Thursday
Oct282010
Windows Phone 7: Exchange with Self-Signed Certificate
Thursday, October 28, 2010 at 12:58AM I wonder if this is a game breaker. Many corporate Exchange servers use a self-signed certificate, and push that certificate into client PC's root CA via group policy.
- With desktop PCs, you can push that certificate and install it
- With the iPhone, it seems that the phone can ignore this.
- With Windows Mobile 6.5, you can install additional certificates.
- But with Windows Phone 7, you can't install additional certificates, which means you can' synchronize with the Exchange server, unless you switch off HTTPS (bad - we're talking about synchronizing contact, emails over the air here…), or buy an expensive certificate from a trusted Root Certificate Authority.
Hopefully Microsoft fix this soon.
Reader Comments (44)
Hiya,
Self Signed Root certs can be deployed on Windows Mobile 7.
Step 1: Export the root cert to .cer
Step 2: Use a hotmail (non outlook as outlook blocks cer files) to email your hotmail account the cer file
Step 3: Download the cer file via hotmail
Step 4: Once downloaded, you can then install the root cert
Step 5 : Close down IE and restart it.
Cheers
Craig
If you have a SAN cert then you need to export it as a .p7b and then import it.
Tried the importing of the certificate - I exported and imported all the certificates on the server, but it still doesn't work. I'm getting an error, that the names don't match; not really surprising, seeing as the server certificate is on the internal server.domain.local and I'm connecting over mail.domain.com
Why can't the phone act like Nokia, Apple and Android devices, warn the user, but let them override?
Just export the cert from the owa site using IE. Exchange07 or 03?
Exchange 03 R2. Tried exporting from IE, but it doesn't display the certificate... Exported it from Firefox and mailed it over, same as before, certificate successfully loaded onto the 'phone, but it still refuses to connect with error 80072F06
Using XP Mode, managed to export it from IE6, but Phone still refuses to connect.
I OWN ONE OF THESE PIECES OF SHIT!!!!!!!! The foregoing is the unadulterated truth. Salespeople (or even MS) of WM7 devices are committing fraud. If I call it "feces", someone won't delete this post. But, WM7 doesn't deserve the word "feces" as a description.
Being a software developer for nearly 3 decades: BELIEVE IT WHEN I SAY:Unless you are a brainless piece of poop, the only thing this phone is going to do FOR BUSINESS USERS IS:
1) Email (If you can get it to work with your exchange server)
2) Surf
3) make phone calls.
That’s it.
I bought it because I think ATT injected my Win Mobile 6.0 Tilt phone with something during the Time Change (it killed a daughter’s the same night!)
IF YOU WANT TO TWIDDLE YOUR THUMBS AND BE ENTERTAINED, EVEN THE IPHONE IS BETTER! I have had enough of this piece of shit — Win Mobile 7 LG Quantum. I’ve had it for several hours now. I don’t want to waste any more of my time.
Win 7 IS A PIECE OF DOGSHIT. WM7 goes beyond SUCK. Read your state laws on implied warranties and fitness for a particular purpose. I see a class action coming… And I *will* solicit a couple of attys to spearhead the action.
I ain’t paying ATT $35 dollars restocking fee to test out MS software. I’ve been a loyal MS developer and WM customer FOR YEARS. WM7 IS ABSURD.
Wow man thats sad. You must be a crappy developer if you cant work this phone. I've set 5 of these things up for exchange 2003-2010 and no problems(self signed and real). No crashing, the batery life is great (only half gone by the end of the day) and if 35$ is to much to get you out of this misery of having to USE this phone then look over your financials again.
Did anybody got this to work? I tried every certificate I could think and I keep getting the error. The strange thing is I have a colleague who has a Dev device and he got this to work. He even sent me the certificate he used and no luck.
Do not use web based email to send the cert. you have to setup an imap or pop account on the phone and transfer the cert that way.
Hi Bryce,
Why would using a pop account be different than a web based email? It's the same email message and attachment, no?
Bryce -- I've been a developer for almost 30 years. I was doing DOS, UNIX, OS/2, and NT before you were even born. In fact, I was doing NT stuff while NT was still in development.
Obviously, you are one of those thumb twiddlers and never used a POCKET PC as a REAL TOOL before.
Enjoy your Miniature Xbox-Phone. You are probably a very good XBox game player. But, you can stay out of my code. I don't think I'd want you there.
Crap.. person--#1 Well this 25 year old got done what you cant, case and point. #2 I dont play Xbox i got better shit ta do(like Ski, the snow season is here) plus mouse and keybaord are far better then the damn controller. #3 FYI I used a pocket PC (compaq Ipaq) back in 9th grade. Owned iPhone (1st and 2nd gen), Black berry, 2 windows mobile 6.5 and 1 6.0 windows phones plus one Android. #4 well there is no #4 it just make it even. #5 but there is a #5 I wrote a tiny program for th Ipaq but in wait for it 9th to read temps off of welding tool for underground gas pipe for my familys business. Ok now im done
Jason- I dont know but from what I read it was something with the mobile IE and access the web based and downloading the attachment it did not working right. Once I added it into outlook on the phone it worked like a champ. Try both cer and crt extentions depend on how you created the self singed cert. Remeber if it 2007 or 10 you need it as a p7b
Bryce - I got it working with exchange, no problem. But, you can't manage your certs without external tools connected to a workstation. Operating blind.
As for your little Ipaq, well, I've personally written a couple million lines of c and c+. Also, I was software engineer for oil and gas pipelines for one of the first and largest systems of realtime flow measurement volumes and online chromatographs over a multi-state area that was all connected together via radio (not your CB band wireless.) When that project first materialized, it was doing 150000 tpd on quad P90s. (I have a hard time topping that with even parallel multi-threaded, multiprocessor systems today.)
So button it and accept the fact that WM7 is a toy for ages 25 and down.
<comment removed>
Well, Bryce... At least I have enough natural talent to know how to spell "fossil."
NOW, to help David solve his problem: Your easiest solution is to logon to a workstation WITHIN your domain (lan) instead of trying to do it via your WAN interface.
Your problem is that your IIS server is not configured correctly to issue certs FROM OUTSIDE YOUR DOMAIN. Find the machine that is the CA for your domain that has your lan-facing interface to your IIS web service http://<server>/certsrv. Login under your desired user id (<lan>\<username>) account. Load your browser (IE?) and go to http://server/certsrv. Issue yourself a user certificate and any other certs you need. Then, export them for your mobile.
The reason for your difficulty on the WAN side is because of the action Kerberos plays in the creation of certs. It's already up and going correctly inside the domain.
Your only other alternative is to basically hack your IIS / Exchange server configuration to provide Kerberos connectivity thru a front-end/back-end exchange server configuration.
Go away Bryce.
<comment removed - duplicate>
The misspelling Fossil yeah ill own up to that, my bad every one my bad. Mr Crap man you actually gave some good advice on helping some one instead of acting like a D-Bag and for that we thank you. Although its probably not need to do all that. Pony up the cash and get a real cert. Hell even SAN certs are cheap now.
Yeah Im here to stay Mr Crap
Sent from my Windows Phone 7
ZING!
A public cert is NOT going to fix David's issue. He's got an internet domain (dot.com) and a lan domain (dot.local). With a public cert, his AUTHENTICATION problem (with Kerberos/SSO) is still the a problem because you have to properly set up AUTHN and AUTHZ.
The way David is currently set up is proper.
<comment removed>
<comment removed>
<comment removed>
Hi guys, it is my wishes that comments on my blog are kept constructive. I will be editing comments and taking out some of the really offensive comments.
My personal feeling and what I tell all my colleagues asking me to compare the WP7 with WM6.5 or iPhone:
1. The WP7 is not yet enterprise ready, not at the level of WM6.5 - you will find that it is a great phone, but with many "but"s. Wait for the 2011Q1 update and we'll see. I know MS is working hard. They need to work fast and furious.
2. Compared to the iPhone, I synchronized all my pictures off the iPhone, and switched it off, and I have not turned it back on - it's still on my shelf. To say I love the WP7 (even with the numerous buts), is an understatement. I adore it and is willing to turn a blind eye to many of its faults.
3. I agree with having a "let user choose skip" option. Seems to be the cheapest and most painless way out.
John... The user interface of WM7 is fine. It meets the definition for "user friendly." My problem is that SUCH A CRITICAL RELEASE of a new 'OS' (WP/WM7) that is expected to replace/surplant the technically-competent WM6x is a major BLUNDER.
Not Enterprise Ready? (THAT HAS GOT TO BE THE UNDERSTATMENT OF THE YEAR.) ISN'T THAT THE PRIMARY USERS OF WINDOWS-PHONES-PAST? IT COULD DO THINGS NO OTHER PHONE COULD! Even Office Mobile is useless because you don't have a file explorer to manage all your documents. Sharepoint? You don't even have cert management features to browse the stuff. What about everything else from your PC that you transfer to your phone? You cannot even find those, either.
What does it do well???? It plays XBox games so you can pay more on your monthly phone bill.
It's ridiculous. It doesn't do JACK except phonecalls, HOTMAIL/ETC email (giving Exchange big negatives due to complexity of setup), and surf (and the old IE even surfed better!). You cannot overlook that upon which you depend. It's sorta like a C-Compiler with no library header files!! Try to get anything done? Could you image Visual Studio with no language compilers?!?!?!!!
Try creating a powerpoint on your PC and then view it on your phone!!!!!!!!! Geez!
INSANE PIECE OF DOGSHIT! IT CANNOT BE OVERLOOKED.
So, restating my prior conclusion, the only thing this phone does is:
VIDEO GAMES!
AND, BALLMER DECIDED TO RELEASE IT WELL IN ADVANCE OF CHRISTMAS TO AVOID THE BLUNDER OF THEIR RECENT-LATE-RELEASE OF THE ORIGINAL XBOX!!!!!!!! SO, EVEN BALLMER KNOWS ITS A CHILD'S TOY.