Introducing the SslChainSaver

Windows Mobile Team Blog : How to add your own root cert via CAB file

Windows Mobile Team Blog : How to add your own root cert via CAB file — Fri, 11 Aug 2006 20:02:39 GMT

PingBack from http://blogs.msdn.com/windowsmobile/archive/2006/01/28/making_a_root_cert_cab_file.aspx

re: Introducing the SslChainSaver

Jay — Thu, 17 Aug 2006 06:30:12 GMT

Thanks Scott, this is great!

re: Introducing the SslChainSaver

Tukker Tom — Thu, 24 Aug 2006 18:22:34 GMT

Unfortunate I have no trouble with adding a SSL certificate for Exchange Server synchronization. I do have a problem with the following, maybe you can also shine your light on this:

I have a E-mail certificate that authenticates my E-mail adres. When I use this certificate on an Outlook client all works well. When using this certificate on my Qtek 9100 device it doesn’t…. Can you give a hint/tip ?

In my Outlook client I did the following:
Tools>Options>Security Tab>Get A digital ID button
This links to the following page
http://office.microsoft.com/en-us/marketplace/EY010504841033.aspx
There is a certificate authority which gives free personal usage
certificates to sign messages :
http://www.comodogroup.com/products/certificate_services/email_certif...
I got on of those certificates and used it in my Outlook 2003 client. It
works OK! Now I want to sue that same certificate on my Windows Mobile 5
device.

Windows Mobile 5 I do the following:
Messages>New>Enter a e-mail adres sin the to field
I press Menu and choose Message Options
I enable Sign Message
I eneter a Subject and a Body
I press Send
ERROR : "The message cannot be signed because you do not have a certificate
for sending signed e-mail. Insert a smart card with the certificate."
Well I tried to import the certificate, this doesn't work.
Please Advise? Anybody luck with installing free certificates to sign you
E-mail message?

Best Regards Tom from Holland

re: Introducing the SslChainSaver

Simon Jackson — Fri, 25 Aug 2006 09:31:51 GMT

The tool sounds great. Can it help me discover why my user certificate is erased from the device sometimes when I am running EAS via ISA server with constrained delegation?

I have been told that this a known bug? Why would my legit cert get erased from my device?

Thanks,
Sam.

re: Introducing the SslChainSaver

Pocket — Thu, 31 Aug 2006 11:25:25 GMT

Nice tool. Thanks!

SSLChainSaver.exe - Application Error

Chris Lakey — Tue, 05 Sep 2006 05:34:34 GMT

Perhaps I am trying to run the program incorrectly?

If I extract the compressed downloaded file, there is the /bin/ directory. If I open a command window, navigate to this directory and run 'sslchainsaver webmail.mydomain.com.au' I get the following Error:
The application failed to initialize properly (0xc0000135). Click OK to terminate the application.

I get the same error if I supply no arguments to sslchainsaver.

I am running this from my workstation XP Pro SP2..
(Am I meant to run from mailserver??)

Thanks.

re: Introducing the SslChainSaver

Scott Yost — Tue, 05 Sep 2006 06:19:44 GMT

Chris - it does require the .NET Framework 2.0. Do you have that installed on the workstation?

re: Introducing the SslChainSaver

Justin Millner — Mon, 11 Sep 2006 14:59:43 GMT

Great bit of code, works a treat. Justin - Thanks

re: Introducing the SslChainSaver

Jonathan — Tue, 12 Sep 2006 23:04:09 GMT

What is rapiconfig and how does it work?

re: Introducing the SslChainSaver

Christian Bachtrögl — Mon, 09 Oct 2006 10:02:20 GMT

finally i manged to sync wm5 with exchange2003 over ssl!

Great App!

re: Introducing the SslChainSaver

Charles Miller — Tue, 10 Oct 2006 20:28:28 GMT

Thank you so much. I have two Verizon Treo 700w that I needed to get setup and have spent three full days researching how to get our self-signed certs to install. Once I found and installed your tool, the problem was fixed in minutes. Nice job and thank you once agin.

re: Introducing the SslChainSaver

Craig Shaffer — Tue, 17 Oct 2006 00:08:04 GMT

I am unsuccessfuly trying to get an intermediate certificate on the Motorola Q.

I have created the XML file now and have made a CAB file from it, but when I try to run the CAB on my Motorola Q, I get

"Installatoin of xxxxxx.cab was unccessful. The installation file is not intended for this device"

Anyone else had this problem? Shed some light to the blind?

Please email cshaffer1 at hines dot com with any love...

re: Introducing the SslChainSaver

Brad — Thu, 02 Nov 2006 19:42:33 GMT

Can you give me a step by step procedure of how to use this tool? I am confused. I have downloaded it and when i try tunning the SSL Chain Server program (i installed netframework 2.0) nothing happens. What am i not doing?

re: Introducing the SslChainSaver

Brad — Sun, 05 Nov 2006 01:26:43 GMT

Okay. So i figured this out on my own. Great tool. Worked really well but for a novice, this is more difficult than running a program. For anyone else that finds this page, this tool should correct your syncing problems with an exchange server without problem!!

Follow these directions

Besides this software you will need the following:

-Windows Mobile 5.0 Smartphone SDK (downloadable through MSDN)

-Visual Studio 5.0 or higher (MSDN had a free trial as of 11/4/2006)

- NetFrame Work 2.0 (you should be able to get this from the Visual Studio 5.0 download, if not download it from microsoft)

Once everything is downloaded and installed you will need to follow these instructions:

Open the command prompt and navigate to the folder which has the SSLChainsaver. In this example the folder is in the C: drive and named "test"

C:\Test\bin\release by typing cd C:\Test\bin\release

4) Type sslchainsaver mail.yourdomain.com

5) All the certificates (root and intermediate) are extracted to a folder under C:\Test\bin\release named mail.yourdomain.com

6) Copy all the certificates to your device

7) Install them one by one on the device by tapping on them in the same order as listed on the actual certificate from File Explorer

re: Introducing the SslChainSaver

Scott Yost — Mon, 06 Nov 2006 02:55:15 GMT

Unfortunately the process is more complicated on some devices - for those devices where certinst won't work out of the box, you'll have to use the CAB method linked from the post.

re: Introducing the SslChainSaver

Doug Steinschneider — Wed, 22 Nov 2006 03:43:40 GMT

I'm posting here to explain how this tool worked for me and hopefully to learn more about certificates. I started with SBS 2003 SP1. It came from the Action Pack that shipped just before the October one that included the SBS 2003 R2 DVD. I applied Exchange SP2 and the AKU2 firmware update to my Verizon XV6700. I then ran CEICW and it walked me though creating the cert. I confess that I don't remember which guide I then followed to get the cert installed on the phone but I got it installed and it worked fine with Direct Push until I upgraded the SBS 2003 to R2. This involved installing the premium technogies cd's which are essentially SQL 2005 WGE and ISA 2004. I only installed the SQL upgrade and then upgraded my companyweb to ASP.Net 2. I also uninstalled Sharepoint MSDE instance and installed a 3rd instance of SQL 2005 and upgraded SharePoint to that instance. During those steps I somehow invalidated my CA. It was then pretty easy to figure out how to re-run CEICW and get OWA running again with a new cert (removed old one first). At this point I tried copying the sbscert.cer over to the phone and using SpAddCert.exe to import the cert but that didn't work. I then found this thread and ran sslchainsaver and the resulting root.cer file worked with SpAddCert on the phone and I'm now back online with Direct Push. Many thanks for creating this tool!

re: Introducing the SslChainSaver

Scott Yost — Wed, 22 Nov 2006 06:10:27 GMT

note to self - I've found two conditions that will cause a failure to sync that the SSLChainSaver tool won't detect.

1) - The hostname you're connecting to doesn't match the hostname in the certificate. Activesync won't ever make a SSL connection in these circumstances.

2) The server only sends down a partial chain AND doesn't send the AIA link to get the rest of the chain, so Windows can't even reconstruct the certificate chain. In this case, the tool won't have the root cert to put in the output XML. In this case you really have to fix the server, or somehow get a copy of the root certificate out-of-band.

Both of these can be detected at runtime by the tool, so in the future I'd like to make that improvement.

re: Introducing the SslChainSaver

Kirby Marshall — Thu, 30 Nov 2006 07:19:02 GMT

Get error: "Connection refused: The target machine active refused it". Mail.domain.com is host name on RHEL AS server. No firewall.

Any ideas?

Cheers

Kirby

re: Introducing the SslChainSaver

Karoly — Sat, 13 Jan 2007 03:22:29 GMT

First I could not install the cab file that SSLChainSaver generated, I got an error message that installation was unsuccesful.

After some playing around, I changed the "xwri = new XmlTextWriter(filename, Encoding.UTF8);" line to "xwri = new XmlTextWriter(filename, Encoding.ASCII);", recomplied it and now I can install the cab files. I am pretty surprised that nobody had this problem before.

Also, is there a way to create cab files that can be installed on PPC 2003 as well?

Thanks

re: Introducing the SslChainSaver

Scott Yost — Sun, 14 Jan 2007 02:59:18 GMT

Hi Karoly,

Good catch! Are you using this against 2003 devices? WM5 supports UTF8 XML on both platforms so I'd expect it to work on a WM5 device.

I'm not entirely sure how much XML cab support there was in PPC 2003. What happens if you rename the cab to CPF when you install it on the PPC 2003 device?

re: Introducing the SslChainSaver

Karoly — Wed, 17 Jan 2007 02:40:39 GMT

Scott,

Thanks for your reply. It was a WM5 device (a T-Mobile MDA) that gave me the error message about unsuccesful installation. So I guess WM5 does not support UTF8 XML...

My other device, an iPAQ with PPC2003 on it gives a different error message: "rootcert.cab is not a valid Windows CE Setup file". If I rename the cab to CPF and try to install it, it simply gets deleted without having the certificates installed.

re: Introducing the SslChainSaver

Scott Yost — Fri, 02 Feb 2007 00:29:51 GMT

I think the most compatible thing to do here is change the encoding to ASCII. I'll try to do that in a future update.

re: Introducing the SslChainSaver

Garth — Thu, 08 Feb 2007 23:02:16 GMT

When would the next release coming out? and is there a way to accomplish the same task without it? I am having the same ASCII problem.

re: Introducing the SslChainSaver

Scott Yost — Fri, 09 Feb 2007 01:08:10 GMT

I have the changes mostly written. I would estimate sometime in the next few weeks. In the meantime, you could either fix it and recompile it, or open the XML that it generates in notepad and resave it as ASCII instead of UTF-8.

Zimra

Informatica Bergamo — Fri, 23 Mar 2007 01:57:19 GMT

I have some proble using it on a Zimbra server... I'll try again.

re: Introducing the SslChainSaver

EJ — Thu, 05 Apr 2007 05:56:37 GMT

I used the tool to generate the XML and then followed the directions on creating the CAB file from it. But when I execute this CAB from my Samsung i730 I just get the error message "Installation of rootcert.cab was unsuccessful." Do you know if this has worked on this model of phone before?

Thanks!

Erik

re: Introducing the SslChainSaver

Scott Yost — Tue, 10 Apr 2007 02:34:32 GMT

So I said "a few weeks" above but it's going to be quite a bit longer. Gotdotnet is going away so I need to find a new home, and there's a lot of paperwork involved in doing that.

re: Introducing the SslChainSaver

FMF — Mon, 16 Apr 2007 16:16:46 GMT

Awesome tool, thanks. It worked with wm5 and moto q, ran the sslchain got 2 certs put it on the device and installed. Great work!

re: Introducing the SslChainSaver

James — Mon, 16 Apr 2007 22:37:39 GMT

Tried this and got the error:

Chain contained 3 certificates

Needed 2 certs from the server but got 1

You must install the intermediate certs onto the device.

I have the root and intermediate certs installed. Any thoughts?

Only have one cert installed on this box

Manager IT

Anandh Sharma — Mon, 30 Apr 2007 14:48:00 GMT

Need to convert certificate file to cab to install on WIndows mobile device

re: Introducing the SslChainSaver

dfletch — Thu, 10 May 2007 10:02:38 GMT

The link to the source code and binary is broken.

re: Introducing the SslChainSaver

Scott Yost — Thu, 10 May 2007 10:23:12 GMT

thanks - I've updated the link

re: Introducing the SslChainSaver

Brett — Fri, 18 May 2007 16:46:56 GMT

The link to the source code and binary is broken again :( This has been phased out by Micro$oft.

Would you have another link/source?

re: Introducing the SslChainSaver

Scott Yost — Sat, 19 May 2007 23:58:09 GMT

The link is still working for me. Are you still seeing it as broken?

re: Introducing the SslChainSaver

Currey — Thu, 24 May 2007 16:55:19 GMT

I get this error message...

Connect failed: A connection attempt failed because the connected party did not

properly respond after a period of time, or established connection failed becaus

e connected host has failed to respond

What would cause this?

re: Introducing the SslChainSaver

Scott Yost — Thu, 24 May 2007 17:47:17 GMT

I'd guess either the site you're trying to connect to is down, or an outbound firewall on your machine (like OneCare) is blocking the connection outwards.

Passing down certificate chain

Jason — Sat, 26 May 2007 10:37:15 GMT

Hi,

You mentioned as one of the conditions the tool doesn't work is that..

"2) The server only sends down a partial chain AND doesn't send the AIA link to get the rest of the chain, so Windows can't even reconstruct the certificate chain. In this case, the tool won't have the root cert to put in the output XML. In this case you really have to fix the server, or somehow get a copy of the root certificate out-of-band."

Is there any easy way of configuring the server to make sure it passes down the full chain? Been looking for that for a while, and its annoying having to install the full chain on the mobiles.

re: Introducing the SslChainSaver

Scott Yost — Sat, 26 May 2007 22:47:38 GMT

Good question, Jason.

I'm not really an expert on web servers. The one thing that I have found to work with IIS is to make sure that the machine that is terminating the connection has each certificate installed on it. Sometimes that machine has only the server cert and not the intermediates and root - in that case it definitely won't send all the necessary certificates during the handshake.

Scott

re: Introducing the SslChainSaver

Craig — Tue, 31 Jul 2007 05:57:58 GMT

Any idea where I might be able to get the sslchainsaver tool from today? I'm having a bear of a time for a large enterprise mobile project - but I'm having trouble with the certs. I think the entire chain isn't getting sent properly - and this tool would be able to help me identify what's missing

re: Introducing the SslChainSaver

Andrew — Thu, 16 Aug 2007 17:02:55 GMT

The link is down (i.e. gotdotnet is closed for business). I am not sure that this tool is what I am looking for, but I thought I would mention it.

I set up my HTC Trinity (Dopod D810) to download emails from my company Exchange server (webex.companyname.com), which has been working fine, but recently it stopped, telling me that the server security certificate had expired and gave me the error 0x80072F05. I vaguely remember having had some issue with certificates when I first set the link up, but I can't remember what it was. There is no need to answer this posting - I shall be checking with our IT guys tomorrow - but I thought I would mention the issue.

Gotdotnet is gone!

Barry — Mon, 20 Aug 2007 10:45:14 GMT

Can we download sslchainserver from anywhere else?

thanks!

re: Introducing the SslChainSaver - Download Here

Shawn — Sun, 26 Aug 2007 08:13:07 GMT

I found it here:

http://files.zimbra.com/downloads/SslChainSaver.exe

Errr When Running SslChainSaver

Charlie — Wed, 03 Oct 2007 15:48:09 GMT

Running the program as a domain administrator returns this error.

SSLChainSaver>sslchainsaver mail.mycompany.com

Unexpected failure: Request for the permission of type 'System.Net.DnsPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

re: Introducing the SslChainSaver

Scott Yost — Wed, 03 Oct 2007 21:54:55 GMT

I haven't seen that before. Are you running the tool off of a network share by any chance?

Certificate problems with Windows Mobile and Active Sync

Wictor Wilen — Mon, 08 Oct 2007 19:52:44 GMT

Certificate problems with Windows Mobile and Active Sync seems to be a pretty common cause of not being able to synchronize you mobile phone with Microsoft Exchange, but despite the number of web pag...

re: Introducing the SslChainSaver

Evil Craig — Mon, 29 Oct 2007 18:59:18 GMT

The download page has gone. Boo Hoo. Any luck trying to find an alternate download source for this?

re: Introducing the SslChainSaver

Ernesto — Wed, 14 Nov 2007 19:02:17 GMT

please can someone upload this tool again?

re: Introducing the SslChainSaver

Richard — Tue, 27 Nov 2007 15:03:35 GMT

Looking for this file as well please!

re: Introducing the SslChainSaver

Bill — Wed, 19 Dec 2007 22:36:35 GMT

With regard to not getting the entire chain from a server: I have found when publishing an SSL site with ISA Server 2006 that you need to ensure the root cert for your site is in the local computer root store, and that the intermediate is in the intermediate store. If the certs are not in their proper places then the chain is sometimes not fully exposed. I am not sure if native IIS has this behavior as well, but it is worth a shot.

re: Introducing the SslChainSaver

Scott Yost — Wed, 19 Dec 2007 23:48:28 GMT

Thanks for the tip, Bill. That matches my experience as well.

re: Introducing the SslChainSaver

Brian — Fri, 28 Dec 2007 19:17:17 GMT

Can someone please tell me where to download this?

I tried here but it gets to 20% and dies

http://wiki.zimbra.com/index.php?title=Moble_Device_Setup

Thanks

re: Introducing the SslChainSaver

Brandon — Thu, 14 Feb 2008 19:14:11 GMT

when i extracted the certs from sslchainsaver it only gave me a root.cer and no intermediate.

I installed the root.cer on my Samsung SCH-i760 and now I received the error 0x80072F06.

What else do I need to do?

I used sslchainsaver from my user login on the network. Should I be logged in as admin?

Thanks,

Brandon

re: Introducing the SslChainSaver

Scott Yost — Thu, 14 Feb 2008 19:20:30 GMT

That error usually means that the site's name doesn't match the name on the certificate. Is there an OWA web page that you can connect to via IE or Firefox? See if one of those browsers is able to make a secure connection to the site. If not, then the server might be slightly misconfigured.

re: Introducing the SslChainSaver

Brandon — Thu, 14 Feb 2008 19:45:05 GMT

Scott,

Thank you for your prompt reply. I just noticed that our OWA is NOT currently https so I am getting that fixed right now and then I will go from there.

Thanks,

Brandon

SSLChainSaver v2 released

Windows Mobile Team Blog — Sun, 18 May 2008 23:13:38 GMT

Two years ago I released the first version of the SSLChainSaver tool. This tool helps you diagnose and

re: Introducing the SslChainSaver

Charles — Tue, 03 Jun 2008 21:58:02 GMT

Hey Scott.. I have a site called

https://webmail.intelllisyn.com

self assigned cert... downloaded and installed... I still can't get ehre.. any ideas?

step by step ?

I'll try and grab the error code

re: Introducing the SslChainSaver

Scott Yost — Wed, 04 Jun 2008 02:01:11 GMT

Hey Charles, I looked at it quickly and it looks okay. The only thing that stuck out is that you have five different CNs in the subject. I'm not sure off the top of my head if that is legal or not.

re: Introducing the SslChainSaver

TKS — Thu, 12 Jun 2008 03:26:35 GMT

Hi sslchainsaver down loaded 2 certificates. It also gave the following error:

"We were unable to find a self-signed root certificate. The server must send the root certificate during the SSL handshake. Windowsmobile device will not be able to connect through Activesync'.

I installed the 2 certificates on my blackjack II and now I am able to access the OWA site through IE. But, activesync is still failing with the error 'The security certificate on the server is not valid' code: 0x80072F0D. Is there anything else that I need to do?

re: Introducing the SslChainSaver

Scott Yost — Fri, 01 Aug 2008 20:16:32 GMT

Rapiconfig comes in the windows mobile SDK.

re: Introducing the SslChainSaver

Grateful — Wed, 24 Sep 2008 09:02:39 GMT

Thank you so much for this program! You saved my job :o)

re: Introducing the SslChainSaver

Challenged_user — Fri, 13 Mar 2009 04:50:59 GMT

The put in link only shows one how to create a CAB file, not how to install it.

re: Introducing the SslChainSaver

EricN — Fri, 13 Mar 2009 19:54:26 GMT

Transfer the CAB file to your device and click on it in the File Explorer. This article may be helpful as well:

http://www.pocketpccentral.net/help/tutorials/install_cab_file.htm