Install Security Certificates on Windows Mobile 6.5

Windows Mobile 6.5 allows users and network administrators to manually install several types of security certificates to ensure secure communications, device authentication, and application trust. Because modern root Certificate Authorities (CAs) have expired since the operating system was released, manually installing Root CA, Intermediate CA, and Personal identity certificates is often necessary to connect to Microsoft Exchange ActiveSync, secure enterprise Wi-Fi networks, and local intranet services.

Supported Certificate Types

Windows Mobile 6.5 supports the manual installation of three primary classes of X.509 certificates:

  • Root CA Certificates: These establish a baseline of trust for the operating system. If your organization uses an internal private Certificate Authority or an updated public commercial CA that postdates Windows Mobile 6.5, you can install the Root CA certificate directly into the device's Root certificate store.
  • Intermediate CA Certificates: These bridge the trust path between an enterprise Root CA and the end-entity certificate presented by a server (such as an Exchange or web server). Installing these prevents SSL/TLS handshake failures caused by incomplete certificate chains.
  • Personal (Client Identity) Certificates: These certificates contain a public certificate and a corresponding private key. They are used for client authentication, allowing the mobile device to identify itself when connecting to corporate networks via VPN, 802.1X EAP-TLS Wi-Fi, or secure email services.

Supported File Formats

To manually install a certificate, the file must be formatted in a standard Windows-compatible encoding:

  • DER Encoded Binary X.509 (.cer, .crt, .der): Commonly used for single Root and Intermediate CA certificates that do not contain private keys.
  • Base-64 Encoded X.509 (.cer): Supported text-based format for individual public certificates.
  • PKCS #12 (.pfx, .p12): Used for Personal/Client certificates. This format bundles the public certificate and the private key and requires a password to import.
  • PKCS #7 (.p7b): Used to import certificate chains containing multiple public certificates without private keys.

Manual Installation Methods

  1. File Explorer Execution: Copy the .cer, .crt, or .pfx file to the device's storage (or a microSD card) via USB. Open the built-in File Explorer on the device, navigate to the file, and tap it. Windows Mobile automatically opens the Certificate Installer. If installing a .pfx file, you will be prompted to enter the password that protects the private key.
  2. Internet Explorer Mobile: Navigate to a secure URL hosting the .cer or .pfx file. Tapping the link downloads the certificate and immediately launches the native import wizard.
  3. WAP/XML Provisioning via CAB: Administrators can package certificates inside a standard .cab file using provisioning XML (_setup.xml). Executing the CAB file silently injects the certificates into the designated store (Privileged Root, Unprivileged Root, or Personal).

Common Applications

  • Microsoft Exchange ActiveSync: Resolves 0x85010014 and SSL certificate untrusted errors when synchronizing email, calendars, and contacts.
  • Enterprise Wi-Fi (802.1X): Supplies the client-side authentication necessary for WPA/WPA2-Enterprise networks utilizing EAP-TLS.
  • L2TP/IPsec VPNs: Provides the mutual identity verification required before establishing an encrypted tunnel to enterprise firewalls.
  • Code Signing: Permits the execution of internal enterprise applications signed with custom digital signatures without encountering security prompt blocks.