When troubleshooting S/MIME in Exchange Online with Microsoft support, one of the key questions was: Is our internal CA certificate chain really stored correctly in the tenant? Exchange Online does not only rely on public online CAs; it maintains its own virtual certificate collection for S/MIME trust, which Outlook Mobile then uses to validate user certificates.
To get a clear answer, I wrote a small PowerShell script that connects to Exchange Online, reads the current S/MIME configuration, and extracts the issuing CA certificate from the SMIMECertificateIssuingCA setting. The result is an X509Certificate2Collection that can be inspected in PowerShell, allowing you to see exactly which root and intermediate CAs Exchange Online trusts for S/MIME.
This turned out to be important, because Outlook for iOS and Android validates S/MIME certificates against that internal Exchange‑Online‑stored CA collection, not simply against the public online CAs. If the chain is incomplete or missing, Outlook Mobile will reject valid S/MIME certificates even though they’re trusted on the user device.
With the script, I was able to export and review the certificate chain from the tenant and provide Microsoft with concrete proof that our internal CA hierarchy was correctly uploaded. This helped close the support case and avoid unnecessary changes to the CA infrastructure.
What the script does
- Checks if the
ExchangeOnlineManagementmodule is installed and installs it if requested. - Connects to Exchange Online if no active session exists.
- Uses
Get-SmimeConfigto read theSMIMECertificateIssuingCAvalue. - Imports the certificate data into an
X509Certificate2Collectionfor inspection.
In short, this script is a quick validation tool to confirm that your S/MIME certificate chain is actually stored in Exchange Online as expected — and that Outlook Mobile can trust it properly.
How to download
You can download the script from GitHub here:
👉 Download the script on GitHub