Exchange Server

wavemaster@news.postalias · Guest

SBS2003 Premium SP1.
I have one Smartphone that synchronizes with Exchange (remotely) without
problems.
Recently I've added a second Smartphone for a different user, to do the
same. For some unknown reason the second installation did not put the server
certificates on the phone. As a result, it will not synchronize with SSL
enabled. It will however sync with without SSL.

Is there anything I need to do to get those certificates to come across, and
if this was supposed to be automatic, how do I get them on the phone now.

Thanks in advance.

Robert

Lee Li (MSFT) · Guest

Dear Robert,

Thanks for posting here.

From your description, I can understand that that you wonder how to add
certificate to the second Smartphone. If I am off base, feel free to let me
know.

Based on my knowledge, if you are using Windows Mobile 2003 Smartphone and
to Windows Mobile 2002 Smartphone, you can follow the steps in the article
below to add root certificate.

How to add root certificates to Windows Mobile 2003 Smartphone and to
Windows Mobile 2002 Smartphone
http://support.microsoft.com/?id=841060

For your information, to add certificate to Pocket PC 2003, you need to
export your root certificate from your certificate snap-ins to export DER
type certificate to a *.cer file, then transfer it to your pocket 2003, then
click the certificate from your pocket pc 2003, it will be automatically
added to your pocket pc 2003's root.

Please try the above steps and let me know the result at your earliest
convenience. Thanks and have a nice day!

Lee Li

Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

"wavemaster@news.postalias"
<wavemasternewspostalias@discussions.microsoft.com> wrote in message
news:68A7CCB2-5A53-40DD-946C-A30A8073603D@microsoft.com...

Robert (AAT) · Guest

Thanks for your reply.

I have retrieved the KB article. The first thing to do:"Export the root
certificate to a computer that is running Microsoft Windows in DER encoded
binary X.509 format with a .cer file name extension"

Questions where do I export it from? The server? Where is the certificate? I
have no clue as to where to start.

Robert

"Lee Li (MSFT)" wrote:

Robert (AAT) · Guest

Today I did an upgrade to the Windows Mobile operating system on the
smartphone where the server certificates were located. After the upgrade,
guess what? Of course, the server certificates are now not installed.
I am no synching without SSL.....

??

"Robert (AAT)" wrote:

Lee Li [MSFT] · Guest

Hi Robert,

Thanks to take time to respond. I first apologize not being able to reply
your mail as soon as you send it. Please understand that it was weekend and
our newsgroups are staffed weekdays. Now I am always here for you. Let me
answer your questions as below.

First of all, to export the root certificate to a computer that is running
Microsoft Windows in DER encoded binary X.509 format with a .cer file name
extension, you can refer to the steps below.

1. In Windows Explorer, double-click the root certificate file.
2. Click the Details tab and select Copy to file to start the Certificate
Manager Export Wizard.
3. On the second screen of the wizard select Base64, and on the third
screen provide a path and file name for the certificate.NOTE: This is the
file that you use in the sample ASP code that is provided in this article.
4. Click Next and then click Finish.

Second, regarding why you can successfully connect Exchange Server after
upgrading Smartphone system, based on my knowledge, the Server ActiveSync
client on a PocketPC/Smartphone 2002 device is hard coded to use Secure
Sockets Layer (SSL). However, The Server ActiveSync client on a
PocketPC/Smartphone 2003 does not require SSL. There is a checkbox on the
client "This server uses secure connections (SSL)" to enable SSL.

Hope I clarify this. If there is anything unclear, feel free to let me
know. Thanks and have a nice day!

Lee Li

Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Robert (AAT) · Guest

Hi Lee,

First of all, DER encoded binary X.509.... I have XP Pro SP2, that is all I
know, oh, and the server is SBS2003 SP1. So have do I verify that I have DER
encoded binary X.....

Tell me exactly in which folder the root certificate is and on which machine
(client or server).

Second, if I enable SSL Server ActiveSync on the Client with the checkbox on
the
it doesn't work. If I disable the SSL it works.

For some reason two server certificates (remote.mydomain.com and another
one), made its way to the Smartphone the first time I did it. The second
phone they didn't come across. When I updated the operating system on the
first phone last Friday, it deleted the two that were on the first phone, and
they have not made it back since I finishedthose server certificates

Robert

"Lee Li [MSFT]" wrote:

Lee Li [MSFT] · Guest

Hi Robert,

It is nice to hear from you. I apologize if I didn't clarify my points.

Let's begin from the second question.

Q1: "Second, if I enable SSL Server ActiveSync on the Client with the
checkbox on the it doesn't work. If I disable the SSL it works."

When you are originally using Smartphone 2002, ActiveSync client is hard
coded to use Secure Sockets Layer (SSL), as you can see there isn't such
option to enable SSL for ActiveSync access. However, if the ActiveSync
virtual directory in IIS of Exchange Server doesn't require SSL, your
ActiveSync access with client SSL will fail, because Smartphone Client SSL
setting doesn't match Exchange Server SSL setting.

However, after you upgrade Smartphone to 2003 Edition, you can see there is
an option "This server uses an SSL connection". If you uncheck this option,
ActiveSync access with client SSL will succeed, because Smartphone Client
SSL setting matches Exchange Server SSL setting, both of which don't
require SSL.

Q2: "First of all, DER encoded binary X.509.... I have XP Pro SP2, that is
all I know, oh, and the server is SBS2003 SP1. So have do I verify that I
have DER encoded binary X....."

This is a Server Side certificate. There isn't a fixed folder to save the
.crt file. Actually, you save this file when you get this from Certificate
Authority.

However, considering information above that you don't enable SSL in
Exchange Server side, you don't need to implement this step. So please skip
this one.

Robert, I would like to let you know that our newsgroup here are focusing
on Exchange ActiveSync issue. If you have concern about restoring server
certificates in Smartphone, I am afraid you may need to submit your
question in the newsgroup below.

microsoft.public.pocketpc

Thanks for your understanding and cooperation regarding this. Have a nice
day!

Lee Li

Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Carol Chisholm · Guest

Hello there,

I'm having the same problem except when I try to import the
certificate (by clicking on it in the Pocket PC( I get a message :
"Security permission was insufficient to update your device."
Any ideas?

Carol Chisholm

On Fri, 16 Sep 2005 16:13:36 +0800, "Lee Li \(MSFT\)"
<v-leeli@online.microsoft.com> wrote:

Lee Li [MSFT] · Guest

Hi Carlo,

Thanks for posting here.

I would like to let you know that the newsgroup is an issue based service,
meaning we usually respond to one question/issue per post per user. This
will lessen the confusion for both of us, as well as ensure that our
results are accurate and not a result of a test for a different question.
Therefore it is better for you to submit a new post in our newsgroup.

Additionally, our newsgroup is only focusing on Exchange related issue
meaning if you encounter any issue during connecting your Pocket PC with
Exchange mailbox by ActiveSync, you can submit your question in our
newsgroup.

If you have any question purely about Pocket PC (PPC) such as importing
certificate in PPC, please submit your question in the newsgroup below.

microsoft.public.pocketpc

Thanks for your understanding and cooperation regarding this. Have a nice
day!

Lee Li

Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

	Exchange Server Forum Index -> Connectivity	All times are GMT
Page 1 of 1