Palm Centro Outlook EAS sync problems - Exchange 2003 SSL Error

Hello,

I setup a new SBS 2003 box (sp2 all updates, exchange sp2 all updates) recently and everything seems to be working fine except when i try to sync my mail to a palm centro with versamail 4.0.1 - i get an SSL error below.  

I've tested all the settings for the virtual directories in IIS and they all function as they should.  I tested the Centro with a different exchange server running SBS 2003 and it synced fine  (different division in Europe)-- checked all the settings on that exchange server and they are identical.

1.  https://mail.mydomain.com/exchange -- functions properly (i can load this in the palm and login)
2.  https://mail.mydomain.com/oma -- i get prompted for username/pw and it logs in (both on the palm and on a remote laptop)
3.  certificate is valid (not a self certificate) issued by Starfield Secure Certification Authority (not go daddy)
4.  performed https://www.testexchangeconnectivity.com/ activesync test on a testuser -- passed all activesync tests
5.  verified this works http://kb.palm.com/wps/portal/kb/common/article/16733_en.html 
6. verified i have latest version for centro http://kb.palm.com/wps/portal/kb/common/article/6012_en.html 
7.  I also installed the SSL certificate onto the phone -- i don't have the link to the step-by-step but it involved downloading the certificate from the server, saving locally (where palm desktop is installed), converting the SSL certificate to a file that phone could understand (with a tool that was provided), adding new file to install directory for palm desktop, syncing with centro then soft resetting a couple times

Below is the exact error on the Palm Centro:

"SSL Error: No Trusted root.  Update CA list. Contact your administrator if this error persists."

Centro is updated to the latest versions of software (sprint 1.07) and versamail (4.0.1.00)     I'm running out of options to check/modify.  I need this to work so that i can monitor admin alerts while away from the office.  Thanks for any help.
Whereismys4Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Whereismys4Author Commented:
below is the test result from activesync test using  https://www.testexchangeconnectivity.com/  

      
Connectivity Test Successful
Test Details
Copy to Clipboard      Expand/Collapse       
      Testing Exchange Activesync for host mail.MYDOMAIN.com
       Exchange Activesync was tested successfully
      Test Steps
       
      Attempting to Resolve the host name mail.MYDOMAIN.com in DNS.
       Host successfully Resolved
      Additional Details
       IP(s) returned: xxx.xxx.xxx.xxx
      Testing TCP Port 443 on host mail.MYDOMAIN.com to ensure it is listening/open.
       The port was opened successfully.
      Testing SSLCertificate for validity.
       The certificate passed all validation requirements.
      Additional Details
       Subject: CN=mail.MYDOMAIN.com, OU=Domain Control Validated, O=mail.MYDOMAIN.com, Issuer SERIALNUMBER=XXXXXXX, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US
      Testing Http Authentication Methods for URL https://mail.MYDOMAIN.com/Microsoft-Server-Activesync/
       Http Authentication Methods are correct
      Additional Details
       Found all expected authentication methods and no disallowed methods Methods Found: Basic realm="mail.MYDOMAIN.com"
      Attempting an Activesync session with server
       Testing an ActiveSync session completed successfully
      Test Steps
       
      Attempting to send OPTIONS command to server
       OPTIONS response was successfully received and is valid
      Additional Details
       Headers received: MicrosoftOfficeWebServer: 5.0_Pub Pragma: no-cache Public: OPTIONS, POST Allow: OPTIONS, POST MS-Server-ActiveSync: 6.5.7638.1 MS-ASProtocolVersions: 1.0,2.0,2.1,2.5 MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy,CreateCollection,DeleteCollection,MoveCollection,FolderSync,FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate,MeetingResponse,ResolveRecipients,ValidateCert,Provision,Search,Notify,Ping Content-Length: 0 Date: Sat, 25 Apr 2009 06:00:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET
      Attempting FolderSync command on ActiveSync session
       FolderSync command completed successfully.
      Additional Details
       Number of Folders: 11
      Attempting initial sync (no data) for Inbox folder
       Completed Sync Command successfully
      Additional Details
       Status: 1
      Attempting to test GetItemEstimate command for Inbox Folder
       Successfully received GetItemEstimate Response from Server
      Additional Details
       Estimate: 1 messages
      Attempting to test Sync of Inbox Folder
       Completed Sync Command successfully
      Additional Details
       Number of items synchronized: 0
activesync-test.jpg
0
Sourabh-ExcahngeCommented:
hi,
have you tried configuring the profile over the windows mobile ?
and what is the common name of your certificate ?
0
Whereismys4Author Commented:
hi -- i dont have any users with windows mobile.  Just Palm users.  

The common name of the certificate is mail.MYDOMAIN.com

all the details are in the SSL test:

Testing SSLCertificate for validity.
       The certificate passed all validation requirements.
      Additional Details
       Subject: CN=mail.MYDOMAIN.com, OU=Domain Control Validated, O=mail.MYDOMAIN.com, Issuer SERIALNUMBER=XXXXXXX, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US
      Testing Http Authentication Methods for URL https://mail.MYDOMAIN.com/Microsoft-Server-Activesync/
       Http Authentication Methods are correct

please advise if there is a emulator i can load for windows mobile -- maybe i could try something with that.
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

Sourabh-ExcahngeCommented:
please download the emulator from here
http://msexchangeteam.com/archive/2007/09/17/447033.aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Whereismys4Author Commented:
thanks will download and install as per instructions.  once i have it setup i will attemp to sync and post results.
0
Whereismys4Author Commented:
i installed a windows mobile 5 emulator and it works like a charm.  Palm still will not sync however now the device shows 'forming secure connection' then after about 60 secs it errors with: "SSL certificate not accepted due to possible expiration. check device date & time and re-sync".

SSL certificate is valid untill 2011 -- and works on windows mobile 5 without any problems.

to test the communication with the server and the Palm device I setup IMAP on the server (SSL only) and enabled it with Chattermail which works (removed the EAS account from versamail).  However chattermail is limited in that it only pulls emails and does not sync calendar/contacts.  
0
Sourabh-ExcahngeCommented:
try and check if you have any option to cee the certificates available on the device if you see those certificate please check if you have any certificate which is not valid please delete those certificates
export the new certificate on the device.
please install all the clases of the certificate
like Root, intermitent
and i hope this will work
0
Whereismys4Author Commented:
here are some steps i did which did not help:

1.  deleted all outdated certificates on the server
2.  downloaded the valid mail.MYDOMAIN.com certificate on the server
3.  moved certificate to local laptop where Palm ActiveSync is installed
4.  hard reset the centro/deleted all data -- created new user profile -- hotsynced centro
5.  installed certificate from step 2
6.  setup eas on centro
7.  attempted to test settings
8.  same error: "forming secure connection' then after about 60 secs it errors with: "SSL certificate not accepted due to possible expiration. check device date & time and re-sync".

trying to locate a palm os emulator to see if i can get to work on another device  (still works on windows mobile)
0
Sourabh-ExcahngeCommented:
are you using desktop sync of the air sync ?
0
Whereismys4Author Commented:
i'm using HotSync Manager 7.0.2
I only use the app above to upload prc files -- i do not sync outlook files
0
Whereismys4Author Commented:
fogot to add I have Palm Desktop 6.2.2 which i only use to upload media files
0
Whereismys4Author Commented:
i was able to get the palm to sync with a test SBS box by creating a self signed SSL certificate here is what i did:

1. used selfssl.exe to create new certificate (site 1)
2. exported certificate with keys locally
3. installed new certificate in trusted root cert auth folder
4. exported new root certificate without keys locally
5. pulled new cert into palm install tool
6. hard reset centro
7. hotsynced centro (installs cert)
8. setup EAS
9. was able to sync

i performed the same steps on the live SBS box and was able to sync using the self signed certificate.  However when i try this using the valid Starfield Secure Authority certificate i receive the 'SSL cert not accepted due to possible expiration'.

The certificate we have expires in 2011, i'm thinking that i may just give up on it -- what are the ramification of using a self signed SSL certificate -- only my users connect to the server for OMA/Exchange and I can just direct them to accept the error that comes up in IE/Mozilla (SSL certificate not signed by trusted authority) and add the SSL certificate exception.  

Is my traffic any less secure when using a self signed SSL certificate as opposed to a authorized CA certificate?
0
Sourabh-ExcahngeCommented:
not it is still secure as you are using the Port 443 for communication
please install the root certificate on the client machine from where you are using OWA then you will not get the certificate error
0
Whereismys4Author Commented:
in the installation instructions of the Starfield Secure Authority (SSA) certificate i am advised to disable the Starfield Secure Authority root certificate.  This is because the SSA certificate uses a intermediate certificate.  I attempted installing first the SSA root certificate on the client which caused the the original error -- then i disabled the root and installed the intermediate certifiate on the client (same error) and finally i tried installing the 'personal' certificate and get the same error.

I'm leaning towards the certificate being too new for the palm OS to understand -- i read about that somewhere in researching this problem.  At this point i think i would rather try to test this on the Centro emulator which i have, except that i cannot get the emulator to connect to the internet thus sync.
0
Whereismys4Author Commented:
Palm emulator does not like the Starfield certificate either -- even after installing certificate on emulator.  I am now stuck with a valid certificate that does not work on the Palm OS... oh well when the time comes we will switch back to MS Mobile OS devices.  thanks for sticking with this question.  
0
Whereismys4Author Commented:
im giving you the points even though we dint come up with a solution.  i believe this is because the certificate is too new and the palm os will not recognize it -- and the fact that it's an intermediary certificate.  
0
oalvaCommented:
is this a godaddy cert?
0
Whereismys4Author Commented:
it is a starfield certificate -- i know godady certs have issues with palm... i've read that on other posts
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Smartphones

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.