My old Live system (Domino 8.5.3 / Windows 2003) is out on the DMZ and needs to be upgraded to a SHA-2 certificate. So, we have built a new Test server also out in the DMZ (Domino 9.0.1 FP6 / Windows 2008) box to move the site to.

I copied the entire Data directory from the Live over the top of the Test 9.0.1 folder to bring across all the databases and jQuery files etc...

I then followed this procedure to create the new certificate:

https://www-10.lotus.com/ldd/dominowiki.nsf/dx/3rd_Party_SHA-2_with_OpenSSL_and_kyrtool?open

I used the procedure to generate a new CSR which we sent to GoDaddy to have them reKey the SHA-2 for the new Test system.

They returned to CRT files.

1) gd_bundle-g2-g1.crt - This I believe holds the Root and Intermediate certificates. But, I only found two certificates in this.

2) 8e0702e83bd035e9.crt - This has the Site certificate

I extracted the two GoDaddy certificates: godaddy_root_Base64_x509.cer GoDaddy_Secure_CA-G2_Base64_X509.cer

Then used the following command to join them all together: type server.key 8e0702e83bd035e9.crt GoDaddy_Secure_CA-G2_Base64_X509.cer godaddy_root_Base64_x509.cer > hbcln04_server.txt

I followed all the steps in the procedure above. The only difference is that the proceedure shows 2 intermediate certificates but GoDaddy only sent me one.

But, I was able to verify both the Keys and the Certificates as the procedure said.

There were no errors in the process.

I put the new kyr file down in the Data directory with the others and then went to the Website document and changed the reference there to the new kyr filename.

Note, this is a Website document not the Server document.

I even went to the Server document and followed a procedure to Disable and Enable the Website documents just in case the path to the Keyring.kyr file was corrupted.

However, because the new Test box is in the DMZ it is very difficult to test.

So, I have modified the servers Host file to map the certificates domain back to the same box. (Otherwise the DNS would keep taking it back to the Live system.)

There is a question as to whether mapping the domain to the IP of the Test box will work with HTTPS. But, I don't see why not.

But no matter what I do, I can't get the certificate to take hold.

I put in the URL for the site and if it is HTTP it works, But soon as I change it the HTTPS I get this:

This page can’t be displayed

• List item Make sure the web address https:_Link_to_site is correct.
• List item Look for the page with your search engine.
• List item Refresh the page in a few minutes.

---

I then refresh the page and I get this:

This page can’t be displayed

Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to https:_Link_to_site again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.

Well unfortunately, I'm the site administrator!

The only things I have seen differ to the procedure is: 1) that I only had 1 intermediate cert and not 2 as in the example. 2) I'm using a Host file to map the domain to the server so it doesn't follow it's usual DNS.

Also note that there are no errors in the log. We did have a few around the Access to the Key files. The kyr file was fine, but the sth file had restricted access. This has been corrected now.

At the moment, I don't know where to even look for an error or what to turn on to see the error.

It seems the certificate just doesn't load.