ActiveSync

[cava83]

Server 2003 Standard
Exchange

Windows mobiles were syncing perfectly yesterday, not problem.

Trying to sync today, no luck, Looping then cancels.

When device is plugged via USB and I use ActiveSync I get an error message which states the following.

The security certificate on the server is invalid. Contact your sever exchange administrator or ISP to install a valid certificate on the server.

Support code:0×80072F0D

(
ActiveSync 4.5 error 0×80072F0D Invalid Certificate with Exchange 2003
)
------------------------------------

Did a restore from a couple of weeks ago (IIS) same problem.

Looked on google, stating I need to put CAB files with own root certs, but surely I should not need to do that if it was ok.

Only thing I can spot is that the server did some MS updates last night :s

Any thoughts?

Oh and it works perfectly with the iphone.

 

[Lee]

What did you restore? Your exchange server?

Are you using SSL?

Download SSLChainsaver if you are, and see which Certs are being used by your exchange server, then compare them to the ones being used on your mobile device.

 

[cava83]

restored IIS.

SSL yes.

Will do, thanks for your input, it's annoying me now.

 

[Lee]

Check the security set in IIS. It's an odd one as you can't enable SSL on part of it or it won't authenticate.

The default website should have SSL enabled, but you should disable it from your OMA site. It should be enabled for everything else.

SSLChainsaver will export the certs for you and allow you to drop them onto your mobile device without all the crap of regenerating them.

How are you getting your certs? Are they generated by a proper certificate authority or are you doing it yourself?

 

[cava83]

They were done by the previous employee. Not done via a proper certificate authority.

This is so annoying.

By following your method, I have to install it on all the devices, but surely this is not the only solution as they would have had the certificates in the first place installed on the handsets.

Thank you for your help, really appreciated.

 

[Daz]

Certificates expire though...

So it's possible that they all stopped working at the same time.

 

[Lee]

They were done by the previous employee. Not done via a proper certificate authority.

This is so annoying.

By following your method, I have to install it on all the devices, but surely this is not the only solution as they would have had the certificates in the first place installed on the handsets.

Thank you for your help, really appreciated.

Yup, that's the whole point of them. To prevent those without them from gaining access. Use SSLChainsaver to save the certs out, view the expirey date on them, if they're okay copy them onto your device. If it still doesn't work it could be a permisions thing in IIS.

 

[Mike_182]

Certs have expired mate.

 

[Daz]

Certificates expire though...

So it's possible that they all stopped working at the same time.

Certs have expired mate.

Catch up mate

 

[Longy]

I reckon the certificates have expired tbh!

 

[cava83]

2011.......

Not expired.

Must be permissions somewhere.

Tried applying the certs on the handset but it's not accepting the CAB files.

 

[Mike_182]

Are they self-issued? Have you checked the certification path?

 

[Daz]

Is that the certificate or the root certificate? (2011)

 

[Woodentop]

2011.......

Not expired.

Must be permissions somewhere.

Tried applying the certs on the handset but it's not accepting the CAB files.

CAB files? When i installed the certificates on my devices i exported the certificate from the server and just double clicked it on the devices.

 

[rctempire]

If you have configured a self signed CA then what you need to do is ensure that the device you are syncing trusts the certification path.
To do this, go to the CA server and open IE. Go to http://localhost/certsrv
Next click Download a CA certificate, certificate chain, or CRL
Then click Download the CA certificate and save the cert.
Now copy the cert to your device using activesync
Then on the device locate the cert using file explorer and open it. This will import it into the trusted CA store on the device and you should then be able to sync (asuming everything else is working fine)

One this to note; depending on which device you are using the device may be locked to prevent installations. This also stops certs being installed. This is particularly a problem for mobile smartphone type devices on certain networks. PDA type devices are usually fine. If you get an error installing the cert on the device this is likely why. At that point then the easiest thing to do is to get a verisign or maybe Godaddy cert.

Let me know how you get on

This could help. Found on tinernet.

Do you have a WM device that can sync to exchange via the GPRS/3G network at all? Turn SSL OFF on the device and OFF in the default website.

 

[Daz]

Don't turn SSL off. Get it working with the certificates

 

[cava83]

They are self certs I believe.

One runs out on 2011 and the other 19/09/2008 issued by CA.

I normally have just previously used Thawte, but this is being a pain.

So annoying.

It's so strange how it's happening now.

Don't really want to turn SSL off

I love finding solutions to problems but not when it's at peoples expense.

Ok, on the default website, I go to view certificate and ity shows the assigned one, date is 19/09/2008.

What more info do you need guys ??

I will send you money for a crate of beers or something

 

[cava83]

Ok, what a pain in the ass.

Right it was a combination of two things.

I created an extra virtual directory as I started scripting some stuff on ASP.NET, apparently IIS Active Sync has an issue with this, god knows why.

Second of all, I resetted the virtual directory.

http://support.microsoft.com/kb/883380/en-us

And now it's syncing.

What a pain in the ass.

Thanks for all your help and advice.

Gabi.

 

[Daz]

Ah, you see.. you didn't mention you'd changed something yourself

 

[Lee]

We ended up doing that, creating a new virtual directory in IIS.

If it works first time it's a peach, if it doesn't you'll waste a day or 2 getting it working.

 

[cava83]

Creating a virtual directory :s

Bless did not ever think it could cause any of this, seems crazy

At least it's sorted.

Ah, you see.. you didn't mention you'd changed something yourself

 

[Daz]

Try doing *anything* in IIS with Exchange 2007 stuff..

It's even worse.