Simple Mail Transport Protocol (SMTP)
Managing TLS certificates with Certificate Manager
HCL Domino 12 introduces a new server task, Certificate Manager (CertMgr), that works with a new database, Certificate Store (certstore.nsf) to manage TLS certificates in your Domino environment.
TLS port configuration
The TLS protocol always provides an encrypted, integrity-checked, communications channel and authenticated server identity. TLS servers can be optionally configured to request various forms of client identity authentication.
Requiring a TLS connection to a server
Require TLS connections when you want to make sure that clients use a secure connection to access databases on the server. You do this by redirecting connection requests that come in over the TCP/IP port to the TLS port. If you do not require an TLS connection, clients can use either TLS or TCP/IP to connect to the server.
Creating an Internet cross-certificate for server-to-server TLS
One server can obtain an Internet cross-certificate from another server for the purposes of establishing trust. For example, if one server needs to access Directory Assistance on another server.
Setting up database access for TLS clients
After you set up TLS on a Domino server, you must give the clients access to databases on the server.
Modifying TLS cipher restrictions
TLS uses public, private, and negotiated session keys. Every set of TLS credentials has one pair of keys -- a public key and private key -- and an X.509 certificate that enable certificate owners to identify themselves over the network and to use S/MIME to encrypt and sign messages. Certificates contain only the public half of the key pair. The private key is kept in the ID file for the Notes® client, and is kept in the key ring file or cerstore.nsf database in the case of the TLS server. Starting with Domino 12, Domino supports both RSA and ECDSA keys. For more information, see ECDSA cryptography support for ACME accounts and for host keys.
Authenticating Web TLS clients in secondary Domino and LDAP directories
When a Web client authenticates with a server, by default, the server checks the primary HCL Domino Directory to see if the client certificate exists in the Person document. If your organization uses a secondary Domino Directory and/or an LDAP directory to verify client certificates, you can set up Domino to check those additional directories. To do so, you set up the secondary Domino and LDAP directories as trusted domains in the Directory Assistance database.
TLS session resumption
TLS session resumption greatly improves performance when using TLS by recalling information from a previous successful TLS session negotiation to bypass the most computationally intensive parts of the TLS session key negotiation. HTTP is the protocol that benefits the most from TLS session resumption, but other Internet protocols may benefit as well.
Managing TLS certificates without Certificate Manager
If you do not manage certificates with Certificate Manager (CertMgr) and the Certificate Store (certstore.nsf) database, you generate and manage certificates manually, as described in this section.