Adding trusted root certificates

Trusted root certificates allow web servers to accept the trusted root certificates from connecting clients. Trusted root certificates are also useful for automatically completing partial certificate chains presented by CAs.

About this task

You create Trusted Root documents in the Trusted Roots view of certstore.nsf to store the trusted root certificates and then select them when you generate TLS certificates.

Note: Let's Encrypt trusted roots for both the Production and Staging environments are included in certstore.nsf and are added automatically to TLS certificates that are generated by the Let's Encrypt CA.

To add a trusted root certificate:

Procedure

  1. Open certstore.nsf.
  2. Select the Trusted Roots view.
    Note: You can use the Usage categories field to define how the trusted root will be used. When Restrict use to category is selected, choosing a category from the list limits the use of the trusted root to that category.
  3. Click Add Trusted Root.
  4. Copy the certificate to the clipboard and then click Paste Certificate.
  5. Click Submit Request to add the trusted root certificate to the Trusted Roots view.

What to do next

When you request a new TLS certificate or update an existing TLS Credentials document, open the Security/Keys tab of the TLS Credentials document. In the Trusted Roots field, select the trusted root certificate that you previously added to the Certificate Store. This configuration is required in some of the following scenarios:

Establishing a Secure TLS Connection to a Remote LDAP Server

When a Domino server establishes a secure TLS connection to a remote LDAP server, such as an Active Directory server accessed through Directory Assistance for Directory Synchronization, the Domino server must trust the Certificate Authority (CA) that issued the LDAP server's certificate.

Domino Web Server Configured for Client Certificate-Based Authentication

When the Domino Web Server is configured for client certificate-based authentication, Domino must trust the Certificate Authorities that issued Internet certificates to the users. During the TLS handshake, Domino validates the certificate presented by the client against the trusted root certificates specified in the TLS Credentials document.

End-User Client Configuration

  1. Obtain the Internet certificate of the user, including the private key, in PKCS #12 (.p12) format.
  2. Import the .p12 file into the web browser or operating system certificate store of the user.
  3. Check if the trusted root CA certificate in the browser's or operating system's is present in the Trusted Root Certification Authorities store.
  4. When accessing the Domino Web Server, select the appropriate client certificate if prompted by the browser.
  5. Verify that the user is successfully authenticated using the client certificate.
By selecting the appropriate trusted root certificates in the TLS Credentials document, Domino can validate certificates presented by remote servers and clients, enabling secure TLS communications and certificate-based authentication.
Note: If you are using the Domino CA to manage Internet certificates issued to Domino users, follow the steps below to configure client certificate-based authentication.

Domino Server Configuration

  1. Export the Domino CA Internet Certificate from the Domino Directory. Security > Certificates > Internet Certificates > Domino CA (The CA used to issue user certificates).
  2. When exporting the certificate, select Base64 encoded X.509 and save the file in .cer format.
  3. Import the Domino CA certificate into the Domino Certificate Store.
  4. Verify that the certificate is available as a trusted certificate in the Certificate Store.
  5. Open the TLS Credentials document used by the Domino Web Server.
  6. On the Security/Keys tab, select the imported Domino CA certificate in the Trusted Roots field.
  7. Save and deploy the TLS Credentials document.
  8. Configure the Domino Web Server to require or allow client certificate-based authentication, as appropriate for your environment.
End-User Client Configuration
  1. Export Internet certificate of the Domino user by following the steps documented in Exporting and importing Internet certificates, including the private key, in PKCS #12 (.p12) format.
  2. Import the .p12 file into the user's web browser or operating system certificate store.
  3. Import and trust the Domino CA root certificate in the browser's or operating system's Trusted Root Certification Authorities store.
  4. When accessing the Domino Web Server, select the appropriate client certificate if prompted by the browser.
  5. Verify that the user is successfully authenticated using the client certificate.

After these steps are completed, the Domino Web Server will trust client certificates issued by the Domino CA and will be able to authenticate users based on their certificates during the TLS handshake.