SSLChainSaver v2 released

Windows Mobile Team Blog : Introducing the SslChainSaver

Windows Mobile Team Blog : Introducing the SslChainSaver — Sun, 18 May 2008 23:16:20 GMT

PingBack from http://blogs.msdn.com/windowsmobile/archive/2006/08/11/sslchainsaver.aspx

re: SSLChainSaver v2 released

Bryan Pizzuti — Fri, 30 May 2008 16:05:16 GMT

Where does this install to? I have .NET framework 2.0 installed, but when I type sslchainsaver at a command prompt, it comes back as: "'sslchainsaver' is not recognized as an internal or external command,

operable program or batch file."

re: SSLChainSaver v2 released

Scott Yost — Fri, 30 May 2008 23:22:45 GMT

It's one of the options you can pick during install. By default I think it will go to "C:\Program Files\Microsoft SSL ChainSaver"

re: SSLChainSaver v2 released

Prashanth — Mon, 16 Jun 2008 04:10:06 GMT

I ran the SSL Chainserver and it created two certificates (a root and a leaf). Now to create a .CAB file do I make use of only the root certificate?

Thanks

re: SSLChainSaver v2 released

Scott Yost — Mon, 16 Jun 2008 08:06:39 GMT

Hey Prashanth,

Use the .XML files that are created in the same directory as the tool. That XML file contains all of the certificates for the chain.

re: SSLChainSaver v2 released

Scott_King — Wed, 25 Jun 2008 00:39:30 GMT

I'm trying to use the tool to get the SSL chain from my LCS 2005 Access Proxy to my Motorola Q. I have a Verisign Public cert at improxy.kindermorgan.com, using TLS on TCP 5061. I tried the tool at FQDN:5061 and get Connection failed: No such host is known. I tried it with the defaults and get connection refused, which makes sense since I'm not using 443.

re: SSLChainSaver v2 released

Scott Yost — Wed, 25 Jun 2008 06:39:27 GMT

Hey Scott,

Make sure you don't put the colon there between the FQDN and the port. I was able to connect to your server when I put a space there.

re: SSLChainSaver v2 released

Jason_AWS — Mon, 14 Jul 2008 22:55:02 GMT

I'm having problems getting the cert to install on my Verizon XV6800. I downloaded SSL Chain Saver and used it per your directions. I took the WM6 file and turned it into a .cab file following the link below http://blogs.msdn.com/windowsmobile/archive/2006/01/28/making_a_root_cert_cab_file.aspx. I didn't change anything in the file I did rename it to include _setup. I even tried it without the _setup. Every time I try to install the CAB file I get installation unsuccessful. The site I'm going to is exchange.aws.com. Any help you can give me on this would be great.

Thanks,

Jason

Usando ActiveSync (& WDC) con Certificados de Seguridad de Exchange

desarrolloMobile.NET — Thu, 17 Jul 2008 09:21:14 GMT

Conectando con un emulador y configurarlo con Exchange a través de ActiveSync Si configuramos un emulador

re: SSLChainSaver v2 released

victor — Tue, 05 Aug 2008 22:19:55 GMT

hi scott,

i have downloaded this program and have followed your directions to open at the command prompt. When i enter the information it doesn't do anything. what am i doing wrong? i installed the program on my desktop, not my server. am running xp pro sp2 and have a HTC 6800 w/ WM6. my main issue is phone is not recognizing self generated certificate and i cannot ative sync remotely. is this the right fix? please help

thanks victor

re: SSLChainSaver v2 released

scottseely20 — Sat, 09 Aug 2008 00:00:15 GMT

Scott et all,

I can't get this website to work on wm 6.1.

I know it will not load up on IE when you have 3.0 ssl checked under tools/advanced..Any ideas???

Thanks in advance!

Scott

re: SSLChainSaver v2 released

scottseely20 — Sat, 09 Aug 2008 00:02:54 GMT

Sorry!!

website is: https://epic.comair.com

Thanks!!

re: SSLChainSaver v2 released

Tamarack — Sat, 13 Sep 2008 01:52:58 GMT

Just a little note to anyone who read over the instructions a bit to quickly... (cough cough me)

When you run the command prompt be sure to change the directory to C:\program files\microsoft SSL ChainSaver\

Then it will work correctly.

re: SSLChainSaver v2 released

Justin — Tue, 30 Sep 2008 02:59:14 GMT

"This file does not have a program associated with it..." is the error I am receiving when I put what you said into run. I have .NET framework 2.0 installed and put the file in "C:\Program Files\Microsoft SSL ChainSaver." What is the problem?

re: SSLChainSaver v2 released

Adam — Thu, 23 Oct 2008 16:43:35 GMT

Hi,

I can't seem to get this SSL Chainsaver to work..

I've downloaded it, installed it and using the syntax above in the root of the SSL ChainSaver directory i get the following error:

"chain contained 2 certificates

Cert 1. Issued to: mail.xxxxxx.org.uk

Unexpected failure: Access to the path 'mail.xxxxxx.org.uk' is denied."

I'm using Windows Vista Ultimate if that makes any difference. Any help appreciated.

re: SSLChainSaver v2 released

Scott Yost — Sat, 25 Oct 2008 21:38:28 GMT

Hey Adam,

I think your situation is covered in the known issues list in this post. (the first one)

re: SSLChainSaver v2 released

Laura Lewis — Sat, 08 Nov 2008 02:39:31 GMT

I am having difficulty with an Entrust issued Cert with an intermediate Entrust-L1A in the chain. My WM6.1 devices error with an invalid cert on connect. Using SSLChainSaver I've tried the WM6.xml in CAB file but the WM6.1 device fails to install. My question, is the WM6.xml supposed to work on a 6.1 device?

re: SSLChainSaver v2 released

Matt — Wed, 12 Nov 2008 23:01:50 GMT

Hi,

I went through and created the .cab but it uninstalls unsuccessfully. I was abke to download and install the program. I created the xml files. i took the one for wm6 and ran the command to make it a cab file. I installed the cab file on my phone and tried to install it from there but i get "installation of rootcert.cab was unsuccessful". Any ideas on what I missed? Did wrong?

Thanks

re: SSLChainSaver v2 released

Scott Yost — Sun, 23 Nov 2008 23:21:20 GMT

@Laura: Yes, it should definitely work w/ a 6.1 device.

@Matt: It's just a guess, but it's possible there was an error during cab creation. The XML file has to be renamed exactly to _setup.xml. (with the underscore and everything) Some people have run into problems when they forgot to rename the XML or didn't get the name exactly right.

re: SSLChainSaver v2 released

nicholasr347 — Thu, 12 Feb 2009 04:47:36 GMT

I'm in an Exchange environment where out Internal Exchange server address is different to the external exhcnage adress. I tried the above process and completed all the commands successfully but still unable to connect via ActiveSync.

Is there anything further i can try or do i need to wait for our IT team to fix the SSL certificate error (which is in regards to the incorrect domain name)

re: SSLChainSaver v2 released

Scott Yost — Thu, 12 Feb 2009 10:19:14 GMT

I don't think you'll be able to connect if the CN on the cert doesn't match the server name. I believe SslChainsaver v2 will alert you to that when you run it.

re: SSLChainSaver v2 released

woody0 — Wed, 29 Apr 2009 23:08:49 GMT

When I ran sslchainsaver.exe, it produced the following error:

Error: We were unable to find a self-signed root certificate. The server must send the root certificate during the SSL handshake. Windows Mobile devices will not be able to connect via ActiveSync.

The 'mail.company.com' folder contained a copy of the leaf certificate (that was produced from a private certificate server), but neither of the xml files contained any thumbprint or certificate information.

I have tried installing both the root and the leaf certificate manually (as per http://blogs.msdn.com/windowsmobile/archive/2006/01/28/making_a_root_cert_cab_file.aspx) , and I can browse to the site in question from the mobile device, but I still get the error: "the certificate was issued by a company you have not chosen to trust".

Is there something I need to change in IIS to send the root certificate as part of the SSL handshake?

re: SSLChainSaver v2 released

Scott Yost — Wed, 06 May 2009 10:10:15 GMT

hey Woody,

in my experience, you can fix that by installing that whole certificate chain onto the IIS box. discussion @ https://blogs.msdn.com/windowsmobile/archive/2006/02/27/ssl-certificates-201.aspx#641650

re: SSLChainSaver v2 released

Daniel Johns — Wed, 01 Jul 2009 17:09:05 GMT

Hi there, really need help with ActiveSync.

This is the response I get from SSLChainSaver

***************************

C:\Program Files\Microsoft SSL ChainSaver>SSLCHAINSAVER RODNEXCH01.LOWRIBECK.CO.

Chain contained 1 certificates

Cert 0. Issued to: rodnexch01.lowribeck.co.uk

ERROR: We were unable to find a self-signed root certificate.

The server must send the root certificate during the SSL handshake.

Windows Mobile devices will not be able to connect via ActiveSync

Certificate XML created. Use "rapiconfig RODNEXCH01.LOWRIBECK.CO.UK.wm6.xml" to

add the certs to a connected device or create a CAB file.

**************************

I am currently using a trial certificate from Thawte. My question is have I done everything correct and this error is as a result of the test certificate? I don't want to recommend purchasing a certificate if I'm still going to have this problem.

I really do not understand certification at all and really struggling to get ActiveSync working.

Any and all help greatly appreciated.

Cheers

Danny