Invalid Certificate Issue still occurs...

Question

Invalid Certificate Issue still occurs...

Tung Wei 20

I met the same problem as described at : https://learn.microsoft.com/en-us/answers/questions/4609967/how-to-fix-invalid-certificate-microsoft-outlook-c

I can confirm I've the right Certificate imported into Windows 11 LTSC, and I'm now using Office 2024 ProPlus there. The "From" email address is THE SAME as what it is in the Certificate.

I just wanna have a test (I mean I send the email to myself). But the issue occurs, and for some older versions of Office, this goes right.

Notice:

Windows is the lastest version (Windows 11 IoT Enterprise LTSC, 24H2, 26100.8246).
Office is the latest version(2604 Build 16.0.19929.20172).

Tung Wei 20 Reputation points

2026-05-18T08:32:10.82+00:00

Still doesn't work :(

Answer accepted by question author

Vergil-V 14,275 Microsoft External Staff Moderator

Please note that our forum is a public platform, and we will modify your image to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.
Hi @Tung Wei
Thank you for your update.

Based on the second image, it appears that the internal CA currently does not have any revocation infrastructure in place, such as CRL, OCSP, or AIA. Because of this, when Outlook 2024 attempts to verify whether the certificate has been revoked, it is unable to retrieve any revocation information and therefore reports the status as Unknown.

In this situation, you might consider the following approaches:

Option 1: Configure an internal CRL endpoint on the CA and reissue the certificates with a proper CDP URL. This allows clients like Outlook to access the revocation data and complete the validation successfully.

Option 2: If configuring the infrastructure is not feasible at this time, you may consider disabling revocation checking for this certificate chain through Group Policy on a single device:

gpedit.msc → Local Computer Policy → Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Certificate Path Validation Settings → Revocation tab

I hope this provides additional insight.

Tung Wei 20 Reputation points

2026-05-21T22:59:09.3933333+00:00

Got it, thanks！

BTW：Is this forced by Outlook 2024 after an update? It used to be OK even if I didn't have these parameters set....？
Tung Wei 20 Reputation points

2026-05-22T01:36:07.9866667+00:00

@Vergil-V ：How to mark your latest answer "May 21, 2026, 5:32 PM" as the best one？
Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-22T07:17:53.5+00:00

Hi @Tung Wei
Thank you for your confirmation.

I have converted your response into an answer, so you can proceed to mark it.

Regarding your question, based on what you have shared so far, it appears that recent updates in Outlook 2024 have progressively tightened S/MIME and certificate validation behavior.

At this time, I was not able to find any official documentation that directly addresses this change, aside from insights shared by other users in the community forums.

I hope this provides additional insight into your situation.

1 additional answer

Your answer

Tung Wei 20 Reputation points

2026-05-18T08:32:10.82+00:00

Still doesn't work :(
Tung Wei 20 Reputation points

2026-05-21T22:59:09.3933333+00:00

Got it, thanks！

BTW：Is this forced by Outlook 2024 after an update? It used to be OK even if I didn't have these parameters set....？
Tung Wei 20 Reputation points

2026-05-22T01:36:07.9866667+00:00

@Vergil-V ：How to mark your latest answer "May 21, 2026, 5:32 PM" as the best one？
Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-22T07:17:53.5+00:00

Hi @Tung Wei
Thank you for your confirmation.

I have converted your response into an answer, so you can proceed to mark it.

Regarding your question, based on what you have shared so far, it appears that recent updates in Outlook 2024 have progressively tightened S/MIME and certificate validation behavior.

At this time, I was not able to find any official documentation that directly addresses this change, aside from insights shared by other users in the community forums.

I hope this provides additional insight into your situation.

Answer 1

Vergil-V 14,275 Microsoft External Staff Moderator

Hi @Tung Wei

Thank you for sharing the details. It really helps in understanding your situation more clearly.

Based on my research, here are some steps you may want to verify further:

1/ Verify the certificate in Certificate Manager

Press Windows + R, then type certmgr.msc, and navigate to: Personal > Certificates > Details

Please check the following:

Key Usage should contain Digital Signature and Key Encipherment
Enhanced Key Usage should include: 1.3.6.1.5.5.7.3.4

2/ Check certificates using Command Prompt

Open Command Prompt with administrator privileges and run:

certutil -user -store My

This command will list all certificates in the current user’s Personal certificate store.

I hope this provides some helpful direction for your investigation. If you have any updates or findings, please feel free to share them here.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-18T08:09:38.07+00:00

Hi @Tung Wei
Hope you're having a good day.

May I ask if there have been any updates since our last exchange?

Have you had a chance to review the responses shared so far?

I’d appreciate any updates you can provide.
Tung Wei 20 Reputation points

2026-05-18T08:35:27.0733333+00:00

I've replied below, still doesn't work :( I've re-posted the related imgs, and even if I re-installed Outlook 2024 ProPlus, it still gets the same result... @Vergil-V
Tung Wei 20 Reputation points

2026-05-18T08:41:34.4466667+00:00

@Vergil-V : Already attached the img onto my 1st Question post, plz have a review, thanks again
Tung Wei 20 Reputation points

2026-05-18T08:47:19.2366667+00:00

PS @Vergil-V , even if I wanna have a sign without encryption to myself, I still get the same error below :(. It seems the Outlook doesn't recognize the certificate?
Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-18T09:56:59.78+00:00
Hi @Tung Wei
Thank you for sharing the details.

Could you please provide the output of the following command?

certutil -user -store My

Specifically, does it explicitly indicate “Encryption test passed” and “Signature test passed”?

~~Additionally, could you run:~~

~~certutil -user -verify My~~

~~If so, does it return any specific error or hex code?~~

I look forward to hearing from you soon.
Tung Wei 20 Reputation points

2026-05-18T10:46:39.3033333+00:00

@Vergil-V : Thank you for your quick reply and patience!

For your 1st command, passed!

[Moderator note: personal info removed]

For your 2nd command, some error happens?!

[Moderator note: personal info removed]

I just save the key here (the path should be right and no Chinese or other Non-Latin characters....):

[Moderator note: personal info removed]
Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-18T12:11:42.54+00:00
Hi @Tung Wei
Thank you for sharing the details.
I noticed that the screenshot contains personal information, so I have moved it to a private message to help protect your safety and privacy.

Please check your inbox for an email with the subject New private message on Microsoft Q&A question to review my response, and look for View message in the banner above the post to access the private message chat.

I also would like to clarify my earlier message. I apologize for the confusion. The command certutil -user -verify requires a file path, not “My”.

Please try the following command instead:

certutil -user -verify -urlfetch filepath.pfx

Once you have the result, feel free to share the output with me through the private message so I can assist you further.
Tung Wei 20 Reputation points

2026-05-18T23:41:58.3066667+00:00

：

This is the error result....and here I didn't expose any personal info, so no need to send a private message :)

I've never met this before, and such a certificate could really be used before...
Vergil-V 14,275 Reputation points Microsoft External Staff Moderator

2026-05-19T11:51:21.2133333+00:00
Hi @Tung Wei
With your update, it seems that certutil cannot read the PFX file, which is likely related to password protection.

That said, you may try the following steps:

Please run this command:

certutil -user -store My <SHA1 HASH HERE> D:\keys\output.cer

Note: Please replace <SHA1 HASH HERE> with the SHA1 value you obtained earlier.

Then, run the following command:

certutil -user -verify -urlfetch D:\keys\output.cer
Tung Wei 20 Reputation points

2026-05-19T23:21:47.7833333+00:00

@Vergil-V :Yes, it has a password.

Now I re-run your cmd, as what you can see for the following things:

Notice (this is a self-signed SMIME, whichi is only used in our inner departments or branch departments...ect).

This is the 1st Root Certificate

This is the 2nd certificate:

Share via

Invalid Certificate Issue still occurs...

1 additional answer

Your answer