wince 6 smart device Could not establish secure channel for SSL / TLS error

Question

I have a web service which i need to access through https. We have a workbout pro 4 with win ce 6.0 running on it. When we were developing our app we had tested it through http. wihtout any problem. When we went live and needed access to https based server we have received the error stated on subject field under VS 2008 Smart Device Project. On the device we receive an error "could not display..." . We have tried to import the standard certificate issued by global si. We still have no success accessing the web service. We can acces the web service on phone, tablet, pc but not with Pro 4:). It would be kind if anyone can share his/her experience with https based web service access or can guide us to over come our problem.

Answer 1

We had a similar issue on CE 7.0.

HTTPS connections using SHA1 certificates would work, however ones with SHA2 certificates would return the error

Could not establish trust relationship with remote server

If possible, try testing your code against a host that uses a SHA1 certificate to see if the issue might be related to missing SHA2 support in CE 6.0.

I should mention that we never formally approached Microsoft to get confirmation on whether SHA2 was supported or not in CE 6.0/7.0, it was just our conclusion after numerous tests that it wasn't.

Answer 2

Secure connection is not implemented on CE fully. Something to do with cert management. Here is what i am considering for my project and it gives a little more info what the issue is. http://labs.rebex.net/HTTPS

Here is some quotes from the site in case its down or something.

.NET Compact Framework does not support TLS 1.2, 1.1, SNI or SHA-2 based certificates.

.NET CF's HttpWebRequest is outdated. It does not support TLS 1.2 or 1.1, it doesn't support Server Name Identification (SNI), and it does not support SHA-2 in X509 certificates. It also suffers from several authentication-related bugs with no known workaround. This makes it unusable in a growing number of scenarios, and Microsoft will never fix this because it no longer cares about these legacy platforms.

Fortunately, it's now possible to work around these shortcomings using a beta version of Rebex HTTPS library. It features a HttpWebRequest replacement object for .NET Compact Framework that plugs into the existing .NET CF WebRequest API and provides the features the default HTTP/HTTPS provider lacks. Most importantly, it adds support for TLS 1.2, TLS 1.1, SNI and SHA-2, it works even on old devices based on Windows CE 5.0 and it makes it simple to add TLS 1.2 support to existing SOAP web service clients.