Hello,
SOGo uses openssl. So I'm guessing just install your certificates according to your OS guideline and test it with openssl? I've never done it myself so this is just a guess.

The "HARICA TLS" CAs are the root CAs for Webserver certificates. The root CAs for S/MIME certificates are the "HARICA Client" CAs.

As many CAs use different root CAs for TLS and S/MIME, it is important to install a certificate bundle with the CAs used for issuing certificates with purpose "Email Protection". curl comes with a tool for this:
https://curl.se/docs/mk-ca-bundle.html

We use the following command:
mk-ca-bundle.pl -d nss -p EMAIL_PROTECTION:TRUSTED_DELEGATOR ca-bundle-mail.crt

Thanks a lot for your answers. We solved our problem by downloading and importing the Client CAs to our server.