Certificate questions for Organization Email Encrytption

I am trying to setup email encryption for my organization. I assume this would be s/mime encryption. I am using this as a guide but am confused about the actual certificate part.

https://blogs.technet.microsoft.com/exchange/2014/12/15/how-to-configure-smime-in-office-365/

Do I need to purchase a certificate for this? And if so what type? I have purchased certificates before for domain names like "mail.domain.com" but can't visualize what this cert would be named. 

Any other guides for people with thick skulls like me?

My concept for setting this up is:

1. Export certificate to .sst file (What is the specific cert to export? Do i buy one?)

2. Upload .sst file to O365 server