Database Users

80072fd Push with SBS2003

My IT guys have been trying to get this push email thing working and it seems to be one difficulty after another and is not as simple as pressing "push email" in the connection icon....
Our latest error appears on my device with the above error code stating
"the security certificate on teh server is invalid. contact your exchange server administrator or ISP to install a valid certificate to the server".
I have read that I need to buy a public certificate from a public authority (CA) or similar such as Verizon or Thawte. Is this the case, or is there a simpler way to get this push email working using the existing configuration and setup of the server?
We use exchange SP2, with outlook 2003 all around. Internet based webmail works correctly with full access, and activesync via PC works perfectly, but push email encounters the above error.
Any suggestions.

are you sure it's 80072fd or 80072efd ?

I don't have a solution, but the problem is described in M$ knowledgebase article: 915438 - see attached Acrobat .PDF.
I had already tried the suggestion in KB915840 to import the certificate from my sbs2k3-domain, but this had failed with "cannot access the certificate" - even with them on the device. However, certificates from my clients' servers, both sbs2k and sbs2k3, import without problems. This happened both before and after o2's AKU2 ROM update - so AKU2 is not the problem. In addition, I spent Easter *totally* reinstalling sbs2k3 and tested it immediately afterwards. All the sbs2k3/Exch2k3-Sp2 boxes are fully patched. The certificate itself is correct/working, since it works for Outlook Web Access via the web with laptops and even the Exec (Universal).
Whilst sync'ing from the workstation via ActiveStink/USB, if you turn off the SSL requirement the sync suceeeds, but that's obviously not a working solution via the 'Net.
Update:
Just had a thought, and checked the various certificates in a hex-editor. The one from my sbs2k3 box is a completely different format. :? I'll see what I can find out.....

maybe not related, but here's a list of all ActiveSync Server Error Codes: http://blogs.flaphead.dns2go.com/archive/2005/11/21/3202.aspx

80072f0d
Sorry, the correct code is 80072f0d.
I know your pains astage, but there is no way we are pulling the box down and putting it back up again, our server hosts 30 + staff simultaneously and I cant take it down just to fix my one desire to have push email.
But I do find it painful and frustrating that microsoft do not adequately support their own platforms and systems dont integrate as they should and as they are promoted.
M$ sks.

Re: 80072f0d
simon_darley said:
....I know your pains astage, but there is no way we are pulling the box down and putting it back up again, our server hosts 30 + staff simultaneously and I cant take it down just to fix my one desire to have push email.....
Click to expand...
Click to collapse
I'm not sure if it was clear from my reply - too tired - but rebuilding the server did not help at all.
Yeh, the pains of rebuilding SBS and having it all configured and running correctly when the staff arrive in the morning is not something I do willingly - hence the use of the holiday. It was done only as a last ditch attempt to solve this and another problem that had Micro$oft totally stumped - not related.
There is a difference in the certificate formats, so that's where I'm concentrating my efforts now. Will let you know what I find.

80072f0d error - the fix!
Just spent the past hour kicking and calling myself an £$%&* idiot.:x
Anyway, to cut the story short, the problem *is* indeed the damn format of the SSL certificate exported by sbs2k3. For the WM5 device to import it, it needs to be in DER X509 format.
If you have imported it into your PC/laptop for OWA/OMA/RWW, then you can easily export it from IE's Internet Options into DER format.
From Internet Options:
- go to Content-tab
- click Certificates-button
- find and highlight your certificate - I had imported mine into Trusted Root Authorities
- click Export-button
- click Next on wizard page
- enable the "DER encoded binary X.509 (.CER)" radio-button, and click Next
- enter a suitable path & filename, e.g.: "myserver.cer"
- click Next, click Finish, click Ok.
- Now copy the certificate to your PDA via ActiveSync.
- Open File Explorer on the PDA,
- Find the certificate file and launch it.
- click Yes to import it and you're done!
I think the reason why my sbs2000 certificates worked was that I had installed Certificate Services on those boxes and exported those certificate from there. I don't understand why some of my client's sbs2003 certificates were in DER-format, and others weren't, but we are talking about Microsoft software, so what else should I expect......

msfp and 80072f0d
After testing a few different certificate variations, the engineers that maintain our servers was able to send me two alternative certificates, one or bother of them appear to ahve worked effective.
So it imported, and now my active sync works for receiving these emails, now I need to look at these heartbeat pings and find out how I set the periodic checking.
Just wondering, normally if you dial a gprs/3g connection, you pay once, and stay connected all day. Does this now mean that it connects, downloads, disconnects, then 5 minutes later reconnects, downloads, and disconnects, thus paying a much larger reconnect fee everytime?
I am playing with this as a new toy, but I can see the costs are going to go ballistic....

and... perhaps for all those that are already experienced here, how does one send an email that remote wipes the device?
is there a command, or a key word or something that makes the system realise the remote wipe command....
sorry, I know this is off the topic of my original post, but thought you might know.
if not, I can start a new topic....!!!
The certificates that I was given was a server.cer and a root.cer.
If anybody needs to know, I can ask the engineers how they did what they gave me to get it to work.

The remote wipe is done from the sbs2k3 box - or rather the box running Exchange2k3Sp2. Your admin needs to install a small tool that he (Domain Administrator credentials needed) then accesses via IE.
Microsoft has published a new white paper (Feb 2006) that describes the whole procedure - just a shame they missed the need for the certificate to be in DER format. The white paper is: "Deploying Windows Mobile 5.0 with Windows Small Business Server 2003".

Push Email with Exchange Server?

Hi all, im kind of new to this but i just read about push email with exchange server and i was wondering how i could use it with my mda vario. I've already installed an updated rom with push email but i dont know how to use it. can any one fill me in on this? thanks for any help.

You need a Exchange 2003 server with at least SP2 installed. Also a UMTS/GPRS connection because is not working over WIFI.
Bitfrotter 8)

Go to www.mail2web.com, sign up there. Than put the settings from the website in the Exchange Server settings in Active Sync on your PPC. Set your current email address to automatically forward your email to your mail2web email address. Enable GPRS and enable push email from the Comm Manager and bingo, push email is yours.

Ok, ive already signed up with mail2web but i want to automatically retrieve hotmail emails. i don't see an option on hotmail to forward all my emails to mail2web. am i missing something here? sorry, im inexperienced and all and these are probably lame questions and all. but please help me out. after reading that article i got hyped up in doing this. thanks for any replies.

Bitfrotter said:
You need a Exchange 2003 server with at least SP2 installed. Also a UMTS/GPRS connection because is not working over WIFI.
Bitfrotter 8)
Click to expand...
Click to collapse
I've gotten DirectPush to work over WiFi... Maybe that was an earlier ROM version though... I don't recall the circumstances under which I got it to work.

MS says that Direct Push does not work over WiFi. WiFi does not allow disconnected connections (in other words, a connection that allows for the data stream to be suspended). If WiFi did it, it would require a continuous connection that would drain the batteries at a very rapid pace.
Setting up Exchange for Direct Push is pretty easy. I set up ours in about 5 minutes.
One of the coolest things you can do with a correctly configured Exchange 2003 system is with the Mobile Admin pack (free download from MS). It allows you to tell the PDA that it needs to "self-destruct" in case the phone is stolen. A remote wipe will do a hard-reset on the phone, deleting all data not stored on an external SD.
I usually get my email on the MDA faster than Outlook on my desktop.
If any Exchange admins are out there, I can post how to set it up if anyone needs help.

exchange/activesync
Yes please!

Hotmail has deleted the possibility of forwarding mail automatically a few years ago in the free version, only Hotmail Plus subscribers can use this option. With gmail however it is still free. So a basic hotmail account will not be able to use Push over Exchange. You can however sign in to MSN Messenger on your device and will then be notified as soon as an email arrives on the hotmail server. This will cost you extra data charges though, since contacts coming online will also result in data transfer to your device.

Romp said:
MS says that Direct Push does not work over WiFi. WiFi does not allow disconnected connections (in other words, a connection that allows for the data stream to be suspended). If WiFi did it, it would require a continuous connection that would drain the batteries at a very rapid pace.
Setting up Exchange for Direct Push is pretty easy. I set up ours in about 5 minutes.
One of the coolest things you can do with a correctly configured Exchange 2003 system is with the Mobile Admin pack (free download from MS). It allows you to tell the PDA that it needs to "self-destruct" in case the phone is stolen. A remote wipe will do a hard-reset on the phone, deleting all data not stored on an external SD.
I usually get my email on the MDA faster than Outlook on my desktop.
If any Exchange admins are out there, I can post how to set it up if anyone needs help.
Click to expand...
Click to collapse
that would be awesome if you know of a tutorial anywhere on this..

so by creating an exchange server as romp said, you can sync any email including hotmail? well that's really a bummer that microsoft disabled forwarding on hotmail. Its mainly my primary email which all my friends/family know. so it would be a miracle if anyone knew how to sync hotmail without subscribing to their hotmail plus.

Well, getting outside emails are a bit more complex. This is usually for a business, but there are plenty of POP-to-Exchange plug ins that would allow getting Hotmail emails. Of course, you would need the Hotmail Plus for the POP.
http://www.slipstick.com/exs/popconnect.htm
My answer was more concerning the Exchange Direct push question, not the hotmail one.
Where I work (yes, I did set up the Exchange system) we have GFI spam filtering and virus filtering (www.gfi.com) and they have a POP2Exchange bridge included. It just checks the account, downloads any POP emails, and drops it in the right mailbox.
Exchange is a complete system, not just mail. It has webmail, Windows Mobile direct push, calendar, contacts, and more. Unless you are in a company with Exchange or Small Business Server, its not a cheap thing to do for a home network.
If you DO have Exchange at your office, run to the IT guy and hurt him until he sets your phone up on it. Its all the functionality of Blackberry and more, built into Exchange.
I'll write that tutorial, g0nk.

ok so if we go the mail2web route... i dont need to install exchange 2003 on a pc myself? does it only work on windows server 2003?
im interested in doing this at my job but i want to make sure it is not too difficult
edit.. well we have our own domain email addresses so the [email protected] is not an option..
any suggestions?

Romp said:
Exchange is a complete system, not just mail. It has webmail, Windows Mobile direct push, calendar, contacts, and more.
If you DO have Exchange at your office, run to the IT guy and hurt him until he sets your phone up on it. Its all the functionality of Blackberry and more, built into Exchange.
I'll write that tutorial, g0nk.
Click to expand...
Click to collapse
1) Agreed
2) I am the IT guy and it don't work on our server - the rootcertificate won't install to the PPC - an MS acknowledged problem............
3) Please forward ASAP !! Thanks !! :lol:

Is it a self published cert? Because you CAN get any externally issued cert to work just fine. We use a $15 GoDaddy cert with no problems.
The big screw up most people have with the cert (myself included) is that the cert is not correctly installed, even though it says it is.
Cheaper certs are called "Chained" certs. All certs need a path back to one of the big cert companies. So, companies like GoDaddy get approved to be second level cert issuers. IE on the PC will look at the cert and track it back to the main cert issuer. For example, the cert on GoDaddy goes from GoDaddy, to Starfield, to VeriCert. The VeriCert certificate is installed on all PCs.
Anyway, the problem is that the PC can follow an undefined cert path, the PPC can't. If you install the cert on the server, IE on the PC can figure out the whole path, PPC can't. So, the big thing is to make sure the MIDDLE CERTS are installed on the server. Even though everything seems fine, chances are that the middle ones are not (in this case STARFIELD)
The easiest way to find out if the cert is valid or not is try to get to your webmail on PIE. If you get a message about the cert, your server is not set up completely.
For my server, I had no luck until I found the Intermediary Cert and installed it. https://certificates.starfieldtech.com/Repository.go
Once that was done, my GoDaddy cert worked on the PPC and syncs went perfectly. Once the server has all the certs in the cert path installed, the PPC can validate each level. Until then, its clueless. Most people think you need to install the cert on the PPC. Its the server that needs it.

Does the self published cert only cause problems with direct push? I've got the "old" polling method working. I created a root CA on my server to sign the cert created for the web server and then turned that root CA into a CAB which was installed on the PPC. I should say that my phone doesn't have an AKU 2.xx rom on yet so I've not tested push mail.
This is all outlined in the following doc :
http://www.microsoft.com/technet/itsolutions/mobile/deploy/msfpdepguide.mspx
Also look at http://support.microsoft.com/kb/817379 if you are running a non sbs2003 exchange server in a configuration that doesn't have a front end/back end exchange server configuration. As there are some minor tweeks needed to the registry and to the default web server setup.

If you can do a remote Activesync, then DirectPush will work just fine.

A newbie Direct Push question:
I upgraded my 8125 ROM to the official Cingular June 19 version, and direct push SEEMS to be working great my my Hosted Exchange provider. When new email comes in to my Exchange server and/or a task / calendar / contact is changed on the desktop Outlook client, those get pushed quickly to the 8125.
Problem is, it doesn't seem to work in reverse. For example, IF I get an email pushed to me on my PDA, I read it and delete it on my PDA.....that deletion action is NOT getting syncronized back to my Exchange server. Is that by design, or is indeed something wrong?
Thanks in advance!

not sure if it helps, but you can change when pocket outlook deletes mail, there are 3 options:
on connect/disconnect
immediately
manually
I dunno if changing that will help you at all, but its in the pocket outlook options.
I'll shut up now, in case I misunderstood

jmel said:
not sure if it helps, but you can change when pocket outlook deletes mail, there are 3 options:
on connect/disconnect
immediately
manually
I dunno if changing that will help you at all, but its in the pocket outlook options.
I'll shut up now, in case I misunderstood
Click to expand...
Click to collapse
I appreciate your reply, but my question is beyond that......it centers around Driect Push.....my thinking is, regardless of that setting you referred to, once the email is deleted on the PDA, the PDA should "reverse-push" that deletion to the Exchange server, and mine does not seem to be doing that.
I hope that is a little clearer?

No, his answer was right. The reverse of the Push is not the same. You have to set the options as Jmel suggested. Its basically to save data.
This allows you to go through your mail, delete all your spam and crap, then update the server. Doing so immediately would be a waste. Recieving/sending emails is considered vital, deleting them...not so much.

Need setup instructions for Exchange sync

We are running off a 2003 server. We do have webmail access. However, apparently we are using a personal security certificate. I can set up the activesync connection, but it never syncs.
I need step by step instructions on what I need to do, how to get the certificate off the server, import to my device, etc. HELP!
Assume I know nothing about exchange, certificates, etc - cause I don't!

Exchange 2003
Have you resolved this yet? I have had extensive research on this subject. My first Q: Do you have exchange setup on laptop or desktop?

You need to install your private certificate authority as a trusted root certificate authority on your device. The following link talk about how to do this.
http://blogs.msdn.com/windowsmobile/archive/2006/01/28/making_a_root_cert_cab_file.aspx
You can also disable the certificate checking. The communication would still be encrypted, but if you ever accessed another site where the certifcate was invalid you would not be warned, so this solution is much less secure and therefore not recommended.
http://winzenz.blogspot.com/2006/03/hacking-your-windows-mobile-50.html

[Solved] Having problems handling Microsoft Exchange Email on my HD2

Hello
I've had my HD2 for almost a month now (replacing my iPhone 3G) and prefer it over my 3G in every way, except Microsoft Exchange email support.
I'm trying to connect to my Uni account. It syncs OK the first time/few times after a hard-reset but afterwards I keep getting the invalid security certificate error below
I've searched everywhere and tried different ROMs but no solution. I didn't have to provide any digital certificate for the iPhone or Outlook on my laptop..
I use the same settings on my iPhone (SSL enabled etc)
Anyone else have this problem?
Thank you

the problem isnt the hd2...... it is your lack of having the right cert your iphone downloaded it winmo requires u to install winmo handles exchane perfectly if you set it up right

So if I remove the iPhone from my synced devices list in OWA will it work?

what you need to do is get the cert your webmail is using. By going to the site you should be able to click the lock icon by the address in internet explorer and view the cert. Export it (copy to file) as a .cer file and put it on your device. then click it in file explorer on your phone and it will install. Once you get it installed it will work perfectly.

Ignore me - as above

Thanks for the replay. I came a cross a solution like that yestarday but it didn't work.
Anyways i've tried again now and heres what I did: deleted the exchange account on the phone completely, exported a certificate from OWA on firefox but it came out as a .crt which the phone can't read, so I converted it to a .cer and opened it on the phone, it gave me a sucess message.
Now I added the email account again and like before, it synced perfectly. However I soft-reset and can't sync anymore..

I use gmail over activesync. You could set up a gmail account and see if that works. If it does your exchange isn't setup properly...
I want to add that I never had any issues setting up an exchange mailbox on activesync. Some haertbeat issues yes, but never the setup itself.

I highly doubt it since a uni would probably use 'the usual' routes for ssl certs, but you might have to export & add the intermediate certificates.
As an example, here is mine, using FF so you're looking at a consistent screen.
If you click on the line ending in (2048), it is a different cert than the one ending in "- L1B" So export all 3 certificates (or however many lines you see) and import them over.
For the record, my exchange works perfectly fine as well.

mazzarin said:
I highly doubt it since a uni would probably use 'the usual' routes for ssl certs, but you might have to export & add the intermediate certificates.
As an example, here is mine, using FF so you're looking at a consistent screen.
If you click on the line ending in (2048), it is a different cert than the one ending in "- L1B" So export all 3 certificates (or however many lines you see) and import them over.
For the record, my exchange works perfectly fine as well.
Click to expand...
Click to collapse
THANK YOU
I've exported all three and worked.

Poutlook email and client side certificate

Hi,
I've an email account which I can access only with a client side cert. With a desktop application like Thunderbird, it is no problem. I just import the .p12 file, go to account settings->security and selecting the imported certs. Works perfectly.
BUT..
on Windows Mobile, I've imported this .p12 file just by clicking on it, and I can see it in settings->system->certificates, but I don't know how to tell poutlook to use this cert.
Is there a way to tell this to poutlook at all? Or if not, is there another email client that can handle client side cert?
thx.

Hmm.. where should I write this to get an answer?

Here is the solution:
http://forum.xda-developers.com/showpost.php?p=5750590&postcount=5