[hrbuckley]

You get a stale status because you don't have access to either a CRL or OCSP servers to provide that information. There is an API to set a certificate status but I havn't seen any thing exposed in the UI to manually set it. You can set up servers to provide a CRL or OCSP services, you can also set up an LDAP server to provide certificates but it is a lot of work to configure and maintain them.

Without knowing the version of the OS you're using, or how you made and signed your certificates it is difficult to say what may be causing your encryption problem.

As I said before, S/Mime support is meant to be used with a BES, you can make it work with PIN messages but you have to get all the pieces set up just right.