All help articles

S/MIME: signed and encrypted mail

Some senders sign their mail with an S/MIME certificate, which proves the message came from their address and was not changed on the way. Mailocity checks every signed message when it arrives and again when you open it.

What webmail shows

• Digitally signed by the sender (green): the certificate is from an authority your server trusts, it is for the address in From, it had not expired, and the message is exactly as signed.
• The digital signature could not be confirmed (amber), with the reason: for example the certificate is from an unknown authority, it is for another address, it expired, or the message was changed after it was signed. Treat such a message with care, especially one asking for money or passwords.

Unsigned mail shows neither; most mail is not signed.

Your own certificate

In webmail Settings → S/MIME certificate, paste your certificate in PEM (-----BEGIN CERTIFICATE-----, with its chain if your authority gave you one). It must be for your mailbox's address, valid now, and for email. Download certificate gives it back.

To sign the mail you send from webmail, paste its private key too (unencrypted PEM: PRIVATE KEY, RSA PRIVATE KEY or EC PRIVATE KEY; export it from your .p12 with openssl pkcs12 -in cert.p12 -nocerts -nodes). The key is kept sealed with the server's key and opened only to sign. New messages then have Sign (S/MIME) switched on; recipients' apps show your mail as signed by you. Remove private key stops signing and keeps the certificate.

Signing is for mail sent at once (not scheduled), and the copy in Sent is the message as written, without the signature.

Encrypted mail

Webmail marks S/MIME-encrypted mail (Encrypted with S/MIME): read it in a mail app that has your certificate and key. Webmail does not decrypt or encrypt. For OpenPGP, see OpenPGP.

Mail apps and JMAP

With urn:ietf:params:jmap:smimeverify (RFC 9219), Email/get returns smimeStatus (signed/verified or signed/failed, checked again when asked), smimeErrors, smimeVerifiedAt and smimeStatusAtDelivery (the check when the message arrived). Email/query filters by hasSmime, hasVerifiedSmime and hasVerifiedSmimeAtDelivery; both verified filters use the check made at delivery, so a search never re-reads every message.

What is checked

The signature (detached multipart/signed, or application/pkcs7-mime signed data), the certificate chain to the operating system's trusted roots, the certificate's dates, and its email address against From. Encrypted mail cannot be read by the server, so it is not checked.

Signed mail stored before this check existed is checked in the background after the upgrade.