Installing Windows Mobile 6.0 Root Certificates
Recently I ran into a situation where we had purchased an Exchange certificate from a fairly common certificate authority (GeoTrust) and everything worked well with browsers automatically trusting the certificate… and then we picked up a Windows Mobile 6.0 device from Verizon. For whatever reason, Verizon or Microsoft has decided this particular CA was not trustworthy and isn’t in the default list, so ActiveSync fails to connect to the Exchange server. Fortunately, we can force the device to trust the certificate.
Windows Mobile 6.0 brought a change in how to install certificates. Users cannot install a certificate into the root certificates store on a phone unless the certificate is self-signed. This ensures that only true root certificates exist in the root store.
The pain here is that when you try installing a certificate such as the one used to secure Outlook Web Access it gets dumped in the personal store, and ActiveSync won’t connect because it can’t verify the certificate authority associated with the certificate. The solution is to get the certificate authority’s self-signed certificate into the root store. We can do this with the following steps:
Open Internet Explorer and navigate to the site securing OWA. Click the lock next to the address bar.
Click the View Certificates link.
Click the Certification Path tab at the top.
Click the top certificate name first (the root CA) and then click View Certificate.
Click the Details tab.
Click the Copy to File… button.
Click Next to start the Certificate Export Wizard.
Click Next to export the certificate as a DER encoded binary X.509 (.CER)
Browse to a location where you’d like to save the certificate and give it a name.
Click Finish to complete the Certificate Export Wizard.
You should see a dialog that the export was successful.
Now copy that .cer file you created to the device in some way. Via a storage card, USB cable, Bluetooth, whatever. Just get the .cer in the file structure of the phone somehow.
Power up the phone and click Start.
Find and open File Explorer.
Locate the .cer file you copied to the phone. I called mine root.cer.
Press Menu and then Install.
You should see a dialog that the install was successful. I’ve seen it fail on the first attempt before, so try a few times if you get an error. Press OK.
Navigate to the phone’s Settings option.
Click on Security and press OK.
Click on Certificates and press OK.
Click on Root and press OK.
Scroll to the end of the certificates list or keep pressing More. You should see the certificate you installed listed at the very end of the list. If it’s not there, try starting over and making sure you’re exporting the certificate authority’s certificate, and not yours.
You can now test ActiveSync and it should be able to connect to the Exchange server without ever needing to install your OWA certificate. It’s automatically trusted because the certificate authority now exists in your root certificates store.
Thanks that worked!
Thanks for posting this. Very helpful for a first time installation of a certificate to to Windows Mobile.
My copy function is grayed out. Is there something else I need to do.
hi
I have followed above mentioned steps.
My certificate installs in intermediate and not Root.!!!
and i am still geting the same error message!!
any help, i will appreciate.
thanks
Thank’s a lot, this was very helpful, my IT depratment hasn’t been able to help me but the step-by-step screen shots certainly helped
So what did u do Rich, when the Copy to File button is greyed out?
My copy to file button is also greyed out.
Perfect guide! Thanks a lot. I didn´t have to perform steps 18-22 on my brand new HTC Diamond2.
Rich, you need to run IE as administrator
Thank you for posting this… very helpful for windows mobile users and developers.
I have a new HTC HD2 device and could’nt synchronise with OWA because of 0×80072FOD error. I followed the steps deeeopped above and… it works!
Thanks a lot
The most amazing is that the customer service of HTC didn’t knew the answer!
It’s very helpfull. Tested on Samsung Omnia. Everything works fine
Yup…your instructions are on target. Thanks
Good advice, worked on HTC s740…!
New HTC HD2, worked perfectly, very clear, thanks, saved me a lot of grief!
hey everyone,
have the same problem as victor, my cert installs as intermediate and not as root, what can I do about it??? anyone has any answers how to solve this?
thx for your help poldy
I am using an HTC Diamond2 and I am amazed at how far back Windows Mobile 6.5 is.
The AppleOS on the Iphone finds the certificate automatically and says ‘Do you want to install it’ and it’s job done.
Why is windows mobile so useless?
Wow! This advice is from 2007 and it is still valid
I walked through step by step and my HD2 with WM6.5.1 is synchronizing again!
Thanks a lot!
Thanks a lot
I walked through step by step and my HD2 is synchronizing again!
Anyone having trouble with not being able to install certificates to the root section, ensure you select THE TOP LEVEL certificate in the list from the OWA Certification Path settings. You may have more than 2 levels of certificates in the OWA list, it’s easy to mistakenly select the last/lowest in the list, when you actually need the top level one.
S.
Perfect ! Thanks a lot, quite straightforward guide
works like a charm! thanks for posting this!
Hi thanks for the tutorial, but i’ve try and it my root certificate install as intermediate. i’ve checked that i was at the top level. have somebody resolve this issue ??
If you have lots of users needing it. Zip the file and post it on your internet.
then send out this email
To all staff with a Windows Mobile company ‘phone (i.e. not Blackberry or iPhone) will have noticed their phones were not automatically updating for the last day or so.
Please read the below instructions and follow on the ‘phone itself:
1) Click this link: https://YourWebAddress/root.zip
2) Click “Open”.
3) Expand “root.zip” by clicking the + symbol.
4) Double click “root.cer”.
5) Click “OK” on the message “One or more certificates were installed successfully” – it will take about 10 seconds to appear after double clicking.
6) Close the Zip window, the download window and the browser.
7) Click “Start” in the top left corner.
9) Click “ActiveSync”
10) Click “Sync”
Your emails should now come through automatically again.
If you are still not getting emails, follow steps 7-10 again. If it still does not work, restart the phone by holding the hang up button for 5 seconds, then click “Power Off”. Once the device is off, press the hang up button again to turn back on.
Any problems, please call IT on the below number.
Apologies for the inconvenience – our certificate vendor has upgraded their security and the preloaded certificates we shipped with the ‘phones would not accept the high security settings.
Many Thanks,
I have only one certificate level and when I install it goes in intermediate level not the root. I am using Blackjack 2 windows mobile 6.1. Can any one please suggest any help ? how to move the certificate from intermediate to root? or to disable the certificate check of active sync completely?
Thanks very much! It helped me fixed my problem!!
Still haven’t got it working but at least have now realised that the Secure Server Certification Authority certificate expired a month ago which is probably causing the issue!
Post 21 solved it for me.
Thank you.
I love you! I was almost at the point of throwing myself out the window trying to get Email Synchronised, Microsoft help docs are absolutely useless but with your help it’s finally working!
I have to mark here. this is the only workable method to me after I tried many kinds of way, search on google, microsoft support. it’s a total solution, no just a not clear diagnose again.
Yep this worked – all IT dept could do was tell me the certificate was never designed to work with WM6.1 or lower. Sounds like it was just bad Cert creation on their part when they compiled it without selecting the certificates top level as described in your step 4 above. Wish I had have searched for this 2 weeks ago rather than wait for their “this can never work” response.