Copyright © TIBCO Software Inc. All Rights Reserved


Appendix B Configuring SSL for HTTP and DIIOP : Configuring Key and Certificate for SSL

Configuring Key and Certificate for SSL
To enable SSL for HTTP and DIIOP, first you need to generate a key and certificate for SSL.
Generating Certificate Authority Key Ring and Server Key Ring
Complete the following tasks to generate a certificate authority key ring and a server key ring.
 
Task A Create Domino Certificate Authority Database
Users who do not use a commercial CA (Certificate Authority) need to create their own CA in Domino.
To create a Domino CA database:
1.
2.
3.
4.
5.
Select the Show advanced templates checkbox.
6.
Select Domino Certificate Authority from the Template area. Choose the cca50.ntf file as the template and ensure that the Inherit future design changes checkbox is selected.
7.
Click OK to create the database.
Task B Create a Certificate Authority Key Ring and Certificate
1.
2.
Click the 1. Create Certificate Authority Key Ring & Certificate option.
If the database has just been created, you may need to close it and then re-open it to allow some newly created views and documents to take effect.
3.
Figure 40 Create Certificate Authority Key Ring
4.
Click the Create Certificate Authority Key Ring button.
If the key ring has been successfully created, a window named Key ring created with self signed trusted root certificate pops up.
 
The key ring file will be created under the data subdirectory in the notes client installation folder.
Task C Create Server Key Ring
1.
2.
In the Open Database window, change the Server field to the location of the server. Select the Server Certificate Admin database, its file name is certsrv.nsf. Click Open.
This database can be found in the Domino data directory. If you cannot find the database, you need to create it. Refer to the Lotus Domino Administrator Help for details about setting up the Server Certificate Admin application.
3.
Click the 1. Create Key Ring option.
4.
 
It is recommended that you keep the default key file name, keyfile.kyr. Otherwise, you must change all the key file names in the server configuration document in Lotus Domino Administrator.
Figure 41 Create Server Key Ring
5.
Click the Create Key Ring button.
If the key ring has been successfully created, a window named Key Ring Created pops up.
 
The key ring file will be created under the data subdirectory in the notes client installation folder.
Installing Certificate into Key Ring
Complete the following tasks to install certificate into the key ring.
 
Task A Create Certificate Request
1.
In the Server Certificate Admin database, click the 2. Create Certificate Request option.
2.
The key ring file is that created for the server key ring. Leave the other fields unchanged.
3.
Click the Create Certificate Request button.
4.
5.
When the Certificate Request Created window pops up, copy the certificate request to the clipboard for later use. Do the copying according to the help information in the window.
Task B Submit Certificate Request
1.
For example, if the name of the database is DCA.nsf, use the following URL to access the database:
   http://domino_server_IP_address/DCA.nsf
Ensure that you have enabled the HTTP service for the Lotus Domino Server. Otherwise, you cannot access the database from the web browser.
2.
Click Request Server Certificate in the left hand panel.
3.
4.
Click the Submit Certificate Request button.
5.
Click Accept This Authority In Your Server in the left hand panel.
6.
Task C Install Trusted root certificate into Key Ring
1.
2.
Click the 3. Install Trusted Root Certificate into Key Ring option.
3.
a.
b.
c.
Select Clipboard as the Certificate Source.
d.
4.
Click the Merge Trusted Root Certificate into Key Ring button.
5.
6.
When the Merge Trusted Root Certificate Confirmation window pops up, check the information, and then click OK to install the certificate.
Once the installation is finished, a window pops up to indicate that the trusted root certificate has been merged into your key ring.
Task D Approve the Server Certificate Request
1.
2.
Click Server Certificate Requests in the left hand panel.
3.
4.
a.
b.
c.
Set an appropriate value in the Validity Period field. A small value will make your certificate expire soon while a very large value will compromise the security.
5.
Click Approve.
6.
7.
Task E Pick Up Server Certificates
1.
For example, if the name of the database is DCA.nsf, use the following URL to access the database:
   http://domino_server_IP_address/DCA.nsf
2.
Click Pick Up Server Certificate in the left hand pane.
3.
4.
Click the Pick Up Signed Certificate button.
5.
Task F Install Certificate into Key Ring
1.
2.
Click the 4. Install Certificate Into Key Ring option.
3.
a.
b.
Select Clipboard as the Certificate Source.
c.
4.
Click the Merge Certificate into Key Ring button.
5.
6.
When the Merge Signed Certificate Confirmation window pops up, check the information, and then click OK to install the certificate.

Copyright © TIBCO Software Inc. All Rights Reserved