Back in November, we took a look at what it takes to encrypt email on the Mac using Apple Mail. If you are the user of an iPhone, iPod Touch, or iPad, and checking your email on that iOS device while sometimes sending encrypted email from your Mac, you will find that you have a problem. The certificate used to encrypt outgoing mail and decrypt incoming mail is stored on the Mac and is not installed on the iOS device by default. Oddly, Apple engineers have not seen fit to make the certificate files part of the information that is synchronized between the computer and the mobile device. But, not to worry. With the release of iOS5, email encryption is now supported. You just have to know the tricks necessary to get the certificate installed and the iOS configured to use the certificate. As it stands now, iOS encrypted email support is technically functional. Its just not smoothly implemented or what I would describe as “up to typical Apple standards.”
We start by assuming that you have already implemented encrypted email on your desktop/laptop Mac OS computer. If you have not, check out this post for the details explaining everything you need to know. The steps detailed below assume that you have the email encryption certificate installed and working on OS X as you will need to export some of that information in order to install it into the iOS based device.
First, open the application called Keychain Access, found in /Application/Utilities of your OS X based computer. Select My Certificates from the Category pane of the main window the locate the certificate that has the name of the email address you want to use for encrypted email on your iOS device. Right click on that certificate and select Export (your email here)… This will create a .p12 file. Give it any time you like and then save it to your Desktop for easy access. There will be a prompt to create a password. Come up with something secure but also make sure it will be easy to type on your iOS device. Once you have created a password, Keychain will require you to enter your system password before it allows you to complete the export of the key. This is just an additional authentication step to insure that someone did not run up to your machine and try to export your certificate while you were away at the coffee machine.
Now that the key file has been saved to the desktop, add that file as an attachment and email it to an address that can be checked from the iOS device that is to contain the certificate. If it seems oddly careless to transfer the certificate via an insecure email message, I’m right there with you. It’s kind of a chicken and the egg type of situation. This is also why it was important to use a strong password when you exported the certificate from the Keychain. For now, fight back that part of your brain that is telling you that this goes against everything you know about hardcore security and just click send on the email. I’ll have more to say on this subject a little later.
Now jump over to the iOS device and retrieve the email message that contained the certificate as an attachment. When the message is viewed, just tap on the attached .p12 file. The Identity Certificate interface will appear. Just tap Install and then tap Install Now when it asks you to confirm that you want to add an Unsigned Profile. I think this message is the result of using a free email certificate (but either way its nothing to worry about). You will be prompted to enter the certificate password that you entered when you generated the .p12 file. After that, just click done.
The final set of steps are required to configure your email account to use the certificate when sending messages. Open the Settings app and select Mail, Contacts, Calendars. Then tap on the account that you just installed the certificate into. Next tap at the top of the screen where it says Account followed by your email address, then scroll down to the bottom to advanced. Scroll to the bottom of the Advanced screen and switch S/MIME to On. Once you do this, scroll down just a bit further and you will see new options for Sign and Encrypt. By going into either of these options you will be able to enable one or both.
Keep in mind that if you turn on the Sign option, all messages sent from your iOS device will be signed by default. While mail clients on the Mac OS have the option to turn the signing option on or off for each message, the Mail app for the iOS lacks this sophistication. This means that all messages will be signed if the preference is enabled. Likewise, the Mail app lacks the sophistication to turn encryption on or off for each message. So the mail app will encrypt the message when it knows it can send a secure message to the recipient and it will send an insecure message when it cannot.
That’s it. You are done. The iOS device has the certificate installed and the mail account has been configure to use it. There’s just one more unintuitive process to go through for each and every contact that you want to exchange secure email with. Before encrypted email can be exchanged, both parties must first exchange signed emails. This gets the public portion of the encryption key pair into the opposing parties hands so they have what they will need to decrypt the message when you send it. When a signed message is sent and received via the mail client on the Mac OS, the certificate is automatically stored when the signed message is received in the initial exchange. But for whatever reason, on iOS devices, the signed certificate is not stored automatically.
You read the correctly. When a signed email message is sent to an iOS email account, the public portion of the certificate is not stored automatically. This means that the person receiving the email must manually store the certificate attached to the email message if they ever want to move on to the next stage of the game and exchange encrypted email with the opposing party. The process for manually storing the certificate from the signed email message is not intuitive. This is one of the places that Apple engineers really dropped the ball when developing the mail client for the iOS.
When a signed email message is received on an iOS device, it is necessary to tap on the sender’s name in the email message. This brings up a screen with the senders information. Here it will likely indicate that the message has been signed. Next tap the View Certificate button. When the certificate information is displayed, tap Install, then click Done. This brings us back to the Sender information. Just click the left arrow at the top of the screen. The arrow is labeled Message and it will take you back to your email message. This completes the process of manually saving the certificate on your iOS device. Once this has been done, it will be possible to send and receive encrypted messages with the selected users email address. This complicated process only needs to be run through a single time for each email address you plan to correspond with. But it is essential to go though these steps before you will be able to complete an encrypted exchange with the opposing account.
Does that manual process sound like a pain in the ass? I take this as a dramatic oversight in the design of the iOS email client. I also consider the need to email the .p12 certificate onto the iOS device in order to start the entire process to be a massive mistake in usability as well as a potential security risk. Some might suggest that Apple’s iPhone Configuration Utility would be a more ideal way to get the .p12 certificate onto the iOS device and circumvent the need to email the certificate entirely. But in my testing, the iPhone Configuration Utility simply did not work. It installed the certificate on the device and looked to have installed correctly. Unfortunatly I was absolutely unable to get the Mail app to link up to the certificate when I entered the Mail settings and tried to activate S/MIME.
I give credit to Apple for finally bring encrypted email support to iOS devices with iOS 5. But the support is rudimentary at best and lacks the polish and sophistication that users have come to expect from Apple products. I am sure that the functionality will be further developed in future releases but it strikes me as though the support was never fully completed and S/MIME support might have been sacrificed in an effort to ship iOS 5 by a set date. Even more puzzling given Apple’s desire to bring enterprise level features to the iOS in an effort to push stalwarts such as Blackberry out of the corporate space. The only thing I can be sure about is that encrypted email on iOS devices is currently only something for the power users. Its certainly not for a novice user for the faint of heart.