Note: To publish the certificate, the user must first have the certificate installed on their local machine. If not published, users will not be able to exchange S/MIME encrypted messages. Publish user’s certificate to the Exchange Online GAL (Global Address List) using Outlook. Set-SmimeConfig -SMIMECertificateIssuingCA $sst 4. (Example: $sst = Get-Content TenantRoot.sst -Encoding Byte) SST to office 365 server: Update the SST on office 365 exchange server by executing the following commands using remote PowerShell. Select Microsoft Serialized Certificate Store(.SST) > Click Next and save the SST file: 3. You can move them to Trust Root CA folder and select them (including the Trusted CA certificates) and export it all in one. Note: There may be some Intermediate CA’s. Open certmgr.msc snap-in, expand Trusted Root Certificate Authorities > Certificates > select the CA Certificates which issued the certificates to end users for S/MIME and right click > All Tasks > Export… I am using Certificate console to export the. SST file for the Trusted Root CA / Intermediate CA of the certificate issued to the users: You can use either Certificate MMC or PowerShellcmdlets to export SST file. Remember that in Exchange Online, only the SST will be used for S/MIME certificate validation.ġ. End user’s certificate for signing and encrypting the message issued from Certificate Authorities(CA) either Windows based CA or Third party CA.SST file is created from certificate store explained below. SST File (Serialized store): The SST file contains all the root and intermediate certificates that are used when validating the S/MIME message in Office 365. In this scenario, all the users are hosted on cloud and there is no on-premises Exchange organization.

Further, Office 365 also provides the capability for end users to compose, encrypt, decrypt, read, and digitally sign emails between two users in an organization using Outlook, Outlook Web App (OWA) or Exchange ActiveSync (EAS) clients.īelow, we will take you through the configuration steps that you will need to follow to configure S/MIME for Exchange Online Only (Scenario 1), and for Exchange Hybrid(Scenario 2).

S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity, non-repudiation of origin (using digital signatures), privacy, and data security (using encryption). This article will also apply to any Office 365 customers who want to use S/MIME for sending digitally signed and encrypted mails.Ĭonfiguring S/MIME will allow users to encrypt and/or digitally sign an email. This blog is for people who want to move from on-premises to Exchange Online and want to continue to use S/MIME. Configuring S/MIME in Office 365 is a slightly different procedure than configuring S/MIME on-premises. S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and digital signingof MIME data.

Office 365 webmail