Blackberry Bold Series 9900 9930 User Guide

							2. Click Security > PGP .
3. Highlight a PGP® key.
4.  Press the 
 key >  Change Label .
5. Type a display name for the PGP key. 6. Click  OK.
Turn off the display name prompt that appears when you add a PGP key to the key store
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > PGP Keys .
3.  Press the 
 key >  Fetch PGP Keys .
4. Press the 
 key >  Options .
5. Clear the  Prompt For Label  check box.
6. Press the 
 key >  Save.
When you add a PGP® key, your BlackBerry® smartphone uses the name that the PGP® Universal Server set for the key when it generated the key.
Turn off the fetch status prompt that appears when you add a PGP key to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3.  Press the 
 key >  Fetch PGP Keys .
4. Press the 
 key >  Options .
• To download the revocation status of a PGP® key when you add it to the key store, change the  Fetch Status field to Yes.
• To add a PGP key to the key store without downloading the revocation status, change the  Fetch Status field to No.
5. Press the 
 key >  Save.
Certificate servers Add a certificate server1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3.  Press the 
 key >  New Server .
4. Specify information for the certificate server. 5. Press the 
 key >  Save.
Change connection information for a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Highlight a certificate server.
User GuideSecurity299 
						

							4.Press the  key >  Edit.
5. Change the connection information for the certificate server.
6. Press the 
 key >  Save.
Connection options for OCSP and CRL servers
OptionDescriptionFriendly NameType a display name for the certificate server.Server URLType the web address of the certificate server.
Connection options for LDAP-enabled servers and DSML-enabled servers
OptionDescriptionFriendly NameType a display name for the server.Server NameType the network address of the server.Base QueryType the base query information for the server using X.509 certificate syntax (for example, o=test.rim.net).PortType the port number for your organisation’s network. The default port number is 389.Authentication TypeSpecify whether you must log in to the server.Connection TypeSpecify whether your  BlackBerry® smartphone uses an SSL connection or a TLS connection
to connect to the server.
Send connection information for a certificate server
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Highlight a certificate server.
4.  Press the 
 key >  Email Server  or PIN Server .
Delete a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Highlight a certificate server.
4. Press the 
 key >  Delete .
User GuideSecurity300 
						

							Key storeAbout the key storeThe key store on your smartphone might store the following items:
• Personal certificates (certificate and private key pairs) • Certificates that you download using the BlackBerry® Desktop Software• Certificates that you download from an LDAP-enabled server or DSML-enabled server
• Certificates that you download from a certification authority profile
• Certificates that you import from your smartphone or a media card
• Certificates that you add from a message
• Root certificates that are included in the BlackBerry Desktop Software • Personal PGP® keys (public and private key pairs)
• PGP public keys that you download from an LDAP-enabled server • PGP public keys that you import from your smartphone or a media card
• PGP public keys that you add from a message
To access items in the key store, you must enter a key store password. If you exceed the number of allowed password
attempts, all your BlackBerry smartphone data is deleted.
Research In Motion recommends that you regularly create and save a back-up file on your computer, especially before you
update any software. Maintaining a current back-up file on your computer might allow you to recover smartphone data if your smartphone is lost, stolen or corrupted by an unforeseen issue.
Change the key store password
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3.  Press the 
 key >  Change Key Store Password .
Synchronise the key store password with the smartphone password
If you synchronise the key store password with your BlackBerry® smartphone password, when you change your smartphone password, the key store password changes to match it automatically.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Use Device Password as Key Store Password  field to Yes.
4. Press the 
 key >  Save.
Change when your smartphone deletes the key store password 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Key Store Password Timeout  field.
User GuideSecurity301 
						

							4.Press the  key >  Save.
To access private keys after your BlackBerry® smartphone deletes the key store password, you must type your key store password.
Add contacts to your Contacts application automatically when you add items to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Select the  Add Certificate Email to Contacts  check box.
4. Press the 
 key >  Save.
Change the service that your smartphone uses to download certificates Depending on your organisation, you might not be able to change the service that your BlackBerry® smartphone uses todownload certificates. For more information, contact your administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Certificate Service  field.
4. Press the 
 key >  Save.
Turn off automatic back-up and restore of key store data By default, items in the key store on your BlackBerry® smartphone are backed up or restored when you back up or restore yoursmartphone data. For security reasons, if you don't want to back up your private key to your computer or restore your private
key from your computer, you can turn off automatic back-up and restore of key store data.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Clear the  Allow Key Store Back-up/Restore  check box.
4. Press the 
 key >  Save.
To turn on automatic back-up and restore of key store data, select the  Allow Key Store Back-up/Restore check box.
Change the refresh rate for certificate revocation lists
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. In the  Certificate Status  section, change the  Expires After field.
4. Press the 
 key >  Save.
Your BlackBerry® smartphone downloads a new revocation status automatically when your smartphone uses a key store item with a status that is older than the time limit that you set.
User GuideSecurity302 
						

							Reject certificate revocation lists from unverified CRL servers1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Clear the  Accept Unverified CRLs  check box.
4. Press the 
 key >  Save.
Your BlackBerry® smartphone rejects certificate revocation lists from CRL servers that the BlackBerry® MDS Connection Service
cannot verify.
Smart cards About using a smart card with your smartphone
Smart cards store certificates and private keys. You can use a smart card reader to import certificates from a smart card to the
key store on your BlackBerry® smartphone, but you can't import private keys. As a result, private key operations such as signing
and decryption use the smart card, and public key operations such as verification and encryption use the public certificates on
your smartphone.
If you use a smart card certificate to authenticate with your smartphone, after you connect your smart card reader to your smartphone, your smartphone requests authentication from the smart card each time that you unlock your smartphone.
You can install multiple smart card drivers on your smartphone, including drivers for microSD smart cards, but you can only
authenticate to one smart card at a time. If you are authenticating using a microSD smart card and you want to transfer media files between your microSD smart card and your computer in mass storage mode, you must temporarily turn off two-factor
authentication or select a different authentication option.
If the S/MIME Support Package for BlackBerry® smartphones is installed on your smartphone, you can use smart card
certificates to send S/MIME-protected messages.
Turn on two-factor authentication
To perform this task, you must set a password for your BlackBerry® smartphone and have the smart card password that you received with your smart card.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
• To use a smart card and your smartphone password to unlock your smartphone, set the  Authentication Type field to
Smart Card .
• To use your connected smart card reader (even if the smart card is not inserted) and your smartphone password to unlock your smartphone, set the  Authentication Type field to Proximity . Select the  Prompt for Device Password  check
box.
3. Press the 
 key >  Save.
User GuideSecurity303 
						

							Import a certificate from a smart card1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3.  Press the 
 key >  Import Smart Card Certs .
4. Enter your smart card password.
5. Select the check box beside a certificate.
6. Click  OK.
7. Enter your key store password.
8. Click  OK.
Lock your smartphone when you remove your smart card from your smart card reader
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  Authentication Type field to Smart Card .
4. Select the  Lock On Card Removal  check box.
5. Press the 
 key >  Save.
Related information
I can't unlock my smartphone using my smart card, 312
About smart password entry
If you use advanced authentication and your BlackBerry® smartphone password or smart card password is numeric, you might
be able to use smart password entry in some password fields. When smart password entry is turned on, your smartphone is
designed to remember the format of a password that you type in a password field. When you type the password again, your smartphone applies a smart password filter to the password field. If the password is numeric, a 123 indicator appears beside
the password field and you do not have to press the Alt key to type numbers. If the password is alphanumeric, an ABC indicator
appears beside the password field.
To use smart password entry, advanced authentication must be turned on and the correct smart card driver and smart card reader must be installed on your smartphone.
Turn off smart password entry To perform this task, you must be using a smart card and a password to unlock your BlackBerry® smartphone.You can turn off smart password entry to reduce the chance that someone might guess your smartphone password or smart card password based on the smart password filter that your smartphone applies to password fields.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  Authentication Type field to Smart Card .
4. Clear the  Smart Password Entry  check box.
5. Press the 
 key >  Save.
User GuideSecurity304 
						

							To turn on smart password entry again, check the Smart Password Entry check box.
Turn off notification for smart card connections
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Smart Card .
3. Clear the  LED Session Indicator  check box.
4. Press the 
 key >  Save.
To turn on the notification for smart card connections, select the  LED Session Indicator check box.
Switch smart password filters
In a blank password field, press the 
 key.
The indicator for the new smart password filter appears beside the password field.
Prerequisites: Using authentication certificates
• Your BlackBerry® smartphone must have the correct smart card driver and smart card reader driver installed.
• You must have imported a certificate from your smart card that you can use for signing and verification.
• You must turn on advanced authentication. • You must have set a smartphone password.
• You must have the smart card password that you received with your smart card.
Use a certificate to authenticate your smart card
To perform this task, you must be using a smart card and a password to unlock your BlackBerry® smartphone. If you use a certificate to authenticate your smart card, the certificate authenticates your smart card whenever you use your
smart card to unlock your smartphone.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  User Authenticator field to Smart card .
4. Change the  Authentication Certificate  field.
5. Press the 
 key >  Save.
To stop using a certificate to authenticate your smart card, change the  Authentication Certificate field to None.
Check the status of your authentication certificate automatically
To perform this task, you must be using a smart card and a password to unlock your BlackBerry® smartphone.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Password .
User GuideSecurity305 
						

							3. If necessary, change the Authentication Type field to Smart Card .
4. Change the  Certificate Status Check  field.
5. Press the 
 key >  Save.
If your smartphone checks the status of your authentication certificate and finds that it is revoked or expired, your smartphone locks.
Store the passphrase for your smart card on your smartphone
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Smart Card .
3. Select the  PIN Caching check box.
4. Press the 
 key >  Save.
Your BlackBerry® smartphone stores the passphrase for the same length of time as it stores your key store password.
VPN settings Depending on the options that your administrator has set for you, this feature might not be supported.
About VPN profiles
A VPN profile contains the information that you require to log in to your organisation's network over VPN. Depending on your
organisation, you might have more than one VPN profile on your BlackBerry® smartphone. For more information about VPN
profiles, contact your administrator.
Log in to a VPN
• To perform this task, your work email account must use a BlackBerry® Enterprise Server that supports this feature. For more information, contact your administrator.
• If you use a software token to log in to a VPN, the software token must be on your smartphone and the software token information that appears in the VPN profile must be correct.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. To connect to your organisation's network, click  Log in.
Change the user name and password for a VPN profile 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. Highlight a VPN profile.
4. Press the 
 key >  Edit.
5. In the  User name  field, type a new user name.
6. In the  Password field, type a new password.
User GuideSecurity306 
						

							7.Press the  key >  Save.
About software tokens You might need a software token to log in to a VPN. A software token includes a token code that your smartphone regeneratesperiodically and a PIN. For more information about software tokens, contact your administrator.
Change the software token for a VPN profile
To perform this task, the software token that you want to use must be installed on your BlackBerry® smartphone. For more information, contact your administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. Highlight a VPN profile.
4. Press the 
 key >  Edit.
5. Change the  Software Token Serial Number  field.
6. Press the 
 key >  Save.
Change the PIN for a software token on your smartphone 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Software Tokens .
3. Click a software token >  Specify PIN.
Verify security software manually Security self-tests are designed to verify that security software is implemented correctly on your BlackBerry® smartphone. The
tests should run automatically after you restart your smartphone, but you can also verify security software manually.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Security Status Information .
3.  Press the 
 key >  Verify Security Software .
Third-party application control About permissions for third-party applications
You or your administrator can set permissions that control how third-party applications on your BlackBerry® smartphone
interact with the other applications on your smartphone. For example, you can control whether third-party applications can access data or the Internet, make calls or use Bluetooth® connections.
If you have added third-party applications to your smartphone, your smartphone is designed to prevent these applicationsfrom sending or receiving data without your knowledge. Before a third-party application sends or receives data, you might be prompted to accept or deny the connection request. For a selected application, you can change this prompt for a specific
location or resource.
User GuideSecurity307 
						

							Set permissions for a third-party application
Note:  Changing permissions for third-party applications can significantly affect the operation of applications on your
BlackBerry® smartphone. For more information about how changing these permissions might affect the operation of the
applications on your smartphone, contact your wireless service provider or administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Device > Application Management .
• To set permissions for a specific third-party application, highlight the application. Press the 
 key >  Edit
Permissions .
• To set permissions for all third-party applications, press the 
 key >  Edit Default Permissions .
3. Select  Connections, Interactions  or User Data  fields and press the [BlackBerry menu icon] key >  Expand or Collapse.
4. Change the permission fields. 5. Press the 
 key >  Save.
Related information
Interaction permissions for third-party applications, 309
Data permissions for third-party applications, 310
Reset connection permissions for third-party applications1. On the Home screen or in a folder, click the  Options icon.
2. Click  Device > Application Management .
3.  Press the 
 key >  Edit Default Permissions .
4.  Press the 
 key >  Reset All Firewall Prompts .
5.  Press the 
 key >  Apply Defaults to All .
About direct Internet connections for third-party applications Some third-party applications that you add to your BlackBerry® smartphone might require a direct TCP or HTTP connection tothe Internet. For example, a stock price application might need to connect to the Internet to retrieve the latest stock prices.You might have to set the APN that the third-party application uses for this connection.
Set up a direct Internet connection for a third-party application
To get the user name and password for the APN, contact your wireless service provider.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Device > Advanced System Settings  > TCP IP .
3. Select APN settings and type the APN information. 4. Press the 
 key >  Save.
Turn on safe mode When you start your BlackBerry® smartphone, you can turn on safe mode to prevent third-party applications from runningautomatically. This safe mode enables you to troubleshoot or remove any unwanted applications.
User GuideSecurity308