SSL - CERT for using mobile phone IMAP Access

[Oswald-Kolle]

Hello everybody,

I want to access my Zimbra-Mailserver with a mobile phone and get an error message like "SSL certificate not supported" - I found out, that I have to download and install the certificate on the mobile...

Now my question: What do I have to do to access the certificate on my server? Where can I download and install it on to my phone? Does any one here had the same question/problem? (haven't found anything for this in the forum)

Hopy you could help...

Regards,
Mario

[Klug]

Are you using the default certificate created by Zimbra or a paid certificate ?

If first case, this is normal and standard behaviour : your phone (just like your browser) does not know who signed the certificate and does not want of it...

Your browser just complains (and is able to "learn" the certificate), your phone seems to reject it unless you force him to "learn".
My phone (Nokia 9300) complains, but I can use the certificate (after the complaint).

[Oswald-Kolle]

Originally Posted by Klug

Are you using the default certificate created by Zimbra or a paid certificate ?

If first case, this is normal and standard behaviour : your phone (just like your browser) does not know who signed the certificate and does not want of it...

Your browser just complains (and is able to "learn" the certificate), your phone seems to reject it unless you force him to "learn".
My phone (Nokia 9300) complains, but I can use the certificate (after the complaint).

I am using the default certificate created by Zimbra...
Sure - I have to tell my mobile that the certificate is okay like in a web-browser - but how do I get the certificate to my mobile? What is the "web adress" to it? or do I have to copy it "by hand" to a http-accessible page on the server? Which file is needed there?

My SE W800i isn't able to run with a "not verified" certificate - it stopps connecting after the complaint... But as I said - I might be able to "download" the certifiacte and "register" it in my mobile (some kind of "adding to trusted sites" I think...)

[Oswald-Kolle]

Hey guys,

I still have problems with my mobile phone...
I tried this to convert the certificate

openssl x509 -in ca.pem -inform PEM -out ca.cer -outform DER

So that my mobile will accept the format - I got an O.K. from the phone that the certificate is accepted, but I can still not log in with IMAP...

Can anyone tell me what I am doing wrong?!?!

I used the .pem file from the folders:
/opt/zimbra/ssl/ssl/ca/ca.pem
and
/opt/zimbra/conf/ca/ca.pem

both without success... :-(

I hope anyone of you could help me??

[jholder]

Have you looked at your logs to see if there is anything in there?
=

[jdell]

Originally Posted by Oswald-Kolle

I still have problems with my mobile phone...
I tried this to convert the certificate

openssl x509 -in ca.pem -inform PEM -out ca.cer -outform DER

So that my mobile will accept the format - I got an O.K. from the phone that the certificate is accepted, but I can still not log in with IMAP...

I used the .pem file from the folders:
/opt/zimbra/ssl/ssl/ca/ca.pem
and
/opt/zimbra/conf/ca/ca.pem

Those 2 ca.pem files *should* be identical, if they are NOT, then you need to see this page: http://wiki.zimbra.com/index.php?tit...icate_Problems

If that is all good, then have a look at this page: http://wiki.zimbra.com/index.php?title=Nokia_E62 that got my cert imported into my Nokia E62. The syntax I used to convert to DER format is only different from your syntax in the file extension, don't know if that makes a difference to Nokia's.

[Oswald-Kolle]

Originally Posted by jdell

Those 2 ca.pem files *should* be identical, if they are NOT, then you need to see this page: http://wiki.zimbra.com/index.php?tit...icate_Problems

If that is all good, then have a look at this page: http://wiki.zimbra.com/index.php?title=Nokia_E62 that got my cert imported into my Nokia E62. The syntax I used to convert to DER format is only different from your syntax in the file extension, don't know if that makes a difference to Nokia's.

I tried the way described in your URL but my SonyEricsson W800i only accepts *.CER files - so it still doesn't work....

Isn't there any other way to get it work with my Sony mobile phone? :-(

[bradn]

For SE phones convert the cert to DER format, but make sure you use a .cer extension.

openssl x509 -outform der -in ca.pem -out ca.cer

Just transfer the file to your phone using bluetooth and you'll get a confirmation dialog asking if you want to accept the cert. To conform it worked got to General Settings->Security->Certificates->Trusted Certificates and make sure it's listed.

I have a W880i and can receive IMAP securely. Still working on sending securely after self-signed cert download - phone still saying "TTL/SSL server certificate not authorized by known authority"

[Oswald-Kolle]

Originally Posted by bradn

phone still saying "TTL/SSL server certificate not authorized by known authority"

Well - thats true, but the W800i stops receiving mails after that message - seems like a problem with my firmware...
So I have to receive Mails without SSL :-(