Blackberry Bold 9650 6 0 User Guide

							PGP key revocation reasons
ReasonDescriptionUnknownThe revocation reason does not match any of the predefined reasons.SupersededA new PGP® key is replacing an existing PGP key.Key CompromiseA person who is not the key subject might have discovered the private key value.Key RetiredThe PGP key is no longer used.User ID InvalidThe user information for the PGP key is not valid.
PGP key optionsChange the display name for a PGP key1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Highlight a PGP® key.
4. Press the 
 key >  Change Label .
5. Type a display name for the PGP key.
6. Click  OK.
Turn off the display name prompt that appears when you add a PGP key to the key store
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Press the 
 key >  Fetch PGP Keys .
4. Press the 
 key >  Options .
5. Change the  Prompt for Label  field to No.
6. Press the 
 key >  Save.
When you add a PGP® key, your BlackBerry® device uses the name that the PGP® Universal Server set for the key when it
generated the key.
Turn off the fetch status prompt that appears when you add a PGP key to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > PGP .
3. Press the 
 key >  Fetch PGP Keys .
4. Press the 
 key >  Options .
• To download the revocation status of a PGP® key when you add it to the key store, change the  Fetch Status field to Yes.
User GuideSecurity269 
						

							• To add a PGP key to the key store without downloading the revocation status, change the Fetch Status field to No.
5. Press the 
 key >  Save.
PGP key shortcuts
View the label of a PGP® keyPress the  Space key.View the properties of a PGP keyPress the  key.View the security level of a PGP private keyPress the  Alt key and  L.View personal PGP keysPress the  Alt key and  P.View PGP keys for other peoplePress the  Alt key and  O.View all PGP keysPress the  Alt key and  A.
Troubleshooting: PGP keys
I cannot download a PGP key from an LDAP-enabled server
Try the following actions: • Verify that your organization permits you to download PGP® keys from an LDAP-enabled server. For more information,contact your administrator.
• If you changed the connection type that your BlackBerry® device uses to connect to an LDAP-enabled server, try using the default connection type.
Certificate servers Add a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Press the 
 key >  New Server .
4. Specify information for the certificate server.
5. Press the 
 key >  Save.
Change connection information for a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
User GuideSecurity270 
						

							3. Highlight a certificate server.
4. Press the 
 key >  Edit.
5. Change the connection information for the certificate server.
6. Press the 
 key >  Save.
Connection options for OCSP and CRL servers
OptionDescriptionFriendly NameType a display name for the certificate server.Server URLType the web address of the certificate server.
Connection options for LDAP-enabled servers and DSML-enabled servers
OptionDescriptionFriendly NameType a display name for the server.Server NameType the network address of the server.Base QueryType the base query information for the server using X.509 certificate syntax (for example, o=test.rim.net).PortType the port number for your organization’s network. The default port number is 389.Authentication TypeSpecify whether you must log in to the server.Connection TypeSpecify whether your BlackBerry® device uses an SSL connection or a TLS connection toconnect to the server.
Send connection information for a certificate server
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Highlight a certificate server. 4. Press the 
 key >  Email Server  or PIN Server .
Delete a certificate server 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificate Servers .
3. Highlight a certificate server.
4. Press the 
 key >  Delete .
User GuideSecurity271 
						

							Key store
About the key store The key store on your BlackBerry® device might store the following items. To access these items in the key store, you must
type a key store password.
• Personal certificates (certificate and private key pairs)
• Certificates that you download using the certificate synchronization tool of the BlackBerry® Desktop Software
• Certificates that you download from an LDAP-enabled server or DSML-enabled server
• Certificates that you download from a certificate authority profile • Certificates that you import from your device or a media card• Certificates that you add from a message• Root certificates that are included in the BlackBerry Desktop Software
• Personal PGP® keys (public and private key pairs)
• PGP public keys that you download from an LDAP-enabled server
• PGP public keys that you import from your device or a media card
• PGP public keys that you add from a message
Change the key store password 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Press the 
 key >  Change Key Store Password .
Synchronize the key store password with the device password If you synchronize the key store password with your BlackBerry® device password, when you change your device password, the
key store password changes to match it automatically.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Use Device Password as Key Store Password  field to Yes.
4. Press the 
 key >  Save.
Change when your device deletes the key store password 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Key Store Password Timeout  field.
User GuideSecurity272 
						

							4.Press the  key >  Save.
To access private keys after your BlackBerry® device deletes the key store password, you must type your key store password.
Add contacts to your Contacts application automatically when you add items to the key store 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Select the  Add Certificate Email to Contacts  check box.
4. Press the 
 key >  Save.
Change the service that your device uses to download certificates Depending on your organization, you might not be able to change the service that your BlackBerry® device uses to download
certificates. For more information, contact your administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Change the  Certificate Service  field.
4. Press the 
 key >  Save.
Turn off automatic backup and restore of key store data By default, items in the key store on your BlackBerry® device are backed up or restored when you back up or restore your
device data. For security reasons, If you do not want to back up your private key to your computer or restore your private key from your computer, you can turn off automatic backup and restore of key store data.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Clear the  Allow Key Store Backup/Restore  check box.
4. Press the 
 key >  Save.
To turn on automatic backup and restore of key store data, select the  Allow Key Store Backup/Restore check box.
Change the refresh rate for certificate revocation lists 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. In the  Certificate Status  section, change the  Expires After field.
4. Press the 
 key >  Save.
Your BlackBerry® device downloads a new revocation status automatically when your device uses a key store item with a status that is older than the time limit that you set.
User GuideSecurity273 
						

							Reject certificate revocation lists from unverified CRL servers1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Key Stores .
3. Clear the  Accept Unverified CRLs  check box.
4. Press the 
 key >  Save.
Your BlackBerry® device rejects certificate revocation lists from CRL servers that the BlackBerry® MDS Connection Service
cannot verify.
Smart cards
About using a smart card with your device Smart cards store certificates and private keys. You can use a smart card reader to import certificates from a smart card to the
key store on your BlackBerry® device, but you cannot import private keys. As a result, private key operations such as signing
and decryption use the smart card, and public key operations such as verification and encryption use the public certificates on
your device.
If you use a smart card certificate to authenticate with your device, after you connect your smart card reader to your device, your device requests authentication from the smart card each time that you unlock your device.
You can install multiple smart card drivers on your device, including drivers for microSD smart cards, but you can only
authenticate to one smart card at a time. If you are authenticating using a microSD smart card and you want to transfer media files between your microSD smart card and your computer in mass storage mode, you must temporarily turn off two-factor
authentication or select a different authentication option.
If the S/MIME Support Package for BlackBerry® devices is installed on your device, you can use smart card certificates to send
S/MIME-protected messages.
Turn on two-factor authentication To perform this task, you must have set a password for your BlackBerry® device and have the smart card password that you
received with your smart card.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
• To use a smart card and your device password to unlock your device, set the  Authentication Type field to Smart Card .
• To use your connected smart card reader (even if the smart card is not inserted) and your device password to unlock your device, set the  Authentication Type  field to Proximity . Select the  Prompt for Device Password  check box.
3. Press the 
 key >  Save.
User GuideSecurity274 
						

							Import a certificate from a smart card1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Certificates .
3. Press the 
 key >  Import Smart Card Certs .
4. Type your smart card password.
5. Select the check box beside a certificate.
6. Click  OK.
7. Type your key store password.
8. Click  OK.
Lock your device when you remove your smart card from your smart card reader 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  User Authenticator field to Smart card .
4. Change the  Lock On Card Removal  field to Enabled .
5. Press the 
 key >  Save.
About smart password entry If you use advanced authentication and your BlackBerry® device password or smart card password is numeric, you might be
able to use smart password entry in some password fields. When smart password entry is turned on, your device is designed to
remember the format of a password that you type in a password field. When you type the password again, your device applies a smart password filter to the password field. If the password is numeric, a 123 indicator appears beside the password field and
you do not have to press the Alt key to type numbers. If the password is alphanumeric, an ABC indicator appears beside the password field.
To use smart password entry, advanced authentication must be turned on and the correct smart card driver and smart card
reader must be installed on your device.
Turn off smart password entry To perform this task, you must be using a smart card and a password to unlock your BlackBerry® device.You can turn off smart password entry to reduce the chance that someone might guess your device password or smart card
password based on the smart password filter that your device applies to password fields.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  User Authenticator field to Smart Card .
4. Set the  Smart Password Entry  field to Disabled .
User GuideSecurity275 
						

							5.Press the  key >  Save.
To turn on smart password entry again, set the  Smart Password Entry field to Enabled .
Switch smart password filters In a blank password field, press the  Enter key.
The indicator for the new smart password filter appears beside the password field.
Prerequisites: Using authentication certificates • Your BlackBerry® device must have the correct smart card driver and smart card reader driver installed.• You must have imported a certificate from your smart card that you can use for signing and verification.
• You must turn on advanced authentication.
• You must have set a device password.
• You must have the smart card password that you received with your smart card.
Use a certificate to authenticate your smart card To perform this task, you must be using a smart card and a password to unlock your BlackBerry® device.
If you use a certificate to authenticate your smart card, the certificate authenticates your smart card whenever you use your
smart card to unlock your device.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Password .
3. If necessary, change the  User Authenticator field to Smart card .
4. Change the  Authentication Certificate  field.
5. Press the 
 key >  Save.
To stop using a certificate to authenticate your smart card, set the  Authentication Certificate field to None.
Check the status of your authentication certificate automatically To perform this task, you must be using a smart card and a password to unlock your BlackBerry® device.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Password .
3. If necessary, change the  User Authenticator field to Smart Card .
4. Change the  Certificate Status Check  field.
5. Press the 
 key >  Save.
If your device checks the status of your authentication certificate and finds that it is revoked or expired, your device locks.
User GuideSecurity276 
						

							Store the passphrase for your smart card on your device1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Smart Card .
3. Select the  PIN Caching check box.
4. Press the 
 key >  Save.
Your BlackBerry® device stores the passphrase for the same length of time as it stores your key store password.
Turn off notification for smart card connections 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Smart Card .
3. Clear the  LED Session Indicator  check box.
4. Press the 
 key >  Save.
To turn on notification for smart card connections, select the  LED Session Indicator check box.
VPN settings Depending on the options that your administrator has set for you, this feature might not be supported.
About VPN profiles A VPN profile contains the information that you require to log in to your organization's network over VPN. Depending on yourorganization, you might have more than one VPN profile on your BlackBerry® device. For more information about VPN profiles,
contact your administrator.
Log in to a VPN • Your email account must use a BlackBerry® Enterprise Server that supports this feature. For more information, contact your administrator.
• If you use a software token to log in to a VPN, the software token must be on your device and the software token information that appears in the VPN profile must be correct.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. To connect to your organization's network, click  Log in.
User GuideSecurity277 
						

							Change the user name and password for a VPN profile1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. Highlight a VPN profile. 4. Press the 
 key >  Edit.
5. In the  Username  field, type a new user name.
6. In the  Password field, type a new password.
7. Press the 
 key >  Save.
About software tokens You might need a software token to log in to a VPN. A software token includes a token code that your device regenerates
periodically and a PIN. For more information about software tokens, contact your administrator.
Change the software token for a VPN profile To perform this task, the software token that you want to use must be installed on your BlackBerry® device. For moreinformation, contact your administrator.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > VPN .
3. Highlight a VPN profile. 4. Press the 
 key >  Edit.
5. Change the  Software Token Serial Number  field.
6. Press the 
 key >  Save.
Change the PIN for a software token on your device 1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Advanced Security Settings  > Software Tokens .
3. Click a software token >  Specify PIN.
Verify security software manually Security self-tests are designed to verify that security software is implemented correctly on your BlackBerry® device. The testsshould run automatically after you restart your device, but you can also verify security software manually.
1. On the Home screen or in a folder, click the  Options icon.
2. Click  Security > Security Status Information .
3. Press the 
 key >  Verify Security Software .
User GuideSecurity278