Exchange Server Cookbook

8.18. Installing a Root Certificate for Use with EAS

Problem

You want to install a root certificate on a portable device for Exchange ActiveSync users.

Solution

Using a graphical user interface

1. Download the Smartphone Add Certificate utility (SmartphoneAddCert.exe) from the Microsoft Download Center (http://www.microsoft.com/downloads/details.aspx?FamilyID=9f812d36-ee54-48cb-9703-7619b1a9e1ad), then extract its contents to a folder.

2. Copy the extracted executable SpAddCert.exe to the smartphone's "Accessories" directory:

   • for Smartphone 2003, use \Storage\Windows\Start Menu\Accessories

   • for Smartphone 2002, \IPSM\Windows\Start Menu\Accessories

3. Export the root certificate as a DER-encoded binary X.509 file; save the exported file as filename.cer.

4. Copy filename.cer to the smartphone's root storage directory: \Storage for Smartphone 2003 or \IPSM for Smartphone 2002.

5. On the smartphone, select Start→ Accessories→ SPAddCert.

6. Select your certificate from the list of available certificates and click OK.

7. Verify the certificate details and click OK. Click OK when you are asked if you are sure you want to add the certificate.

Discussion

Windows Mobile 2002 and 2003 smartphones ship with root certificates installed for the major certification authorities, but many enterprises wish to issue their own root certificates for use with Exchange ActiveSync, VPN, or web services. Microsoft has made the Smartphone Add Certificate Utility available to allow users to add this root certificate authority to the device's ...