Blackberry Storm 2 Instruction Manual

							7. Press the Menu key.
8. Click  Options.
9. Perform one of the following actions: • To download the revocation status of a certificate when you add it to the key store, change the  Fetch Status field to Yes.
• To add a certificate to the key store without downloading the revocation status, change the  Fetch Status field to No.
10. Press the  Menu key.
11. Click  Save.
Change how often a certificate authority profile checks certificate status
Depending on your organization, you might be able to change how often a certificate authority profile checks the status of its certificate. If the
certificate is scheduled to expire soon you can re-enroll with the certificate authority profile to receive an updated certificate.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Certificate Authority Profile .
5. Change the  Certificate Status Check Interval  field.
6. Press the  Menu key.
7. Click  Save.
PGP keys
PGP key basics
Download a PGP key from an LDAP certificate server If you use the PGP® Universal Server, you might not be able to download PGP keys from an LDAP certificate server.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP keys .
5. Press the  Menu key.
6. Click  Fetch PGP Keys .
7. Specify the search criteria.
8. Press the  Menu key.
9. Click  Search.
10. Click a PGP key.
11. Click  Add PGP Key to Key Store .User GuideSecurity269 
						

							Download a personal PGP key from the PGP Universal Server1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  PGP.
4. Press the  Menu key.
5. Click  Download Keys .
Download an updated PGP key from an LDAP certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP keys .
5. Highlight a PGP® key.
6. Press the  Menu key.
7. Click  Fetch Updated PGP Key .
View properties for a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP keys .
5. Click a PGP® key.
6. Click  View Subkey .
PGP key properties Revocation Status: This field displays the revocation status of the PGP® key at a specified date and time.
Trust Status: This field displays the trust status of the PGP key. A PGP key can be explicitly trusted (the PGP key itself is trusted), implicitly trusted (the
PGP key is associated with a private key on your BlackBerry® device), or not trusted (the PGP key is not explicitly trusted and is not
associated with a trusted PGP key on your device, and a chain of digital signatures to a trusted key does not exist).
Creation Date: This field displays the date that the PGP® Universal Server generated the PGP key.
Expiration Date: This field displays the date that the PGP Universal Server specified as the expiration date of the PGP key.
User GuideSecurity270 
						

							Email Address:This field displays the email address that is associated with the PGP key. Multiple Email Address fields might appear.
Public Key Type: This field displays the standard to which the public key complies. Your device supports RSA®, DSA, and Diffie-Hellman keys.
Key Usage: This field displays approved uses of the PGP key.
Fingerprint: This field displays the PGP key fingerprint in hexadecimal format.
Send a PGP key When you send a PGP® key, your BlackBerry® device sends the public key, but does not send the corresponding private key.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Highlight a PGP key.
6. Press the  Menu key.
7. Click  Send via Email  or Send via PIN .
Delete a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Highlight a PGP® key.
6. Press the  Menu key.
7. Click  Delete.
Clear the PGP data cache The PGP® data cache contains cached PGP public keys and the PGP® Universal Server policy that your BlackBerry® device downloads from
the PGP Universal Server.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  PGP.
4. Press the  Menu key.User GuideSecurity271 
						

							5. Click Clear Universal Cache .
The next time that you send a PGP protected message, your device downloads an updated PGP Universal Server policy and updated PGP public
keys from the PGP Universal Server.
PGP key status
PGP key status indicators
: The PGP® key has a corresponding private key that is stored on your BlackBerry® device.
:The PGP key is trusted and valid, and the revocation status of the PGP key is good.
: The revocation status of the PGP key is unknown or the key is weak.
:The PGP key is untrusted, revoked, expired, not valid, or cannot be verified.
Check the revocation status of a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Highlight a PGP® key.
6. Press the  Menu key.
7. Click  Fetch Status .
Change the trust status of a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Highlight a PGP® key.
6. Press the  Menu key.
7. Click  Trust or Distrust .
User GuideSecurity272 
						

							Revoke a PGP keyIf you revoke a  PGP® key, the PGP key is revoked only in the key store on your  BlackBerry® device. Your device does not update the revocation
status on the PGP® Universal Server.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Highlight a PGP® key.
6. Press the  Menu key.
7. Click  Revoke.
8. Click  Yes.
9. Change the  Reason field.
10. Click  OK.
PGP key revocation reasons Unknown: The revocation reason does not match any of the predefined reasons.
Superseded: A new PGP® key is replacing an existing PGP key.
Key Compromise: A person who is not the key subject might have discovered the private key value.
Key Retired: The PGP key is no longer used.
User ID Invalid: The user information for the PGP key is not valid.
PGP key options
Change the display name for a PGP key 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP keys .
5. Highlight a PGP® key.
User GuideSecurity273 
						

							6. Press the Menu key.
7. Click  Change Label .
8. Type a display name for the PGP key.
9. Click  OK.
Turn off the display name prompt that appears when you add a PGP key to the key
store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP keys .
5. Press the  Menu key.
6. Click  Fetch PGP Keys .
7. Press the  Menu key.
8. Click  Options.
9. Change the  Prompt for Label  field to No.
10. Press the  Menu key.
11. Click  Save.
When you add a PGP® key, your BlackBerry®  device uses the name that the PGP® Universal Server set for the key when it generated the key.
Turn off the fetch status prompt that appears when you add a PGP key to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  PGP Keys .
5. Press the  Menu key.
6. Click  Fetch PGP Keys .
7. Press the  Menu key.
8. Click  Options.
9. Perform one of the following actions: • To download the revocation status of a PGP® key when you add it to the key store, change the  Fetch Status field to Yes.
• To add a PGP key to the key store without downloading the revocation status, change the  Fetch Status field to No.
10. Press the  Menu key.
11. Click  Save.User GuideSecurity274 
						

							PGP key troubleshooting
I cannot download a PGP key from an LDAP certificate server Try performing the following actions: •Verify that your organization permits you to download  PGP® keys from an LDAP certificate server. For more information, contact your
administrator.
• If you changed the connection type that your BlackBerry® device uses to connect to an LDAP certificate server, try using the default connection type.
Certificate servers
Add a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Certificate Servers .
5. Press the  Menu key.
6. Click  New Server .
7. Specify information for the certificate server.
8. Press the  Menu key.
9. Click  Save.
Change connection information for a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Certificate Servers .
5. Highlight a certificate server.
6. Press the  Menu key.
7. Click  Edit.
8. Change connection information for the certificate server.
9. Press the  Menu key.
10. Click  Save.
User GuideSecurity275 
						

							Connection options for LDAP and DSML certificate serversFriendly Name: Type a display name for the certificate server.
Server Name: Type the network address of the certificate server.
Base Query: Type the base query information for the certificate server using X.509 certificate syntax (for example, o=test.rim.net).
Port: Type the port number for your organization’s network. The default port number is 389.
Authentication Type: Specify whether you must log in to the certificate server.
Connection Type: Specify whether your BlackBerry® device uses an SSL connection or a TLS connection to connect to the certificate server.
Connection options for OCSP and CRL servers Friendly Name: Type a display name for the certificate server.
Server URL: Type the web address of the certificate server.
Send connection information for a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Certificate Servers .
5. Highlight a certificate server.
6. Press the  Menu key.
7. Click  Email Server  or PIN Server .
Delete a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
User GuideSecurity276 
						

							3. Click Advanced Security Options .
4. Click  Certificate Servers .
5. Highlight a certificate server.
6. Press the  Menu key.
7. Click  Delete.
Key stores
About the key store The key store on your BlackBerry® device might store the following items. To access these items in the key store, you must type a key store
password.
• personal certificates (certificate and private key pairs)
• certificates that you download using the certificate synchronization tool of the BlackBerry® Desktop Manager
• certificates that you download from an LDAP or DSML certificate server
• certificates that you download from a certificate authority profile
• certificates that you import from the device memory or a media card
• certificates that you add from a message
• root certificates that are included in the BlackBerry® Desktop Software
• personal PGP® keys (public and private key pairs)
• PGP public keys that you download from an LDAP certificate server
• PGP public keys that you import from the device memory or a media card
• PGP public keys that you add from a message
Change the key store password 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Key Stores .
5. Press the  Menu key.
6. Click  Change Password .
Synchronize the key store password with the device password If you synchronize the key store password with the device password, when you change the device password, the key store password changes
to match it automatically.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .User GuideSecurity277 
						

							4. Click Key Stores .
5. Change the  Synchronize Key Store Password to Device Password  field to Yes.
6. Press the  Menu key.
7. Click  Save.
Change when your device deletes the key store password 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Key Stores .
5. Change the  Private Key Password Timeout  field.
6. Press the  Menu key.
7. Click  Save.
To access private keys after your BlackBerry® device deletes the key store password, you must type your key store password.
Add contacts to your contact list automatically when you add items to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Key Stores .
5. Change the  Key Store Address Injector  field to Enabled .
6. Press the  Menu key.
7. Click  Save.
Change the service that your device uses to download certificates Depending on your organization, you might not be able to change the service that your  BlackBerry® device uses to download certificates. For
more information, contact your administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security Options .
3. Click  Advanced Security Options .
4. Click  Key Stores .
5. Change the  Certificate Service  field.
6. Press the  Menu key.
7. Click  Save.User GuideSecurity278