Need a Domino Consultant? Call NotesMail +1 212-599-2048 - HCLSoftware Business Partner
SECURING
Setting up Notes and Internet clients for TLS client authentication
You can set up a Notes® or Internet client for client authentication with a server. You cannot use client authentication for SMTP and IIOP connections.
About this task
For TLS client authentication, the Notes or Internet client must have:
- An Internet certificate issued by a Domino® or third-party certifier.
- A trusted root certificate for a Domino or third-party certifier.
- (Notes clients only) A cross-certificate for the Domino or third-party certifier created from the trusted root certificate. The trusted root certificate is not necessary for Notes clients after you create the cross-certificate.
- Software, such as a Web browser or a Notes workstation, that supports the use of TLS.
If an LDAP client supports the Simple Authentication and Security Layer protocol (SASL), Domino automatically uses this protocol when the client uses TLS client authentication to connect to the server. SASL is not supported for TCP/IP connections or TLS connections with only server authentication.
Setting up a Person document for an Internet user using TLS client authentication
In the Domino Directory on your Domino server, set up a Person document for Internet clients using TLS client authentication to connect to a Domino server. The Person document for the user stores the user's Internet certificate, which is used to verify the user's identity. The Person document also lists the names that a Domino server can use to authenticate an Internet user.
Publishing third-party CA client certificates in a Person record
Notes and Internet users who have a client certificate from a third-party certifier may want to have this certificate published in their Person record so that, if a user authenticates with a Domino server over TLS with that certificate, Domino will be able to determine the user's Notes identity.
Parent topic: TLS and S/MIME for clients
To set up Notes clients with certificates issued by a Domino CA
About this task
The CA and client complete these steps.
Procedure
1. Before issuing certificates, the CA must determine if Internet certificates should be created using the existing public and private keys from the Notes ID file or if the CA wants to issue certificates based on new keys generated from a browser certificate request. If clients use a browser that supports PKCS #12, clients can also import an existing Internet certificate into the Notes ID file. Depending on the environment, the administrator may choose to use a combination of these options for different users.
2. The CA adds a trusted root certificate to a Domino Directory that the client can access.
The client can also add a trusted root certificate to Contacts; however, adding a trusted root certificate simplifies the process of setting up Notes clients for TLS because the trusted root is accessible to many clients.
3. The client creates a cross-certificate using the trusted root certificate for the CA and stores it in Contacts.
4. To create a certificate using the existing public and private keys in the Notes ID file:
a. The CA adds an Internet certificate to the Person document.
b. The client authenticates with the home server. Notes automatically adds the Internet certificate to the ID file.
5. To use new public and private keys to create an Internet certificate, do the following:
a. The client requests the Internet certificate from the CA.
b. The CA approves the request, and Domino automatically adds the client's public key to the user's Person document.
c. The client merges the certificate into the ID file.
d. The CA adds an Internet certificate to the user's Person document.
To set up Internet clients with certificates issued by a Domino CA
Procedure
1. The CA administrator creates a Person document for the Internet client.
2. The client obtains the trusted root certificate for the server's CA.
3. The client requests the Internet certificate from the CA.
4. The CA approves the request, and Domino automatically adds the client's public key to the user's Person document.
5. The client merges the certificate into the local file.
To set up Notes and Internet clients with certificates issued by a third-party CA
About this task
The CA and client complete these steps.
Procedure
1. (Internet clients only) The CA administrator creates a Person document for the client.
2. Using any browser, the client follows the third-party CA's established procedure to request and merge the Internet certificate.
3. The Internet client follows the third-party CA's established procedure to merge the trusted root certificate for the CA.
4. The CA adds the client's public key to the Person document.
Example
For example, to obtain an Internet certificate from VeriSign, visit the site TLS Certificate Authority and Digital IDs in the related links and follow the instructions provided.
Related concepts
Setting up Notes and Internet clients for TLS authentication
TLS and S/MIME for clients
Related tasks
How users can obtain trusted certificates manually
Creating an Internet cross-certificate for a CA
Issuing Internet certificates in a Person document
Internet certificates for TLS and S/MIME
Signing an Internet client certificate and adding the certificate to the Domino Directory
|