It seems that my post on "Hacking your Windows Mobile 5.0 Registry" gets read a lot.  In fact, about 50% of the traffic to my blog comes from visits to that page (most of it from search engine referrals).  Based on some comments, though, I feel like I need to clarify something.

The main reason that I blogged about the ability to disable certificate checking in Windows Mobile 5.0 is because I use a Wildcard certificate (*.company.com) at my current company.  Unfortunately, wildcard certs are NOT supported in Windows Mobile 5.0.  This means that even if the certificate is installed properly, Windows Mobile 5.0 will not properly use it and will instead display an error stating that an invalid certificate is installed.  In order to get synchronization working with MY environment, I had to disable certificate checking.  This still allows me to use SSL, but it tells Windows Mobile not to check if the certificate is valid (basically, the hostname doesn't have to match).

However, if you are using a self-signed certificate (generated by an internal Certificate Authority), there is NO need to add this registry key.  Windows Mobile 5.0 fully supports self-signed certs, and has made it MUCH easier to install your own certificate.  An abundance of posts provide helpful information on how to install a certificate on Windows Mobile 5.0 in many different ways, from copying and clicking a .cer file, to installing as a .cab file, to installing using a signed version of the spaddcert.exe tool (Sprint and Verizon).  Think of it this way.  If you are using a self-signed cert for, say, OWA access, what happens when an external client tries to log in to OWA?  Internet Explorer indicates there is a problem with the certificate.  How do you get around that certificate error popping up each time you visit the page?  You install your certificate into IE's certificate store as a Trusted Root Certificate Authority.  The same action is required with Windows Mobile, with the exception that if you want to synchronize at ALL using SSL, you have to install the cert (or disable SSL - not recommended).

What prompted this post?  I've had some questions about the original post that indicated folks had disabled certificate checking, only to be continually prompted for a password.  That's annoying! (the continual password prompt, not the questions!).  The common thread I've seen in each case so far, though, was that the issue was one with the certificate.  In at least one case, disabling SSL (as a test) allowed sychronization to work (a sure sign that the issue is with the cert).

What do you do if you are continually being prompted for a password?  Here is a list of things to check.

1.  Are you sure that you have installed your certificate as a root certificate on your Windows Mobile device?  Windows Mobile devices also have a certificate store, which is viewable by the user.  Check your device for the exact location (I believe it may display in a different location depending on if you have a PocketPC-based device, or a Smartphone-based device), and make sure that your certificate shows up there.

2.  Have you made sure that the server name in the ActiveSync settings *exactly* matches the one that's on the cert?  This is what disabling certificate checking is supposed to fix (a wildcard cert won't match exactly), but since disabling cert checking does decrease security, it shouldn't be done unless absolutely necessary.

3.  If you disable SSL on your Windows Mobile device, does synchronization work and your password get accepted?

4.  Does the name of the server you are entering in ActiveSync exist in external and internal DNS?

5.  Have you made sure that your cert is indeed valid, and not expired?  IE should show you any issues from this side of things.

If I can think of anything else, I'll edit this post.  I've also asked the folks on the Windows Mobile blog to comment on what might cause the looping password.

- posted by Ben Winzenz @ 2:01 PM