Blackberry Bold Series 9900 9930 User Guide

							Download a certificate from a certificate authority
To perform this task, your work email account must use a BlackBerry® Enterprise Server that supports this feature. For more information, contact your administrator.
If your administrator has provided you with a certificate authority profile, you can enrol with the profile to download acertificate to your BlackBerry smartphone. If the certificate is scheduled to expire soon, you can re-enrol to receive an updated certificate.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Enrolment  > Enrol  or Re-enrol .
3. If necessary, type the credentials that you use to connect to your organisation's network.
To hide the screen for the certificate authority profile while the request is being processed, press the 
 key >  Hide. To
return to this screen, on the Home screen, click the  Certificate Authority Profile icon.
Related information
I can't download a certificate, 312
Import a certificate or PGP key that is saved on your smartphone
1. On the Home screen or in a folder, click the  Media icon or  Files icon.
2. Find and highlight a certificate or PGP® key.
3.  Press the 
 key >  Import Certificate  or Import PGP Key .
To view the certificate or PGP key, press the 
 key >  View Certificate or Display Certificate  or Display PGP Key .
Import a certificate or PGP key from a media card
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security  > Advanced Security Settings  > Certificates  or PGP Keys .
3.  Press the 
 key >  Show Media Card Certs  or Import Media Card PGP Keys .
To view the details for a certificate or PGP® key, press the 
 key >  Details .
Install a root certificate on your smartphone You might not be able to connect to some Wi-Fi® networks until you install a root certificate on your BlackBerry® smartphone.You can install the root certificate on your computer, and then use the BlackBerry® Desktop Software to synchronise the rootcertificate between your smartphone and your computer. For more information, see the Help in the BlackBerry DesktopSoftware or contact your administrator.
View properties for a certificate
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Click a certificate.
User GuideSecurity289 
						

							Certificate properties
PropertyDescriptionRevocation StatusThis field displays the revocation status of the certificate at a
specified date and time.Trust StatusThis field displays the trust status of the certificate chain. A
certificate can be explicitly trusted (the certificate itself is trusted), implicitly trusted (the root certificate in the
certificate chain is trusted on your BlackBerry® smartphone)
or not trusted (the certificate isn't explicitly trusted and the root certificate in the certificate chain isn't trusted or doesn't
exist on your smartphone).Expiration DateThis field displays the expiry date of the certificate, as specified by the certificate issuer.Certificate TypeThis field displays the certificate format. Your smartphonesupports X.509 and WTLS certificate formats.Public Key TypeThis field displays the standard to which the public keycomplies. Your smartphone supports RSA®, DSA, Diffie-
Hellman and ECC keys.SubjectThis field displays information about the certificate subject.IssuerThis field displays information about the certificate issuer.Serial NumberThis field displays the certificate serial number in hexadecimal
format.Key UsageThis field displays approved uses of the public key.Subject Alt NameThis field displays an alternative email address for the certificate subject, if an alternative email address is available.Signature AlgorithmThis field displays the algorithm that the certificate issuer used
to generate the digital signature.SHA1 ThumbprintThis field displays the SHA-1 digital thumbprint of the
certificate.MD5 ThumbprintThis field displays the MD5 digital thumbprint of the
certificate.User GuideSecurity290 
						

							View one type of certificate in the certificate list1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Press the 
 key.
4. Click one of the following menu items: •Show Personal Certificates
• Show Others' Certificates
• Show CA Certificates
• Show Root Certificates
To view all the certificates on your BlackBerry® smartphone, press the 
 key >  Show All Certificates .
Send a certificate
When you send a certificate, your BlackBerry® smartphone sends the public key, but doesn't send the corresponding private key.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Send via Email  or Send via PIN .
Delete a certificate 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4. Press the 
 key >  Delete .
View the certificate chain for a certificate
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Show Chain .
Certificate status
Status indicators for certificates and certificate authority profiles Status indicators for certificates
User GuideSecurity291 
						

							IndicatorDescriptionThe certificate has a corresponding private key that is stored on your BlackBerry® smartphone or a
smart card.The certificate chain is trusted and valid, and the revocation status of the certificate chain is good.The revocation status of the certificate chain is unknown, or a public key for a certificate in the
certificate chain is weak.The certificate is untrusted or revoked, or a certificate in the certificate chain is untrusted, revoked, expired, not valid or cannot be verified.
Status indicators for certificate authority profiles
IndicatorDescriptionA valid certificate is associated with the certificate authority profile.A new certificate is being retrieved because the current certificate is scheduled to expire soon.The enrolment request is pending approval from the certificate authority.Enrolment with the certificate authority profile is pending because an action from the user is
required to continue, or because enrolment is scheduled to occur later.Enrolment with the certificate authority profile is required and will occur automatically.
Check the revocation status of a certificate or certificate chain
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Fetch Status  or Fetch Chain Status .
Change the trust status of a certificate
Depending on the types of certificates that your administrator allows, you might not be able to trust some types of certificates.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Trust or Distrust .
5. If you trust a certificate, do one of the following: • To trust the highlighted certificate, click  Selected Certificate.
User GuideSecurity292 
						

							• To trust the highlighted certificate and all the other certificates in the chain, click Entire Chain.
Revoke a certificate
If you revoke a certificate, the certificate is revoked only in the key store on your BlackBerry® smartphone. Your smartphone
doesn't update the revocation status on the certificate authority or CRL servers.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Revoke  > Yes .
5. Change the  Reason field.
6. Click  OK.
To cancel a certificate hold, highlight the certificate. Press the 
 key >  Cancel Hold .
Certificate revocation reasons
ReasonDescriptionUnknownThe revocation reason does not match any of the predefined reasons.Key CompromiseA person who is not the key subject might have discovered the private key value.CA CompromiseSomeone might have revealed the private key of the certificate issuer.Change in AffiliationThe certificate subject no longer works for the organisation.SupersededA new certificate is replacing an existing certificate.Cessation of OperationThe certificate subject no longer requires the certificate.Certificate HoldYou want to revoke the certificate temporarily.
Certificate options
Change the display name for a certificate
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Change Label .
5. Type a display name for the certificate. 6. Click  OK.
User GuideSecurity293 
						

							Add an email address to a certificate1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Highlight a certificate.
4.  Press the 
 key >  Associate Addresses .
5.  Press the 
 key >  Add Address .
6. Do one of the following: • Click a contact.
• Click  Use Once . Type an email address. Press the 
 key on the keyboard.
7. Press the 
 key >  Save.
Turn off the display name prompt that appears when you add a certificate to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3.  Press the 
 key >  Fetch Certificates .
4. Press the 
 key >  Options .
5. Clear the  Prompt for Label  checkbox.
6. Press the 
 key >  Save.
When you add a certificate, your BlackBerry® smartphone uses the certificate subject as the name for the certificate.
Turn off the fetch status prompt that appears when you add a certificate to the key store
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3.  Press the 
 key >  Fetch Certificates .
4. Press the 
 key >  Options .
• To download the revocation status of a certificate when you add it to the key store, change the  Fetch Status field to
Yes .
• To add a certificate to the key store without downloading the revocation status, change the  Fetch Status field to No.
5. Press the 
 key >  Save.
Change how often a certificate authority profile checks certificate status Depending on your organisation, you might be able to change how often a certificate authority profile checks the status of its
certificate. If the certificate is scheduled to expire soon you can re-enrol with the certificate authority profile to receive an
updated certificate.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Enrolment .
3. Change the  Certificate Revocation Check Interval  field.
User GuideSecurity294 
						

							4.Press the  key >  Save.
PGP keys About PGP keys
If your work email account uses a BlackBerry® Enterprise Server that supports this feature, you can download PGP® keys over the wireless network from a certificate server provided by your administrator. Depending on your organisation, enrolment for a certificate might be required and might also occur automatically.
PGP keys allow you to send and receive PGP messages using your BlackBerry smartphone if you're already sending andreceiving PGP messages on your computer.
PGP key basics
Download a PGP key from an LDAP-enabled server If you use the PGP® Universal Server, you might not be able to download PGP keys from an LDAP-enabled server.1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > PGP Keys .
3.  Press the 
 key >  Fetch PGP Keys .
4. Specify the search criteria.
5. Press the 
 key >  Search .
6. Click a PGPkey.
7. Click  Add PGP® Key to Key Store .
Related information I can't download a PGP key from an LDAP-enabled server, 312
Download a personal PGP key from the PGP Universal Server
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3.  Press the 
 key >  Download Keys .
Download an updated PGP key from an LDAP-enabled server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Highlight a PGP® key.
4.  Press the 
 key >  Fetch Updated PGP Key .
Import a certificate or PGP key that is saved on your smartphone
1. On the Home screen or in a folder, click the  Media icon or  Files icon.
User GuideSecurity295 
						

							2. Find and highlight a certificate or PGP® key.
3.  Press the 
 key >  Import Certificate  or Import PGP Key .
To view the certificate or PGP key, press the 
 key >  View Certificate or Display Certificate  or Display PGP Key .
Import a certificate or PGP key from a media card
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security  > Advanced Security Settings  > Certificates  or PGP Keys .
3.  Press the 
 key >  Show Media Card Certs  or Import Media Card PGP Keys .
To view the details for a certificate or PGP® key, press the 
 key >  Details .
View properties for a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Click a PGP® key.
4. Click  View Subkey .
PGP key properties
PropertyDescriptionRevocation StatusThis field displays the revocation status of the PGP® key at a specified date and time.Trust StatusThis field displays the trust status of the PGP key. A PGP key can be explicitly trusted (the
PGP key itself is trusted), implicitly trusted (the PGP key is associated with a private key on
your BlackBerry®  smartphone), or not trusted (the PGP key isn't explicitly trusted and isn't
associated with a trusted PGP key on your smartphone, and a chain of digital signatures to a trusted key doesn't exist).Creation DateThis field displays the date that the PGP® Universal Server generated the PGP key.Expiration DateThis field displays the date that the PGP Universal Server specified as the expiry date of the
PGP key.Email AddressThis field displays the email address that is associated with the PGP key. Multiple Email Address fields might appear.Public Key TypeThis field displays the standard to which the public key complies. Your smartphone supports
RSA®, DSA and Diffie-Hellman keys.Key UsageThis field displays approved uses of the PGP key.FingerprintThis field displays the PGP key fingerprint in hexadecimal format.User GuideSecurity296 
						

							Send a PGP keyWhen you send a PGP® key, your BlackBerry® smartphone sends the public key, but doesn't send the corresponding private
key.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > PGP Keys .
3. Highlight a PGP key.
4.  Press the 
 key >  Send via Email  or Send via PIN .
Delete a PGP key
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Highlight a PGP® key.
4. Press the 
 key >  Delete .
Clear the PGP data cache The PGP® data cache contains cached PGP public keys and the PGP® Universal Server policy that your BlackBerry® smartphone
downloads from the PGP Universal Server.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3.  Press the 
 key >  Clear Universal Cache .
The next time that you send a PGP protected message, your smartphone downloads an updated PGP Universal Server policy
and updated PGP public keys from the PGP Universal Server.
PGP key status
PGP key status indicators
IndicatorDescriptionThe PGP® key has a corresponding private key that is stored on your BlackBerry® smartphone.The PGP key is trusted and valid, and the revocation status of the PGP key is good.The revocation status of the PGP key is unknown or the key is weak.The PGP key is untrusted, revoked, expired, not valid or cannot be verified.User GuideSecurity297 
						

							Check the revocation status of a PGP key
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Highlight a PGP® key.
4.  Press the 
 key >  Fetch Status .
Change the trust status of a PGP key
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Highlight a PGP® key.
4.  Press the 
 key >  Trust or Distrust .
Revoke a PGP key If you revoke a PGP® key, the PGP key is revoked only in the key store on your BlackBerry® smartphone. Your smartphone
doesn't update the revocation status on the PGP® Universal Server.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > PGP Keys .
3. Highlight a PGP key.
4.  Press the 
 key >  Revoke  > Yes .
5. Change the  Reason field.
6. Click  OK.
PGP key revocation reasons
ReasonDescriptionUnknownThe revocation reason does not match any of the predefined reasons.SupersededA new PGP® key is replacing an existing PGP key.Key CompromiseA person who is not the key subject might have discovered the private key value.Key RetiredThe PGP key is no longer used.User ID InvalidThe user information for the PGP key is not valid.
PGP key options
Change the display name for a PGP key
1. On the Home screen or in a folder, click the  Options icon.
User GuideSecurity298