S/MIME
Import your certificate, collect your contacts' certificates, and sign, encrypt and verify mail with S/MIME.
S/MIME works with X.509 certificates issued by a certificate authority. To sign and to read encrypted mail, FOLD needs your own certificate with its private key. To encrypt, it needs a certificate for every recipient.
What works where
| Mac | iPhone and iPad | |
|---|---|---|
| Verify signatures | Yes | Yes |
| Decrypt | Yes | Yes, for RSA certificates and AES-CBC content |
| Sign | Yes | Yes |
| Encrypt | Yes | Yes, to certificates collected from signed mail |
| Import recipient certificates by hand | Yes | Not yet |
| Own identities | One per account | One, attached to your first account |
Your own certificate
On the Mac, open Settings (⌘,) > Security > S/MIME certificate. Pick the account, click Choose file …, select the PKCS#12 file (.p12) and enter its password.
On iPhone and iPad, tap your account picture, then Security & Privacy > S/MIME identity > Import identity (.p12).
FOLD stores the .p12 file and its password in the keychain of this device. They are not synced to iCloud.
Recipient certificates
When a signed message verifies, FOLD stores the signer’s certificate under its email address. From then on you can encrypt to that address. A collected certificate never replaces one you imported yourself, and it replaces an earlier collected one only if it chains to a trusted authority and the old one did not.
On the Mac you can also add certificates in Settings > Security > Recipient certificates > Import certificate (.cer, .pem or .der). The certificate must contain an email address.
Sending
When signing or encrypting is possible, the compose window on the Mac shows a lock button for signing and a shield button for encrypting. On iPhone and iPad, both switches are under More in the compose form. FOLD chooses the method itself:
- Signing uses your OpenPGP key if the account has one, otherwise your S/MIME identity. S/MIME signatures use SHA-256.
- Encrypting uses OpenPGP if every recipient has an OpenPGP key, otherwise S/MIME if every recipient has a certificate. If neither covers all recipients, FOLD does not send and names the recipients without a key.
A message that is both signed and encrypted is signed first, then encrypted.
Reading
FOLD verifies S/MIME signatures automatically, after decryption if necessary, against the certificate authorities your system trusts. The security inspector shows one of these states:
- verified ✓: the signature is valid, the certificate chains to a trusted authority and its address matches the sender.
- valid, unknown CA: the signature is valid, but the authority is not trusted, for example a self-signed certificate.
- valid, certificate expired
- certificate revoked: only reported when the online check below is on.
- invalid signature: the content was changed, or the certificate belongs to an address other than the sender’s.
Encrypted messages open with your identity. Without a matching identity, FOLD shows a notice instead of the encrypted data.
Revocation checks
By default FOLD checks certificates offline. S/MIME revocation check (online) in the security settings makes FOLD ask the authority’s OCSP or CRL server whenever you open signed mail. An unreachable server is not treated as a revocation.