MacOS – Getting “Certificate signed by untrusted issuer” on Mac

First, to get the certificate to show up in the TLS section of the account, you need to import the cert into your keychain in P12 format. This is important because if you only import the cert (.crt), then that is only the public-facing portion of the identity (i.e. the public key). When you import the cert as a .p12, you are importing both the .crt and the private key associated with it. Now, keychain recognizes this as YOUR identity and will let you select it in mail as the source of encryption and signing. Also be sure that the certificate you are using has the correct authority to encrypt and sign email. You can verify this by checking for the presence of "email protection" under extended key usage and "Digital signature" and "key encipherment" under Key usage. Without these, you will likely have similar problems.

Similarly, be sure the .crt of the person you are encrypting is in your keychain, or you won't be able to encrypt TO them.

The procedure to locate an expired certificate in a specific keychain is covered well in this answer:

• How do I fix the SSL warning I get when visiting github.com?

Be sure that you look on the left of the Keychain Access window - you should have a login keychain, maybe an iCloud keychain, a system Keychain and System Roots.

If you don't find the expired certificate in the first keychain, repeat the process after selecting each other keychain. Also pay attention in case you are not selecting All Items or Certificates in the filter under the list of Keychains.