HCL Notes and Domino wiki: Domino security: IBM Notes and Domino Interim Fixes to support TLS 1.2

IBM Notes and Domino Interim Fixes to support TLS 1.2

Added by ~Keiko Kinibergoden | Edited by ~Keiko Kinibergoden on April 9, 2015 | Version 10

Actions ▼

Abstract

Abstract

IBM Notes 9.0.1 FP3 IF3 and IBM Domino 9.0.1 FP3 IF2 provide support for Transport Layer Security version 1.2

Tags: SHA-2, SSL, TLS

As follow up to delivery of Transport Layer Security (TLS) 1.0 support in 4Q2014, this page introduces TLS 1.2 support in Notes 9.0.1 FP3 IF 3 and Domino 9.0.1 FP3 IF2. See the Interim Fix section below for links to the Interim Fixes. Installing this fix on your 9.0.1 FP3 Domino server and/or Notes client will enable TLS 1.2 across all of the following protocols: HTTP, SMTP, LDAP, POP3 and IMAP (inbound and outbound). As in the previous TLS 1.0 interim fix, no additional configuration is required to set up TLS 1.2. With this interim fix. clients and servers previously configured for SSL or for TLS 1.0 will connect with browsers (and other SSL/TLS clients and servers) that request a TLS connection using the newer version of the protocol TLS 1.2, negotiating the highest version mutually supported. Likewise, for purposes of backwards compatibility, this Interim Fix continues to support SSL V3 connections by default.

To install and configure Notes or Domino 9.0.1 FP3 to use TLS 1.2
1) Bring down your Notes client or Domino server
2) Apply the appropriate interim fix for your platform
3) Bring up your client or server

To test it, hit the server with a browser running TLS 1.2

In addition to the features provided in Notes and Domino TLS 1.0 Interim Fix, this Interim Fix adds support for

Notes / Domino Support for TLS 1.2 with protocols: HTTP, SMTP, LDAP, POP3 & IMAP.
Perfect Forward Secrecy (PFS) via Ephemeral Diffie-Hellman (DHE) cipher specs for SSL/TLS
Authenticated Encryption with Associated Data (AEAD) including Advanced Encryption Standard (AES) Galois/Counter Mode and SHA-256 cipher specs for increased security with TLS 1.2
New notes.ini SSL_DISABLE_TLS_10 to support disabling TLS1.0 for compliance reasons. Used in conjunction with existing DISABLE_SSLV3=1 allows you to limit communication to TLS 1.2 only for protocols: HTTP, SMTP, LDAP, POP3 & IMAP
More detailed logging for SSL/TLS connections to help diagnose failed connections including events such as

TLS 1.2 Client handshake request rejected by Server if server certificate chain signature type not supported by the client
TLS 1.2 Notes / Domino as a TLS client rejects handshake with server if no common signature algorithm available
Add IP Information to HTTP Thread logs for TLS Handshake connections

Implement Http Strict Transport Security (HSTS).This header informs supported browsers that the site should only be accessed over an SSL-protected connection (HTTPS) and helps to prevent downgrade attacks

The following SPR fixes are also included:

DKEN9RVQGD - kyrtool import all sometimes reports "SECIssUpdateKeyringPrivateKey returned error 0x0720", "AVA separator not found" or "Syntax error in OID" when a '/' is in a certificate name part
MKIN9QHT5W - Passing a directory to kyrtool will crash the tool
KLYH9UQJQN - Remove RC4-SHA from the default cipher list for TLS 1.2

Please note that:

Java support for TLS 1.2 (including the JVM bundled with Notes and Domino) is available in a separate fix. Please see this Security Bulletin for more information.
TLS support for DIIOP is not available at this time and is tracked as SPR ITDL9U329W.
These Interim Fixes do not implement TLS 1.1 and IBM has no plans to implement this at this time.
Since Interim Fixes do not permit changes to the user interface or to templates used for configuration (e.g. Domino server document, Internet site document where SSL is configured), all SSL configuration options remain in the UI. However, as mentioned above, the installation of this Interim Fix will override your existing configuration with support for TLS 1.2

Interim Fix for TLS 1.2

Domino 9.0.1 FP3 IF2

Platform	Fix Central ID (link)
W32	DominoServer_901FP3IF2_W32
W64	DominoServer_901FP3IF2_W64
Linux	DominoServer_901FP3IF2_Linux
Linux64	DominoServer_901FP3IF2_Linux64
AIX32	DominoServer_901FP3IF2_AIX32
AIX64	DominoServer_901FP3IF2_AIX64
IBM i 6.1, 7.1 & 7.2	DominoServer_901FP3IF2_IBMi_6.1_7.1
System z	DominoServer_901FP3IF2_zSeries

Notes 9.0.1 FP3 IF3

Platform	Fix Central ID (link)
`W32 - Basic`	Notes_901FP3IF3_W32_Basic
`W32 - Standard`	Notes_901FP3IF3_W32_Standard
`MAC - Standard`	Notes_901FP3IF3_MAC_Standard
`Linux`	Notes_901FP3IF3_Linux_BinaryFiles