HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status Assessment
Workspace Domino
Categories Security
Created by Guest
Created on Dec 10, 2020

RELATED IDEAS

Domino is expected to have enhanced PKCS12 Internet Certificate Management .

Domino is expected to have enhanced PKCS12 Internet Certificate Management .

Currently as per documented process there is GUI method of importing internet certificates deployed by internal CA outside of Domino to the person documents in the NAB(Domino Directory).

Thus to import the internet certficates to a large number of NAB users uusing GUI is tidiuos as this needs action on each person document individually.(Goal is to put only public keys (*.cer) into the internet certificate field).

Though there are undocumented Lotusscript method of using @Command([PKCS12ImportCertsToNAB] without GUI, but it is expected from Domino to have a better enhanced PKCS12 Internet Certifcate Managament. Where using GUI method this certifcate import can be done to multiple set of users in a go as per requirement.

  • Attach files
  • Guest
    Reply
    |     Sep 26, 2024

    The internet CA supports higher SHA algorithms. It's maybe a bit tricky to configure.

    Look at my test cert:


    #0

    Subject : /O=dnug-lab/OU=demo/CN=Rudi Rakete/emailAddress=rudi.rakete@notes.lab

    Issuer : /C=DE/ST=NRW/L=Koeln/O=DNUG-Lab/OU=IT/CN=CA

    Not Before : 2024.09.15 07:12:34

    Not After : 2026.09.16 07:12:27 (expires in 2.0 years)


    Serial : 7444111D4E404BCA336C7FC749D52ADD3DBAB4E0

    Sign Alg : sha384WithRSAEncryption

    KeyUsage : DigitalSignature, DataEncipherment, KeyAgreement

    Extensions : KeyUsage

    Key : RSA 2048 bit


    CRL : ldap://linus.lab.dnug.eu/CN=CA,OU=IT,O=DNUG-Lab,L=Koeln,ST=NRW,C=DE


    MD5 : 85:56:29:EE:97:14:15:32:AC:15:5D:57:29:9B:32:FF

    SHA1 : C5:BB:AA:68:4E:5D:7C:48:5E:5C:8A:EC:3D:F4:AF:F6:4A:1A:A7:57

    SHA256 : 62:30:A2:32:5B:CC:E4:0E:EE:36:61:3A:7E:B0:73:EB:35:68:42:E0:68:08:6E:98:75:62:69:18:45:5C:DD:A2

  • Guest
    Reply
    |     Sep 26, 2024

    Hi Thomas,

    The Domino CA process still issues SHA1 (or worse) signed certficates and is therefore no longer a valid source for client certificates.
    But you could put "enable the Internet CA to create SHA256/SHA512 signed certs" on your list.

  • Admin
    Thomas Hampel
    Reply
    |     Jan 18, 2021

    If you would like to distribute a 3rd party X509 email certificate to your users, there are two methods:

    a) the end user creating a Certificate Signing Request - this can only be done with a private key, so it must be done by the user

    b) admins can create a new keypair, which will then be used to create a CSR. However, the keypair needs to be merged back into the user's ID file - and again this is an action that only the user can do.

    Without the password you can not change the contents of the user ID file, so distributing a new x509 cert can not be done by just uploading it to the DominoDirectory.

    However, the Domino CA process can very well be used to issue X509 certs to existing users. Distributing 3rd party key material without involving the user requires more than just an @function.

Copyright © 2023 HCL Technologies Limited