• BlackBerry® Enterprise Server version 3.6 to 4.1
• Java® Runtime Environment (JRE)

The cacerts file is a keystore with certificate authority (CA) certificates, and it includes multiple trusted root CA certificates, such as VeriSign®. For the BlackBerry® Mobile Data Service or BlackBerry MDS to trust a web server, the BlackBerry Mobile Data Service or BlackBerry MDS must check that the web server certificate with the certificate authority. If the web server certificate is purchased from a trusted certificate authority, the check is successful because the issuer′s root CA certificate is in the cacerts file by default. If a private certificate authority is used to issue the web site certificate, the check fails and access to the website from the BlackBerry smartphone is either denied or a prompt to trust the certificate appears. To resolve this issue, perform one of the following:

• Import the private certificate authority′s root CA certificate and any relevant intermediate certificates into the cacerts file.
• Import the web server certificate into the cacerts file.

Note: The BlackBerry Mobile Data Service is included with BlackBerry Enterprise Server version 3.6 to 4.0. BlackBerry MDS is included with BlackBerry Enterprise Server version 4.1.

To import the certificate into the cacerts file, complete the following tasks:

Task 1 - Add the Java Bin folder to the Path environment variable (Optional)

Note: To assist the Key and Certificate Management Tool, add the path of the Java Bin directory to the Path environment variable. If the Java Bin directory is not added to the Path environment variable, commands require full path information.

To add the Java Bin folder to the Path environment variable, complete the following steps:

1. On the computer, right-click My Computer and choose Properties.
2. Click the Advanced tab.
3. Click Environment Variables.
4. Select Path in the System Variables list box and click Edit.
5. Go to the end of the text by pressing the End key on the keyboard.
6. Add ; to the end of the text followed by the path to the Java Bin directory.

Task 2 - Add a certificate to the BlackBerry Mobile Data Service or BlackBerry MDS certificate store

Note: The default keystore password is changeit.  The aliasname used in the commands below needs to be unique.

To add a certificate to the BlackBerry Mobile Data Service or BlackBerry MDS certificate store, complete the following steps:

1. Copy the certificatename.cer file to C:Program FilesJavajre1.5.0_06libsecurity.

   If the Java directory is not in the Path environment variable, type the following command at the C:Program FilesJavajre1.5.0_06in prompt to add the certificate to the cacerts file.

   keytool -import -trustcacerts -alias aliasname -file ..libsecuritycertificateName.cer -keystore ..libsecuritycacerts

   Or

   If the path statement exists for the Java Bin directory, type the following command from the C:Program FilesJavajre1.5.0_06libsecurity prompt:

   keytool -import -trustcacerts -alias aliasname -file certificateName.cer -keystore cacerts

2. Check that the cacerts file contains the updated information for the new alias and certificate.

   If the Java directory is not in the Path environment variable, type the following command at the C:Program FilesJavajre1.5.0_06in prompt to check that the cacerts file contains the updated information:

   keytool -list -v -keystore ..libsecuritycacerts

   Or

   If the path variable exists, type the following command from the C:Program FilesJavajre1.5.0_06libsecurity prompt:

   keytool -list -v -keystore cacerts

3. Once the cacerts file in the security folder contains the correct information, restart the BlackBerry Mobile Data Service or BlackBerry MDS Services for the changes to take effect.

   Important: Restarting certain BlackBerry Enterprise Server services delays email message delivery to BlackBerry smartphones. For more information, see KB04789.

If the following error message appears in the BlackBerry Mobile Data Service or BlackBerry MDS log file after accessing an HTTPS site from a BlackBerry smartphone, it might be caused by the web server′s certificate not being added to the cacerts file:

BlackBerry Enterprise Server version 3.6 to 4.1 SP5

<MDS-CS_1>:<DEBUG>:<LAYER = IPPP, URL [https://testsite/test.css] SSLException
[sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]>

BlackBerry Enterprise Server version 4.1 SP6

<MDS-CS_SERVERNAME_MDS-CS_1>:<DEBUG>:<LAYER = IPPP, Access Denied: Insecure SSL Request>