Support

How does a receptionist set up the mailbox?

From the Business Owner dashboard, choose the provider and add an Email Response Computer. Enter the displayed IMAP and SMTP settings in Outlook or Apple Mail. Certificate and profile installation instructions, including the certificate passcode, are sent to the shared mailbox.

How is a patient enrolled?

The receptionist signs into the reception portal on the iPad / iPhone, enters the patient details, and reviews the waiver with the patient. After the patient signs the waiver, the portal creates a QR code. The patient scans that code using their iPad / iPhone to enroll.

How do I install the profile on my iPhone and turn on S/MIME signing and encryption?

1. Download the profile on your iPhone. Open your Pervasieve setup link in Safari, or scan the enrollment QR code with the iPhone camera and open the link. Follow the setup page to download the .mobileconfig file. Tap Allow when asked to download the configuration profile.
2. Install the downloaded profile. Open Settings > Profile Downloaded. Alternatively, open Settings > General > VPN & Device Management and select the downloaded Pervasieve profile. Review the account details, tap Install, enter your iPhone device passcode when prompted, and follow the remaining prompts. Tap Done. Downloading alone does not install the profile; iOS deletes an uninstalled download after eight minutes.
3. Open the mailbox settings. Go to Settings > Apps > Mail > Mail Accounts and select your Pervasieve account. On older iOS versions, use Settings > Mail > Accounts. Tap Account or Account Settings, then Advanced.
4. Turn on signing. Under S/MIME, enable S/MIME if a switch is shown. Open Sign, turn it on, and select the installed certificate matching this mailbox address. Return to Advanced.
5. Turn on encryption. Open Encrypt by Default, turn it on, and select the certificate for the same mailbox if prompted. Go back and tap Done if shown. The profile may have enabled these settings already; confirm both are on.
6. Exchange public certificates. Each sender needs the recipient’s public certificate. First exchange signed messages containing no sensitive information. In Apple Mail, open the sender details on the signed message, tap View Certificate, then Install if offered. The other person must also obtain your public certificate to encrypt replies. Never share your private key or certificate passcode.
7. Check before sending. Open Apple Mail, compose from your Pervasieve address, and add the recipient. Confirm that Mail shows the message as encrypted with a closed lock. Every recipient in To, Cc, and Bcc needs an available certificate. If Mail cannot encrypt, resolve the missing certificate before sending sensitive information. Check replies too: their encryption state can follow the incoming message instead of your default.

For screenshots and additional details, see Apple’s profile installation instructions and S/MIME encryption guide.

How do I remove a Pervasieve email account from my iPhone?

On the iPhone, open Settings > General > VPN & Device Management. Under Configuration Profiles, select the account you want to remove, tap Remove Profile, and follow the prompts.

What if a certificate is lost or expires?

Contact Pervasieve Support to replace a lost or expired certificate. Adding an Email Response Computer provides setup links for the current certificate; it does not renew or replace it. Existing encrypted messages cannot be recovered without the old private key.

For Outlook on Mac, use Legacy Outlook. After importing the .p12 file, confirm the private key appears below the certificate in Keychain Access, select that certificate in Outlook’s security settings, and restart Outlook.

How do I set up a receptionist email responder in classic Outlook for Windows?

Use classic Outlook on the Windows Email Responder computer. The Enrollment iPad user signs in to the Pervasieve reception portal; the Email Responder computer does not need a local LDAP installation or a portal sign-in.

1. Add the mailbox in Outlook. Go to File. Under Account Information, click + Add Account. In Email address, enter the newly created receptionist address, for example reception@provider.com. Open Advanced options, check Let me set up my account manually, click Connect, then choose IMAP.
2. Enter the mailbox settings. Enter the password displayed when you choose Add an email response computer. Set both incoming and outgoing server names to email.pervasieve.com. Use incoming IMAP port 993 and outgoing SMTP port 465; set the encryption method for both to SSL/TLS.
3. Open the welcome email. It contains the S/MIME certificate download link and passcode, plus the LDAP login details for the address book. Download smime_cert.p12 and double-click it to import using the default options. Keep the certificate passcode private.
4. Configure Outlook S/MIME. Go to File > Options > Trust Center > Trust Center Settings > Email Security. Uncheck Send clear text signed message when sending signed messages, then click Settings. Enter a name under Security Settings Name (for example, Pervasieve). Click Choose for both Signing Certificate and Encryption Certificate; Outlook should select the imported certificates. If it does not, choose the certificate matching the mailbox address you added. Leave the hash and encryption algorithms unchanged, keep Send these certificates with signed messages checked, then click OK until you return to Outlook.
5. Enable signing and encryption. When composing a message from the receptionist account, open Options and use the Sign and Encrypt controls. If Outlook warns that a patient's certificate is missing or invalid, choose Send Unencrypted only for a message containing no PHI. Do not send patient information in an unencrypted message.
6. Exchange certificates with the patient. After the patient receives a signed, unencrypted message, have them open the receptionist's sender details, choose View Contact Card > View Certificate > Install > Install > Done (the exact labels can vary by mail client). The patient can then use the installed receptionist certificate to send an encrypted reply. The responder also needs the patient's public certificate before Outlook can encrypt messages to that patient.
7. Add the Pervasieve LDAP address book.
   1. Open classic Outlook and click the File tab.
   2. Select Account Settings, then click Account Settings again.
   3. Go to the Address Books tab and click New.
   4. Choose Internet Directory Service (LDAP) and click Next.
   5. In Server name, enter ldap.pervasieve.com.
   6. Check This server requires me to log on. Enter the user name as mail=reception@provider.com,dc=pervasieve,dc=com, replacing the example with the receptionist’s email address.
   7. Enter the LDAP password from the welcome email. This is not the mailbox/email password.
   8. Click More Settings, set the port to 636, and check Use Secure Sockets Layer. Leave Secure Password Authentication unchecked.
   9. Click OK, Next, Finish, and Close.
   10. Restart Outlook. When composing a message, click To and choose the Pervasieve directory to search for recipients.

How does a signed email show which certificate identity was used?

An S/MIME signature is checked against the sender email address in the signing certificate and the certificate authority (CA) that issued it. Pervasieve-issued certificates are trusted when the message signature validates to the Pervasieve CA that the recipient has trusted. A certificate for the same email address issued by a different CA is a different identity and does not validate to the Pervasieve CA.

A name such as “Pervasieve” written in a certificate is not enough to make it trusted. The certificate must chain to the trusted Pervasieve CA. Apple Developer certificates used to sign configuration profiles are separate from mailbox S/MIME certificates and do not sign or validate email messages.

How do I configure the directory mappings for Mail and Contacts on a Mac?

Complete this setup once on each reception Mac. Receptionists then use Contacts and Mail without signing into the Pervasieve website. Use the reception address and LDAP password from the computer setup email.

1. Open Directory Utility using Spotlight. Click the lock and authenticate with the Mac administrator account. Select Services > LDAPv3, then click the pencil / Configure button.
2. Select the existing Pervasieve configuration, or add one if needed. Set the server to ldap.pervasieve.com. Select RFC2307 as the starting LDAP mapping template. Enter the search base dc=pervasieve,dc=com.
3. Click Edit… > Connection. Enable Encrypt using SSL, enable the custom port, and enter 636.
4. Under Security, enable Use authentication when connecting. Enter the distinguished name mail=reception@provider.com,dc=pervasieve,dc=com, replacing the example address with your actual reception address. Enter the LDAP password from the setup email, then press Tab to finish editing the field. The LDAP password is separate from the mailbox password and certificate passcode.
5. Open Search & Mappings. Select Users. Set its search base to dc=pervasieve,dc=com and its scope to all subtrees. Its object-class mappings must include inetOrgPerson with OR / any matching. The RFC2307 defaults can retain their other object classes with OR matching.
6. Expand Users and configure the attributes in the table below. To add a missing attribute such as UserCertificate, select Users and click the + beneath the left-hand Record Types and Attributes list, choose Attribute Types, and select that attribute. Then select the attribute and enter its single LDAP mapping in the right-hand list. Repeat for each missing attribute. Leave an existing RealName mapping set to cn.
7. Save with OK > OK > Apply. The template may now show Custom; that is expected after adding mappings. Reopen the configuration and confirm the Users mappings and search base stayed saved.
8. In the main Directory Utility window, open Search Policy and select the Contacts tab. Use a custom search path, keep /Local/Default first, and add /LDAPv3/ldap.pervasieve.com. Click Apply. Make this change on the Contacts tab only; keep the Authentication policy unchanged.
9. Quit and reopen Contacts. Show the sidebar, select the directory, and search by patient name or secure email address. Follow the Keychain Access certificate lookup steps in the reception computer setup email, then open a fresh Mail message and check the encryption lock before sending.

RecordName must contain only mail. A value such as mail;displayName;cn;sn;givenName is treated as one attribute and causes lookup failures. The semicolon in userCertificate;binary is valid and must be retained.

Preserve the other RFC2307 mappings, including People. Apply the table under Users even if similar mappings already exist under People. For additional editor details, see Apple’s LDAP mapping instructions.

Why is the encryption lock greyed out in Apple Mail on Mac?

Mail needs the recipient’s public certificate and a certificate for your own sending address so you can read your encrypted message in Sent Mail. The recipient does not need to share a private key.

1. In Keychain Access, select the login keychain. Under My Certificates, find the certificate for the address in Mail’s From field and confirm a private key appears beneath it.
2. Select that certificate, choose File > New Identity Preference, and enter your sending email address.
3. Under Certificates, select the same certificate, choose File > New Certificate Preference, and enter your sending email address again. This lets Mail find your public certificate for its Sent copy.
4. Make the recipient’s public S/MIME certificate available through the configured directory and the Keychain Access lookup setting described in your reception setup email, or import their public certificate into the login keychain. If using an imported certificate and Mail cannot find it, create a Certificate Preference for the recipient’s exact email address. You do not need their private key.
5. Compose a new message from the address you configured. Check that Mail shows the signing checkmark and that the encryption lock is available before sending.

Command-line alternative for your own certificate

On a Mac with the Swift command-line tool installed, replace the example email address below. Find the SHA-256 fingerprint of the mailbox identity certificate with a private key, not the Pervasieve CA certificate. Use that fingerprint in place of SHA256_OF_MAILBOX_CERT.

export SMIME_EMAIL='you@example.com'
security find-identity -v -p smime
security find-certificate -a -e "$SMIME_EMAIL" -Z
security set-identity-preference -s "$SMIME_EMAIL" -Z SHA256_OF_MAILBOX_CERT
swift -e 'import Foundation; import Security; let email = ProcessInfo.processInfo.environment["SMIME_EMAIL"]!; guard let identity = SecIdentityCopyPreferred(email as CFString, nil, nil) else { fatalError("Identity not found") }; var certificate: SecCertificate?; guard SecIdentityCopyCertificate(identity, &certificate) == errSecSuccess, let certificate else { fatalError("Certificate not found") }; let status = SecCertificateSetPreferred(certificate, email as CFString, [kSecAttrCanEncrypt] as CFArray); guard status == errSecSuccess else { fatalError("Preference failed: \(status)") }; print("Encryption certificate preference set for \(email)")'

The security set-identity-preference command sets the sending identity. The swift command sets the separate encryption Certificate Preference for the same address. Then open a new Mail message and check the lock.

If the lock remains greyed out, check every address in To, Cc, and Bcc. Each recipient must have an available public S/MIME certificate.

Why can’t I continue after entering the reception email?

The practice domain must be verified first. Add the MX, TXT, and CNAME records shown during setup, then select Check Domain Verification. DNS changes can take time to propagate.

How do I regain access to the Business Owner dashboard?

Use Forgot Password on the Login page. The reset page shows a masked version of the account email. Receptionists should ask their Business Owner to initiate access recovery rather than using the Business Owner reset flow.