Signing works with wrong iCloud email alias

Question

Hi,
I've succesfully created a free StartSSL S/MIME certificate for the email address I want to sign/encrypt, and have succesfully added it (along with its private key) to my iPhone 4S using the iPhone Configuration Utility.  I had to include the two StartCom root certificates and two Intermediate certificates (a Class 1 and a Class 3) from my Mac to make it work.  Here's what I have now:
Settings > Mail, Contacts… > iCloud account > Account > Mail > Advanced > S/MIME: ON; Sign: YES; Encrypt: YES
Under Sign (and Encrypt) > Certificates it displays the email alias I want to encrypt with a tick next to it.  Tapping on this certificate shows that it is Trusted.
Now, if I open Mail and choose Compose, it displays "Encrypted" under "New message", but with the wrong "From" address.  If I change the "From" address to match the address on the certificate, "Encrypted" disappears.
The address the certificate works with is the iCloud login address, which differs a great deal from the alias I created the certificate for.  The same certificate/private key pair works just fine for sending signed emails for that alias from Mail.app on the Mac.  Why won't it work on the iPhone?
Additional info that might be relevant: if I turn off "Encrypt" and just use "Sign", Mail on the iPhone doesn't sign any of the iCloud addresses - it doesn't appear to work at all.
I know that S/MIME is a tricky business on the iPhone, but this problem seems to differ from the other problems I've read about here on the forums.
Anyone know what to do?
EDIT: I've tried re-booting the iPhone too.  Didn't change anything.

Answer 1

Hi,
I have recently set up S/MIME on my iPhone and Mac using StartSSL Class1 certificates. I only use IMAP on my iPhone with email aliases so it's a bit different than your setup. My experience is that Mail on iPhone only uses the first email address of the account to sign/encrypt messages, even if the certificate belongs to the second or third alias. In my case I had to make the alias that the certificate belongs to the first to make it work.
You can try to make your alias the default address to see if it helps.
Another note: have you installed the intermediate certificates in your Mac and iPhone or you created a certificate bundle? My understanding is that they should be part of your certificate bundle because otherwise it won't work on other machines (that don't have the intermediate certificates installed). Also I think you need only the intermediate class 1 or class 3 client certificate but not both. If you want to make it in an easy way you can use the "Create PKCS#12 (PFX) File" under "Tool Box" in the StartSSL control panel to generate the bundle with all the necessary additional certificates.