Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry Work 3.2
  3. Configuring Office 365 Modern Authentication for BlackBerry Dynamics Apps
  4. Import non-public certificates to BEMS

Import non-public certificates to 
BEMS

You can use the following steps to import certificate authority certificates into the 
Java
 cacerts keystore as an alternative to uploading certificate authority certificates into the 
BEMS
 database using the Dashboard. Some 
BEMS
 features may not support verifying certificate trusts using certificates stored in the database (for example, the 
Presence
 service for on-premises 
Skype for Business
 using non-trusted application mode).
  1. If necessary, verify the 
    Java
     bin directory is correctly specified in your environment PATH.
    1. In a command prompt, type 
      set | findstr "JAVA_HOME"
      .
    2. Press 
      Enter
      .
    3. In the command prompt, type 
      set | findstr "Path"
    4. Press 
      Enter
      .
    Verify that the JAVA_HOME System variable is set to the correct 
    Java
     directory and that the PATH System variable includes the path to the same 
    Java
     directory. For instructions about setting the JAVA_HOME and PATH system variables, see .
  2. Obtain a copy of the non-public CA certificate from the server that 
    BEMS
     must communiate with. For more information, contact your administrator of your 
    Microsoft Exchange Server
    , , or 
    Microsoft SharePoint
     servers.
  3. On the 
    BEMS
     host, make a backup of the 
    Java
     keystore file. By default, the 
    Java
     keystore file is located at 
    %JAVA_HOME%\lib\security\cacerts
    , where JAVA_HOME is confirmed in step 1.
  4. Copy the non-public CA certificate to the 
    Java
     keystore directory in step 3.
  5. Open a command prompt and change directory to the 
    Java
     keystore directory in step 3.
  6. Type the following command to import the non-public CA certificate into the 
    Java
     keystore: 
    keytool -importcert -trustcacerts -alias <
    your_cert_alias
    > -file <
    your_cert
    >.cer -keystore cacerts -storepass changeit
    • Where 
      your_cert_alias
       is the unique name that you are assigning the certificate in the cacerts file. This alias cannot already exist in the cacerts file.
    • Where 
      your_cert
       is the file name of the non-public certificate. If this is the path to the file, add quotation marks (" ") around the full path, filename, and extension.
  7. Repeat Steps 2 to 6 for each non-public CA certificate.
  8. In the 
    Windows
     Service Manager, restart the 
    Good Technology Common Services
     service.