Simple question, but I couldn’t find the answer anywhere…

I need to send encrypted e‑mails through using s/mime (talking about security, even most of metadata should be unknown). The problem is I’m not part of Google app organization (and I don’t need it since it’s not free).

How do I configure Gmail or the Samsung e-mail app to use the CA trusted certificate (which only contains public key) I installed on the device for sending enciphered e‑mails through s/mime ?

I also need to manually select the certificate which will be used for encryption (The company generate the paid certificate for me so it match my e-mail address and not company one).

  • You can't just configure an app to use S/MIME - it has to support it. Neither GMail nor the default Mail app support S/MIME AFAIK. Have you checked R2Mail2 and MailDroid?
    – Robert
    Jun 20 '18 at 17:12
  • @Robert yes I did. At that point, I wouldn’t mind about using the web interface, but I need to use my Gmail address for sending the messages. I heard the Google app for works supports encryption along acknowledgements but not with a Gmail address ending with gmail.com. Jun 20 '18 at 17:43
  • @Robert I also need to sign at the same time. Jun 20 '18 at 17:56
  • I am sorry I am giving up. Your question is still unclear. Have you set-up the Email client correctly to use use your S/MIME certificate - at least signing should be possible. If it not, you don't have to start trying to send encrypted mails.
    – Robert
    Jun 21 '18 at 15:09
  • @Robert no, simple I have a trusted cert matching my.email@gmail.com. But I have no public keys for department@company.com (but company.com has private key of certificate matching my.email@gmail.com). Most email client selects certificates automatically according to recipient, which mean they (softwares) try to find a public certificate for department@company.com, but since there’s no certificate verified for department@company.com, the e mail client refuses to encrypt the message and sending fails. What I need is to be able to manually select the certificate matching my.email@gmail.com. Jun 21 '18 at 20:25

For the Samsung email app (on my Galaxy Tab A anyway) you need the following ▪An exchange activesync account - for some reason s/mime is not enabled for any other email type ▪Your public and private keys for your exchange account as a PKCS#12 cert uploaded to your tablet already or in your download directory ( root/sdcard/Download directory ) ready for import.

Go to the email settings > exchange account > security options screen and select the encryption certificate option then import. It should show you the PKCS#12 file and let you select it, enter any needed password and import it to your keystore with a friendly name of your choice. Repeat for the signing key - typicallly this is the same PKCS#12 file. Set it to sign all outgoing mail if you wish - that'll help distribute your public key and maybe raises peoples awareness of s/mime. It's probably not worth encrypting all outgoing messages by default as you'll get a warning for each recipient that you don't have their public key.

Send yourself test signed and then encrypted emails to prove this is working - preferably using a second device to test thoroughly. The three-dot menu on the send email will let you pick security options to sign and encrypt for individual messges.

The next stage is to try to exchange signed email with other real contacts - if you've defaulted to sign all this should just happen and they should be able to validate the signature.

The last stage is to send them an encrypted email, for that you need their public key / cert. If you've been exchanging signed email you should have it - hopefully you're also using exchange contacts and their record has their key else you'll need to add it from a received email.

Slightly concerning that you say the recipient has a copy of your private key - this should never happen as your private key should always remain private to you. Officially you should revoke you key and get a new one. The practical upshot is things will get very confusing as to what's going on if you've got keys mixed up between public and private and sender and recipient. Good luck.

I don't think Samsung mail lets you easily swap your certs either - you can go into settings and change them but unless youre doing something interesting you should only have one email address on your exchange account.If you're trying to use encrypted group email I don't think Samsung email is going to help, and I don't know of any other mail client that can either.

  • I would definitely prefer using the offial ᴀᴘᴘ. Jan 2 '19 at 18:06

You need to use a mail app that supports, S/MIME. Check out Blackberry Hub app, K9 Mail, or others.

You can set up your gmail account as imap so that you send and receive using your gmail account.

  • Of course I already know that. The question is how ? Jun 20 '18 at 23:46

First you need an S/MIME certificate including private key for your selected E-Mail address.

If you don't have this you don't have to look for apps. AFAIK there is no "Let's Encrypt" for S/MIME therefore you have to buy the certificate for your e-mail address.

If you want to use your GMail account you have to enable IMAP on it.

Now you need an Android app that supports S/MIME signing and verifying. AFAIK the Google for enterprise apps are different form the regular apps, therefore the Gmail app won't work. As far as I know the following two apps should fully support S/MIME:

  • The following apps won’t let me select a certificate manually. They complain that there is no certificates matching recipient. This is about using the same certificate for signing and encryption. If you found an app, also describe how to use encryption through the selecting the trusted certificate manually. Jun 21 '18 at 8:26
  • Do you have an S/MIME certificate including private key for your e-mail address (not for the recipient)? Because if not you can stop here. The rest only works if you have a valid S/MIME certificate for your account.
    – Robert
    Jun 21 '18 at 11:16
  • If you would have read my question correctly, you would have know that I have a trusted certificate for my e mail address. But I do not have a public certificate for recipient (recipient have a copy of my private key instead). so I can sign e mails but I cannot encrypt them. Jun 21 '18 at 11:26
  • So you have configured both GMail and the Samsung EMail client to use your S/MIME certificate? Note: S/MIME does not allow to send just an encrypted E-Mail to a recipient. Your own certificate also has to be installed (this prevents that you can't decrypt the mails stored in the sent folder).
    – Robert
    Jun 21 '18 at 11:33
  • Currently using Firefox extension. Yes, I installed my own (or rather third party provided and generated) certificate on system store. Again, that’s not fully certificate problem. Jun 21 '18 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.