Blackbe;rry PRD-10459-035 - Enterprise Server For MDS Instruction Manual

BlackBerry Enterprise Server for MDS Applications
Version: 4.1 | Service Pack: 7
Administration Guide

Published: 2010-01-11
SWD-966846-0111050411-001

Contents
1 Creating administrator accounts.............................................................................................................................................. 9
Administrative roles........................................................................................................................................................................ 9
Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment......................................... 10
Assign an administrative role to a new or existing Microsoft SQL Server database account....................................... 10
Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment................... 11
2 Configuring security options..................................................................................................................................................... 12
How the BlackBerry Enterprise Solution encrypts data on the transport layer....................................................................... 12
Symmetric key encryption algorithms that the BlackBerry Enterprise Solution uses.................................................... 12
Change the encryption type.................................................................................................................................................. 12
Generating organization-specific encryption keys for PIN message encryption.................................................................... 13
Generate a new peer-to-peer encryption key..................................................................................................................... 13
Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services............................ 13
Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager.................................. 14
Allow client authentication between the BlackBerry MDS Integration Service and web services............................... 14
3 Setting up proxy servers for BlackBerry Enterprise Server components............................................................................ 16
Configuring certain BlackBerry Enterprise Server components to use proxy servers............................................................ 16
Configure a BlackBerry Enterprise Server component to use a .pac file......................................................................... 16
Configure a BlackBerry Enterprise Server component to use a proxy server.................................................................. 17
Configure a BlackBerry Enterprise Server component to authenticate to a proxy server on behalf of BlackBerry
devices..................................................................................................................................................................................... 17
4 Sharing BlackBerry Enterprise Server components............................................................................................................... 19
Configuring multiple BlackBerry Enterprise Server instances to use the same BlackBerry Enterprise Server component
........................................................................................................................................................................................................... 19
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS Connection Service
.................................................................................................................................................................................................. 19
Configure multiple BlackBerry Enterprise Server instances to use the same BlackBerry MDS Integration Service
.................................................................................................................................................................................................. 20
5 Configuring user accounts......................................................................................................................................................... 21
Adding user accounts to the BlackBerry Enterprise Server....................................................................................................... 21
Add user accounts to the BlackBerry Enterprise Server.................................................................................................... 21
Creating user groups...................................................................................................................................................................... 21

Create a user group................................................................................................................................................................ 21
Add a user account to a user group..................................................................................................................................... 22
6 Sending software and BlackBerry Java Applications to BlackBerry devices...................................................................... 23
Making BlackBerry Device Software and Java applications available to users....................................................................... 23
Making software and applications available on a network drive.............................................................................................. 23
Install the BlackBerry Device Software on a network drive.............................................................................................. 23
Add a Java application to a network drive........................................................................................................................... 24
Add the BlackBerry MDS Runtime to a network drive....................................................................................................... 24
Indexing applications on a network drive.................................................................................................................................... 24
Create or update a software index for applications on a network drive.......................................................................... 24
Share a network drive for applications................................................................................................................................ 25
Defining software configurations.................................................................................................................................................. 25
Create a software configuration........................................................................................................................................... 25
Define an application control policy.................................................................................................................................... 26
Assign an application control policy to an application...................................................................................................... 26
Assign a software configuration to a user group................................................................................................................ 27
Assign a software configuration to a user account............................................................................................................ 27
Send an application to a BlackBerry device over the wireless network................................................................................... 27
Monitor wireless application push failures.................................................................................................................................. 28
Error messages: Wireless application push......................................................................................................................... 28
Install the BlackBerry Device Software or BlackBerry Applications on a BlackBerry device using the BlackBerry Manager
........................................................................................................................................................................................................... 30
7 Making BlackBerry MDS Runtime Applications available to users..................................................................................... 32
Creating BlackBerry MDS Runtime Applications and sending them to BlackBerry devices................................................. 32
Preparing BlackBerry devices to install BlackBerry MDS Runtime Applications.................................................................... 34
Configuring access to web services and managing signed and unsigned applications........................................................ 35
Allow BlackBerry MDS Runtime Applications to access web services using HTTPS...................................................... 35
Define a BlackBerry MDS Runtime Application as a trusted application........................................................................ 35
Configure whether users can install unsigned BlackBerry MDS Runtime Applications on BlackBerry devices......... 36
Configuring how users access and use BlackBerry MDS Runtime Applications..................................................................... 36
Create a BlackBerry MDS Integration Service device policy............................................................................................. 36
Assign a BlackBerry MDS Integration Service device policy to a user group................................................................. 37
Assign a BlackBerry MDS Integration Service device policy to a specific user.............................................................. 37
Sending BlackBerry MDS Runtime Applications and BlackBerry Browser Applications to BlackBerry devices.................. 38

Install a BlackBerry MDS Runtime Application on BlackBerry devices........................................................................... 38
Install a BlackBerry MDS Runtime Application on a specific BlackBerry device............................................................ 38
Applying an application control policy to a BlackBerry MDS Runtime Application............................................................... 39
Add the application launcher file for a BlackBerry MDS Runtime Application to the network drive.......................... 39
Assign an application control policy to a BlackBerry MDS Runtime Application........................................................... 40
8 Configuring how users access enterprise applications and web content.......................................................................... 42
Specifying a BlackBerry MDS Connection Service as the central push server........................................................................ 42
Specify the central push server............................................................................................................................................. 42
Configuring how BlackBerry devices authenticate to content servers..................................................................................... 42
Configure how BlackBerry devices authenticate to content servers................................................................................ 43
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that use
NTLM........................................................................................................................................................................................ 43
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that use
Kerberos................................................................................................................................................................................... 44
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to content servers that use
LTPA......................................................................................................................................................................................... 44
Configure the BlackBerry MDS Connection Service to authenticate BlackBerry devices to the RSA Authentication
Manager.................................................................................................................................................................................. 44
Configuring how the BlackBerry MDS Connection Service manages requests for web content.......................................... 45
Configure the BlackBerry MDS Connection Service to manage HTTP cookie storage.................................................. 45
Configure the timeout limit for HTTP connections with BlackBerry devices.................................................................. 46
Configure the timeout limit for HTTP connections to web servers................................................................................... 46
Configure the maximum number of times that the BlackBerry Browser accepts HTTP redirections........................... 46
Permitting push applications to make trusted connections to a BlackBerry MDS Connection Service............................... 47
Create a key store to store certificates for use with HTTPS connections........................................................................ 47
Add a certificate for the BlackBerry MDS Connection Service......................................................................................... 47
Export the BlackBerry MDS Connection Service certificate to make it available to push applications....................... 48
Import the BlackBerry MDS Connection Service certificate to the key store of a push application............................ 48
Configuring a BlackBerry MDS Connection Service to trust web servers................................................................................ 49
Allow BlackBerry devices to connect to untrusted web servers........................................................................................ 49
Configure the BlackBerry MDS Connection Service to retrieve certificates for web servers........................................ 49
Configure the BlackBerry MDS Connection Service to retrieve the status of certificates for web servers................. 50
Add a retrieved certificate for a web server to the key store............................................................................................ 51
Configuring how the BlackBerry MDS Connection Service connects to BlackBerry devices................................................ 51

Specify the maximum amount of data that the BlackBerry MDS Connection Service can send to BlackBerry devices
.................................................................................................................................................................................................. 51
Specify the pending content timeout limit for the BlackBerry MDS Connection Service............................................. 51
Allow Java applications to use persistent socket connections with the BlackBerry MDS Connection Service........... 52
Specify the thread pool size of the BlackBerry MDS Connection Service....................................................................... 52
Specify the maximum number of persistent socket connections..................................................................................... 52
Specify the port number that the web server listens on for push application requests................................................ 53
Specify how often the BlackBerry MDS Connection Service polls for configuration information................................ 53
9 Assigning BlackBerry devices to users..................................................................................................................................... 54
Assigning BlackBerry devices to user accounts.......................................................................................................................... 54
Option 1: Activate a BlackBerry device using the BlackBerry Manager........................................................................... 54
Option 2: Activating BlackBerry devices over the wireless network................................................................................ 54
10 Managing administrator accounts............................................................................................................................................ 57
Assign a BlackBerry Enterprise Server administrator to a different administrative role........................................................ 57
Delete an administrator account from a BlackBerry Enterprise Server.................................................................................... 57
11 Controlling the BlackBerry Enterprise Solution...................................................................................................................... 58
Controlling BlackBerry device access to the BlackBerry Enterprise Server............................................................................. 58
Turn on the Enterprise Service Policy.................................................................................................................................. 58
Permit a user to override the Enterprise Service Policy..................................................................................................... 59
Controlling BlackBerry device behavior using IT policies.......................................................................................................... 59
Create an IT policy.................................................................................................................................................................. 59
Assign an IT policy to a group of users................................................................................................................................ 60
Assign an IT policy to a user account................................................................................................................................... 61
Enforcing IT policy changes over the wireless network..................................................................................................... 61
Deactivating BlackBerry devices without applied IT policies............................................................................................ 62
Changing the default behavior of BlackBerry devices and the BlackBerry Desktop Software..................................... 63
Returning to the default behavior of BlackBerry devices and the BlackBerry Desktop Software................................ 64
Creating new IT policy rules to control third-party applications...................................................................................... 64
12 Managing user accounts............................................................................................................................................................ 66
Managing user groups................................................................................................................................................................... 66
Change the properties of a user group................................................................................................................................ 66
Rename a user group............................................................................................................................................................. 66

Delete a user group................................................................................................................................................................ 67
Managing user accounts................................................................................................................................................................ 67
Move a user account to a different user group................................................................................................................... 67
Move a user account out of a user group............................................................................................................................ 67
Move a user account from one BlackBerry Enterprise Server to another........................................................................ 68
Delete a user account from the BlackBerry Enterprise Server.......................................................................................... 68
13 Protecting and reassigning BlackBerry devices..................................................................................................................... 69
Protecting lost, stolen, or replaced BlackBerry devices.............................................................................................................. 69
Protect a lost BlackBerry device........................................................................................................................................... 69
Protect a lost BlackBerry device that a user might recover.............................................................................................. 70
Protect a stolen BlackBerry device....................................................................................................................................... 70
Reissuing BlackBerry devices to new users................................................................................................................................. 70
Preparing a BlackBerry device for redistribution................................................................................................................ 71
14 Managing the delivery of BlackBerry Java Applications, BlackBerry Device Software, and device settings to
BlackBerry devices...................................................................................................................................................................... 72
Managing BlackBerry Java Applications on BlackBerry devices............................................................................................... 72
Upgrade an application on a BlackBerry device over the wireless network................................................................... 72
Remove applications from BlackBerry devices over the wireless network...................................................................... 72
Change an application control policy.................................................................................................................................. 72
Managing software configurations............................................................................................................................................... 73
Delete a software configuration from a user account........................................................................................................ 73
Create a software configuration based on an existing software configuration.............................................................. 73
15 Managing attachment support.................................................................................................................................................. 74
Changing how a BlackBerry Attachment Service converts attachments................................................................................. 74
Optimize how the BlackBerry Attachment Service converts attachments...................................................................... 74
BlackBerry Attachment Service optimization settings....................................................................................................... 75
Change the maximum file size for attachments that users can receive.......................................................................... 76
Suggested file sizes for attachments................................................................................................................................... 76
Change the maximum dimensions for image attachments that users can view............................................................ 76
Changing how the BlackBerry Messaging Agent reconciles attachments to the messaging server................................... 77
Change the maximum file size for attachments that users can send.............................................................................. 77
Prevent users from sending large attachments.................................................................................................................. 78
Change the maximum file size of attachments that users can download....................................................................... 78

Turn off support for an attachment file format........................................................................................................................... 78
Add support for additional attachment file formats................................................................................................................... 79
16 Managing BlackBerry MDS Runtime Applications and BlackBerry Browser Applications.............................................. 80
Upgrade a BlackBerry MDS Runtime Application on BlackBerry devices............................................................................... 80
Remove a trusted certificate from the BlackBerry MDS Integration Service........................................................................... 81
Making installed BlackBerry MDS Runtime Applications unavailable on BlackBerry devices.............................................. 81
Make an installed BlackBerry MDS Runtime Application unavailable on BlackBerry devices..................................... 81
Make an installed BlackBerry MDS Runtime Application available on BlackBerry devices again............................... 81
Removing BlackBerry MDS Runtime Applications and BlackBerry Browser Applications..................................................... 82
Make a BlackBerry MDS Runtime Application unavailable for installation.................................................................... 82
Remove an installed BlackBerry MDS Runtime Application from BlackBerry devices.................................................. 82
Remove an installed BlackBerry MDS Runtime Application from a specific BlackBerry device................................... 83
ConfiguringanewconnectionbetweenaBlackBerryMDSIntegrationServiceandaBlackBerryMDSConnectionService
........................................................................................................................................................................................................... 83
Make a BlackBerry MDS Connection Service available to a BlackBerry MDS Integration Service.............................. 84
Make a BlackBerry MDS Connection Service unavailable to a BlackBerry MDS Integration Service.......................... 84
17 Managing how users access enterprise applications and web content.............................................................................. 85
Restricting user access to content on web servers..................................................................................................................... 85
Restrict requests for content on web servers from BlackBerry devices........................................................................... 85
Specify web address patterns............................................................................................................................................... 85
Create a pull rule.................................................................................................................................................................... 86
Restrict or allow web address patterns using a pull rule................................................................................................... 86
Assign a pull rule to a user group......................................................................................................................................... 87
Assign a pull rule to a specific user...................................................................................................................................... 87
Restricting user access to media content in the BlackBerry Browser...................................................................................... 87
Prevent users from accessing specific media types........................................................................................................... 88
Configure a maximum file size for media types.................................................................................................................. 88
Restricting the push application content that users can receive.............................................................................................. 88
Restrict push applications from sending data to BlackBerry devices.............................................................................. 89
Create push initiators for push applications....................................................................................................................... 89
Turn on push authorization................................................................................................................................................... 90
Create a push rule.................................................................................................................................................................. 90
Assign push initiators to a push rule.................................................................................................................................... 91
Assign a push rule to a user group....................................................................................................................................... 91

Assign a push rule to a specific user.................................................................................................................................... 91
Encrypt push requests that push applications send to BlackBerry devices.................................................................... 92
Associate a push initiator with the BlackBerry MDS Integration Service........................................................................ 92
Managing push application requests........................................................................................................................................... 93
Specify device ports for application-reliable push requests............................................................................................. 93
Store push application requests in the BlackBerry Configuration Database.................................................................. 94
Configure the settings for storing push requests in the BlackBerry Configuration Database...................................... 94
Configure the maximum number of active connections that the BlackBerry MDS Connection Service can process
.................................................................................................................................................................................................. 94
Configure the maximum number of queued connections that the BlackBerry MDS Connection Service can process
.................................................................................................................................................................................................. 95
Delete requests from the push request queue manually................................................................................................... 95
18 Monitoring a BlackBerry Domain.............................................................................................................................................. 96
How the BlackBerry Controller monitors the BlackBerry Enterprise Server components...................................................... 96
Changing how the BlackBerry Controller monitors the BlackBerry Enterprise Server components and restarts services
........................................................................................................................................................................................................... 96
Change how the BlackBerry Controller restarts the BlackBerry Messaging Agent....................................................... 96
Change how the BlackBerry Controller restarts the BlackBerry Enterprise Server services......................................... 99
Monitoring the BlackBerry MDS Integration Service notification messages.......................................................................... 100
Set up monitoring of the BlackBerry MDS Integration Service notification messages for a BlackBerry device......... 100
Monitor the BlackBerry MDS Integration Service notification messages for a BlackBerry device............................... 101
Filter the BlackBerry MDS Integration Service notification messages by date and time.............................................. 101
Block notification messages from a web services host...................................................................................................... 101
Remove all notification messages for the BlackBerry MDS Integration Service............................................................ 102
Monitoring PIN messages, SMS text messages, and calls......................................................................................................... 102
Change the default location for the PIN message, SMS text message, and phone log files........................................ 102
Monitor PIN messages........................................................................................................................................................... 102
Monitor SMS text messages.................................................................................................................................................. 103
Turn off call logging............................................................................................................................................................... 104
Log files for the BlackBerry Enterprise Server components....................................................................................................... 104
Changing where the BlackBerry Enterprise Server components write log files...................................................................... 104
Change the location where the BlackBerry Enterprise Server components write log files........................................... 104
Store all of the BlackBerry Enterprise Server component log files in one folder............................................................ 105
Changing how the BlackBerry Enterprise Server components create log files....................................................................... 105

Add a prefix to the file names of all the BlackBerry Enterprise Server component log files......................................... 105
Configure the maximum size for a BlackBerry Enterprise Server component log file................................................... 105
Change the logging level for a BlackBerry Enterprise Server component...................................................................... 106
Create a new BlackBerry Enterprise Server component log file when the current log file reaches the maximum size
.................................................................................................................................................................................................. 106
Change the identifier for a BlackBerry Enterprise Server component log file................................................................ 107
Prevent a BlackBerry Enterprise Server component from creating a daily log file......................................................... 107
Configure when to delete BlackBerry Enterprise Server component log files................................................................ 107
Changing how the BlackBerry MDS Connection Service creates a log file............................................................................. 108
Change the logging level for the BlackBerry MDS Connection Service.......................................................................... 108
Change the location where the BlackBerry MDS Connection Service writes log files.................................................. 108
Change the interval at which the BlackBerry MDS Connection Service writes information to the log file................ 109
Change the logging level for the UDP log file.................................................................................................................... 109
Change the port number that the BlackBerry MDS Connection Service connects to when sending UDP log file
messages................................................................................................................................................................................. 109
Change the logging level for the TCP log file..................................................................................................................... 110
Change the port number that the BlackBerry MDS Connection Service connects to when sending TCP log file
messages................................................................................................................................................................................. 110
Change the logging level for the Event log file.................................................................................................................. 110
Change which BlackBerry MDS Connection Service activities are written to the log file..................................................... 111
19 Managing a BlackBerry Domain............................................................................................................................................... 113
Managing multiple BlackBerry Domain instances...................................................................................................................... 113
Connect the BlackBerry Manager to a different BlackBerry Domain.............................................................................. 113
Managing CAL keys........................................................................................................................................................................ 113
Add or delete a CAL key........................................................................................................................................................ 114
Copy a license key to a text file............................................................................................................................................ 114
20 Glossary......................................................................................................................................................................................... 115
21 Legal notice.................................................................................................................................................................................. 118

Creating administrator accounts 1
Administrative roles
You can use the predefined roles in the BlackBerry® Enterprise Server, that mirror typical administrative roles that exist in
organizations, to control which administrators can perform specific tasks and what information the administrators can view.
YouassigneachBlackBerryEnterpriseServer administratortoanadministrative role.Ifyoumanage yourorganization'sBlackBerry
Enterprise Server using Windows® groups, you can assign the groups to the administrative roles so that you can manage role
membership within the group.
If an administrator starts the BlackBerry Manager, the BlackBerry Manager checks the administrator's authentication credentials,
determines which administrative role the administrator is assigned to, and displays a list of the tasks that the administrator can
perform.
Role Description
security administrator
(rim_db_admin_security)
These administrators can perform all tasks and can view all information. They are the only
administrators who can manage role membership.
The administrator account that you created during the installation process is assigned the
security administrator role automatically.
enterprise administrator
(rim_db_admin_enterprise)
These administrators can perform all tasks for user accounts, BlackBerry Enterprise Server
instances, and global application data. These administrators can perform some security
tasks.
These administrators cannot view role membership.
device administrator
(rim_db_admin_handheld)
These administrators can perform tasks for managing BlackBerry devices and user
accounts.
senior help desk administrator
(rim_db_admin_sr_helpdesk)
These administrators can perform all device management tasks that relate to user account
management.
junior help desk administrator
(rim_db_admin_jr_helpdesk)
These administrators can perform specific tasks to manage user accounts. However, these
administrators cannot add, move, or delete user accounts or send specific IT administration
commands.
Administration Guide Creating administrator accounts
9

Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL
Server environment
BlackBerry® Enterprise Server administrators are database users who can access the BlackBerry Configuration Database using
the BlackBerry Manager. This access is restricted to the administrative roles that the BlackBerry Enterprise Server administrators
are assigned to.
Only administrators who are assigned to the security administrator role can create other BlackBerry Enterprise Server
administrators accounts. When creating administrator accounts, perform one of the following tasks:
• assign an administrative role to an existing database account
• create a new database account and assign it an administrative role
Assign an administrative role to a new or existing Microsoft SQL Server database account
Note: Do not assign an administrative role using the Microsoft® SQL Server® consoles or assign more than one administrative
role to an administrator. The BlackBerry® Configuration Database uses the most restrictive settings to determine which tasks
the BlackBerry Manager displays, so an administrator who is assigned both enterprise and junior help desk roles sees only the
tasks for the junior help desk role.
Before you begin:
• Verify that you have the system administrator role on the database server.
•If you are creating a new database account and want to use Windows® authentication, verify that the Windows user account
or group already exists.
1. In the BlackBerry Manager, in the left pane, click BlackBerry Domain.
2. On the Role Administration tab, click a role.
3. Complete one of the following actions:
• To add an administrative role to an existing Microsoft SQL Server database account, click List Administrators.
•To create a new Microsoft SQL Server database account and assign it to an administrative role, click Add Administrators.
4. Complete one of the following actions:
•To add an administrative role to an existing administrator account, click the administrator account that you want to add
the role to.
• To create a database account only and add an administrative role to the account, type a user name.
• To create a database account for an existing Windows user account or group and add an administrative role to the
account, type a user name preceded by a domain name (for example, DOMAIN\username).
5. If prompted, type and confirm a password.
6. Click OK.
Administration Guide Creating a BlackBerry Enterprise Server administrator in a Microsoft SQL Server environment
10

Configure the BlackBerry Manager to use database authentication in a
Microsoft SQL Server environment
During the installation process, if you choose to connect to the BlackBerry® Configuration Database using Windows®
authentication, the BlackBerry Manager uses Windows authentication automatically. If you create database accounts for your
administrators, you must change the type of authentication that the BlackBerry Manager uses.
1. In the BlackBerry Manager, on the Tools menu, click Options.
2. Click Database.
3. In the Authentication drop-down list, click Database Authentication.
4. Click OK.
5. Restart the BlackBerry Manager.
Administration Guide Configure the BlackBerry Manager to use database authentication in a Microsoft SQL Server environment
11

Configuring security options 2
How the BlackBerry Enterprise Solution encrypts data on the transport layer
The BlackBerry® Enterprise Solution uses a symmetric key encryption algorithm (Triple DES or AES) to protect all data that the
BlackBerry® Enterprise Server and a BlackBerry device send between them.
The BlackBerry Enterprise Solution uses the symmetric key encryption algorithm to create message keys and master encryption
keys, and uses those encryption keys to encrypt all data that the BlackBerry device sends or receives, while the data travels
between the BlackBerry device and the BlackBerry Enterprise Server.
This data encryption process occurs automatically and is designed to verify that a message that a user sends from a BlackBerry
device, which is outside the organization's firewall, remains protected on the transport layer until the BlackBerry Enterprise Server
receives the message.
Symmetric key encryption algorithms that the BlackBerry Enterprise Solution uses
Encryption type Description
AES • uses the AES algorithm to encrypt and decrypt all of the data that the
BlackBerry Enterprise Server and BlackBerry devices that are associated with
the BlackBerry Enterprise Server send between each other
• designed to use a longer encryption key to provide a better combination of
security and performance than Triple DES
•designed to protect user data and encryption keys from traditional attacks and
side-channel attacks
• requires BlackBerry® Desktop Software version 4.0 or later and BlackBerry®
Device Software version 4.0 or later
Change the encryption type
1. In the BlackBerry® Manager, in the left pane, click a BlackBerry® Enterprise Server.
2. On the Server Configuration tab, click Edit Properties.
3. Click General.
4. In the Security section, click Encryption Algorithm.
Administration Guide Configuring security options
12

5. In the drop-down list, select an encryption type.
6. Click OK.
Related topics
Assigning BlackBerry devices to user accounts, 54
Generating organization-specific encryption keys for PIN message
encryption
By default, all BlackBerry® devices store a common PIN encryption key that they use to protect PIN messages. To limit the number
of BlackBerry devices that can decrypt PIN messages that users in your organization send from their BlackBerry devices, you can
generate a new PIN encryption key that is stored on and known only to BlackBerry devices in your organization. BlackBerry
devices with a PIN encryption key that is specific to your organization can send and receive PIN messages only with other
BlackBerry devices that store the same PIN encryption key.
You should generate a new PIN encryption key if you know that your current organization-specific PIN encryption key is
compromised.
Generate a new peer-to-peer encryption key
1. In the BlackBerry® Manager, in the left pane, click BlackBerry Domain.
2. On the Global tab, expand Service Control & Customization.
3. Click Update Peer-to-Peer Encryption Key.
4. Click Set or update the Peer-to-Peer encryption key for all devices within this organization.
5. Click Yes.
Authenticating the BlackBerry MDS Integration Service to the BlackBerry
Manager and web services
After you install the BlackBerry® MDS Integration Service, you must install a digital certificate for the BlackBerry MDS Integration
Service in the key store on the same computer. This certificate allows server-authenticated communication between the
BlackBerry MDS Integration Service and the BlackBerry Manager.
You can install a self-signed certificate for the BlackBerry MDS Integration Service, or you can get a signed root certificate from
a certificate authority and install it in the key store using the Java® keytool. You can replace the self-signed certificate with a
signed root certificate at any time, but you should install the certificate that you want to use immediately after you install the
BlackBerry MDS Integration Service and before you allow authentication with the BlackBerry Manager or web services using that
certificate.
Administration Guide Generating organization-specific encryption keys for PIN message encryption
13

You can also export the certificate for the BlackBerry MDS Integration Service to allow client authentication with external web
services.
For more information about using the Java keytool, visit java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html.
Allow the BlackBerry MDS Integration Service to communicate with the BlackBerry Manager
When the BlackBerry® Manager connects to the BlackBerry MDS Integration Service for the first time after installation, the
BlackBerryManager promptsyoutoviewandinstallthe BlackBerryMDSIntegrationServiceself-signedcertificate.This certificate
allows server-authenticated communication between the BlackBerry MDS Integration Service and the BlackBerry Manager.
Before you begin: Perform this task immediately after you install the BlackBerry MDS Integration Service.
1. In the BlackBerry Manager, in the left pane, click a BlackBerry MDS Integration Service.
2. In the certificate installation dialog box, click View Certificate.
3. Review the certificate information.
4. Click Install Certificate.
5. Complete the instructions on the screen. Accept the default settings.
6. When prompted, click Cancel.
Allow client authentication between the BlackBerry MDS Integration Service and web
services
The self-signed certificate for the BlackBerry® MDS Integration Service allows client authentication between the BlackBerry
MDSIntegrationServiceandwebservices hosts. If the BlackBerry® MDS Runtime Applications inyourorganization'senvironment
use HTTPS to communicate with web servers to receive application data and application updates, you must export the certificate
for the BlackBerry MDS Integration Service to the web services hosts. This allows BlackBerry MDS Runtime Applications that use
web services to authenticate to the web services and access them.
Before you begin:
•Contact your organization's application developers for information about the web services that the BlackBerry MDS Runtime
Applications in your environment use.
• If you replaced the self-signed certificate for the BlackBerry MDS Integration Service with a signed root certificate from a
certificate authority, the web services must trust the root certificate authority to authenticate to the BlackBerry MDS
Integration Service.
1. Using Microsoft® Internet Explorer®, export the self-signed certificate for the BlackBerry MDS Integration Service from the
trusted root certificate authorities area of the computer's key store.
2. Send the self-signed certificate to the web services servers that the BlackBerry MDS Runtime Applications use.
3. Verify that the certificate is installed in the trusted key store of the web services servers.
After you finish:
Administration Guide Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services
14

• If multiple BlackBerry MDS Integration Service servers are installed, export the certificate for each BlackBerry MDS
Integration Service.
• Allow BlackBerry MDS Runtime Applications to access web services using HTTPS.
Administration Guide Authenticating the BlackBerry MDS Integration Service to the BlackBerry Manager and web services
15

Setting up proxy servers for BlackBerry Enterprise Server
components 3
Configuring certain BlackBerry Enterprise Server components to use proxy
servers
You can configure the BlackBerry® MDS Connection Service and BlackBerry MDS Integration Service to use proxy servers to
access web addresses on the Internet and your organization's intranet. You should use a proxy method that is consistent with
the proxy method that other applications and servers in your organization use to access web content.
Proxy servers typically do not permit network traffic between servers that are on the same side of the firewall, so you can configure
certain BlackBerry® Enterprise Server components to use a .pac file, or to access the Internet directly through a proxy server.
You can also configure multiple proxy servers to manage traffic to specific web addresses, and you can specify URLs that the
BlackBerry Enterprise Server components can access without using a proxy server.
The BlackBerry MDS Integration Service sends application updates and data to BlackBerry devices through the BlackBerry MDS
Connection Service. The BlackBerry MDS Integration Service can only accept and respond to messages that it receives from a
direct connection with the BlackBerry MDS Connection Service. If you configured the BlackBerry MDS Connection Service to use
a proxy server, you must configure proxy rules to permit a direct connection between the BlackBerry MDS Connection Service
and the BlackBerry MDS Integration Service. You cannot use a proxy server to exchange data between these components. If you
use a .pac file configuration, you can change the .pac file to permit a direct connection between the BlackBerry MDS Connection
Service and BlackBerry MDS Integration Service.
Related topics
Configuring multiple BlackBerry Enterprise Server instances to use the same BlackBerry Enterprise Server component, 19
Configure a BlackBerry Enterprise Server component to use a .pac file
You can configure the BlackBerry® MDS Connection Service and BlackBerry MDS Integration Service to use a .pac file.
1. In the BlackBerry Manager, in the left pane, click a BlackBerry® Enterprise Server component.
2. On the appropriate tab for a BlackBerry Enterprise Server component, click Edit Properties.
3. In the left pane, click Proxy.
4. Double-click Proxy Mappings.
5. Click New.
6. Double-click Universal Resource Locator.
7. Type the URL regular expression that you want the proxy mapping rule to control.
8. Double-click Proxy String.
Administration Guide Setting up proxy servers for BlackBerry Enterprise Server components
16

9. Click New.
10. In the Proxy Type drop-down list, perform one of the following actions:
• To detect a .pac file automatically, click AUTO. Double-click the Proxy String field and delete the default values.
• To specify the location of the .pac file, click PAC. Double-click the Proxy String field and type the proxy server name,
port number, and location of the .pac file (for example, http://<ProxyServer>:<Port>/<PACFilePath>/<PACFileName>).
11. Click OK.
Configure a BlackBerry Enterprise Server component to use a proxy server
You can configure the BlackBerry® MDS Connection Service and the BlackBerry MDS Integration Service to access web servers
through a proxy server.
You can specify more than one proxy string in a proxy mapping rule for a web address. If the BlackBerry® Enterprise Server
component cannot access the web server using the first proxy string, it tries to access the web server using the subsequent proxy
strings that you typed, until it accesses the web server successfully.
If the BlackBerry MDS Connection Service is configured to use a proxy server, BlackBerry device users can browse web sites that
use HTTPS if the proxy server supports basic authentication only.
1. In the BlackBerry Manager, in the left pane, click a BlackBerry Enterprise Server component.
2. On the appropriate tab for a BlackBerry Enterprise Server component, click Edit Properties.
3. In the left pane, click Proxy.
4. Click New.
5. In the Universal Resource Locator field, type the regular expression for the web address that you want the proxy mapping
rule to control.
6. Double-click Proxy String.
7. Click New.
8. In the Proxy Type drop-down list, perform any of the following actions:
•To configure a proxy server, click PROXY. Double-click the Proxy String field and type the proxy server name and port
number.
• To exclude the web address from routing through the proxy server, click DIRECT. Double-click the Proxy String field
and delete the default value.
9. Click OK.
Configure a BlackBerry Enterprise Server component to authenticate to a proxy server on
behalf of BlackBerry devices
You can configure the BlackBerry® MDS Connection Service and BlackBerry MDS Integration Service to authenticate to a proxy
server on behalf of BlackBerry devices.
1. In the BlackBerry Manager, in the left pane, click a BlackBerry® Enterprise Server component.
Administration Guide Configuring certain BlackBerry Enterprise Server components to use proxy servers
17

2. On the appropriate tab, click Edit Properties.
3. In the left pane, click Proxy.
4. Double-click Proxy Mappings.
5. Click a URL.
6. Click Properties.
7. In the User Name field, type the user name that the BlackBerry Enterprise Server component can use to connect to the
proxy server that is defined for the web address.
8. In the Password field, type the password for the user name.
9. In the Password (Confirmation) field, retype the password.
10. Click OK.
Administration Guide Configuring certain BlackBerry Enterprise Server components to use proxy servers
18