[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Palm Centro  Outlook EAS sync problems - Exchange 2003  SSL Error

Posted on 2009-04-24
18
Medium Priority
?
2,360 Views
Last Modified: 2012-05-06
Hello,

I setup a new SBS 2003 box (sp2 all updates, exchange sp2 all updates) recently and everything seems to be working fine except when i try to sync my mail to a palm centro with versamail 4.0.1 - i get an SSL error below.  

I've tested all the settings for the virtual directories in IIS and they all function as they should.  I tested the Centro with a different exchange server running SBS 2003 and it synced fine  (different division in Europe)-- checked all the settings on that exchange server and they are identical.

1.  https://mail.mydomain.com/exchange -- functions properly (i can load this in the palm and login)
2.  https://mail.mydomain.com/oma -- i get prompted for username/pw and it logs in (both on the palm and on a remote laptop)
3.  certificate is valid (not a self certificate) issued by Starfield Secure Certification Authority (not go daddy)
4.  performed https://www.testexchangeconnectivity.com/ activesync test on a testuser -- passed all activesync tests
5.  verified this works http://kb.palm.com/wps/portal/kb/common/article/16733_en.html 
6. verified i have latest version for centro http://kb.palm.com/wps/portal/kb/common/article/6012_en.html 
7.  I also installed the SSL certificate onto the phone -- i don't have the link to the step-by-step but it involved downloading the certificate from the server, saving locally (where palm desktop is installed), converting the SSL certificate to a file that phone could understand (with a tool that was provided), adding new file to install directory for palm desktop, syncing with centro then soft resetting a couple times

Below is the exact error on the Palm Centro:

"SSL Error: No Trusted root.  Update CA list. Contact your administrator if this error persists."

Centro is updated to the latest versions of software (sprint 1.07) and versamail (4.0.1.00)     I'm running out of options to check/modify.  I need this to work so that i can monitor admin alerts while away from the office.  Thanks for any help.
0
Comment
Question by:Whereismys4
  • 12
  • 5
18 Comments
 

Author Comment

by:Whereismys4
ID: 24230994
below is the test result from activesync test using  https://www.testexchangeconnectivity.com/  

      
Connectivity Test Successful
Test Details
Copy to Clipboard      Expand/Collapse       
      Testing Exchange Activesync for host mail.MYDOMAIN.com
       Exchange Activesync was tested successfully
      Test Steps
       
      Attempting to Resolve the host name mail.MYDOMAIN.com in DNS.
       Host successfully Resolved
      Additional Details
       IP(s) returned: xxx.xxx.xxx.xxx
      Testing TCP Port 443 on host mail.MYDOMAIN.com to ensure it is listening/open.
       The port was opened successfully.
      Testing SSLCertificate for validity.
       The certificate passed all validation requirements.
      Additional Details
       Subject: CN=mail.MYDOMAIN.com, OU=Domain Control Validated, O=mail.MYDOMAIN.com, Issuer SERIALNUMBER=XXXXXXX, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US
      Testing Http Authentication Methods for URL https://mail.MYDOMAIN.com/Microsoft-Server-Activesync/
       Http Authentication Methods are correct
      Additional Details
       Found all expected authentication methods and no disallowed methods Methods Found: Basic realm="mail.MYDOMAIN.com"
      Attempting an Activesync session with server
       Testing an ActiveSync session completed successfully
      Test Steps
       
      Attempting to send OPTIONS command to server
       OPTIONS response was successfully received and is valid
      Additional Details
       Headers received: MicrosoftOfficeWebServer: 5.0_Pub Pragma: no-cache Public: OPTIONS, POST Allow: OPTIONS, POST MS-Server-ActiveSync: 6.5.7638.1 MS-ASProtocolVersions: 1.0,2.0,2.1,2.5 MS-ASProtocolCommands: Sync,SendMail,SmartForward,SmartReply,GetAttachment,GetHierarchy,CreateCollection,DeleteCollection,MoveCollection,FolderSync,FolderCreate,FolderDelete,FolderUpdate,MoveItems,GetItemEstimate,MeetingResponse,ResolveRecipients,ValidateCert,Provision,Search,Notify,Ping Content-Length: 0 Date: Sat, 25 Apr 2009 06:00:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET
      Attempting FolderSync command on ActiveSync session
       FolderSync command completed successfully.
      Additional Details
       Number of Folders: 11
      Attempting initial sync (no data) for Inbox folder
       Completed Sync Command successfully
      Additional Details
       Status: 1
      Attempting to test GetItemEstimate command for Inbox Folder
       Successfully received GetItemEstimate Response from Server
      Additional Details
       Estimate: 1 messages
      Attempting to test Sync of Inbox Folder
       Completed Sync Command successfully
      Additional Details
       Number of items synchronized: 0
activesync-test.jpg
0
 
LVL 3

Assisted Solution

by:Sourabh-Excahnge
Sourabh-Excahnge earned 750 total points
ID: 24240658
hi,
have you tried configuring the profile over the windows mobile ?
and what is the common name of your certificate ?
0
 

Author Comment

by:Whereismys4
ID: 24245049
hi -- i dont have any users with windows mobile.  Just Palm users.  

The common name of the certificate is mail.MYDOMAIN.com

all the details are in the SSL test:

Testing SSLCertificate for validity.
       The certificate passed all validation requirements.
      Additional Details
       Subject: CN=mail.MYDOMAIN.com, OU=Domain Control Validated, O=mail.MYDOMAIN.com, Issuer SERIALNUMBER=XXXXXXX, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US
      Testing Http Authentication Methods for URL https://mail.MYDOMAIN.com/Microsoft-Server-Activesync/
       Http Authentication Methods are correct

please advise if there is a emulator i can load for windows mobile -- maybe i could try something with that.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
LVL 3

Accepted Solution

by:
Sourabh-Excahnge earned 750 total points
ID: 24251960
please download the emulator from here
http://msexchangeteam.com/archive/2007/09/17/447033.aspx
0
 

Author Comment

by:Whereismys4
ID: 24252958
thanks will download and install as per instructions.  once i have it setup i will attemp to sync and post results.
0
 

Author Comment

by:Whereismys4
ID: 24260051
i installed a windows mobile 5 emulator and it works like a charm.  Palm still will not sync however now the device shows 'forming secure connection' then after about 60 secs it errors with: "SSL certificate not accepted due to possible expiration. check device date & time and re-sync".

SSL certificate is valid untill 2011 -- and works on windows mobile 5 without any problems.

to test the communication with the server and the Palm device I setup IMAP on the server (SSL only) and enabled it with Chattermail which works (removed the EAS account from versamail).  However chattermail is limited in that it only pulls emails and does not sync calendar/contacts.  
0
 
LVL 3

Assisted Solution

by:Sourabh-Excahnge
Sourabh-Excahnge earned 750 total points
ID: 24262578
try and check if you have any option to cee the certificates available on the device if you see those certificate please check if you have any certificate which is not valid please delete those certificates
export the new certificate on the device.
please install all the clases of the certificate
like Root, intermitent
and i hope this will work
0
 

Author Comment

by:Whereismys4
ID: 24265661
here are some steps i did which did not help:

1.  deleted all outdated certificates on the server
2.  downloaded the valid mail.MYDOMAIN.com certificate on the server
3.  moved certificate to local laptop where Palm ActiveSync is installed
4.  hard reset the centro/deleted all data -- created new user profile -- hotsynced centro
5.  installed certificate from step 2
6.  setup eas on centro
7.  attempted to test settings
8.  same error: "forming secure connection' then after about 60 secs it errors with: "SSL certificate not accepted due to possible expiration. check device date & time and re-sync".

trying to locate a palm os emulator to see if i can get to work on another device  (still works on windows mobile)
0
 
LVL 3

Expert Comment

by:Sourabh-Excahnge
ID: 24267720
are you using desktop sync of the air sync ?
0
 

Author Comment

by:Whereismys4
ID: 24270735
i'm using HotSync Manager 7.0.2
I only use the app above to upload prc files -- i do not sync outlook files
0
 

Author Comment

by:Whereismys4
ID: 24270778
fogot to add I have Palm Desktop 6.2.2 which i only use to upload media files
0
 

Author Comment

by:Whereismys4
ID: 24272802
i was able to get the palm to sync with a test SBS box by creating a self signed SSL certificate here is what i did:

1. used selfssl.exe to create new certificate (site 1)
2. exported certificate with keys locally
3. installed new certificate in trusted root cert auth folder
4. exported new root certificate without keys locally
5. pulled new cert into palm install tool
6. hard reset centro
7. hotsynced centro (installs cert)
8. setup EAS
9. was able to sync

i performed the same steps on the live SBS box and was able to sync using the self signed certificate.  However when i try this using the valid Starfield Secure Authority certificate i receive the 'SSL cert not accepted due to possible expiration'.

The certificate we have expires in 2011, i'm thinking that i may just give up on it -- what are the ramification of using a self signed SSL certificate -- only my users connect to the server for OMA/Exchange and I can just direct them to accept the error that comes up in IE/Mozilla (SSL certificate not signed by trusted authority) and add the SSL certificate exception.  

Is my traffic any less secure when using a self signed SSL certificate as opposed to a authorized CA certificate?
0
 
LVL 3

Assisted Solution

by:Sourabh-Excahnge
Sourabh-Excahnge earned 750 total points
ID: 24277698
not it is still secure as you are using the Port 443 for communication
please install the root certificate on the client machine from where you are using OWA then you will not get the certificate error
0
 

Author Comment

by:Whereismys4
ID: 24278422
in the installation instructions of the Starfield Secure Authority (SSA) certificate i am advised to disable the Starfield Secure Authority root certificate.  This is because the SSA certificate uses a intermediate certificate.  I attempted installing first the SSA root certificate on the client which caused the the original error -- then i disabled the root and installed the intermediate certifiate on the client (same error) and finally i tried installing the 'personal' certificate and get the same error.

I'm leaning towards the certificate being too new for the palm OS to understand -- i read about that somewhere in researching this problem.  At this point i think i would rather try to test this on the Centro emulator which i have, except that i cannot get the emulator to connect to the internet thus sync.
0
 

Author Comment

by:Whereismys4
ID: 24318881
Palm emulator does not like the Starfield certificate either -- even after installing certificate on emulator.  I am now stuck with a valid certificate that does not work on the Palm OS... oh well when the time comes we will switch back to MS Mobile OS devices.  thanks for sticking with this question.  
0
 

Author Closing Comment

by:Whereismys4
ID: 31578695
im giving you the points even though we dint come up with a solution.  i believe this is because the certificate is too new and the palm os will not recognize it -- and the fact that it's an intermediary certificate.  
0
 
LVL 5

Expert Comment

by:oalva
ID: 24991213
is this a godaddy cert?
0
 

Author Comment

by:Whereismys4
ID: 25148384
it is a starfield certificate -- i know godady certs have issues with palm... i've read that on other posts
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
Exchange administrators are always vigilant about Exchange crashes and disasters that are possible any time. It is quite essential to identify the symptoms of a possible Exchange issue and be prepared with a proper recovery plan. There are multiple…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
Suggested Courses
Course of the Month19 days, 13 hours left to enroll

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question