---
title: S/MIME support in Ivanti Email+ for iOS
slug: emailplus/guide/ios/smime-support-in-ivanti-email-for-ios
createdAt: 2026-09-07T11:21:47.466Z
---
Ivanti Email+ for iOS includes support for Secure/Multipurpose Internet Mail Extensions (S/MIME). This functionality provides the following features:
- The device user sending the email can digitally sign the email.
On the receiving side, Email+ for iOS validates the sender’s identity and determines whether the email has been tampered with.
- The device user sending the email can encrypt the email.
On the receiving side, Email+ for iOS decrypts the email.
- Email+ for iOS automatically encrypts emails when replying to or forwarding an encrypted email thread.
Using S/MIME requires a user certificate on the device running Email+ for iOS. You can import encryption certificates in one of two ways:
- [Pushing S/MIME certificates from Ivanti EPMM](docId\:g8JnyHOEJF7m-MDzdB2aH)
OR
- [Importing S/MIME certificates to the device through email](docId\:g8JnyHOEJF7m-MDzdB2aH)
## Before you set up S/MIME for Email+ for iOS
Before you set up S/MIME do the following:
- Make users’ public encryption keys accessible to all users.
To send an encrypted email, a user needs the recipient’s public key. If you provide users’ public keys in the Active Directory, Email+ for iOS uses global address lookup to retrieve a public key as needed.
Another way for one user to have the public key of another user is to receive an email from a user with one certificate for both signing and encryption. When receiving a signed email where the signing certificate and encryption certificate are the same, Email+ for iOS now has the sender’s public key. The recipient can now send an encrypted email to the sender of the signed email.
- Make sure users’ encryption certificates are the same on all devices.
Users need their private keys and certificates to read encrypted emails. A user’s encryption key and certificate must be the same on all the user’s email apps that use S/MIME, including desktop email apps.
- When an encryption key/certificate is renewed, the existing email on a device cannot be decrypted unless the original key certificate is available. Keep a backup copy of the encryption key and certificate or consider using a third-party escrow service.
- To restore an encryption key and certificate from backup, users can send themselves the key/certificate as an email attachment, as described in [Importing S/MIME certificates to the device through email](docId\:g8JnyHOEJF7m-MDzdB2aH)*.*
## Pushing S/MIME certificates from Ivanti EPMM
Pushing S/MIME certificates from Ivanti EPMM is a two-step process:
1. [Enabling per-message S/MIME for iOS](docId\:g8JnyHOEJF7m-MDzdB2aH)
2. [Configuring key-value pairs](docId\:g8JnyHOEJF7m-MDzdB2aH)
### Enabling per-message S/MIME for iOS
See the “Enabling per-message S/MIME for iOS” section in the Ivanti EPMM Device Management Guide for iOS and macOS Devices for iOS device to set up the encryption and signing certificates for S/MIME.
### Configuring key-value pairs
The key-value pairs define the encryption and signing certificates to be used in Email+. The value for each key is the certificate enrollment setting you created. You enter the key-value pairs in the AppConnect app configuration you created for Email+ for iOS.
**Procedure **
1. In the Ivanti EPMM Admin Portal, go to Policy & Configs > Configurations.
2. Select the app configuration you created in [Creating an AppConnect app configuration for Ivanti Email+](docId\:t-AJKenoRlnuxE9905uHw).
3. Click Edit.
4. Add the following key-value pairs in the App-specific Configurations section:
1. email\_encryption\_certificate: This key specifies the certificate to use for encrypting S/MIME emails. Select the SCEP setting you want to use from the dropdown list.
2. email\_signing\_certificate: This key specifies the certificate to use for signing S/MIME emails. Select the SCEP setting you want to use from the dropdown list.
:::hint{type="info"}
Use of expired or revoked certificates for signing and encryption not supported. Also, the expired certificates are not displayed in the signing or encryption selection lists.
:::
## Pushing S/MIME certificates from Ivanti Neurons for MDM
To enable S/MIME encryption, set up the certificates you will use for S/MIME in Ivanti Neurons for MDM. You will reference the certificates in the Email+ configuration to distribute the certificates to devices. Certificates are sent to the devices to which the configuration is distributed. Email+ imports the certificates into the keychain and selects the certificates as the encryption and signing certificates, respectively. Device users can then use the certificates in Email+ for iOS.
**Procedure **
1. Set up certificates: Create a Certificate or Identity Certificate setting from Configurations > +Add. Before creating an Identity Certificate, you must have also added a certificate authority in Admin > Certificate Authority. See Ivanti Neurons for MDM Help for information about setting up certificates in Ivanti Neurons for MDM.
2. Configure the S/MIME key-value pairs in the Email+ configuration: The key-value pairs define the encryption and signing certificates to be used in Email+ for iOS. The value for each key is the certificate setting you created in [Set up certificates: Create a Certificate or Identity Certificate setting from Configurations > +Add. Before creating an Identity Certificate, you must have also added a certificate authority in Admin > Certificate Authority. See Ivanti Neurons for MDM Help for information about setting up certificates in Ivanti Neurons for MDM.](docId\:g8JnyHOEJF7m-MDzdB2aH)
Related topics
See the [key-value pairs for customization](docId\:fiDbv5N89HMfJSPm6WnML), for the S/MIME key-value pairs for the encryption and signing certificates.
## Importing S/MIME certificates to the device through email
Device users can import the signing and encryption certificates to their device from email.
**Procedure **
1. Device users email themselves the certificate they use for S/MIME as an attachment. The certificate must be sent as a PFX file.
2. Open the email using Email+ for iOS on the device
3. Tap to open the attachment. Email+ for iOS prompts the user for the certificate password.
4. Enter the certificate password. Email+ for iOS imports the certificate into its keychain.
5. Enable S/MIME signing and encryption in the mail settings in Email+ for iOS.
1. In Email+ for iOS, tap Settings > Mail.
2. Tap Security.
3. Tap Sign. The user’s signing certificate is automatically selected. Users may optionally tap Always Sign to always sign emails with their certificate, and Sign As Clear Text.
4. Tap Encrypt. The user’s signing certificate is automatically selected. Users may optionally tap Always Encrypt to encrypt every email they send through Email+ for iOS.