- Certificates
A certificate is a unique digital signature that identifies a user or server. Server and user IDs contain one or more HCL Notes® certificates. In addition, user IDs may contain one or more Internet certificates that identify users when they use TLS to connect to an Internet server or send a signed S/MIME mail message.
- Notes clients and two-factor authentication
HCL Notes client authentication with a Notes ID provides built-in, automatic, two-factor authentication.
- Password-protection for Notes and Domino IDs
To ensure the security of the Domino® system, password-protect all Notes® and Domino® IDs -- certifier, server, and user. When you password-protect an ID, a key that is derived from the password encrypts the data on the ID. Then, when you attempt to access mail, open a server-based database, or examine ID file information, you are prompted to enter a password.
- The password quality scale
When creating passwords for user, server, or certifier IDs, you need to understand the criteria by which Domino® measures password strength and security. Domino® measures this criteria according to the level assigned on its password quality scale. The scale assigns a minimum level of quality to the password on an ID file. Domino® bases the password quality on the number and variety of characters in the password.
- Verifying user passwords during authentication
You can enable password verification so that a Notes® user can authenticate with a server only after providing the correct password that is associated with the user ID.
- Setting up password verification
You can enable password verification through the use of a security policy settings document, which allows you to enable this feature for multiple users, or you can enable password verification on an individual basis through the Domino® Directory.
- Custom password policies
Information protection and data privacy laws include specific requirements for the selection of secure passwords for identity verification. To help users comply with these laws, HCL Domino® includes the ability to implement password restrictions on a policy basis. Administrators can enforce password requirements that will fit almost any set of corporate or government security requirements.
- Assigning multiple passwords to server and certifier IDs
To assign multiple passwords to server and certifier IDs, all of the administrators whose passwords will be assigned to the ID must be present. Then, during the procedure of assigning multiple passwords, each administrator completes a series of steps.
- Using Notes Shared Login to suppress password prompts
Notes® Shared Login (NSL) allows users to start Notes® without having to provide Notes® passwords. Instead, they only need to log in to Microsoft™ Windows™ using their Windows™ passwords.
- Using Nomad Shared Login to suppress password prompts
Starting in HCL Domino 12.0.2, Nomad Shared Login allows users of HCL Nomad for web browsers to authenticate with Domino servers without having to provide Notes® ID file passwords after initial setup. This feature is enabled by default for Nomad deployments starting with Nomad for web browsers 1.0.8.
- Using Notes Shared Login to secure server ID files
Starting with HCL Domino 12.0.1, you can secure the server ID files of Domino servers on Windows using the Notes Shared Login (NSL) functionality.
- Notes ID vault
The ID vault is an optional, server-based database that holds protected copies of Notes® user IDs. An ID vault allows administrators and users to easily manage Notes® user IDs. Users are assigned to a vault through policy configuration, and copies of user IDs are uploaded to a vault automatically once the policy has taken effect.
- ID recovery
Use of the ID vault for ID recovery is strongly recommended. However, the ID recovery feature described in this topic is still supported.
- Public key security
Every Notes® user ID and Domino® server ID has a unique public key for the Notes® certificate. The public key is stored in an ID file and in the Person or Server document for that ID in the Domino® Directory. Notes® and Domino® use the public key to authenticate users and servers, verify digital signatures, and encrypt messages and databases. A Notes® user ID can also have a unique public key for an Internet certificate.
- User and server key rollover
Key rollover is the process used to update the set of Notes® public and private keys that is stored in user and server ID files. Periodically, this set of keys may need to be replaced -- as a precaution against undetected compromise of the private key; as a remedy to recover from a known compromise of the private key; or to increase security by updating to a larger key.
- Using cross-certificates to access servers and send secure S/MIME messages
Domino® uses both Notes® and Internet cross-certificates. Notes® cross-certificates allow users in different hierarchically-certified organizations to access servers and to receive signed mail messages. Internet cross-certificates allow users to receive signed mail messages and send encrypted mail messages.
- Adding cross-certificates to the Domino Directory or Contacts
You can use several methods to obtain an HCL Notes® or Internet cross-certificate.