HTTPS certificate issue

[sandypop]

Hello Nokia,
My midlet application is communicating with HTTPS url.
Its working fine on Nokia 5130 XpressMusic but on Nokia 5220 XpressMusic getting "certificate error".

Certificate information:
Verisign Class 3 Extended Validation SSL CA
Version: V3
Signature Algorithm: sha1RSA
Public Key: RSA(2048 bits)

Thanks In Advance
Sandeep

[hartti]

That certificate is probably missing from your phone. Have you tried installing the certificate?

Hartti

[skalogir]

Hi sandypop,

It could also be that the root certificate used to authenticate the Web Server (that uses the Verisign Class 3 Extended Validation SSL CA) is already on your 5220 XpressMusic but the server authentication option is disabled for the root.

Based on the information from VeriSign here:
http://www.verisign.com/support/roots.html

It seems that the following root certificate is used for the authentication of the Web Server you are trying to contact: VeriSign Class 3 Public Primary

Try to find this root certificate on your device as follows:
Go to Menu>Settings>Security>Authority Certificates>

If you find Versign Class 3 Public Primary in the list of certificates do the following:
Highlight VeriSign Class 3 Public Primary>Options>Select Use>Enable Server authentication

[traud]

Its working fine on Nokia 5130 XpressMusic but on Nokia 5220 XpressMusic getting "certificate error".

Both devices are from the same platform release (and edition). Therefore this is rather curious and interesting issue. Make sure you include all intermediates and in the right order:

1. your certificate
2. VeriSign Class 3 Extended Validation SSL CA
3. VeriSign Class 3 Public Primary Certification Authority - G5

The latter extends to Class 3 Public Primary Certification Authority (no G2 or G5) which comes with every Nokia mobile phone for ages. No need to include that within your server.

Check your server with tools like

openssl s_client -crlf -connect www.verisign.com:443

VeriSign itself uses the SGC, so do not worry about their chain of certificates. If your server is correct, perhaps the date on your phone is using the wrong year. Or someone deleted the certificate authority. This happens sometimes while updating to a newer firmware.