了解了一下 S/MIME ， 發(fā)現(xiàn)在 iOS 設(shè)備上比 PGP 更好用，自帶的郵件 App 就支持相關(guān)功能。
S/MIME 相較于主要區(qū)別是 CA 頒發(fā)證書來(lái)確保可信度，而 PGP 靠信任網(wǎng)絡(luò)，那么如果自簽 S/MIME 證書+信任網(wǎng)絡(luò)，結(jié)合易用性與安全性，體驗(yàn)更佳。

01 獲取S/MIME證書

01-1 方式1：使用CA簽名的免費(fèi)證書

Actalis免費(fèi)個(gè)人證書

https://extrassl.actalis.it/portal/uapub/freemail?lang=en

01-2 方式2：創(chuàng)建自簽名 S/MIME 證書

# 為CA生成RSA密鑰 openssl genrsa -aes256 -out ca.key 8192

# 為CA創(chuàng)建自簽名證書 openssl req -new -x509 -days 36500 -key ca.key -out ca.crt ?-extensions v3_ca

# 為個(gè)人電子郵件生成RSA密鑰 openssl genrsa -aes256 -out smime_name.key 8192

# 創(chuàng)建個(gè)人電子郵件證書 openssl req -new -key smime_name.key -out smime_name.csr

# 創(chuàng)建smime.cnf，iOS使用證書必須要有此步驟，內(nèi)容如下，subjectAltName可添加多個(gè)email [smime] keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = email:name@outlook.com, email:xxxxx extendedKeyUsage = emailProtection

# 使用CA對(duì)證書進(jìn)行簽名,注意此處如果要簽多個(gè)證書，-set_serial 1要變更 openssl x509 -req -days 36500 -in smime_name.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out smime_name.crt -addtrust emailProtection -addreject clientAuth -addreject serverAuth -trustout -extfile smime.cnf -extensions smime

# 檢查證書是否ok，其中必需包含S/MIME signing = Yes、S/MIME encryption = Yes、X509v3 Key Usage = Digital、Signature, Non Repudiation, Key Encipherment、X509v3 Extended Key Usage = E-mail Protection、Trusted Uses = E-mail Protection openssl x509 -in smime_name.crt -purpose -noout -text

# 將證書打包為 PKCS12 格式 openssl pkcs12 -export -in smime_name.crt -inkey smime_name.key -out smime_name.p12

02 導(dǎo)入證書

將ca.crt、smime_name.p12郵件發(fā)給iOS設(shè)備，點(diǎn)擊附件導(dǎo)入、信任?？蓞⒖?3中的鏈接操作。

03 郵件設(shè)置

進(jìn)入郵件設(shè)置，啟用簽名及加密，參考Apple官方指導(dǎo)、這個(gè)鏈接或者這個(gè)鏈接

04 參考

• Using our own certificate authority for business email encryption

• Creating Certificate Authorities and self-signed SSL certificates

• Create Self-Signed S/MIME Certificates

• Can I create my own S/MIME certificate for email encryption?

• Creating SSL certificates for S/MIME email encryption with OpenSSL

• Issue Your Own Self-Signed S/MIME Certs with OpenSSL