Review Trusted Root CAs in Windows Mobile 6.5

Windows Mobile 6.5 provided a built-in Certificate Manager interface that enabled users and system administrators to inspect, manage, and verify digital certificates stored on the device. This interface organized security credentials into distinct categories, allowing direct access to the trusted root Certification Authorities (CAs) that underpinned secure communications, encrypted web browsing, and application signing. By interacting with this native utility, administrators could ensure device compliance, troubleshoot SSL/TLS handshakes, and verify the validity of pre-installed and custom root authorities.

To access the certificate management interface, users navigated through the operating system's settings menus:

  1. Tap the Start button on the home screen.
  2. Select Settings, followed by the System or Security folder depending on the specific OEM build.
  3. Open the Certificates applet.

Inside the Certificates interface, the operating system organized certificates into three distinct tabs: Personal, Intermediate, and Root.

Selecting the Root tab displayed the complete list of trusted root CAs installed in the device's system store. This list contained pre-installed root certificates from major global CAs (such as VeriSign, GeoTrust, and Entrust) built into the ROM, as well as any enterprise or custom root CAs deployed by administrators.

Users could review the properties of any individual CA by tapping its name in the list. The detail view exposed critical certificate metadata, including:

  • Issued To: The Common Name (CN) and organizational details of the authority.
  • Issued By: Identifying whether the certificate was self-signed (standard for root CAs).
  • Validity Period: The specific "Valid From" and "Expires On" dates to verify the certificate had not expired.
  • Thumbprint and Algorithms: The cryptographic signature algorithms (such as SHA-1 or MD5, common at the time) and thumbprint hashes used for identity verification.
  • Intended Purposes: The authorized key usages, such as Server Authentication, Client Authentication, Code Signing, or Secure Email.

While users could view all root certificates, management permissions varied based on the certificate's origin. Pre-installed ROM certificates were typically marked as read-only to prevent system instability or security degradation. However, user-installed or enterprise-provisioned root CAs could be manually removed from this tab by selecting the certificate and tapping Delete. Adding new root CAs to this store typically involved opening a .cer or .der certificate file directly on the device via File Explorer or provisioning it remotely through an OMA DM (Open Mobile Alliance Device Management) XML script.