3

When I receive an email signed (not encrypted) with S/MIME in my Gmail account, it provides me no option of verifying the signature when I'm using the webmail interface. Which is fine, I have made peace with that. However, when I open the signed email (in my Gmail account) on my iPhone, it also doesn't show the checkmark next to the sender's name, which it does for signed email received in my Exchange account.

What's going on there? Is Gmail actively stripping the attached certificate so that my iPhone can't use it? Any ideas? Thanks!

  • Gmail's handling of S/MIME, in a word, sucks. Outlook (at least on Windows) can both send and verify signed email over Gmail at least some of the time, but sometimes Gmail instead eats the entire message except for the "To:" and "From:" addresses. I cannot recommend using Gmail for S/MIME at this time. – CBHacking May 10 '17 at 19:52
  • Can your iPhone verify signed messages received over other IMAP services? Some (many, really) email clients just don't support S/MIME for IMAP or POP3 servers. It's totally possible to support it, but for some reason a lot of email client developers apparently decided it's an "enterprise-only" feature and therefore only support it for Exchange servers. – CBHacking May 10 '17 at 19:55
  • Can you name one of those clients? – eckes May 10 '17 at 22:10
  • Thanks! I don't have another IMAP account to test with, unfortunately. I guess I just don't understand what the problem is, considering it's just an attachment that needs to be parsed. If a client (such as iPhone Mail) can parse it for one service it shouldn't be a problem for another such as IMAP, right? That led me to conclude that Gmail itself is doing weird stuff, which doesn't make sense to me considering they're placing their bets on email authentication as well (albeit in the form of DKIM). – finkelstein May 11 '17 at 5:55
2

Gmail mangles S/MIME signed only messages. Before 2017 it was done for multipart/signed from summer 2017 it has started for signed-data as well.

Looks like it's done in a favor of G Suite subscribers and there is no hope that Gmail team will fix it.
https://productforums.google.com/forum/?utm_medium=email&utm_source=footer#!msg/gmail/RUBO_qtA5nM/FclopwMZBAAJ

  • Currently I don't have any such problems (S/MIME signatures are verified by Gmail webapp and still verifiable by IMAP clients), so in the end perhaps they did fix it. – grawity May 16 '18 at 11:20
  • Just checked. The bug is still present. S/MIME signature is not available for plain users if a signed email was sent and received inside Gmail. Do you use G Suite subscription? – Maxim Sokolov May 18 '18 at 12:37
  • No, it's just regular free Gmail. (I see the green checkmark and signature details via web UI, but still get a normal multipart/signed via IMAP and all my clients are able to verify the signature on their own.) – grawity May 18 '18 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.