Blackberry 9788 Smartphone 6 0 User Guide

							PropertyDescriptionSHA1 ThumbprintThis field displays the SHA-1 digital thumbprint of the certificate.MD5 ThumbprintThis field displays the MD5 digital thumbprint of the 
certificate.
View one type of certificate in the certificate list
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Press the  key.
4.Click one of the following menu items:
•Show Personal Certificates
•Show Others' Certificates
•Show CA Certificates
•Show Root Certificates
To view all the certificates on your BlackBerry® device, press the  key > Show All Certificates.
Send a certificate
When you send a certificate, your BlackBerry® device sends the public key, but does not send the corresponding private key.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Send via Email or Send via PIN.
Delete a certificate
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Delete.
View the certificate chain for a certificate
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Show Chain.
User GuideSecurity279 
						

							Certificate status
Status indicators for certificates and certificate authority profiles
Status indicators for certificates
IndicatorDescriptionThe certificate has a corresponding private key that is stored on your BlackBerry® device or a smart 
card.The certificate chain is trusted and valid, and the revocation status of the certificate chain is good.The revocation status of the certificate chain is unknown, or a public key for a certificate in the 
certificate chain is weak.The certificate is untrusted or revoked, or a certificate in the certificate chain is untrusted, revoked, 
expired, not valid, or cannot be verified.
Status indicators for certificate authority profiles
IndicatorDescriptionA valid certificate is associated with the certificate authority profile.A new certificate is being retrieved because the current certificate is scheduled to expire soon.The enrollment request is pending approval from the certificate authority.Enrollment with the certificate authority profile is pending because an action from the user is 
required to continue, or because enrollment is scheduled to occur later.Enrollment with the certificate authority profile is required and will occur automatically.
Check the revocation status of a certificate or certificate chain
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Fetch Status or Fetch Chain Status.
Change the trust status of a certificate
Depending on the types of certificates that your administrator allows, you might not be able to trust some types of certificates.
1.On the Home screen or in a folder, click the Options icon.
User GuideSecurity280 
						

							2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Trust or Distrust.
5.If you are trusting a certificate, do one of the following:
•To trust the highlighted certificate, click Selected Certificate.
•To trust the highlighted certificate and all the other certificates in the chain, click Entire Chain.
Revoke a certificate
If you revoke a certificate, the certificate is revoked only in the key store on your BlackBerry® device. Your device does not 
update the revocation status on the certificate authority or CRL servers.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Revoke > Yes.
5.Change the Reason field.
6.Click OK.
To cancel a certificate hold, highlight the certificate. Press the  key > Cancel Hold.
Certificate revocation reasons
ReasonDescriptionUnknownThe revocation reason does not match any of the predefined reasons.Key CompromiseA person who is not the key subject might have discovered the private key value.CA CompromiseSomeone might have revealed the private key of the certificate issuer.Change in AffiliationThe certificate subject no longer works for the organization.SupersededA new certificate is replacing an existing certificate.Cessation of OperationThe certificate subject no longer requires the certificate.Certificate HoldYou want to revoke the certificate temporarily.
Certificate options
Change the display name for a certificate
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
User GuideSecurity281 
						

							4.Press the  key > Change Label.
5.Type a display name for the certificate.
6.Click OK.
Add an email address to a certificate
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Highlight a certificate.
4.Press the  key > Associate Addresses.
5.Press the  key > Add Address.
6.Do one of the following:
•Click a contact.
•Click Use Once. Type an email address. Press the  key on the keyboard.
7.Press the  key > Save.
Turn off the display name prompt that appears when you add a certificate to the key store
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Press the  key > Fetch Certificates.
4.Press the  key > Options.
5.Clear the Prompt for Label checkbox.
6.Press the  key > Save.
When you add a certificate, your BlackBerry® device uses the certificate subject as the name for the certificate.
Turn off the fetch status prompt that appears when you add a certificate to the key store
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates.
3.Press the  key > Fetch Certificates.
4.Press the  key > Options.
•To download the revocation status of a certificate when you add it to the key store, change the Fetch Status field to 
Yes.
•To add a certificate to the key store without downloading the revocation status, change the Fetch Status field to No.
5.Press the  key > Save.
User GuideSecurity282 
						

							Change how often a certificate authority profile checks certificate status
Depending on your organization, you might be able to change how often a certificate authority profile checks the status of its certificate. If the certificate is scheduled to expire soon you can re-enroll with the certificate authority profile to receive an 
updated certificate.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificate Enrollment.
3.Change the Certificate Revocation Check Interval field.
4.Press the  key > Save.
PGP keys
About PGP keys
If your email account uses a BlackBerry® Enterprise Server that supports this feature, you can download PGP® keys over the  wireless network from a certificate server provided by your administrator. Depending on your organization, enrollment for a 
certificate might be required and might also occur automatically.
PGP keys allow you to send and receive PGP messages using your BlackBerry® device if you are already sending and receiving  PGP messages on your computer.
PGP key basics
Download a PGP key from an LDAP-enabled server
If you use the PGP® Universal Server, you might not be able to download PGP keys from an LDAP-enabled server.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > PGP Keys.
3.Press the  key > Fetch PGP Keys.
4.Specify the search criteria.
5.Press the  key > Search.
6.Click a PGP key.
7.Click Add PGP Key to Key Store.
Download a personal PGP key from the PGP Universal Server
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Press the  key > Download Keys.
User GuideSecurity283 
						

							Download an updated PGP key from an LDAP-enabled server
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Fetch Updated PGP Key.
Import a certificate or PGP key that is saved on your device
1.On the Home screen or in a folder, click the Media icon or Files icon.
2.Find and highlight a certificate or PGP® key.
3.Press the  key > Import Certificate or Import PGP Key.
To view the certificate or PGP key, press the  key > Display Certificate or Display PGP Key.
Import a certificate or PGP key from a media card
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificates or PGP.
3.Press the  key > Show Media Card Certificates or Show Media Card PGP Keys.
To view the certificate or PGP® key, press the  key > Display Certificate or Display PGP Key.
View properties for a PGP key
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Click a PGP® key.
4.Click View Subkey.
PGP key properties
PropertyDescriptionRevocation StatusThis field displays the revocation status of the PGP® key at a specified date and time.Trust StatusThis field displays the trust status of the PGP key. A PGP key can be explicitly trusted (the 
PGP key itself is trusted), implicitly trusted (the PGP key is associated with a private key on  your BlackBerry® device), or not trusted (the PGP key is not explicitly trusted and is not 
associated with a trusted PGP key on your device, and a chain of digital signatures to a  trusted key does not exist).Creation DateThis field displays the date that the PGP® Universal Server generated the PGP key.User GuideSecurity284 
						

							PropertyDescriptionExpiration DateThis field displays the date that the PGP Universal Server specified as the expiration date 
of the PGP key.Email AddressThis field displays the email address that is associated with the PGP key. Multiple Email 
Address fields might appear.Public Key TypeThis field displays the standard to which the public key complies. Your device supports 
RSA®, DSA, and Diffie-Hellman keys.Key UsageThis field displays approved uses of the PGP key.FingerprintThis field displays the PGP key fingerprint in hexadecimal format.
Send a PGP key
When you send a PGP® key, your BlackBerry® device sends the public key, but does not send the corresponding private key.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP key.
4.Press the  key > Send via Email or Send via PIN.
Delete a PGP key
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Delete.
Clear the PGP data cache
The PGP® data cache contains cached PGP public keys and the PGP® Universal Server policy that your BlackBerry® device 
downloads from the PGP Universal Server.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Press the  key > Clear Universal Cache.
The next time that you send a PGP protected message, your device downloads an updated PGP Universal Server policy and 
updated PGP public keys from the PGP Universal Server.
User GuideSecurity285 
						

							PGP key status
PGP key status indicators
IndicatorDescriptionThe PGP® key has a corresponding private key that is stored on your BlackBerry® device.The PGP key is trusted and valid, and the revocation status of the PGP key is good.The revocation status of the PGP key is unknown or the key is weak.The PGP key is untrusted, revoked, expired, not valid, or cannot be verified.
Check the revocation status of a PGP key
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Fetch Status.
Change the trust status of a PGP key
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Trust or Distrust.
Revoke a PGP key
If you revoke a PGP® key, the PGP key is revoked only in the key store on your BlackBerry® device. Your device does not update 
the revocation status on the PGP® Universal Server.
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Revoke > Yes.
5.Change the Reason field.
6.Click OK.
User GuideSecurity286 
						

							PGP key revocation reasons
ReasonDescriptionUnknownThe revocation reason does not match any of the predefined reasons.SupersededA new PGP® key is replacing an existing PGP key.Key CompromiseA person who is not the key subject might have discovered the private key value.Key RetiredThe PGP key is no longer used.User ID InvalidThe user information for the PGP key is not valid.
PGP key options
Change the display name for a PGP key
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Highlight a PGP® key.
4.Press the  key > Change Label.
5.Type a display name for the PGP key.
6.Click OK.
Turn off the display name prompt that appears when you add a PGP key to the key store
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Press the  key > Fetch PGP Keys.
4.Press the  key > Options.
5.Change the Prompt for Label field to No.
6.Press the  key > Save.
When you add a PGP® key, your BlackBerry® device uses the name that the PGP® Universal Server set for the key when it 
generated the key.
Turn off the fetch status prompt that appears when you add a PGP key to the key store
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > PGP.
3.Press the  key > Fetch PGP Keys.
4.Press the  key > Options.
User GuideSecurity287 
						

							•To download the revocation status of a PGP® key when you add it to the key store, change the Fetch Status field to Yes.
•To add a PGP key to the key store without downloading the revocation status, change the Fetch Status field to No.
5.Press the  key > Save.
Troubleshooting: PGP keys
I cannot download a PGP key from an LDAP-enabled server
Try the following actions:
•Verify that your organization permits you to download PGP® keys from an LDAP-enabled server. For more information, contact your administrator.
•If you changed the connection type that your BlackBerry® device uses to connect to an LDAP-enabled server, try using 
the default connection type.
Certificate servers
Add a certificate server
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificate Servers.
3.Press the  key > New Server.
4.Specify information for the certificate server.
5.Press the  key > Save.
Change connection information for a certificate server
1.On the Home screen or in a folder, click the Options icon.
2.Click Security > Advanced Security Settings > Certificate Servers.
3.Highlight a certificate server.
4.Press the  key > Edit.
5.Change the connection information for the certificate server.
6.Press the  key > Save.
Connection options for OCSP and CRL servers
OptionDescriptionFriendly NameType a display name for the certificate server.User GuideSecurity288