I have been asked to set-up a test Exchange Server 2010 machine in order to test the Exchange ActiveSync system as an alternative to our existing Blackberry mobile email solution. We intend on using Windows 7 phones to hook into our Exchange system.

I have installed the server and installed a commercial SSL certificate. I have migrated a single mailbox across to the new server. I can access that mailbox quite happily in OWA and in desktop Outlook , all seems fine from that front.

I have a problem with the Exchange ActiveSync element though.

No matter what settings I use I cannot get the mobile phone to sync with the server.

The error I am getting is:

You'll need a personal certificate to connect to mail.example.co.uk. Error code 85030027

Now, my limited understanding[1] of our set up is that we should not need personal certificates. The Exchange ActiveSync system is set to use Basic Authentication which should just be a plaintext username/password combination over SSL.

We've never needed to use Exchange ActiveSync before, so I haven't done any further set up other then accept the defaults. The handset is on our own internet wifi network so we should not need to worry about ensuring we can SSL traffic forwarded from the external IP to the internal machine at this point.

For reference I can access the OWA page under SSL and the certificate looks ok. If I manually visit the full path specified as the Exchange ActiveSync URL then I get a username and password popup box which I understand to be normal.

I feel like I'm missing something silly and would really appreciate a point in the right direction.

[1] We have a fairly basic use for our existing Exchange Server 2003, we do not do anything complicated with it so have never needed to set up external connections or integration with mobiles before. There is probably some piece of 'common' knowledge I am lacking.

  • 1
    Seems to be OK... Can you have a look at your IIS Settings for the Microsoft-Server-ActiveSync application? Anything about Client Certificate required there? – MichelZ May 29 '12 at 15:12
  • I think you may be onto somethng. When I'm browsing to the EAS URL from the server I now get this message:- HTTP Error 403.7 - Forbidden I suppose I need to turn off mutual SSL,based on a quick Google. Never set SSL up before so have probably made a mistake. The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes. – Rob May 29 '12 at 15:28
  • Odd thing is I'm sure I could access that page before and received a Username/Password popup prompt... – Rob May 29 '12 at 15:33

Try the following in the Exchange Management Shell:

Set-ActiveSyncVirtualDirectory -Identity "T01\Microsoft-Server-ActiveSync (Default Web Site)" -ClientCertAuth Ignore

Where T01 is your server name.


  1. Navigate to Exchange Management Console > Server Configuration > Client Access > Exchange ActiveSync > Microsoft-Server-ActiveSync (Default Web Site) > Authentication.
  2. Make sure that Basic authentication is set to Enabled.
  3. Make sure that Client certificate authentication is set to Ignore client certificates.
  • I can confirm that Basic Authentication is On and Client Certificates are set to Ignore. It was on Require, and I dropped it to Accept based on the previous suggestion. I'm also testing on an Android phone which is not connecting, but isn't giving any errors other than "Failed to connect to the Exchange server". – Rob May 29 '12 at 15:56
  • I'm pretty sure it /is/ talking to the server since if I turn off the Require SSL option in my android client I get a message back immediately basically saying you need SSL on, but if within the IIS SSL settings for the Microsoft-Server-ActiveSync application if I untick the "Require SSL" option altogether that error goes away. That suggests there is some form of communication going on here. – Rob May 29 '12 at 15:58
  • 1
    Try to test Active Sync with this tool: testexchangeconnectivity.com That might tell you more detailed whats going on – MichelZ May 29 '12 at 16:03
  • The problem I have with that is that I am not convinced our Pix firewall is correctly setup to forward external traffic just yet. all the testing we are doing is on our internal wifi network so far. – Rob May 29 '12 at 16:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.