mac and Linux, and summarized in S/MIME Support.