This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


~Naomi Zenniteroopsi
Sep 2, 2015, 9:04 PM
11 Posts

Domino, Traveler and SSL/TLS

  • Category: Security
  • Platform: Windows
  • Release: 9.0.1
  • Role: Administrator
  • Tags: Traveler 9.0.0.1,Domino 9.0.1,SSL
  • Replies: 4

Hello,

A couple of years ago, i installed by a Domino 8.5.3FP6 server with Traveler 8.5.3.3 beside an existing Domino domain still existing as users wanted to access their mail files from their smartphones.
But as they also wanted to be able to to do it from "anywhere", so i installed a proxy (Zen Load Balancer) between the Traveler server and the router, and implemented SSL using the cca.ntf database, so SSL is used for the communications with the Domino/Traveler server.

Today, i upgrated the server to Domino 9.0.1.4+HF70 and Traveler 9.0.1.7. Everything went ok, but when starting Traveler, there are a lot of "TLS/SSL connection ... failed with server certificate chain signature alogrithms NOT supported by client" messages and "TLS/SSL connection... failed with server certificate chain requiring support for MD5". And the smartphone clients can't connect. (i didn't see the exact message).

I'm really not a cryptography expert; so, my understanding is that the cca.ntf i used in the past delivered me an SSLv3 certificate. Is it for that reason (to weak certificate algorithm) that it doesn't work ?

TIA if you can help me.

Yan

~Tanita Desweverobu
Sep 3, 2015, 2:06 PM
94 Posts
Upgrade your server certificate from MD5 to SHA-1 or (preferably) SHA-256
TLS 1.2 adds a mandatory extension to the ClientHello that allows the client to specify what signing algorithms it supports, and many clients are now excluding MD5 from that list.  This will cause TLS 1.2 connections to fail against your MD5 server certificate.  Most browsers will then retry with TLS 1.1 or 1.0 and -- lacking that extension -- succeed, but many non-browser clients will just stop there and fail completely.

The Notes/Domino wiki has some good information on how to create your own self-signed certificates or how to request a stronger certificate from a public CA.
~Sven Quetvelupulakoi
Sep 3, 2015, 2:11 PM
24 Posts
Replace your MD5 Web server keyring with SHA-2 (or SHA1)
You will need to replace your server keyring with a SHA-2 (or SHA-1) certificate that does not use the MD5 hashing algorithm.

Title:        Domino Web Server keyring still using MD5 may cause TLS 1.2 handshake failure
Doc #:        1701159
URL:        http://www.ibm.com/support/docview.wss?uid=swg21701159
~Naomi Zenniteroopsi
Sep 4, 2015, 5:02 PM
11 Posts
Replace your MD5 Web server keyring with SHA-2 (or SHA1)

Dave, David,

Thanks for your answers.
I'm happy to see that my further searches sent me to the same Technotes you quote, so i'll follow them.

Thanks again.

Yan
 


This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal