Reply
Thread Tools
Posts: 11 | Thanked: 85 times | Joined on Jan 2010 @ Helsinki
#1031
Originally Posted by Rob1n View Post
Thanks for that - it reports "Verification failed: unable to get local issuer certificate". The web browser is perfectly capable of validating the certificate though, so is this doing something differently?
Obviously yes. To give a better answer I need more details. Which port did you connect to with the web browser? If it's just https://..., it will connect to port 443 and it may not be the same port the mail sync connects to. Hence, the service behind the port and the certificates it sends may be different.

One possible reason to the problem is that while the server certificate and the root certificate are OK, the sync client has problems in validating the intermediate CA certificates.

To get to the bottom of this, please do the following. Give the same command as before but this time with the -s-switch to save the certificates the server sends.

Code:
cmcli -T common-ca -sv <your-servers-dns-name-or-ip>:<port>
...which makes the command to write a couple of files with the .pem-extension in the current default directory. Then send those files to me. They should contain no secrets, so I guess it's all right to do this.

I updated these instructions to the Heartbeat wiki as well.
 

The Following User Says Thank You to juhanima For This Useful Post:
Posts: 101 | Thanked: 18 times | Joined on Dec 2009 @ Sweden
#1032
This thread is growing way beyond practical use

When I recieve a mail I get the blue flashing LED. If I choose to read the mail on the computer the status is changed to "read", but itīs still in the unread status and the LED is still flashing if another mail is left open when the unit locked itself.
When I unlock the device and close the open mail The led stops flashing and I do not have any new unread messages ( just as it should be)

A bug?

note: I use "always on" as sync method.
 
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#1033
Originally Posted by juhanima View Post
Obviously yes. To give a better answer I need more details. Which port did you connect to with the web browser? If it's just https://..., it will connect to port 443 and it may not be the same port the mail sync connects to. Hence, the service behind the port and the certificates it sends may be different.
I was using the same port for both. Anyway, I've tracked down the problem - the proxy I was using uses the same parameter names as Apache but for different purposes. I've changed the configuration and the certificate now gets verified okay, and MfE works without needing the intermediate certificate. I'm still not sure why the browser worked without problem though, unless I've stored an exception at some point (I don't think I did though).
 
Posts: 13 | Thanked: 18 times | Joined on Jan 2010
#1034
Originally Posted by Soap77 View Post
This thread is growing way beyond practical use

When I recieve a mail I get the blue flashing LED. If I choose to read the mail on the computer the status is changed to "read", but itīs still in the unread status and the LED is still flashing if another mail is left open when the unit locked itself.
When I unlock the device and close the open mail The led stops flashing and I do not have any new unread messages ( just as it should be)

A bug?

note: I use "always on" as sync method.
I've filed bug 8340 on the issue. I imagine it's more of an oversight than a bug.

The good news is that it's Modest related, which is open source, so it can be fixed even without Nokia doing it... give me a few months to get really annoyed by it and maybe I'll do it myself
 

The Following User Says Thank You to Zhentar For This Useful Post:
Posts: 11 | Thanked: 85 times | Joined on Jan 2010 @ Helsinki
#1035
Originally Posted by Rob1n View Post
I was using the same port for both. Anyway, I've tracked down the problem - the proxy I was using uses the same parameter names as Apache but for different purposes. I've changed the configuration and the certificate now gets verified okay, and MfE works without needing the intermediate certificate. I'm still not sure why the browser worked without problem though, unless I've stored an exception at some point (I don't think I did though).
I'm glad it worked out for you. It bugs me a little bit that I still don't quite understand what was the problem in the first place and why changing the proxy settings helped. But then again, these things tend to be really complicated sometimes. So please keep comments coming if you detect any anomalies. Vitaly and the rest of us drones will try our best to have them fixed for you.
 
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#1036
Originally Posted by juhanima View Post
I'm glad it worked out for you. It bugs me a little bit that I still don't quite understand what was the problem in the first place and why changing the proxy settings helped. But then again, these things tend to be really complicated sometimes. So please keep comments coming if you detect any anomalies. Vitaly and the rest of us drones will try our best to have them fixed for you.
The original problem was that the proxy server (which acts as a HTTPS/HTTP gateway) was only serving the immediate certificate. The configuration setting I assumed (based on Apache configuration experience) was for the CA chain, was only actually used for verifying client certificates. I needed to append the server certificate and CA chain into a single file and set the proxy to use that as the certificate file instead.

Thanks for all your help anyway
 

The Following User Says Thank You to Rob1n For This Useful Post:
Posts: 14 | Thanked: 2 times | Joined on Mar 2009
#1037
Originally Posted by nightfire View Post
Hey everyone,

I'm also unable to connect with the latest build (51.1); I believe my exchange server is 2003, but I'm not the admin and it's a fairly big organization.

This is what I got from the log:


Jan 23 14:25:09 glamb-n900 activesync[1804]: ASDAEMON: ICListener proxyHost: usessl = 1, proxy_host = (null)
Jan 23 14:25:09 glamb-n900 activesync[1804]: HTTP REQUEST: POST https://__omitted__/Microsoft-Server...ype=SmartPhone
Jan 23 14:25:09 glamb-n900 activesync[1804]: ASDAEMON-CONN: startSession start, aWait=30 seconds
Jan 23 14:25:09 glamb-n900 activesync[1804]: ASDAEMON-CONN: CURL-CONN-CALLBACK: Action=2
Jan 23 14:25:09 glamb-n900 activesync[1804]: ASDAEMON-CONN: CURL-CONN-CALLBACK: Action=1
Jan 23 14:25:09 glamb-n900 activesync[1804]: ASDAEMON-PING: Ping is disabled.. Ignore Ping action
Jan 23 14:25:10 glamb-n900 activesync[1804]: ASDAEMON-CONN: CURL-CONN-CALLBACK: Action=4
Jan 23 14:25:10 glamb-n900 activesync[1804]: ASDAEMON-CONN: startSession end, ret=0
Jan 23 14:25:10 glamb-n900 activesync[1804]: AS-PERF: Transfered 262 bytes in 1 seconds. Transfer rate is 0 Kb/sec
Jan 23 14:25:10 glamb-n900 activesync[1804]: CurlConnectionManager: sendReceive attempt 1: CancelErr=0
Jan 23 14:25:10 glamb-n900 activesync[1804]: HTTP REQUEST headers:
Jan 23 14:25:10 glamb-n900 activesync[1804]: User-Agent: N900/1.1
Jan 23 14:25:10 glamb-n900 activesync[1804]: Host: mas01.webmd.net
Jan 23 14:25:10 glamb-n900 activesync[1804]: Connection: Keep-Alive
Jan 23 14:25:10 glamb-n900 activesync[1804]: Authorization: <skipped>
Jan 23 14:25:10 glamb-n900 activesync[1804]: MS-ASProtocolVersion: 2.5
Jan 23 14:25:10 glamb-n900 activesync[1804]: Content-Type: application/vnd.ms-sync.wbxml
Jan 23 14:25:10 glamb-n900 activesync[1804]: Content-Length: 13
Jan 23 14:25:10 glamb-n900 activesync[1804]: HTTP STATUS: 403

I presume it's another device security check.
HTTP 403 error is authorization error.
This is the same error I am getting when trying to use N900.

The company I work for uses client certificates for WinMo devices. When I setup initial sync with ActiveSync I need to enroll and get personal certificate in ActiveSync. This certificate is stored on WinMo device and used to authenticate the device to Exchange server. Check with your IT whether they will generate this cert for you.

Vitaly, (or anyone) could you please tell us if MfE supports authentication with client certificate?
 
Posts: 2 | Thanked: 0 times | Joined on Jan 2010
#1038
Originally Posted by vitaly_repin View Post
Could you file a bug and attach logs to the bug?


The procedure to take logs is described here: http://talk.maemo.org/showpost.php?p...&postcount=228

Thank you in advance.
Hi, i have the same problem. I added a log under bug 6467

Br. Patrik
 
Posts: 2 | Thanked: 0 times | Joined on Jan 2010
#1039
Originally Posted by vitaly_repin View Post
Point is taken.

Just small comment. N900 does not have java and MMS inside. Nobody cares.
N900 has MfE inside. With limited functionality (compared with other Nokia phones). Everybody cares.

Don't take this comment as an attempt to defense. Just side comment.
Oh I care, a lot!
Lack of Java, I can live with that. MMS support is more important for me, i'm in the business of providing sms/mms services for daily newspapers and MMS is a good source of getting UGC for newspapers.
 
Posts: 310 | Thanked: 383 times | Joined on Jan 2010
#1040
Originally Posted by 0xDEADBEEF View Post
HTTP 403 error is authorization error.
This is the same error I am getting when trying to use N900.

The company I work for uses client certificates for WinMo devices. When I setup initial sync with ActiveSync I need to enroll and get personal certificate in ActiveSync. This certificate is stored on WinMo device and used to authenticate the device to Exchange server. Check with your IT whether they will generate this cert for you.

Vitaly, (or anyone) could you please tell us if MfE supports authentication with client certificate?
Well, I don't remember enrolling my WinMO device, but maybe they changed the policy or something.

I still have my old phone... anyone know if it's possible to retrieve old certs from it?
 
Reply

Tags
activesync, certificate, email, exchange, fremantle, ignore tex14, maemo 5, mail for exchange, mfe, n900, provisioning, sync, thanks vitaly!

Thread Tools

 
Forum Jump


All times are GMT. The time now is 22:33.