Wednesday, June 19, 2013

Google and S/MIME

I've been a happy customer of Google for some time now, as they service my email as well as provide other features -- like this blog!

One irksome thing I've run into lately, however, has been the use of S/MIME for sending digitally authenticated and/or encrypted email messages. (I've run into the issue because my employer offers digital ID certificates to authenticate official email messages, which is a great idea and a great service!)

I've since obtained a free email signing certificate from Comodo, a trusted signing authority for most browsers and email clients for my personal email account. Getting things to work with a Google Apps account (and/or the Gmail backend provided by Apps) has been a bit of a bear.

In particular, it seems that the Google Apps Sync (recently discontinued for non-paying members) Exchange implementation cannot properly pass the S/MIME digital signatures generated by iOS or Outlook. Instead of having a message be signed (and appear as signed by the recipient), the message is not signed and has a .p7s file attachment.

For now, a workaround is to use Google's SMTP servers to relay the message. In that scenario, everything works fine. (On iOS, this means abandoning Google Sync and push email -- a feature I enjoy.)

I've submitted a bug report with Google directly, since I'm a paying customer. After proving that I could configure Outlook correctly, and identifying that their Exchange servers were the common point of failure for passing S/MIME digital signatures, they promised to look into it as "it was an issue affecting many, many customers." I was also promised a resolution in a 1 -- 2 week timespan.

I won't hold my breath, but at least they're (supposedly) on the case. (This is because S/MIME support has been a problem for several years....)