Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Afternoon all,

I have been asked to set-up a test Exchange 2010 machine in order to test the Exchange ActiveSync system as an alternative to our existing Blackberry mobile email solution. We intend on using Window 7 phones to hook into our Exchange system

So, to this end I have installed the server and installed a commercial SSL certificate. I have migrated a single mailbox across to the new server. I can access that mailbox quite happily in OWA and in desktop Outlook , all seems fine from that front.

I have a problem with the Exchange ActiveSync element though.

No matter what settings I use I cannot get the mobile phone to sync with the server.

The error I am getting is "You'll need a personal certificate to connect to mail.example.co.uk. Error code 85030027"

Now, my limited understanding[1] of our set-up is that we should not need personal certificates. The Exchange ActiveSync system is set to use Basic Authentication which should just be a plaintext username/password combination over SSL.

We've never needed to use EAS before, so I haven't done any further set-up other then accept the defaults. The handset is on our own internet wifi network so we should not need to worry about ensuring we can SSL traffic forwarded from the external IP to the internal machine at this point.

For reference I can access the OWA page under SSL and the certificate looks ok. If I manually visit the full path specified as the EAS URL then I get a username and password popup box which I understand to be normal.

I feel like I'm missing something silly and would really appreciate a point in the right direction.

Rob

  1. We have a fairly basic use for our existing Exchange 2003 server, we do not do anything complicated with it so have never needed to set-up external connections or integration with mobiles before. there is probably some piece of 'common' knowledge I am lacking.
share|improve this question
1  
Seems to be OK... Can you have a look at your IIS Settings for the Microsoft-Server-ActiveSync application? Anything about Client Certificate required there? –  MichelZ May 29 '12 at 15:12
    
I think you may be onto somethng. When I'm browsing to the EAS URL from the server I now get this message:- HTTP Error 403.7 - Forbidden I suppose I need to turn off mutual SSL,based on a quick Google. Never set SSL up before so have probably made a mistake. The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes. –  Rob May 29 '12 at 15:28
    
Odd thing is I'm sure I could access that page before and received a Username/Password popup prompt... –  Rob May 29 '12 at 15:33

1 Answer 1

Try the following in the Exchange Management Shell:

Set-ActiveSyncVirtualDirectory -Identity "T01\Microsoft-Server-ActiveSync (Default Web Site)" -ClientCertAuth Ignore

where T01 = your server name.

Or in the Exchange Management Console:

  • Server Configuration
  • Client Access
  • Exchange ActiveSync
  • Microsoft-Server-ActiveSync (Default Web Site)
  • Authentication

Make sure that Basic authentication is enabled, and Client certificate authentication is on "Ignore client certificates"

share|improve this answer
    
I can confirm that Basic Authentication is On and Client Certificates are set to Ignore. It was on Require, and I dropped it to Accept based on the previous suggestion. I'm also testing on an Android phone which is not connecting, but isn't giving any errors other than "Failed to connect to the Exchange server". –  Rob May 29 '12 at 15:56
    
I'm pretty sure it /is/ talking to the server since if I turn off the Require SSL option in my android client I get a message back immediately basically saying you need SSL on, but if within the IIS SSL settings for the Microsoft-Server-ActiveSync application if I untick the "Require SSL" option altogether that error goes away. That suggests there is some form of communication going on here. –  Rob May 29 '12 at 15:58
1  
Try to test Active Sync with this tool: testexchangeconnectivity.com That might tell you more detailed whats going on –  MichelZ May 29 '12 at 16:03
    
The problem I have with that is that I am not convinced our Pix firewall is correctly setup to forward external traffic just yet. all the testing we are doing is on our internal wifi network so far. –  Rob May 29 '12 at 16:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.