Windows Mobile 6.5 Certificate Revocation Protocols

Windows Mobile 6.5 relied on a streamlined version of Microsoft’s CryptoAPI to manage Public Key Infrastructure (PKI) and validate digital certificates. This article details the specific certificate revocation protocols supported by the operating system, the absence of native modern standards like OCSP, and the operational limitations that defined certificate validation on legacy mobile platforms.

Native Revocation Mechanisms: Certificate Revocation Lists (CRLs)

Windows Mobile 6.5 primarily utilized traditional Certificate Revocation Lists (CRLs) to check the validity of X.509 security certificates. Under this mechanism:

  • CRL Distribution Points (CDP): The system retrieved a list of revoked certificates published periodically by a Certificate Authority (CA) via HTTP or LDAP URLs defined within the certificate’s CDP extension.
  • Local Caching: Once downloaded, CRLs were stored in a local cache on the device until they expired, preventing repeated network lookups during subsequent connections.
  • Network Constraints: Because downloading large CRL files over 2G and 3G cellular connections consumed significant bandwidth and caused connection latency, complete CRL checking was often disabled by default in components like Internet Explorer Mobile and native mail clients.

Online Certificate Status Protocol (OCSP) Limitations

Windows Mobile 6.5 did not feature native support for the Online Certificate Status Protocol (OCSP).

While desktop Windows operating systems introduced native OCSP validation starting with Windows Vista and Windows Server 2008, Windows Mobile 6.5 was built on the older Windows CE 5.2 kernel. As a result:

  • No Real-Time Lookups: The operating system could not natively query an OCSP responder to obtain real-time, low-overhead status responses for individual certificates.
  • Enterprise Workarounds: Environments requiring real-time revocation checks or OCSP compliance had to deploy specialized third-party security clients, VPN software, or custom cryptographic service providers (CSPs) that intercepted network requests and performed external OCSP validation.

CryptoAPI Configuration and Registry Controls

Certificate validation and revocation policies in Windows Mobile 6.5 were managed through the device registry, primarily under [HKEY_LOCAL_MACHINE\Comm\Security\CryptoAPI]. Administrators and mobile device management (MDM) platforms could configure flags to alter how the CryptoAPI handled revocation:

  • Revocation Enforcement: Administrators could force the system to fail a connection if a CRL could not be retrieved, though this frequently caused connection failures when devices operated with intermittent network coverage.
  • Soft-Fail Behavior: By default, if the system was configured to check revocation and the CRL distribution server was unreachable, it generally reverted to a "soft-fail" mode, allowing the SSL/TLS connection to proceed rather than terminating the session.