SECURITY

Setting up Notes and Internet clients for SSL client authentication
You can set up an IBM® Lotus® Notes® or Internet client for client authentication with a server. You cannot use client authentication for SMTP and IIOP connections. For SSL client authentication, the Lotus Notes or Internet client must have:
If an LDAP client supports the Simple Authentication and Security Layer protocol (SASL), Lotus Domino automatically uses this protocol when the client uses SSL client authentication to connect to the server. SASL is not supported for TCP/IP connections or SSL connections with only server authentication.

To set up Notes clients with certificates issued by a Domino CA

The CA and client complete these steps.

1. Before issuing certificates, the CA must determine if Internet certificates should be created using the existing public and private keys from the Lotus Notes ID file or if the CA wants to issue certificates based on new keys generated from a browser certificate request. If clients use a browser that supports PKCS #12, clients can also import an existing Internet certificate into the Lotus Notes ID file. Depending on the environment, the administrator may choose to use a combination of these options for different users.

2. The CA adds a trusted root certificate to a Domino Directory that the client can access.


3. The client creates a cross-certificate using the trusted root certificate for the CA and stores it in Contacts.

4. To create a certificate using the existing public and private keys in the Lotus Notes ID file:

5. To use new public and private keys to create an Internet certificate, do the following: To set up Internet clients with certificates issued by a Domino CA

1. The CA administrator creates a Person document for the Internet client.

2. The client obtains the trusted root certificate for the server's CA.

3. The client requests the Internet certificate from the CA.

4. The CA approves the request, and Lotus Domino automatically adds the client's public key to the user's Person document.

5. The client merges the certificate into the local file.

To set up Notes and Internet clients with certificates issued by a third-party CA

The CA and client complete these steps.

1. (Internet clients only) The CA administrator creates a Person document for the client.

2. Using any browser, the client follows the third-party CA's established procedure to request and merge the Internet certificate.

3. The Internet client follows the third-party CA's established procedure to merge the trusted root certificate for the CA.

4. The CA adds the client's public key to the Person document.

For example, to obtain an Internet certificate from VeriSign, visit the site "SSL Certificate Authority and Digital IDs" and follow the instructions provided.

Related topics