Home
IBM® Domino 10.0.1 Documentation
Welcome to the IBM® Domino 10.0.1 Administrator Help.
Securing
This section describes IBM® Domino® security features, including execution control lists, IDs, and SSL.
SSL and S/MIME for clients
Clients can use a Domino® certificate authority (CA) application or a third-party CA to obtain certificates for secure SSL and S/MIME communication.
Pushing trusted certificates to Notes® clients
You can create cross-certificates in the Domino® Directory for Internet certifiers and Notes® certifiers and then push the cross-certificates to the Contacts application on Notes clients. The cross-certificates are used to establish client trust of a certifier when accessing servers, reading encrypted S/MIME mail, or installing signed Notes client plug-ins. When you push cross certificates, users are not required to create the cross-certificates or retrieve them from the Domino Directory.
How users can obtain trusted certificates manually
The copy of the CA's certificate is called a trusted root certificate. After obtaining the trusted root certificate and -- if you are using a Notes® client -- an Internet cross-certificate for the root certificate, the client will trust the CA and by extension, any certificates issued by this CA. If you are setting up server authentication for an Internet client, you add this trusted root to a local file. If you are setting up server authentication for a Notes client, you add this trusted root to a Domino® Directory that users can access to generate a cross-certificate in their Contacts.
Creating an Internet cross-certificate for a CA
Before an IBM® Domino® client can authenticate servers or send secure S/MIME messages, the client must first create a cross-certificate for the CA server and store it in Contacts. This allows the IBM Notes® client to trust servers or clients that have certificates issued by that CA.

Creating an Internet cross-certificate for a CA

Before an IBM® Domino® client can authenticate servers or send secure S/MIME messages, the client must first create a cross-certificate for the CA server and store it in Contacts. This allows the IBM Notes® client to trust servers or clients that have certificates issued by that CA.

About this task

The client uses a trusted root certificate to create the cross-certificate. Once the cross-certificate is created, the client no longer needs the trusted root certificate.

SSL server authentication for Internet clients other than Notes does not require a cross-certificate.

A Notes client can also create a cross-certificate for a server or client; however, this allows the Notes client to trust only that server or client. The Notes client does not then trust other servers and clients with certificates issued by a CA.

Note: Best practice is to push trusted cross-certificates to Notes clients' Contacts rather than having users retrieve them from the Domino Directory themselves.

Procedure

Make sure the CA created a trusted root certificate in the Domino Directory.
Instruct clients to retrieve an Internet cross-certificate through the User Security dialog box.

Results

Notes users can view the Internet cross-certificates contained in Contacts. For information on how Notes users can see and retrieve their Internet cross-certificates, see Notes Help.