[finger]

Ok here we go.
Got the phone, sent back to Nokia to upgrade firmware so compatible for Mail for Exchange.
Version 1.3.0 mail for exchange
OWA server uses a certificate that I have created. Other phones using windows mobile 5 working perfectly.
I have moved the certificate to the phone but the icon has a blue question mark and the format is not supported. This happens when the certificate ( xxx.cer ) is in the X509 format ( der ). When the format is in ( 64 ) x509 then the icon is yellow the a red dot on it. It seems to know the format of the certificate when in this format but will not install. I open the certificate and nothing happens.

I test our owa server by accessing it without the certificate, works properly.
Place SSL back and it doesn't work.
What I have read is that the certificate must be in DER format but when I try this it doesn't work. I must have the certificate and want this phone working correctly.

Please help, I have emailed twice, called Nokia 4 times, but it doesn't seem like they know what to do with the certificate.

[frustrated]

finger I hope you get an answer - but doubt it will be useful. I have the same problem and have contacted Nokia via phone and email lots of times over the last two months to no avail. I have gone through these forums and tried everything suggested. The correct certificate has been exported, I've used the suggestion of others with converting via OpenSSL...but I still can't stop the prompting to accept a certificate or save the very certificate that it sends. Our company iMates and Blackberrys have no trouble - it is just the Nokias that won't do it properly. I have wasted weeks on this. I think I will have to go back to a Blackberry myself. PLEASE NOKIA - GET THIS ISSUE SOLVED!!!!

[finger]

Aiih I am hearin ya loud and clear on this one Brother. I have spent alot of time on this too and at the present time Nokia hasn't a clue to assist. I have I Mates up and running within minutes but thought about trying this new phone.... bad mistake. Sync's good when using 80 with no security but that is a no go..

You say that you have the certificate installed?
Please tell me if you have because that is my first problem. Format 64 is seen but are you using DER??
I read use der but the phone cannot see this format.


Did the installation ever say it installed?

[atmasphere]

Pardon my ignorance, but what is the certificate for? thought e4m used owa access...

[finger]

the certificate is so you are using SSL port 443 128 bit encryption. Then your owa server is fully secure. If using port 80 then someone could access your username and password.

You can create your own certificate or purchase from a company like verisign.

[atmasphere]

gotcha - thanks!

[finger]

I have now moved into the direction of Symbian, it's there software so I have emailed them to find out what the G O is with the certificates. If I get anything from them, I will post it here.
When it comes down to it, they should be able to give me more assistance than Nokia... you would think

[frustrated]

Nokia have told me its an issue with other brands of phones as well and it is a significant issue worlwide. Last week they issued a bulletin to their tech support people worldwide regarding certificates and providing some suggestions. The suggestions were of no use to me. I would have thought there would be a way around the dumb prompting to accept a certificate by having the phone accept it silently. It's only requesting an answer to a prompt. Surely a user should be able to change a setting to allow that?

[finger]

Mate, I would be happy if I could gain access to our owa...can you tell me what formatted certificate you are using because this phone doesn't recognise DER, only 64 and I keep getting system error... that is as far as I can get.
Talk to me frustrated or we will need to change names... because not only does this phone not sync to the server..... IT'S MY PHONE - I am the network administrator so I need to get this working before passing the sinker to someone else... we are very lucky that we tested out the owa server on other smart phones like the jamin imate or we wouldn't have got the server working

[frustrated]

DER works for me, but only some of the DER certs work. No idea why. It seems the root DER is OK, but anything else does not.

Message Edited by orinoco on 22-Sep-2006
10:10 AM

[finger]

Is the icon for the der certificate yellow or have a blue question mark? The phone cannot work out the format for the der but the 64 it's a yellow icon and looks like the phone knows what the format is... this is very strange. Do you know if you can upgrade the symbian OS from 9.1 to 9.3 ?
I have 9.1 and am finding my phone is different than other people having the same problem.

Thanks for your replies dude....

[elliottgroup]

Just found this, haven't had a chance to try it yet but it's worth a go.

So in order to export and install an SSL certificate from your OWA website to your Nokia smartphone, you need to do the following:

1) Go to your OWA url (eg. https://mail.mydomain.com)
2) You should see the SSL lock icon down at the botton
3) Double click on it, go to the Details tab and click on “Copy to File”
4) On the Certificate Export Wizard, go to Next.
5) Select the first option “DER encoded binary X.509(.CER)”, click Next
6) Give the File a name and save it to your desktop and click Finish

Now transfer the .CER extension file to your phone’s memory. Install it by clicking on the .CER file from a File Manager. It will ask about Importing the certificate. Choose yes. That’s it. Now your self signed SSL certificate is trusted on the device and should no longer have problems synching wirelessly with the Exchange Server.

Important: If you have a chain of certificates in your certificate’s Certification Path (check https://mail.google.com for example), you need to export and install all the certificates in the chain if they are not from a renowned CA or preinstalled on the device.

[atmasphere]

I don't see any option to export on Mac for either Safari or Firefox... ;(

[finger]

got a hp ipaq and configured it within 5 mins....Nokia... offer services and cannot support or promise what they are offering...sucks

Message Edited by m_shaharizai on 04-Oct-2006
02:40 PM

[spudit]

Here is rundown of my own issues and what worked for me on the Nokia E62. We run our own Exchange server with its own security certificate. I've been trying to get Mail for Exchange working for a couple days. Initial sync would work, but I would get pop-ups asking about the security certificate every time it tried to re-sync. M4E would as this point lock up and not work any further. To get the certificate-- I used IE in windows to login to exchange via OWA. Exported this certificate as a DER x509 file with .CER as the suffix...called this file exch.cer Used openssl to convert this first to a .pem file then further to a .der file recognizable to the E62. See http://www.allaboutsymbian.com/forum/archive/index.php/t-48061.html for more detail on how to do this file conversion. Copied the new file 'exch.der' to a temp folder on our exchange web server. Used the phone web browser to connect to this file directly-- example: http://exchange_server/temp/exch.der (I disabled SSL in exchange for a short time to make this transfer easier) Finally...it asked is I wanted to install the certificate, Wahoo! Previously, I tried transfering it to the phone via PC Suite, bluetooth, file transfer, etc. with no luck. You need to download it via the web. You also need to be sure that the MIME file type is added for the .der file in your temp web folder (again...see above link). In IIS, in your temp folder, go to properties, then HTTP Headers tab. See the MIME stuff at bottom. I needed to reset the phone and start over with Mail for Exchange, but it finally sync'd and kept going. Before I even started with the E62, it was also necessary to do some work on our exchange server so that OMA and Activesync was configured properly for SSL. Thx- Spudit

[andrewfelluss]

I accidentally erased the certificates in my E61...oops! Well, I wasn't being careful and I thought I was clearing out the cookies.

Oh well, it's been a pain in the neck, but I have learned a thing or two about it, as I've meticulously restored them as needed.

The E61 will always say 'This site is using an untrusted cert' and then you can view the certificate name. Then if you can find the DER certificate online, you'd just need to download it the phone and excecute the file from the file manager.

If you can't find the right format certificate, it's still possible to convert (with windows) to Internet options/Content/SSL Certificates/Export (DER X509), then save to the phone.

[dariuszl]

Another, tested way of installing certificate:
As in my case just opening the certificate (DER encoded)
I have send as ZIP attachement to the email message,
does not work for some reason,
I have stored this .CER file in the filesystem and tried just opening it - with no results.
So, I have send that certificate as pure email attachement.
And now E61 email client recognizes its type (probably by MIME type) and opening it shows familiar "certificate install" question - It was root cartificate.

Good luck.

DariuszL

[sark]

So I managed to install my certificate via the method of exporting the file as .cer, converting it to .der via OpenSSL and then downloading it via the E61 web browser.

The certificate is installed in the Cert Manager but I still get prompted about Untrusted Certificate when I check my mail. I have enabled the Internet trust settings and the fingerprints match on the cert presented and the one installed.

Any ideas?

[twingnu]

Hi,

you'll need to install the root certificate of the signer on the phone. All phones have just min root cert's installed because of security risk.

[mbongartz]

---

08-Feb-2007
04:08 PM
twingnu wrote:
Hi,

you'll need to install the root certificate of the signer on the phone. All phones have just min root cert's installed because of security risk.

---

Hi,

i don't know what i did but it worked now. I had the same problems as everybody importing certificates to my E61 and E60.

On the Exchange Server i openend Internet Explorer und Options. Tab Content --> Certificates --> (my IE is in german so i have to guess) --> Tab trustet root Certificates?? I klicked on our owa cert and then the button andvanced. I klicked every check box i could klick. And then i exportet the Certificate to the DER Format.

I copied the cert to my laptop and sent it via bluetooth to my E61. I openend it and finally i could save it to my phone.