S/MIME Certificate not trusted in Office 365 (OWA and Outlook iOS app)

Question

I have an S/MIME certificate from GlobalSign and followed the instructions of the MS Tech Community Blog post (https://techcommunity.microsoft.com/t5/exchange-team-blog/how-to-configure-s-mime-in-office-365/ba-p/584516). The certificate works well in Outlook on the PC or when configuring it with the iOS native Mail app. But when I try to use it in OWA or the iOS Outlook app, I get an error that the certificate is not trusted ("Certificate invalid" in iOS Outlook and "An error occurred while sending this S/MIME message. The certificate used to sign this message isn’t trusted by your organisation" in OWA.

I tried exporting the personal certificate itself, presuming that the Certification Path would be included as well.

When that didn't work, I moved the PersonalSign 1 and Root CA into the same folder of my certificates and exported/imported these two as one .SST but it didn't help either.

What puzzles me is that after exporting the certificate to an .SST and importing it via PowerShell in O365 the value SMIMECertificateIssuingCA is {0, 0, 0, 0...} (~not set?) but I can see from SMIMECertificatesExpiryDate and SMIMEExpiredCertificateThumbprint that the imported certificates change. Is it ok though, that when I exported/imported RootCA+PersonalSign in one package, that the information in Get-SmimeConfig only show the date and thumbprint of PersonalSign 1?

Answer 1

After some back and forth with Microsoft Support I now have a solution:

I had to export the certificate path certificates (see screenshot in original post) as .SST and import that one. Although I had tried that already before I guess that I hadn't correctly published the personal certificate via Outlook or hadn't waited the right amount of time after publishing.

Now it worked immediately (in OWA and the iOS app) after importing the path.sst - no waiting time at all.

Edit:

Also, to check if the correct certificates have been uploaded you can use the following commands (writes to c:\temp):

$sst = (Get-SmimeConfig).SMIMECertificateIssuingCA

$certs = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection

$certs.Import($sst, $null, 0);

$certs

$certs | % {Export-Certificate -Cert $_ -FilePath C:\temp$($_.subject).cer}

Answer 2

Hi Manfred Heimgartner, 

Many thanks for your reply with above information. If you can send S/MIME encrypted emails from Outlook for PC client, then the new .SST you imported should be ok.

Per checking the information you shared in the PM, "OWAIncludeSMIMECapabilitiesInMessage" property is false, which means the S/MIME is not deployed successfully in OWA. The cause might be that you didn't publish the new certificate successfully from Outlook desktop client.  

Please kindly follow Steps3 in below document to republish the certificate to Office 365 GAL and check if this will make any difference: 

https://techcommunity.microsoft.com/t5/exchange-team-blog/how-to-configure-s-mime-in-office-365/ba-p/584516 

It may need some time for the changes to take effects, please be patient for a while, and then restart your computer to see the results. If the issue persists, run the following command and share the result with us in the PM:

Get-Mailbox <user> | FL or FT *user*

Besides, for the problem in Outlook for iOS APP, you may refer to this article to check if you have correctly deployed S/MIME for Outlook for iOS app: Sensitivity labeling and protection in Outlook for iOS and Android

Best regards,

Jennifer

Answer 3

Hello!

Thanks for your reply and assistance!

Regarding OWA Settings I am not sure what would help there? 

I enabled the S/MIME signature when writing an email and activating S/MIME in the message options...

I imported the certificate via PowerShell to create a virtual certificate collection, yes. Maybe I am exporting/Importing the wrong certificate there? As I mentioned, I assumed that when I export my personal certificate, that the whole certificate path (see screenshot in original post) would be imported/deemed trustworthy as well?

Answer 4

Hi Manfred Heimgartner,

Thanks for your post with the details. From your description, the certificate works in Outlook on the PC, which means that you should have successfully configured S/MIME at the beginning. 

Given this situation and if the S/MIME feature still works in Outlook on the PC, please make sure the user has correctly configured S/MIME control in OWA by going to Settings > View all Outlook Settings > Mail > S/MIME.

Besides, as you mentioned the value SMIMECertificateIssuingCA is null, you may kindly refer to the article below to set up virtual certificate collection to validate S/MIME and check if this will make any difference:

Set up virtual certificate collection in Exchange Online to validate S/MIME

To help you further, please kindly run the following cmdlet to check the S/MIME configuration of your organization and share the result with us via the Private Message (PM) for analysis:

Get-SmimeConfig

Moreover, for the problem in the Outlook for iOS APP, I need some time to consult our senior engineers, thanks for your understanding for this.

Best regards,

Jennifer