iOS using wrong public key to encrypt mail I've recently updated most of my certificates as they've expired at similar times.

It appears that iOS mail is encrypting mail to one of my recipients using their old certificate, as such they cannot decrypt it when they receive it.

I checked in the one profile that is installed and it only contains my own certificate and key. Where are my recipients public keys kept? I need to check them and delete the old ones. Otherwise how do you tell iOS which public key to use when encrypting mail?
There is no list, you can scroll through to edit the public keys of the emails you received.
The only way is to open an old mail (signed with the old public key), hit the certificate and manually uninstall it.
It seems that iOS on iPhone has a bug since version 9.x that causes that new public keys of certs can not overwrite the old versions automatically.
See the discussion here:
https://discussions.apple.com/message/29015875?start=0&amp;tstart=0

Do NOT follow Apple's advice in the support document &quot;Send an encrypted message to someone outside your Exchange environment&quot;. Specifically, do NOT manually trust the certificate by hitting View Certificate&gt;Install because (I believe) this will keep a trusted certificate in your keychain after this certificate expires and is replaced. iOS will not let you install an updated certificate with the same RFC 822 Name (email address), and will continue to encrypt using the same trusted-but-expired certificate. After hitting Install, you'll have to Reset All Settings to get rid of it (bad).
Rather, View Certificate, then request a copy of the Root Certificate Authority (.cer) and, if necessary, the Intermediate CA (.cer) that signs the sender's cert. Install these .cer certificates in your System Profiles. In my experience, I need both the Root and Intermediate CAs for iOS.

(btw: I had exactly the same problem)