Re: Nokia Email Setup with Exchange

Question

Karim,
Are you familiar with Active Sync for Exchange? It is a feature available on the new Nokia E70 which I purchased for exactly this purpose. I am getting a message that reads "site is not sending a trusted certificate" but I was told that it should still synch without trusted certificate.
Now, Nokia is telling me that it is dependent on my service provider which needs to enable Exchange Synch ML in order for me to use this feature. I have my own email server and am trying to sync with Exchange remotely.
Any thoughts?
Thanks for your time.
Cliff
edited to keep message to the point.
Orinoco.Message Edited by orinoco on 17-Aug-2006
09:49 AM

Answer 1

When Mail for Exchange connects to a server using a secure connection, it is best if the device has the same root certificate installed that has been used to issue the server certificate. Otherwise the device will prompt the user about an untrusted certificate every time a connection is made to the server. This may happen several times daily, sometimes only minutes between.
Nokia devices come with many certificates pre-installed. These can be viewed by using Menu-Tools-Settings-Security-Certif_management. If a certificate issued by one of these certificates is used on the server, no additional certificates are required on the device.
If a certificate that can not be validated with the device’s pre-installed certificates is used, for example a certificate that has been self-created, the root certificate that has been used to issue the server certificate must be installed on all devices the administrator deploys.
In the case of a self-signed server certificate, the root certificate is the same as the server certificate since there is no certificate chain. The server certificate is the one that should be installed.
Before installation the administrator must convert the certificate to a format the Nokia device supports.
For the experienced admin, this statement can be followed: A server’s root certificate must be converted to ‘DER encoded binary X.509’ format.
Step 1: Obtain the root (not intermediate) certificate for the server in base64 format. This should look something like this:
-----BEGIN CERTIFICATE-----
VQQGEwJaQTEiMCAGA1UECBMZRk9SIFRFU1RJTkcgUF
VSUE9TRVMgT05MWTEdMBsGRVNUMRwwGgYDVQQDExNU
aGF3dGUgVGVzdCBDQSBSb290MB4XDTA1MTEwNzExMj
BgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly
FLgsY+QtxYo=
-----END CERTIFICATE-----
Step 2: Cut and paste this into notepad and save (or rename) this file with “.cer” extension, i.e.
Step 3: On a Windows PC (XP is used here), double-click the file you created. A Certificate application will start after several seconds. There are three tabs (General, Details, and Certification Path). Select the ‘Details’ tab.
Now press ‘Copy to File…’ button to start the ‘Certificate Export Wizard’. Press ‘Next’. Now select ‘DER encoded binary X.509 (.CER)’ and press ‘Next’. Continue to save the file with any name like . Make sure the filename has a ‘.cer’ extension.
Step 4: Get this file to the device via any means (email, Bluetooth, memory card, etc.). Find the file on the device and select it. If these steps were followed correctly, the device will start to import the certificate. Follow prompts and when asked, check the boxes for both ‘Internet’ and ‘Online cert. checking’.
Result: You should see a new certificate installed in the device’s Security management list.
Otherwise, the phone will display an error about file format not being supported. If this happens, the certificate has not been imported.