How to send an encrypted s/mime e‑mail? Simple question, but I couldn’t find the answer anywhere…

I need to send encrypted e‑mails through using s/mime (talking about security, even most of metadata should be unknown). The problem is I’m not part of Google app organization (and I don’t need it since it’s not free).

How do I configure Gmail or the Samsung e-mail app to use the CA trusted certificate (which only contains public key) I installed on the device for sending enciphered e‑mails through s/mime ?

I also need to manually select the certificate which will be used for encryption (The company generate the paid certificate for me so it match my e-mail address and not company one).
For the Samsung email app (on my Galaxy Tab A anyway) you need the following
▪An exchange activesync account - for some reason s/mime is not enabled for any other email type
▪Your public and private keys for your exchange account as a PKCS#12 cert uploaded to your tablet already or in your download directory ( root/sdcard/Download directory ) ready for import.

Go to the email settings > exchange account > security options screen and select the encryption certificate option then import. It should show you the PKCS#12 file and let you select it, enter any needed password and import it to your keystore with a friendly name of your choice. Repeat for the signing key - typicallly this is the same PKCS#12 file.
Set it to sign all outgoing mail if you wish - that'll help distribute your public key and maybe raises peoples awareness of s/mime.
It's probably not worth encrypting all outgoing messages by default as you'll get a warning for each recipient that you don't have their public key.

Send yourself test signed and then encrypted emails to prove this is working - preferably using a second device to test thoroughly. The three-dot menu on the send email will let you pick security options to sign and encrypt for individual messges.

The next stage is to try to exchange signed email with other real contacts - if you've defaulted to sign all this should just happen and they should be able to validate the signature.

The last stage is to send them an encrypted email, for that you need their public key / cert. If you've been exchanging signed email you should have it - hopefully you're also using exchange contacts and their record has their key else you'll need to add it from a received email.

Slightly concerning that you say the  recipient has a copy of your private key - this should never happen as your private key should always remain private to you. Officially you should revoke you key and get a new one. The practical upshot is things will get very confusing as to what's going on if you've got keys mixed up between public and private and sender and recipient. Good luck.

I don't think Samsung mail lets you easily swap your certs either - you can go into settings and change them but unless youre doing something interesting you should only have one email address on your exchange account.If you're trying to use encrypted group email I don't think Samsung email is going to help, and I don't know of any other mail client that can either.