"Unable to establish a connection" errors in the BlackBerry Collaboration Service 5.0 SP3 logs

• BlackBerry® Enterprise Server 5.0 SP3 for Microsoft® Exchange®
• Microsoft® Office Communications Server 2007 R2

When a user attempts to log into the Enterprise Messenger Client on the BlackBerry smartphone, the BBIM logs show:

<2011-01-03 15:38:08.949 EST>:[292]:<BBIM_BCSSERVER02_BBIM_3>:<INFO >:<LAYER = BBIM, DEVICEPIN = 12345678, USERID = u1a, SIP URI = sip:user01@example.com>
<2011-01-03 15:38:08.949 EST>:[293]:<BBIM_BCSSERVER02_BBIM_3>:<INFO >:<LAYER = BBIM, DEVICEPIN = 12345678, USERID = u1a, Account = EXAMPLE\user01>
<2011-01-03 15:38:10.558 EST>:[301]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, [OCSC] A User Endpoint for URI: sip:user01@example.com could NOT be established. RealTimeException msg: Unable to establish a connection., inner exception:  No connection could be made because the target machine actively refused it 192.168.0.1:5061>
<2011-01-03 15:38:10.574 EST>:[303]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, DEVICEPIN = 12345678, USERID = u1a, OCS -> IM Proxy failure event = Unable to establish a connection.>

or

<2011-04-05 11:17:50.977 EDT>:[264]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, [OCSC] A User Endpoint for URI: sip:user02@example.com could NOT be established. RealTimeException msg: Unable to establish a connection., inner exception: An existing connection was forcibly closed by the remote host>
<2011-04-05 11:17:50.977 EDT>:[266]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, DEVICEPIN = 12345678, USERID = u12b, OCS -> IM Proxy failure event = Unable to establish a connection.>

or

<2011-04-05 11:21:18.283 EDT>:[348]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, [OCSC] A User Endpoint for URI: sip:user02@example.com could NOT be established. OperationTimeoutException msg: This operation has timed out., inner exception: none>
<2011-04-05 11:21:18.346 EDT>:[350]:<BBIM_BCSSERVER02_BBIM_3>:<WARNG>:<LAYER = BBIM, DEVICEPIN = 12345678, USERID = u12b, OCS -> IM Proxy failure event = This operation has timed out.>

The causes of these kind of error messages are related to certificate issues, or certificate trust issues.

Cause 1 - The certificate issued for the BlackBerry Collaboration Service has a spelling mistake where the Subject Name does not match the actual computer name of the server hosting the BlackBerry Collaboration Service.

Cause 2 - The OCS Pool does not have the Root Certificate Authority loaded into its Certificate Manager, and is unable to validate the incoming certificate with the TLS request from the BlackBerry Collaboration Service.

Cause 3 - The OCS Front End Servers have a manual reference for the server hosting the BlackBerry Collaboration Service loaded into the Host Authorization tab.

Cause 1
The certificate issued for the BlackBerry Collaboration Service has a spelling mistake where the Subject Name does not match the actual computer name of the server hosting the BlackBerry Collaboration Service.

Resolution 1
Request a new certificate that includes the proper information. Please refer to KB24960 for details.

Cause 2
The OCS Pool does not have the Root Certificate Authority loaded into its Certificate Manager, and is unable to validate the incoming certificate with the TLS request from the BlackBerry Collaboration Service.

Resolution 2
Install the Root Certificate Authority certificate onto the OCS Pool servers.

Cause 3
The OCS Front End Servers have a manual reference for the server hosting the BlackBerry Collaboration Service loaded into the Host Authorization tab.

Resolution 3
Remove any manual references from the Host Authorization tab of the OCS Pool servers.  These entries are unnecessary, as the BlackBerry Collaboration Service automatically provisions into Active Directory.  By default, this path is : CN=Trusted Services,CN=RTC Service,CN=Services,CN=Configuration,DC=example,DC=com. This coupled with a valid certificate that is presented from the BlackBerry Collaboration Service to the OCS Pool, properly authenticates itself to the OCS Pool.