Install Self-Signed Certificates on Windows Mobile 6.5

Testing private servers and internal SSL/TLS services on Windows Mobile 6.5 required establishing trust between the mobile device and the local Certificate Authority (CA). Because the operating system natively rejected untrusted connections—such as private Microsoft Exchange ActiveSync deployments or secure intranet sites—administrators had to manually import the private server's self-signed root certificate into the device's local certificate store. This was achieved either through direct installation via File Explorer or by deploying automated XML provisioning files.

1. Exporting the Certificate in the Correct Format

Before moving the certificate to the mobile device, the root CA certificate had to be exported from the issuing server in a compatible format:

  • The certificate had to be the Root Certificate, not the intermediate or leaf server certificate.
  • The file needed to be exported as a DER encoded binary X.509 (.CER) file or Base-64 encoded X.509 (.CER). PKCS#7 or PKCS#12 bundles containing private keys were not recommended for public root deployment.

2. Transferring the Certificate to the Device

Once the .cer file was generated, it was transferred to the Windows Mobile 6.5 device using one of the following methods:

  • ActiveSync or Windows Mobile Device Center (WMDC): Connecting the device via USB and copying the .cer file directly to the device's internal storage or root directory.
  • Storage Card: Copying the file to a physical microSD card and inserting it into the device.
  • Direct Download: Hosting the .cer file on an unsecured internal HTTP server (or downloading via email attachment) and accessing it via Pocket Internet Explorer.

3. Direct Installation via File Explorer

The native method to install a certificate was straightforward:

  1. Open the File Explorer utility on the Windows Mobile 6.5 device.
  2. Locate the transferred .cer file.
  3. Tap the file directly to execute the built-in certificate installer.
  4. Confirm the security prompt asking if you trust the certificate and want to add it to the device's store.

4. Automated Installation via XML/CAB Provisioning

In enterprise or continuous testing environments where manual tapping was inefficient, administrators utilized OMA Client Provisioning (WAP Provisioning XML):

  1. A configuration file (such as _setup.xml) was created using the CertificateStore Configuration Service Provider (CSP).
  2. The Base-64 encoded string of the certificate was embedded within the Root certificate store path:
<wap-provisioningdoc>
   <characteristic type="CertificateStore">
      <characteristic type="Root">
         <characteristic type="ThumbprintHash">
            <parm name="EncodedCertificate" value="BASE64_CERTIFICATE_DATA" />
         </characteristic>
      </characteristic>
   </characteristic>
</wap-provisioningdoc>
  1. The XML file was packaged into a signed .cab file using makecab.exe and executed on the device, silently placing the certificate into the Trusted Root Certification Authorities store without user intervention.

5. Verifying the Certificate Installation

To confirm that the certificate was properly loaded:

  1. Navigate to Start > Settings > System > Certificates.
  2. Select the Root tab.
  3. Verify that the private root CA appears in the list of trusted authorities.

Once verified, applications such as Pocket Internet Explorer and ActiveSync could securely communicate with private testing servers without generating invalid certificate warnings or connection blocks.