If you configured the BlackBerry MDS Connection Service to retrieve the status of the certificates using an OCSP server or a
CRL server and pull authorization is turned on, devices may not be able to enroll some certificates over the mobile network.
The devices might not be able to enroll some certificates because, devices that initiate the request to the web addresses
follow pull authorization rules that restrict access to some of the web addresses for OCSP servers and CRL servers.
1.
In the BlackBerry Administration Service, on the
BlackBerry solution management
menu, expand
Policy
.
2.
Click
Manage IT policies
.
3.
Click an IT policy.
4.
Click
Edit IT policy
.
5.
On the
Certificate Authority Profile
tab, change the appropriate values for the IT policy rules.
6.
Click
Save All
.
After you finish:
For more information about the IT policy rules, see the
BlackBerry Enterprise Server Policy Reference
Guide
.
Related information
Assigning IT policies and resolving IT policy conflicts,
49
Configure the BlackBerry MDS Connection
Service to connect to the certificate
authority
If your organization's environment includes a Microsoft enterprise certification authority, the certification authority requires
Windows authentication, and a certification authority administrator must approve certificate requests, you must configure
the BlackBerry MDS Connection Service with the server name of the certification authority and the certification authority
credentials so that the BlackBerry MDS Connection Service can send certificate requests to the certification authority.
Before you begin:
Create a custom template on the certification authority that does not permit the subject name to
originate from information in Microsoft Active Directory.
1.
In the BlackBerry Administration Service, on the
Servers and components
menu, expand
BlackBerry Solution
topology > BlackBerry Domain > Component view
.
2.
Click
MDS Connection Service
.
3.
Click
Edit component
.
4.
On the
HTTP
tab, in the
Name
field, type the certificate authority name.
5.
In the
Service URL
field, type the URL that the BlackBerry MDS Connection Service can use to send certificate
requests to the certification authority using the following format: http://
<FQDN_of_CA_server>
:
<port_number>
/* (for
Administration Guide
Configuring BlackBerry devices to enroll certificates over the wireless network
218