Use digital signatures for email with Apple Mail and Outlook for macOS
On this page:
- Before you begin
- Install in macOS
- Use your certificate with Apple Mail
- Use your certificate with Outlook for macOS
- Use a group account certificate
- Disable your certificate in Apple Mail
- Disable your certificate in Outlook for macOS
Before you begin
To view all the content available to you here, use the green log into the Knowledge Base.
button at the top of this page toYou can use S/MIME certificates, also called "S/MIME Certs" or "Personal Certificates", with most email clients to digitally sign and/or encrypt email messages. At Indiana University, S/MIME certificates are provided by the InCommon Certificate Service. For instructions on getting a certificate, see Get an S/MIME certificate for digital email signatures at IU.
For details about potential issues with various devices and applications when using digital signatures, be sure to refer to Known issues with digitally signed email at IU.
When you receive your certificate from InCommon, it will be encrypted in the PKCS 12 format (.p12
or .pfx
), using the strong passphrase ("PIN") you created for it at the time of request. You will need this passphrase to install the certificate.
View a video about using digital signatures in Apple Mail and Outlook for macOS.
Install in macOS
- Double-click the file downloaded from the InCommon Certificate Manager.
- Keychain Access will prompt you for the certificate passphrase; use the second, "PIN" passphrase, not the first "request" passphrase.
The certificate will be installed on your Mac and will appear in the "My Certificates" section of Keychain Access. The certificate is now available for Apple Mail, Outlook, and other applications that can use client certificates.
Use your certificate with Apple Mail
Use these instructions to enable Apple Mail to use client certificates to digitally sign and encrypt email.
Enable digital signing and encryption
- If you have just installed your certificate on your Mac, close Mail and then restart it.
- Begin composing an email message. You should see the "Signed" icon (
) in the lower right of the message header (this indicates the message will be signed). If you don't see the "Signed" icon, select (in the lower left of the message header), and add the "Lock" and "Signed" icons.
Sign email
To send a signed message, verify that the "Signed" icon has a checkmark (✔
) in it . If the "Signed" icon has an x
instead, your message will not be signed.
You may not want to sign messages to mailing lists, because S/MIME digital signatures are attachments, which some lists do not accept.
Encrypt email
If you have the public certificate for the user or users to whom the messages is addressed, you will be able to encrypt the email message: In the lower right of the message header, click the open lock icon to lock it; when the icon is locked, your email message will be encrypted.
If you do not have certificates for everyone to whom the message is addressed, you will be prompted to send the message unencrypted.
Use your certificate with Outlook for macOS
Use these instructions to enable Outlook to use client certificates to digitally sign and encrypt email.
Enable digital signing and encryption
- If you have just installed your certificate on your Mac, close Outlook and then restart it.
- From the menu, select . Select your IU email account. If you are using the classic Outlook interface, click , and then select the tab. If you are using New Outlook, click .
- In the "Digital signing" section, select your certificate from the drop-down menu.
- For "Signing algorithm", the default value of is appropriate for most situations. This section will not be available in the New Outlook interface.
- For the best usability, enable the following options:
- In the "Encryption" section, select your certificate from the drop-down menu.
- It is not necessary to check ; each email message can be optionally encrypted when you compose it. If you are using the classic Outlook interface, is the best encryption algorithm.
- IU does not currently use the "Certificate authentication" options; if this is an option, do not set this.
- Click to save your changes and exit Outlook Preferences.
Sign email
By default, your email messages will be digitally signed. To indicate signing, a lock icon with the text "This message will be digitally signed" will appear when you compose an email message:
If you do not want to sign a message, from the
tab of the mail message, click so that it is not selected. If you don't see the tab, you may need to open the message you're composing in its own window. Click the far right icon next to the "From:" field.You may not want to sign messages to mailing lists, because S/MIME digital signatures are attachments, which some lists do not accept.
Encrypt email
Address and compose your email message. From the
tab of the mail message, click so that it is selected. If you don't see the tab, you may need to open the message you're composing in its own window. Click the far right icon next to the "From:" field.If Outlook is unable to find certificates for everyone to whom the message is addressed, you will be prompted to search for user certificates. If Outlook is still unable to find certificates for all addressees, you will be prompted to send the message unencrypted.
Use a group account certificate
To use an S/MIME certificate with a group account, install and enable the certificate as you would for a standard account.
- If the profile you are using in your email client is the group account, there should be no issues.
- If the profile you are using in your email client is your personal account and you want to send email from the group account, in your email message, open the "From" field and enter the group account address. If your personal account has "send as" rights for the group account, there should be no issues. If you are unsure whether you have "send as" rights, contact your IT Pro.
Disable your certificate in Apple Mail
- Open Mail.
- Begin composing an email message. Click the "Signed" icon (
) in the lower right of the message header to no longer digitally sign email.
Disable your certificate in Outlook for macOS
- From the menu, select . Select your IU email account. If you are using the classic Outlook interface, click , and then select the tab. If you are using New Outlook, click .
- In the "Digital signing" section, select your certificate from the drop-down menu.
- Uncheck .
- Uncheck .
- Uncheck .
- Click to save your changes and exit Outlook Preferences.
This is document bcsn in the Knowledge Base.
Last modified on 2022-04-22 16:24:28.