HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status Assessment
Workspace Domino
Categories Security
Created by Guest
Created on Feb 23, 2024

RELATED IDEAS

Ability to send trusted certificate list even if destination endpoint sends empty DN

Domino currently is designed to decline sending any certificate and requires the destination endpoint to send a list of trusted DN CAs.

As per EXO "Exchange sends its certificate along with the certificate request to Domino. In our certificate request, we do not specify a list of preferred CAs, since this is optional plus we do not have preferred CAs, in the sense that we can accept many of them and we will validate the trust later".

EXO do not specify a list of preferred CAs. Due to this Domino does not send the list of it's trusted CA certificate. And overall SMTP routing does not takes place.

Customer requirement is to have ability to enforce domino to send it's trusted certificate to EXO in response wherein EXO does not sent DA list.

  • Attach files
      Drop here to upload
    • Guest
      Feb 6, 2025

      Hi.

      I'm now facing the same problem, with O365. As they are the kind of that world...

      Regards

      Reply
    • Guest
      Feb 4, 2025

      Microsoft just answer us about the fact that our domino is not correctly sending mails to an inbound connector in Exchange Online that is supposed to check our certificate:

      "Sending a DN List is not mandatory
      The Server DN List is an optional TLS handshake field (per RFC 5246 - TLS 1.2).
      Many SMTP servers do not send a DN List because the client should already know which certificate to present.
      In mutual TLS (MTLS) scenarios, the server typically only requests a certificate without sending a DN List."

      As you can read about the Microsoft answer: they do not send a DN list (even if the connector is about checking a certificate).

      And as Domino do not submit the certificate for the StartTLS session, we are facing a lose/lose situation.

      Any way to force domnio to present a certain certificate from certstore (we only have one in our certstore) to be able to send mail securely to Microsoft 365 ?

      Reply
    • Admin
      Thomas Hampel
      Feb 27, 2024

      Domino is correctly following the RFC definition.

      In this idea, you are requesting Domino to (blindly) submit all(!) certificates available even if they dont match the target.

      This is the first time I've seen this request but doing all of that matching in a keyring file based environment - it would be extremely difficult to implement. 

      So do not expect this functionality to be changed anytime soon.

      Reply
    Copyright © 2023 HCL Technologies Limited