Setting up a Domino 5 Certificate Authority

2. Using the Domino Designer, create the Domino Certificate Authority application on the server using the Domino R5 Certificate Authority template (CCA50.NTF). To view the template file, select the option Advanced templates. You can name the application anything you wish -- for example, CERTCA.NSF.

3. Edit the ACL of the Domino 5 Certificate Authority database, as follows:

1. Add the names of the administrators who will issue and manage Internet certificates. Assign Editor with Delete access and the [CAPrivlegedUser] role to each administrator.
2. Set the -Default- access to Author with Create documents privilege.

Tip To hide the Domino Certificate Authority application so that it doesn't appear when users choose File - Database - Open and when Web clients browse a database list, deselect "Show in Open Database Dialog" on the Tools tab in the Database Properties box.

Creating a CA key ring file and certificate
When you use the Domino Administrator to create the CA key ring file, it is stored by default in the client's data directory.

Make sure that you keep the key ring file in a secure location, especially if you copy it to a shared location. To prevent unauthorized access, only the administrators that you specify should have access to the CA's key ring file and password.

To create a CA key ring file and certificate

1. Make sure you created the Domino Certificate Authority application.

2. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.

3. Click Create Certificate Authority Key Ring & Certificate.

4. Complete these fields:

Field	Action
Key ring file name	Enter the explicit path and file name for the CA key ring. The default is CAKEY.KYR in the Domino Administrator's data directory. It's helpful to use the extension .KYR to keep server and CA key ring file names consistent.
Key ring password	Specify a password for the key ring.
Password verify	Enter the password entered into the previous field. This helps ensure the password is entered correctly.
Key Size	Select the size of the public and private key pairs. The larger the size, the stronger the encryption.
Common name	Enter a descriptive name that identifies the CA certificate -- for example, Acme SSLCA.
Organization	Enter the name of the certifier organization. This is usually a company name, such as Acme.
Organizational Unit	(Optional) Enter the division or department in which the certifier resides.
City or Locality	(Optional) Enter the city or town where the certifier resides.
State or Province	Enter three or more characters that represent the state or province where the certifier resides, such as Massachusetts. (For U.S. states, enter the complete state name, not the abbreviation.)
Country	Enter the two-character representation of the country where the certifier resides -- for example, US for United States or CA for Canada.

Note The Common name, Organization, Organizational Unit, City or Locality, State or Province, and Country make up the CA server's distinguished name. Choose the CA name carefully; it is a costly process to reissue certificates if you change the name.

5. Click Create Certificate Authority Key Ring.

6. After you review the information about the key ring file and CA name, click OK.

7. Make a backup copy of the Certificate Authority key ring file, and store it in a secure location.

8. Configure the Domino Certificate Authority application profile.

To change the password for the CA key ring file

To ensure the continued security of the CA key ring file, periodically change its password.

1. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.

2. Click View Certificate Authority Key Ring, and then click Change CA Key Ring Password.

3. Enter the old password, and then click OK.

4. Enter a new password, and then click OK.

To set up a Domino CA server, you must perform these tasks:

1. Set up the server as a Domino Web server.

2. Create the Domino 5 Certificate Authority application.

3. Create a CA key ring file and CA certificate

4. Configure the CA profile to specify key ring and mail settings.

5. Set up SSL on the CA server.

Configuring the Domino Certificate Authority application profile
The Domino Certificate Authority application profile identifies the CA's key ring file and specifies the name of the CA server. Domino adds a link to the CA server when you send a message to clients and server administrators who request certificates. The clients and server administrators use this information to determine where to pick up certificates.

1. Make sure you created a CA key ring file and certificate.

2. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.

3. Click Configure Certificate Authority Profile.

4. If necessary, enter the CA key ring path and file name in the CA Key File field. By default, Notes looks for the key ring file on the local hard drive. You can also specify a network drive accessible to other administrators.

5. Enter the TCP/IP DNS name of the server that runs the CA application in the Certificate Server DNS name field. Domino uses this name to indicate where to pick up signed certificates in the messages sent to administrators and clients.

The following fields set default values for the Approved Client Certificates screen. You can override these when approving a certificate.

7. Set up SSL on the CA server.

Setting up SSL on the CA server
Because server administrators and clients use browsers to access the CA server to request and pick up certificates, use SSL to protect the CA server. When you set up the CA server for SSL, you create the server key ring file and request a server certificate. Domino automatically approves the server certificate and merges the CA certificate as a trusted root.

1. Make sure you configured the Domino Certificate Authority application profile.

2. From the Domino Administrator, click the Files tab, and open the Domino Certificate Authority application.

3. Click Create Server Key Ring & Certificate.

4. Complete these fields:

6. Enter the CA key ring file password, and then click OK. The server SSL key ring file is created.

7. Copy the server key ring file to the Domino data directory on the server. The Domino Certificate Authority application creates the file locally; however, the server needs the key ring file to use SSL.

Note If you choose to store the server key ring file in some place other than the Domino data directory, you must specify the full directory path to it in the Server document or Site document.

8. Configure the SSL port.

9. Enable server authentication on the server.

Displaying the CA key ring file
1. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.

2. Click View Certificate Authority Key Ring.

3. Click Display CA Key Ring.

4. Enter the password when prompted.

5. Double-click the CA Key Pair document you want to open and view.

6. To exit the document after viewing, click Close.

Exporting the CA key ring file
Export the CA key ring to a text file to troubleshoot problems with the CA server and compare key ring files.

1. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.

2. Click View Certificate Authority Key Ring.

3. Click Dump CA Key Ring to Text.

4. Enter the password when prompted.

5. Enter the name of the file to which you want to export the key ring. Notes creates this text file and places it in the data directory.

6. To view the text file, open it with a text editor.

Signing server certificates
The certificate authority signs a server certificate to add its digital signature to the certificate. A request for a server certificate appears in the Server Certificate Requests view in the Domino Certificate Authority application. When the certificate authority signs a certificate, the certificate authority can automatically notify the requesting server administrator by e-mail. The e-mail describes how to pick up the certificate and includes a pick-up ID, which the server administrator must use to identify the certificate during the pick-up process. Domino automatically generates the pick-up ID.

To sign a server certificate with a Domino 5 Certificate Authority

Before you begin, make sure that:

• The requesting server administrator has merged the Certificate Authority's certificate into the server key ring as a trusted root.
• You understand your organization's policy on signing certificates. Sign certificates only if the certificate requests comply with your organization's security policy.

2. Click Server Certificate Requests.

3. Open the request to sign.

4. Review the user information and distinguished name. Make sure that the information provided complies with your organization's security policy. If you want to deny the request, complete Step 5. Otherwise, go to Step 6.

5. To deny the request, do the following:

1. Enter a reason for the denied request.
2. If you do not want to notify the server administrator by e-mail, deselect "Send a notification email to the requester." Otherwise, Domino sends the server administrator an e-mail indicating that you denied the request and the reason why you denied the request.
3. Click Deny.

1. Enter a validity period. For short-term projects, 90 days is typical; for ongoing projects, you can enter several years.
2. If you do not want to notify the server administrator by e-mail to pick up the certificate, deselect "Send a notification email to the requester." Otherwise, Domino sends the server administrator an e-mail with a URL indicating the location to pick up the certificate.
3. Click Approve.
4. Enter the password for the CA's key ring file, and then click OK.

Viewing requests for certificates
Domino certificate authority administrators can view information about server and client certificates waiting for approval, approved requests waiting for pick-up, and requests that have been denied.
1. From the Domino Administrator, click Files and open the Domino Certificate Authority application.

2. Click Server Certificate Requests or Client Certificate Requests.

3. Use the Actions menu to display requests waiting for approval, approved requests, and denied requests.

Web Server Configuration documents
If you are migrating your site from Domino 5 to a later release you do not need to immediately convert from the old view to the new view. However, you will need to convert to the Internet Sites view to take advantage of many of the Web Site features.

Many of the HTTP task Server record settings used in Domino 5 are now available in the Web Site document. If you enable the Internet Sites view, the HTTP task uses the Web Site settings instead of those in the Server record.

Hosting Web sites using Web Server Configurations

Lotus Domino 5 uses the model of multiple virtual servers that are associated with a single Domino Web server. Each site is configured with its own IP address; default home page; customized Web server message; and HTML, CGI, and icons directories. All of the virtual servers share a single Domino data directory.

You set up each virtual server with a network connection with its own separate, permanent numeric IP address or map multiple host names to the same IP address. The number of virtual servers is dependent only on your operating system and the system hardware. See your operating system documentation and hardware documentation for more information.

• From the IBM Lotus Domino Administrator, click Configuration and click Servers.
• If you are creating a Web Realm document for a virtual server, click Web - Web Server Configurations.

• Open the Server document for the server to which the Web realm will apply.
• If you are creating a Web Realm document for a virtual server, open the Virtual Server document.

4. Complete these fields and then save the document:

      tell http restart

Creating file protection for virtual servers
Do one of the following:

• From the IBM Lotus Domino Administrator, choose Configuration - Servers, and open the Server document for the server to which the file protection will apply.
• If you are creating a File Protection document for a virtual server, chose Web - Web Server Configurations, and open the Virtual Server document.

2. Click the Basics tab, and complete these fields:

tell http refresh

Domino displays the File Protection document as a response to the Server document.