For quite some time now I was struggeling with my certificate, that I signed with my own CA for my Collax Business Server at home. There were two problems:
- I had no idea how to install the root certificate on my phone, from which I intend to access my emails as well as from my ubuntu desktop and anywhere else.
- Thunderbird (and other email clients) had some weird problem with the certificate: it complained that the used hostname didn’t match the one in the certificate, although the error dialog clearly showed the opposite. Unfortunatly also the otherwise always helpful support forum for the Collax Business Server was clueless.

A while after I created the issue with Thunderbird, somebody replied on it with the resolution. It’s actually not Thunderbird, which is wrong (except for providing a error dialog that is not very helpful in analysing the error condition), but the certificate. This is what I excpected, but I had no idea what to change in the certificate. It turned out that if you use alias names in your certificate, which I do because the server can be access under a variation of names (like blog.karroum.dyndns.org for our blogs and bilder.karroum.dyndns.org for the picture gallery), you need to repeat the CN of the certificate! Once I did that,Thunderbird was happy with only my own CA imported. Problem one resolved.
One problem remaining. How can I convince my phone that this is a trusted server for the encrypted connection? Up to recently, I had to confirm on every connection attempt to my own server that the certificate should be trusted. Importing the CA to symbian phone is not so easy as you might think it is.
The certificate has to be in binary DER format. Collax can export certificates only as PEM (which is Bas64 encoded), if you don’t want your private key to be included. Thus, I had to convert it first. In general Jacco de Leeuw’s article “Importing certificates on Symbian” was very helpful.
Converting the certificate to DER
It all boils down to download and install openssl and then issue the following command. In my case my exported PEM certificate was CA.crt, DER encoded certificate ended up in CA.cer:
openssl x509 -in CA.crt -out CA.cer -outform DER
Installing the certificate
After the certificate is in the right format for use with Symbian, you now have to install it in the phone. This sounds easier that it actually is. You have to transfer it to the phone, and then place it in the right … place. I mailed the certificate to myself, because I can access my emails from my mobile, but you could also use an internet service, where you can upload you certificate for you to access it with your mobile browser. By doing so you save the hassle of making sure your MIME types etc. are configured correctly for downloading certificates. How to install it in the phone after it’s on it, is also well described in above mentioned article from Jacco de Leeuw.
Conclusion
1) These days, nothing is simple.
2) Funny enough it works nice on my E90, but not on the N80i. The latter still asks me everytime, if my server can be trusted. No solution to that problem yet.