From Expired Certificates to Identity Mismatches: How Well Do Email Clients Communicate S/MIME Issues?

This research explores how modern email clients handle security and technical issues associated with S/MIME encrypted and signed emails. By testing 13 widely used clients across multiple platforms, it examines how well they detect common issues - such as expired or revoked certificates and mismatched sender identities - and how clearly these problems are communicated to users. The results show noticeable differences in detection accuracy: while some clients consistently performed well, others - particularly Android-only apps and mobile versions - proved less reliable. Warning clarity also varied, with some clients providing misleading information. Overall, the findings show that even though S/MIME has been available for many years, many email clients still struggle to properly handle and communicate related security issues.