Issue Your Own Self-Signed S/MIME Certs with OpenSSL

makeauthority.sh

# Run this once
openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.crt

makecert.sh

# Run this for each email account.  The system must install the CA cert and the resulting p12 file in order to be happy.

# Borrowed from http://serverfault.com/questions/103263/can-i-create-my-own-s-mime-certificate-for-email-encryption

openssl genrsa -des3 -out smime.key 4096
openssl req -new -key smime.key -out smime.csr
openssl x509 -req -days 365 -in smime.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out smime.crt -setalias "Self Signed SMIME" -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout
openssl pkcs12 -export -in smime.crt -inkey smime.key -out smime.p12

Thanks so much @sm5050 !!

https://www.dalesandro.net/create-self-signed-smime-certificates/

That was the perfect guide and now I can do a self signed S/MIME cert on my Mail.app on macOS 10.14.3.

I’m not able to get Mail on macOS(10.14.4) or Mail on iOS(12.2) to cooperate with me.

I’ve create ca and test user([email protected] for example), install test user’s p12 on my iphone, and Login test user on iOS Mail.

Turn on the settings for sign and encrypt in account/mail/advanced.

Finally, go to mail and send mail to my self. Nothing happend (no lock as describe in many other tutorials), login to webpage and the mail is plain.