Home
Securing your data
IBM® Notes® security enables you to protect your workspace and data at all times, so only you and the people you designate have access to your data.
Accessing servers using certificates
A certificate is an electronic stamp, like a stamp on a passport, which verifies to a server that you are who you say you are. Certificates are stored in your User ID. When you first receive your User ID from your administrator, it contains a Notes® certificate. You may decide to use Internet certificates as well. (You may see Internet certificates being referred to as X.509 certificates.)
To retrieve an Internet cross certificate
If you try to request an Internet certificate, and your Contacts does not have a cross certificate for the certificate authority (CA) you are requesting the certificate from, you have to retrieve an Internet cross certificate to complete the request.

Securing your data
IBM® Notes® security enables you to protect your workspace and data at all times, so only you and the people you designate have access to your data.
- Your Notes User ID and how to store it
- Changing passwords
  Passwords prevent others from using your User ID. When your administrator creates your User ID, he or she decides whether it needs a password, and what type of password is required. Once you access IBM® Notes® for the first time, you should change your password to something that you can remember but is hard for others to guess.
- Using Notes shared login to eliminate Notes password prompts
  Notes® shared login (hereafter shared login) allows you to start IBM® Notes and use your User ID without having to provide a Notes password. You only need to log in to Microsoft® Windows® using your Windows password. Your administrator controls whether you can use shared login.
- Locking the Notes ID
  Locking your IBM® Notes® ID prevents others from using Notes when you are away from your computer. Locking your ID clears your Notes credentials and drops all connections to Notes servers. You must log in again in order to take any new action using Notes.
- Enabling Smartcards for Notes® login
  Smartcards resemble credit cards, but instead of containing a magnetic strip they contain a microprocessor and memory. You can use a Smartcard with your User ID to login to IBM® Notes®, provided you have a Smartcard reader installed on your computer. Once your User ID is enabled for Smartcard login, you are prompted for your Smartcard Personal Identification Number (PIN) in place of your Notes password.
- Requesting a new user name
  If you want to request a new User Name - for example, if you got married and you want to change your name - you must contact your administrator.
- Your Notes® and Internet names
  You can view all the names that identify you in Notes®.
- Sending mail to your administrator
- Accessing servers using certificates
  A certificate is an electronic stamp, like a stamp on a passport, which verifies to a server that you are who you say you are. Certificates are stored in your User ID. When you first receive your User ID from your administrator, it contains a Notes® certificate. You may decide to use Internet certificates as well. (You may see Internet certificates being referred to as X.509 certificates.)
  - Renewing Notes® certificates before expiration
    Your User ID comes with a IBM® Notes® Multi-purpose certificate and a Notes International certificate. They are valid for a period of time and then need to be renewed before they expire.
  - Requesting Internet certificates
    You can request an Internet certificate from IBM® Domino® through your Domino administrator, or you can request an Internet certificate from another vendor. Regardless of where you request the Internet certificate from, you need to use the IBM Notes® browser to request it, so you can use the Internet certificate with Notes. Internet certificates can be used to sign and encrypt mail messages and make secure connections over the Internet.
  - Importing and exporting Internet certificates for use between browsers
    When you receive new Internet certificates, you can only use them in the browser with which you requested them. However, you can export Internet certificates from a browser and then import them into your User ID so you can use them with the IBM® Notes® browser and Internet-style mail (S/MIME). In the same respect, you can export Internet certificates from your User ID so you can use them with a browser other than Notes. You can also import and export Internet certificates for use between other Internet applications, such as Microsoft® Outlook.
  - Deleting certificates
    You can delete flat certificates and Internet certificates from your User ID. However, when you delete certificates, IBM® Notes® retains the appropriate keys to decrypt data that was encrypted with those certificates.
  - Finding Notes® and Internet certificates you trust
    You can check your Contacts and the IBM® Domino® Directory for all certificates belonging to a specific person. For example, you may want to send encrypted mail to a colleague in your company. To successfully send encrypted mail, IBM Notes® must be able to find your colleague's certificate. If you are not sure Notes can find your colleague's certificate or whether you trust that person's certificate, you can check for certificates belonging to your colleague.
  - Sending and receiving Notes® certificates to establish trust
    Trust is established for a certificate through a cross certificate. You may need to send someone your IBM® Notes® certificate so that person can create a cross certificate for it. You in turn may receive a Notes certificate that you need to cross-certify with. You can also create a cross certificate for a certificate in the IBM Domino® Directory.
  - To retrieve an Internet cross certificate
    If you try to request an Internet certificate, and your Contacts does not have a cross certificate for the certificate authority (CA) you are requesting the certificate from, you have to retrieve an Internet cross certificate to complete the request.
- The Access Control List
  Every database includes an access control list (ACL), which IBM® Notes® uses to determine the level of access users and servers have to a database. Levels assigned to users determine the tasks that users can perform on a database. Levels assigned to servers determine what information within the database the servers can replicate.
- Restricting access to local databases
  When you enable encryption for a local database, IBM® Notes® encrypts the database using your public key from your User ID. You are the only one who can then decrypt the database because you have the corresponding private key in your User ID. Nobody else's User ID can open the database.
- Notes data
  You can restrict access to applications you have stored locally or encrypt a document in an application.
- Preventing others from reading or viewing specific documents
  You can protect your documents, so that only you and the people you designate can read them, even if others have access to the database your documents are in.
- Encrypting documents using secret keys
  Using a secret encryption key that is stored in your User ID, you can encrypt a document that you are posting in a public database, provided the document contains fields that are encryptable.
- How Notes® uses public and private keys for encrypting and signing mail
  IBM® Notes® uses a public and private key set to encrypt and decrypt data, as well as to validate digital signatures. The public and private key in a set are mathematically related to each other and are unique to your User ID. Your public key is stored in your Notes certificate. Your certificate is stored in your User ID and the IBM Domino® Directory. Your private key is stored only in your User ID.
- Restricting execution access with the Execution Control List
  You can protect your workstation by specifying different types of execution access for different people or organizational certifiers who run IBM® Notes® scripts and formulas. For example, you may give all types of execution access to your IBM Domino® administrator, but allow no execution access to unsigned scripts or formulas.
- Securing your POP3, IMAP, or LDAP accounts
  IBM® Notes® supports Secure Sockets Layer (SSL), which makes communication secure for your POP3, IMAP, or LDAP accounts. SSL encrypts the data that is sent between your Notes client and the server you specify for your account. Notes supports SSL versions 2.0 and 3.0. By default, Notes negotiates the best SSL version to use with a particular server.
- Signed plug-ins
  Your administrator may have selected plug-ins to be installed automatically with your client software. These plug-ins are signed with a certificate that is trusted by your client, and verified that the data they contain is not corrupted. Plug-ins signed in this way can then be installed without having to prompt you to accept them.

To retrieve an Internet cross certificate

If you try to request an Internet certificate, and your Contacts does not have a cross certificate for the certificate authority (CA) you are requesting the certificate from, you have to retrieve an Internet cross certificate to complete the request.

About this task

You may also need to add an Internet cross certificate if you are trying to make an SSL connection to a website. For example, www.verisign.com is an SSL connection, known because of the "S" added to the end of the HTTP that precedes the address. You must have an Internet cross certificate to access SSL sites.

If you attempt to make an SSL connection to a secure website using the IBM® Notes® browser, you may be prompted to make a cross certificate on the spot. If you are not prompted then you need to retrieve a cross certificate.

Procedure

Click File > Security > User Security (Macintosh OS X users: Notes > Security > User Security).
Click Identity of Others > People, Services.
Select "Find more about people/services, and then click Retrieve Internet service certificate.
Enter the URL of a website secured by the same certificate authority you're requesting a certificate from in the Service name field of the Retrieve Internet Service Certificate dialog box. For example, enter www.ibm.com.
Click the type of port to use to connect to the server in the Protocol field. The server must be listening on the port indicated. Usually, you can leave the defaults.

Note: Once you obtain the Internet cross certificate, it can be used for SSL communications using any protocol.
Click the Connect.
Do one of the following:
- To accept the specific Internet cross certificate you requested, click OK in the Trust for service dialog box.
- To view the other cross certificates you can accept, for example trusting the CA that is issuing this certificate as well as any other certificate the CA issues, click Advanced Options to choose the specific service you want to trust. Then click the Trust this certificate.
- To view specific details about the certificate, click the Certificate Details, Trust Details or Advanced Details button in the Trust for Service or Trust Certificate dialog box.

Results

If you are having trouble getting a cross certificate, you should check your proxy settings in the Location document of your Contacts.