I just have finished a new code path for OABInteg that will now allow you to do a proactive scan against your active directory to see what your mail enabled objects look like when it comes to certificates. This should help you to eliminate certificates
