HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status Under Consideration
Workspace Domino
Categories Administration
Created by Guest
Created on Jan 23, 2022

RELATED IDEAS

In Certificate Store Validate 'Servers with access' field

When creating new TLS Credentials in the Certificate Store (certstore.nsf) ensure the "Servers with access" field is populated before allowing the "Create Exportable Key" action button to be used. Failure to enter the servers before performing the "Create Exportable Key" functionality will render the keys unusable on any server other than the server the TLS Credentials were created on even if that server is later added to the "Servers with access" field. The other servers will display the following error in the console/log when starting up:
TLSCache-HTTP: Error decrypting TLS Certificate cache entry for [0x936]

: The encrypted data has been modified or the wrong key was used to decrypt it

  • Attach files
  • Guest
    Reply
    |     Jan 26, 2022

    Hi there, I just wanted to make sure we're all talking about the same thing 🙂. I was having issues due to using the "Create Exportable Key" functionality and not first populating the "Services with access" field, not the "Import TLD Credentials" functionality. In my case, I was creating a new TLS Credential but needed to export the certificate (multiple SANs) to use on other devices.

  • Guest
    Reply
    |     Jan 23, 2022

    Some background:

    The import functionality is a client side functionality without any server round trip.
    The TLS Credentials private key is written by the client for the CertMgr server and all servers you specify before you hit the import button as you say.


    You don't have to specify a server with access when importing.

    It could also be that you only want to import and later decide to use it on a server.


    The real enhancement would be to catch that the server with access field has been changed after the import button is used and let the CertMgr server add the new server.


    This can be done manually today. The limitation is that the later change is not detected by the template. This is the limitation you are running into.

    We will have a look for the next update of the certstore.ntf design.

    Another idea we can look into is to show an info in the import dialog if no server is selected.


Copyright © 2023 HCL Technologies Limited