?
Solved

ActiveSync fails after certificate renewal

Posted on 2011-02-28
11
Medium Priority
?
2,753 Views
Last Modified: 2013-12-27
Hi Experts,

I recently renewed my certificate on my exchange 2003 server.  Now I have two Palm Treo 700wx's that cannot sync (activesync).  The new and old certificates are from Comodo and was a renewal (old one expired on 2/25/11).

The renewal didn't affect any of our "rpc over https" clients.
The Treo's CAN open the https://...../oma web page and read mail.

The error displayed on the Treo is:  "The security cert. on the server is invalid.  Contact...admin...to install a valid cert. on the server."

The error code is:  0x80072f0d

I'm following this article now and have confirmed that OWA opens on the device:

http://support.microsoft.com/kb/915438

Should I look somewhere else or am I on the right track?

Thanks!



0
Comment
Question by:iteched1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
11 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35001352
I had the same issue with a customer's server.  Please check your IIS settings against my article and hopefully we will get you up and running PDQ.

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/A_1798-Exchange-2003-Activesync-Connection-Problems-FAQ.html

Alan
0
 

Author Comment

by:iteched1
ID: 35002116
I think I have a clue:

Basically while running the test this popped up:

      The certificate is only trusted on Windows Mobile 6.0 and later versions. Devices running Windows Mobile 5.0 and 5.0 with the Messaging and Security Feature Pack won't be able to sync. Root = CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE.

The Treo is a 5.0 device.  It just strikes me strange how the renewal seems to have caused the problem...unless the "new" cert simply isn't understood by WM 5.0.

0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35002218
Was the cert 1024 bit or 2048 bit?

Sounds like that won't help if the Treo is WM5.0.

Thinking if there is a solution to keeping the new cert and having the Treo work.
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35002231
You can always resort to issuing your own SSL certificate and installing it on the Treo.

How many mobile devices does your server support?  When is the handset due for an upgrade, or do you have a newer one handy in a drawer somewhere?
0
 

Author Comment

by:iteched1
ID: 35002279
I'm pretty sure it is 2048 bit.

Most of my mobiles devices are Blackberries and iphones.

I could issue my own cert for JUST the Treo's (or Activesync more specifically)...so long as it doesn't affect the Blackberries, iPhones, and outlook "RPC over Https" clients.

I don't mess with this stuff on an everyday basis so getting in there is sometimes a bit scary...

Is it possible to run a different cert for just the Activesync process?


0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 2000 total points
ID: 35002330
The Blackberries don't use SSL certs as they don't use Activesync - the iPhones / and RPC over HTTPS clients would be affected.

You can't have separate certs as the cert is installed on the Default Website - and everything hangs off that site and it can only have one cert.

Might be time to upgrade the Treo for an iPhone / Blackberry.
0
 

Author Comment

by:iteched1
ID: 35002365
That's what I was thinking...

I think I'll make a call to Comodo and see if they can re-issue a cert that will work...but I expect they can't.

Otherwise it may be time for different phones - fortunately I have several.

0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35002389
Not sure if this will work - but you might be able to install the Root Certificate for Comodo on the Treo which might get around the problem.

http://support.microsoft.com/kb/915840
0
 

Author Comment

by:iteched1
ID: 35002627
I'll give that a go...

Otherwise we decided to ditch the Treo's for some BB "Tours" we have extra.

0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 35002647
: )  At least the keyboard stays pretty much the same between the Treo and BB.
0
 

Author Closing Comment

by:iteched1
ID: 35020075
I ended up taking the easy way out with this issue.  The Treo's were abandoned in favor of some Blackberries that I had laying around.  I did try installing the cert on the Treo but that also failed to fix the problem.

So...as far as I can tell there is no solid solution other than retiring the old phones.
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
Suggested Courses
Course of the Month12 days, 8 hours left to enroll

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question