Як використовувати S/MIME на iOS?

S/MIME дає вашій пошті дві речі, яких не може запропонувати звичайна пошта. підписане повідомлення доводить, що воно справді надійшло від вас і не було змінене; зашифроване повідомлення може відкрити лише людина, якій ви його надіслали. BlueMail підтримує обидва на iPhone та iPad.

What you need

• A certificate for your address, as a .p12 or .pfx file, along with the password that protects it. These are usually issued by your organization's IT team or a certificate authority, and the certificate has to be issued to the same address as the account you are setting up.
• An Enterprise license. S/MIME is part of BlueMail's Enterprise offering. If your account is not on it yet, the S/MIME screen shows an Enterprise license required note with a Billing link, so you can see exactly what to ask for.

Have the .p12 file somewhere your device can reach it, saved in Files, iCloud Drive, or sent to yourself as an attachment.

BlueMail imports the certificate from a file, not from an installed iOS profile. If your certificate arrived as a configuration profile under Settings | General | VPN & Device Management, iOS holds that identity for its own use and BlueMail reads the .p12 instead. Ask whoever issued it for the file, or have your IT team push it to BlueMail directly, which is what the managed-configuration route below is for.

Once imported, the private key is kept in BlueMail's own keychain entry, set never to sync to iCloud or migrate to another device, so the key stays on the device you imported it on.

Importing your certificate

1. Go to Settings | Privacy & Security | End-to-End Encryption.
2. Tap S/MIME Encryption & Signing.
3. Choose the account you are setting up.
4. Under Certificates for this account, tap Select… beside Signing certificate.
5. Pick your .p12 or .pfx file in the iOS file picker.
6. Enter the file's password at the Certificate password prompt and tap Import.

You will see Certificate imported, and the certificate now shows its validity dates and a SHA-256 fingerprint so you can confirm you loaded the right one.

Do the same for Encryption certificate. Many certificates cover both signing and encryption, in which case you import the same file into both slots.

If the file is issued to a different address, BlueMail tells you plainly: "This certificate is issued to …, not this account …", which saves you hunting for a configuration problem that isn't there.

Getting your certificate pushed to you automatically

If your device is managed by your organization, you may not have to do any of the above. BlueMail supports iOS Managed App Configuration, so your IT team can deliver your S/MIME identity with the app itself. You open BlueMail and your certificate is already there, signing and decrypting straight away. Nothing to download, no password to be sent around, and no chance of importing the wrong file.

BlueMail matches a pushed certificate to the right account by the email address inside the certificate, so it lands on the correct mailbox on its own. The import runs once and is skipped afterwards, so re-opening the app does not repeat it. Replacing a certificate at renewal simply pushes the new one through.

For administrators. Three keys in the managed app configuration do the work:

• smimeP12: the identity itself, as a base64-encoded .p12
• smimeP12Password: the password protecting that .p12
• enableSmime: grants the S/MIME entitlement, so a managed device needs nothing arranged separately

iOS re-reads the managed configuration when BlueMail next comes to the foreground, so a change you publish applies the next time the user opens the app. The full set of managed settings, including the policy keys that ship alongside these, is in S/MIME Support, and the wider set of managed settings is in Can I deploy BlueMail with MDM?.

Android is configured the same way through Android Enterprise; see How do I use S/MIME on Android?.

Trusting the authority that issued a signature

The Trusted CAs section is what lets BlueMail confirm other people's signatures: "Certificate authorities used to verify signed mail as trusted. Importing a .p12 also trusts its issuing chain."

So importing your own certificate usually covers your colleagues too, since you share an issuer. For anyone outside that chain, tap Import CA certificate and pick their .pem or .cer file. The section keeps a running count of how many authorities you trust.

Choosing what happens to each email

Once a certificate is in place, a security button appears to the right of the Subject line whenever you compose. Tap it and choose how to send this message:

The choice applies to the email in front of you, so you can sign routine mail and encrypt the occasional sensitive one without changing any settings.

To avoid deciding every time, set your defaults back on the S/MIME screen under Default behavior for outgoing mail:

• Digitally sign all outgoing messages: every message goes out signed.
• Encrypt messages by default when all recipients support S/MIME: encryption applies automatically whenever BlueMail has a certificate for everyone on the message, and stays off when it would fail.
• Send clear-signed copies for compatibility: keeps signed mail readable in apps that do not handle S/MIME signatures.

Encrypting to other people

Encryption needs the recipient's certificate, and BlueMail looks these up for you as you address the message, you may briefly see "Looking up S/MIME certificates for recipients…". If someone on the list has no certificate available, BlueMail names them under Missing S/MIME certificates rather than sending something they could not open, so you can sign that message instead or ask them for their certificate.

The reliable way to collect certificates is simply to exchange signed mail: a signed message carries the sender's certificate, so once a contact signs an email to you, you can encrypt to them from then on.

Reading signed and encrypted mail

Incoming S/MIME messages carry a badge in the message header telling you what BlueMail confirmed:

• Signed: the signature checks out.
• Encrypted: the message was encrypted to you and has been decrypted on your device.
• Signed & Encrypted: both.
• Signed · unverified sender: the message is signed, but BlueMail could not tie the signature to a trusted authority yet.

You may see Verifying signature... or Decrypting... for a moment while it works.

Tap the badge for S/MIME Message Information, which shows Signed with, Decrypted with, Your certificate, Encrypted to and the SHA-256 fingerprint, everything you need to confirm exactly which certificate was involved.

When a signature shows as unverified, BlueMail says why, and the reason points at the fix:

• "The signer's certificate isn't from a trusted authority. Import its CA to trust it.", add that authority under Trusted CAs above.
• "The certificate's email doesn't match the sender's address."
• "The signer's certificate has expired." or "isn't valid yet."
• "The certificate isn't authorized for email protection." or "for signing."

Prefer PGP?

BlueMail supports PGP as well, on the same End-to-End Encryption screen, and PGP is completely free, no Enterprise license, nothing to buy. If you would rather use PGP keys than a certificate authority's, see PGP keys in BlueMail.

Removing a certificate

Tap Remove beside a certificate. BlueMail confirms first: "This deletes the S/MIME certificate and its private key from this device. You can re-import it later."

When you remove the whole account, BlueMail asks whether to keep the private key on the device. Keeping it means re-adding the account will decrypt your past S/MIME mail without another import; choosing Delete key means you will need the .p12 file again.

Managing certificates on iOS is done entirely from this screen, the desktop apps additionally offer a link into the operating system's own certificate manager.

Also available on Android, Windows, Mac and Linux, and summarized in S/MIME Support.