Originally Posted by luh3418

I checked my folders and there was no directory /home/user/.activesync/certs so I created one. I looked in /home/user/.maemosec-certs/ssl-ca/ and there were no certs. Could only find certs in /etc/certs/common-ca as .pem files

I tried smlink from /etc/certs/common-ca to /home/user/.activesync/certs but this did not work.

Originally Posted by luh3418

I have tried importing the cert as a .p7b file and saving it in /home/user/.activesync/certs and this did not work.

Originally Posted by Rob1n

That's because the underlying issue for this was fixed in PR1.1, so does absolutely nothing now.



That's presumably because the certificate is not a CA certificate. See http://wiki.maemo.org/Mail_For_Excha...rtbeat_and_FAQ for suggestions & debugging details.

Originally Posted by luh3418

Thanks. Yes you are quite right it is not a CA cert :-(

I tried debugging but could not work out:
a- how to find which .pem file I was looking for. Looked at the SHA numbers etc and could not see a match
b- even if 'a' no idea what to edit the file to say.

Originally Posted by luh3418

Will this all be a non issue with pr.1.2?

Originally Posted by Rob1n

You can't edit the files - they're encrypted & signed to prevent that. If it's a self-signed certificate then you'll need to get a new one made with the CA flag set. If it's not a self-signed certificate then you'll need to load the certificate for the issuing CA instead.


I've not heard of any changes to this in PR1.2.

Originally Posted by luh3418

Re my certificate problem: I saved the certificate as a p7b then email it to my N900 and open it in certificate manager. All good. It is not self signed. The issuing CA is Equifax and it is issued to "*sol.net.au"

How then do I "load the certificate for the issuing CA instead."

After opening it in certificate manager when I look at all my certificates in Settings > Certificate Manager it is not there.

Sorry for dullardedness but SSL is not my forte.

Originally Posted by Rob1n

There's several ways to do this. The easiest is probably to use Firefox on your desktop - open the URL you use for MfE. Click in the URL bar (on the left hand side, where it gives the domain for the SSL certificate). It should pop up a window detailing the security status - click on the "More Information" button, the click on the "View Certificate" button. Go to the details tab - it should show the certificate hierarchy. You can then select any of the certificates in the hierarchy and export them to PEM files (which can then be loaded on the N900).

You can do the same thing with IE if you prefer that (in IE7, you click on the padlock to the right of the URL bar to get to the certificates, not sure about IE8 though).

Originally Posted by luh3418

Thanks again your patience is appreciated. I found the cert hierarchy as you explained and actually imported and converted all 2 certificates. One was the same as before and did not load in the certificate manager but was read. The other one loaded and I saved it for server email etc but when I tried to install credentials for Mfe I still get the invalid server message :-(

I had a look in firefox certificate manager and in "other" tab I found a certificate that was from Equifax to the exchange/zimbra server. I imported it converted to p7b and then when I tried to load it in n900 cert manager it said the certificate date was invalid/ expired which indeed it was.

Could that be the right certificate and the problem? I recall in firefox the first time I had to validate that cert it asked me if I would ignore the expiry date. Could n900 manager not be able to do this perhaps? I have asked our IT people to issue a new unexpired certificate.

Originally Posted by RoRoD

Hi I'm currently facing another strange Issue with Exchange 2007 and N900 :

I'm using a certificate authority im my domain to generate a self signed CA certificate.

then i generate a new certificate for my exchange 2007 server.
It's installed Ok.
then i export it from IIS 6 server in PFX format, i ca import it on my N900 device (i show 2 certificates chained, the CA one and the WebServer (exchange2007/IIS) One.
I installed both selecting E-Mail and Server, they are visible in the certificate Manager.

i tested them folowing step here :http://wiki.maemo.org/Mail_For_Excha..._certificates:

cmcli -T common-ca -v <your-server-dns-name-or-ip-address>:<port-number>
issues with an error "Verification failed : unable to get local issuer certificate

witch is logical, as this is a self signed one.

then
cmcli -t ssl-ca -v <your-server-dns-name-or-ip-address>:<port-number>

replies something like this :

0115e5345e4dd64855ed1e3d44060be25f26c2e6 MYDOMAIN
trust chain(2):
b5567d6c9eef05f07966d98eb2a85716bff4e80d MYDOMAIN
Verified OK


and cmcli -T common-ca -t ssl-ca -v <your-server-dns-name-or-ip-address>:<port-number>

replies something like this :
0115e5345e4dd64855ed1e3d44060be25f26c2e6 MYDOMAIN
trust chain(2):
b5567d6c9eef05f07966d98eb2a85716bff4e80d MYDOMAIN
+-> 0115e5345e4dd64855ed1e3d44060be25f26c2e6 MYDOMAIN
Verified OK


but i'm currently unable to sync my exchange 2007 account, i've got the same error from my device "Either exchange server requires a secure connection or your account is disabled". "


Am I doing something wrong ?