Security Certificates on a Nokia 6630

Maybe on other Series 60 phones, too. This post may seem a bit long, but believe me, it takes all of about 5 minutes to do it.

Symbian Series 60 phones have a strange way of reacting to certificates offered by websites which are not one of those pre-installed in the phone. The phone pops a message saying "This site has sent an untrusted certificate. Continue anyway?". The user has to manually click Options & select Continue. They can view the details at the most, but that's it. This happens every single time a secure exchange is being made. Believe me, very, very annoying.

So, I was trying for a really long time to install new certificates to my Nokia 6630. It turned out to be extremely simple, but not intuitive at all. This post and some experimentation was what led me to it. The user's manual says nothing about this & the default certificate management application doesn't have an option to install a new certificate.

Here's how to do it:

You'll need: one Nokia 6630 phone, the DKU-2 (USB) cable or bluetooth connectivity & one Windows PC.

Steps:

1. Get hold of the certificate you want to install.
   
   • For example, this is the certificate used by GMail for its POP access.
     
   • Various commonly used Root CA (Certification Authority - such as Verisign, GeoTrust) certificates are available for download on the CA websites.
     
   • All common browsers provide functionality to install a new certificate being sent by a website you're accessing. Browsers like Internet Explorer (IE) let you export these installed certificates, too. So, if you're looking at a self-signed certificate, just install it in IE & export it.
     
2. Make sure that the certificate is in the DER encoded binary X.509 format (.cer file). If you're not sure, in Windows you could import it through IE and export in this format.
   
   • If the certificate is in the Base-64 encoded X.509, the phone just treats it as a normal note & you can't do anything with it. The format is important.
     
3. Transfer the certificate to a folder on the phone using the USB cable or Bluetooth software.
   
4. Open this folder from Organizer -> File Manager. Click to open the certificate file.
   
5. The phone tells you that this is an untrusted certificate & then shows you the certificate. Click on Save.
   
6. It asks you for what purposes do you want to use the certificate for. These are called Trust Settings. Select Internet and click OK.
   
   • You may want to use it for something else, such as signed software installation. In that case, select the appropriate trust setting.
     
7. Confirm once that the trust settings are set properly through Tools -> Settings -> Security -> Certificate Management.
   

Allright!! You're set to go. Whenever you visit a website which uses the certificate you just installed, you get no more annoying popups. Just a clean, click-free website.

Update 06/01/2009

Just to answer a question posed by Ivan in comments, if you only have a base-64 encoded X.509 certificate, here's how you convert it (using Windows, I'm afraid):

1. Go to Windows Control Panel and open Internet Options (you can also open this from Internet Explorer's Tools -> Options menu).
2. Go to the Content tab and click on Certificates.
3. The Certificates window has a button named Import... Click on this and import your base-64 encoded certificate.
4. The certificate will now be visible in one of the tabs - most probably the one you had open when you imported it.
5. Now select your certificate and click on Export...
6. Once inside this Wizard, just go through it selecting DER encoded binary format, when asked.
7. Locate the exported certificate file and you're done.