[Upgrading, Modifying and Unlocking] dovlas:
Installing root certificates without installing WM5 and reinstalling WM6

========================================

[dovlas] Like many other people, some time ago I flashed my hx4700 with Kozhura's edition of WM6 (I had 2003 on it before and never dared installing troublesome WM5). Everything was perfect until my company turned SSL on and required a certificate in order to sync with Exchange server. As many others, WM6 kept rejecting to install the certificate. I tried several things, none of which worked. Then I started my own experimentation and debugging and this is what worked for me, without having to downgrade to WM5:

1. Install the certificate that my company issued on THE PC. I did this by simply double-clicking on the .p7b certificate file that my company gave me and then, when the "Certificates" window opens, select and double-click the certificate. Another window "Certificate" opens, with the "Install Certificate..." button at the bottom of the window. Click the "Install Certificate..." button. At this point certificate information is loaded into PC's registry.

2. In the "Certificate" window, I clicked on the Details tab and located the Thumbprint field. You would see the value being something like "15 1A 96 00 E8 0E 0D 99 C1 26 79 F2 2C E8 41 82 93 8F A7 08". Copy the value and then paste it into say Notepad and remove spaces. At this point you would have something like 161B9701E90F0D99C12679F22CE84182938FA708.

3. Oper regedit.exe. Search for the key (161B9701E90F0D99C12679F22CE84182938FA708). It is typically under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates, in say CA or Root folder, or both. In my case, it was in both folders.

4. Right-click on the key and say "Export". When you open the file in a text editor, it looks something like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\161B9701E90F0D99C12679F22CE84182938FA708]

"Blob"=hex:15,01,01,01,02,01,01,01,15,01,01,01,fd,1b,f8,f9,bc,7c,e8,bc,db,7c,\

e5,68,2c,94,c7,5b,98,5f,ac,3f,03,00,00,00,01,00,00,00,14,00,00,00,15,1a,96,\

00,e8,0e,0d,99,c1,26,79,f2,2c,e8,41,82,93,8f,a7,08,19,00,00,00,01,00,00,00,\

10,00,00,00,34,a2,3f,f3,4f,e1,d8,93,0a,ca,86,1c,a6,97,3c,36,20,00,00,00,01,\

00,00,00,54,03,00,00,30,82,03,50,30,82,02,fa,a0,03,02,01,02,02,10,18,17,7d,\

f9,90,d4,39,92,4c,cf,f3,91,3a,e6,39,7f,30,0d,06,09,2a,86,48,86,f7,0d,01,01,\

05,05,00,30,63,31,0b,30,09,06,03,55,04,06,13,02,55,53,31,0b,30,09,06,03,55,\

04,08,13,02,46,6c,31,0e,30,0c,06,03,55,04,07,13,05,4f,63,61,6c,61,31,1d,30,\

1b,06,03,55,04,0a,13,14,49,6e,74,65,6c,6c,6f,6e,20,43,6f,72,70,6f,72,61,74,\

69,6f,6e,31,18,30,16,06,03,55,04,03,13,0f,49,6e,74,65,6c,6c,6f,6e,20,56,50,\

4e,20,43,41,30,1e,17,0d,30,35,30,36,30,34,31,35,31,37,35,39,5a,17,0d,30,37,\

30,36,30,34,31,35,32,31,35,35,5a,30,63,31,0b,30,09,06,03,55,04,06,13,02,55,\

19,67,2d,2c,00,50,3d,c9,bb

If the key was exported from the Root subfolder then line

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\161B9701E90F0D99C12679F22CE84182938FA708]

would actually look like this:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\161B9701E90F0D99C12679F22CE84182938FA708]

5. Now adapt the registry file for importing it into WM6's registry. This is because WM6 stores certificates in a different folder. Replace "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates" in the registry file "with HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates" and save the file.

6. Now the critical part!!! Without following change, all my attempts to import the file using three different Windows Mobile registry editors (IBE RegEditor, PHM RegEdit and Resco Registry, all eval/freeware versions) were consistently failing to import all the data from the registry file. After some trial-and-error I concluded the reason is a bug in the Registry manipulation API in the WM6 image that does not handle "hex:". I opened the saved registry file again and replaced "hex:" with "REG_BINARY:".

7. Copy the saved registry file from the PC to my WM6.

8. I imported the file using a registry editor.

9. Took my hx4700 out of the cradle, exit registry editor, close all running applications on my WM6 and pressed the Stand-By button. I left the device alone for around a minute (to let any background writes to flash to complete) and then pushed the Soft Reset button.

10. When I now went to Start->Settings>Certificates, the certificate was showing in the Root tab.

11. I started ActiveSync on my PC and the device properly synced with our corporate Exchange server.

I should mention that in my case, I found the certificate stored in both CA and Root folders on my PC. So, I exported both keys, one at a time, into separate files and performed editing on both files. Then I merged the content of the two files and removed the second instance of "Windows Registry Editor Version 5.00" string. So, what I imported into my WM6 looked something like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates\CA\Certificates\161B9701E90F0D99C12679F22CE84182938FA708]

"Blob"=REG_BINARY:15,01,01,01,02,01,01,01,15,01,01,01,fd,1b,f8,f9,bc,7c,e8,bc,db,7c,\

e5,68,2c,94,c7,5b,98,5f,ac,3f,03,00,00,00,01,00,00,00,14,00,00,00,15,1a,96,\

00,e8,0e,0d,99,c1,26,79,f2,2c,e8,41,82,93,8f,a7,08,19,00,00,00,01,00,00,00,\

10,00,00,00,34,a2,3f,f3,4f,e1,d8,93,0a,ca,86,1c,a6,97,3c,36,20,00,00,00,01,\

00,00,00,54,03,00,00,30,82,03,50,30,82,02,fa,a0,03,02,01,02,02,10,18,17,7d,\

f9,90,d4,39,92,4c,cf,f3,91,3a,e6,39,7f,30,0d,06,09,2a,86,48,86,f7,0d,01,01,\

05,05,00,30,63,31,0b,30,09,06,03,55,04,06,13,02,55,53,31,0b,30,09,06,03,55,\

04,08,13,02,46,6c,31,0e,30,0c,06,03,55,04,07,13,05,4f,63,61,6c,61,31,1d,30,\

1b,06,03,55,04,0a,13,14,49,6e,74,65,6c,6c,6f,6e,20,43,6f,72,70,6f,72,61,74,\

69,6f,6e,31,18,30,16,06,03,55,04,03,13,0f,49,6e,74,65,6c,6c,6f,6e,20,56,50,\

4e,20,43,41,30,1e,17,0d,30,35,30,36,30,34,31,35,31,37,35,39,5a,17,0d,30,37,\

30,36,30,34,31,35,32,31,35,35,5a,30,63,31,0b,30,09,06,03,55,04,06,13,02,55,\

19,67,2d,2c,00,50,3d,c9,bb

[HKEY_LOCAL_MACHINE\Comm\Security\SystemCertificates\Root\Certificates\161B9701E90F0D99C12679F22CE84182938FA708]

"Blob"=REG_BINARY:04,00,00,00,01,00,00,00,10,00,00,00,6d,a8,48,40,7a,c1,64,d9,c9,8b,\

ad,40,42,6c,63,e4,19,00,00,00,01,00,00,00,10,00,00,00,34,a2,3f,f3,4f,e1,d8,\

93,0a,ca,86,1c,a6,97,3c,36,03,00,00,00,01,00,00,00,14,00,00,00,15,1a,96,00,\

e8,0e,0d,99,c1,26,79,f2,2c,e8,41,82,93,8f,a7,08,14,00,00,00,01,00,00,00,14,\

00,00,00,fc,1b,f8,f9,bc,7c,e8,bc,db,7c,e5,68,2c,94,c7,5b,98,5f,ac,3f,20,00,\

00,00,01,00,00,00,54,03,00,00,30,82,03,50,30,82,02,fa,a0,03,02,01,02,02,10,\

18,17,7d,f9,90,d4,39,92,4c,cf,f3,91,3a,e6,39,7f,30,0d,06,09,2a,86,48,86,f7,\

0d,01,01,05,05,00,30,63,31,0b,30,09,06,03,55,04,06,13,02,55,53,31,0b,30,09,\

06,03,55,04,08,13,02,46,6c,31,0e,30,0c,06,03,55,04,07,13,05,4f,63,61,6c,61,\

31,1d,30,1b,06,03,55,04,0a,13,14,49,6e,74,65,6c,6c,6f,6e,20,43,6f,72,70,6f,\

72,61,74,69,6f,6e,31,18,30,16,06,03,55,04,03,13,0f,49,6e,74,65,6c,6c,6f,6e,\

20,56,50,4e,20,43,41,30,1e,17,0d,30,35,30,36,30,34,31,35,31,37,35,39,5a,17,\

00,75,e8,19,67,2d,2c,00,50,3d,c9,bb

Now, this worked for me. Messing up with the registry can easily render the device inoperable, cause loss of data and/or require reinstaallation.

USE AT YOUR OWN RISK,

FURTHERMORE, DO NOT IMPORT ANY OF THE ACTUAL CONTENT IN THIS POST. IT IS JUST FOR ILLUSTRATION PURPOSES. DATA BEING EXPORTED AND IMPORTED DEPENDS ON THE CERTIFICATE!