Windows Mobile 6.0 brought a change in how to install certificates. Users cannot install a certificate into the root certificates store on a phone unless the certificate is self-signed. This ensures that only true root certificates exist in the root store.

The pain here is that when you try installing a certificate such as the one used to secure Outlook Web Access it gets dumped in the personal store, and ActiveSync won’t connect because it can’t verify the certificate authority associated with the certificate. The solution is to get the certificate authority’s self-signed certificate into the root store. We can do this with the following steps:

1. Open Internet Explorer and navigate to the site securing OWA. Click the lock next to the address bar.

2. Click the View Certificates link.

3. Click the Certification Path tab at the top.

4. Click the top certificate name first (the root CA) and then click View Certificate.

5. Click the Details tab.

6. Click the Copy to File… button.

7. Click Next to start the Certificate Export Wizard.

8. Click Next to export the certificate as a DER encoded binary X.509 (.CER)

9. Browse to a location where you’d like to save the certificate and give it a name.

10. Click Finish to complete the Certificate Export Wizard.

11. You should see a dialog that the export was successful.

12. Now copy that .cer file you created to the device in some way. Via a storage card, USB cable, Bluetooth, whatever. Just get the .cer in the file structure of the phone somehow.

13. Power up the phone and click Start.

14. Find and open File Explorer.

15. Locate the .cer file you copied to the phone. I called mine root.cer.

16. Press Menu and then Install.

17. You should see a dialog that the install was successful. I’ve seen it fail on the first attempt before, so try a few times if you get an error. Press OK.

18. Navigate to the phone’s Settings option.

19. Click on Security and press OK.

20. Click on Certificates and press OK.

21. Click on Root and press OK.

22. Scroll to the end of the certificates list or keep pressing More. You should see the certificate you installed listed at the very end of the list. If it’s not there, try starting over and making sure you’re exporting the certificate authority’s certificate, and not yours.

You can now test ActiveSync and it should be able to connect to the Exchange server without ever needing to install your OWA certificate. It’s automatically trusted because the certificate authority now exists in your root certificates store.