Import SST to Exchange Online with Set-SmimeConfig -SMIMECertificateIssuingCA

Question

Hello, I would like to know, if its possible to use PowerShell to import CA trusth chaint to tenant. HERICA seems not to be in the trust cert list.
I would like to digital sign emails in new Outlook.

Do you have a an experience?

Answer 1

Hi @Jana Darsa

Thank you for posting your question in Microsoft Q&A. 

Just to clarify, are you referring to HARICA - the Hellenic Academic & Research Institutions CA? 

Based on my research, you can add a CA trust chain to your Microsoft 365 (Exchange Online) tenant using PowerShell to ensure that S/MIME certificates issued by that CA are trusted in the new Outlook and Outlook on the web. 

HARICA (or HERICA) is a public, third‑party Certificate Authority that participates in major global Root CA trust programs, including Microsoft, Apple, Mozilla, Adobe, and Google. This means HARICA’s root certificates are widely recognized and trusted across common operating systems and browsers. 

Because HARICA is a trusted public CA, its certificates, such as S/MIME, electronic signature, SSL/TLS, and code‑signing certificates, are already included in the trusted root stores of Windows, macOS, iOS, Android, and others. 

However, in Microsoft 365 and Exchange Online, S/MIME does not automatically trust any CA, even well‑known public CAs like HARICA. This is by design for security reasons. Administrators must manually upload the trusted CA chain (SST file) into the organization’s Exchange Online S/MIME configuration. 

 

You can refer via: 

Configure S/MIME in Exchange Online | Microsoft Learn

How do trust S/MIME certificate in Office 365? 

Note: Microsoft is providing this information as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the above link. 

Therefore, you can refer to the AI suggestion. You can obtain an SST file by running the following command: 

Get-ChildItem -Path cert:\CurrentUser\my | Export-Certificate -FilePath C:\certs\allcerts.sst -Type SST  

Then use the Set-SmimeConfig cmdlet with the -SMIMECertificateIssuingCA parameter in PowerShell to import the CA. 

I hope this helps. 

Please feel free to correct me if I misunderstood your request. If you have any additional concerns, feel free to comment below. I would be more than happy to assist.  

---

Note: Please follow the steps in [our documentation] to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

Hi @Hin-V

thank you for a navigation.
I did all the steps you descripbe and when Im trying to import certificate to new Outlook I get error msg: Certificate is already imported.
When I ask Copilot if its possible to digital sign a mail in new Outlook I get a resolut: No.
Becouse new Outlook has its own inner CA list and its inpossible to extend.

And Im starting to believe it :)

What do you think?

[Moderator note: personal info removed]

Answer 3

Yes, you can use PowerShell to import a CA trust chain into Exchange Online using the Set-SmimeConfig cmdlet with the -SMIMECertificateIssuingCA parameter. This allows you to specify the SST file that contains the root and intermediate certificates necessary for validating S/MIME certificates. Here’s how you can do it:

1. First, ensure that you have created an SST file containing the required certificates. You can create this file by exporting certificates from a trusted machine using the Export-Certificate cmdlet.
2. Once you have the SST file, you can import it into Exchange Online by running the following command in Exchange Online PowerShell:

      Set-SmimeConfig -SMIMECertificateIssuingCA ([System.IO.File]::ReadAllBytes('C:\My Documents\Exported Certificate Store.sst'))
   

   Make sure to replace the path with the actual path to your SST file.

This process will help ensure that the necessary certificates are trusted for digital signing of emails in the new Outlook. If HERICA is not in the trust certificate list, you may need to include its certificates in the SST file before importing.

---

References:

• Configure S/MIME in Exchange Online
• Set-SmimeConfig