Installing the Recipient's Public Key
The foundation of successful S/MIME encryption is having the correct public key available locally. macOS does not automatically fetch these keys; they must be imported manually from the recipient or obtained through a directory service if configured. Without this step, the encryption option will either be unavailable or show no valid certificates to choose from.
Start by receiving the public key file from your colleague. This is typically a .cer, .crt, or .pem file. Double-click this file on your Mac. A window will appear asking where to store the key. Select System or Login keychain depending on your preference, though the Login keychain is standard for personal use. Click Add to install it.
After installation, you may need to trust the certificate. Open the Keychain Access application, locate the newly added certificate, and double-click it. In the Trust section, expand the dropdown and set When using this certificate to Always Trust. Close the window and enter your password when prompted to save the changes. This step is critical because macOS will block encryption attempts if the certificate chain is not explicitly trusted.
Configuring Mail Account Settings
Before you can send encrypted mail, your own identity must be properly configured. Open the Mail application and navigate to Settings (or Preferences on older versions) in the top menu bar. Select the Accounts tab and choose the email account you intend to use for sending secure messages.
Click the More Info button, then switch to the Signing Identities tab. Here, you should see your own S/MIME certificate listed. If it is missing, click Add and select your personal certificate from the list. Ensure that the email address matches exactly what recipients expect. While this section handles digital signatures, verifying it here ensures your entire S/MIME setup is active and recognized by the Mail app.
Selecting the Key During Composition
This is the core of your query: how to actually pick the right key when writing an email. Open a new message window. Look at the toolbar above the message body. You will see a small lock icon or a gear icon depending on your macOS version. Click this icon to reveal the encryption options.
If you do not see the lock icon immediately, go to the menu bar and select Message > Encrypt. A submenu will appear listing all available public keys for the recipient(s) in the To field. You must manually select the specific certificate that matches the recipient's current email address. It is vital to verify the email address next to the certificate name to avoid sending encrypted data to the wrong person.
Once selected, the lock icon in the toolbar will change appearance, often turning solid or displaying a checkmark, indicating that encryption is active. The message will now be encoded using the public key you selected. Only the recipient, who holds the corresponding private key, can decrypt and read the content.
Troubleshooting Common Issues
If the encryption option is grayed out or fails, several factors could be at play. First, verify that the recipient has provided their public key directly to you. Some organizations distribute keys via internal directories, but if you are emailing external contacts, manual exchange is required.
Another common issue is certificate expiration. Check the validity dates in Keychain Access. An expired certificate cannot be used for encryption. Additionally, ensure that the recipient’s email client supports S/MIME. While most modern clients like Apple Mail, Outlook, and Thunderbird support it, some web-based interfaces may strip encryption headers or fail to display them correctly.
If you encounter errors during sending, check the Activity Monitor in Mail to see if the message is stuck. Sometimes, network issues prevent the transmission of large encrypted attachments. Also, remember that while you can encrypt the body of the email, attachments may require separate handling depending on your specific setup. For more insights on keeping your mail client stable, consider reviewing resources on Dealing with Mac Mail Acting Improperly: Troubleshooting Tips.
Verifying Encryption Success
To confirm that your settings are working, send a test email to yourself. Compose a message, apply the encryption, and send it. When you receive it, the message should display as unreadable plain text unless you have the corresponding private key installed. Since you likely have your own key, you should be able to decrypt it successfully. If you send it to a colleague, ask them to confirm they can open it without errors. This loop confirms that both your signing identity and their public key integration are functioning correctly.
Frequently Asked Questions
Can I encrypt emails to recipients who don't have S/MIME?
No, S/MIME requires both parties to have compatible certificates installed. If the recipient lacks the public key, you cannot encrypt the message for them. You would need to send the unencrypted email or guide them to install the necessary certificate first.
Why is my S/MIME certificate showing as invalid?
This usually happens if the certificate chain is broken or the root CA is not trusted. Open Keychain Access, find the certificate, and check its details. Ensure that the intermediate and root certificates are also present and marked as trusted in your system settings.
Does macOS Mail automatically update S/MIME certificates?
No, macOS Mail does not auto-update certificates. You must manually import new certificates when they are renewed or changed. Relying on automatic updates can lead to failed encryption attempts if the old key expires.
How do I know which certificate to select if a recipient has multiple?
Look at the email address associated with each certificate in the selection menu. Choose the one that exactly matches the recipient's current email address. If they have multiple addresses, you may need to install keys for each one they might use.
Is S/MIME supported on iOS devices?
Yes, Apple Mail on iPhone and iPad supports S/MIME. However, you must install the same certificates on your iOS device via a configuration profile or by syncing your iCloud Keychain. The process for selecting the key remains similar across platforms.