This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


May 20, 2015, 7:25 PM
10 Posts

SHA-2 certifcate

  • Category: Domino Administrator
  • Platform: Windows
  • Release: 9.0.1
  • Role: Administrator
  • Tags: SHA-2
  • Replies: 4

II will need to replace my Domino Web server  SSL certifcates. The current certificate requests (SHA-1) were generated last year using the time tested certsrv.nsf application which is based on the StdNotes50SSLAdmin template.  I don't believe our Certificate Authority (Thawte) will accept SHA-1 requests any longer.

Can I use this application to generate a certificate request that is SHA-2. If not now in the near future? My servers are up to date 9.01 FP3. I am wondering if waiting a bit longer for an upgrade could spare me from having to learn how to use the kyrtool program.

 

Thank You

 

TBear

 

May 20, 2015, 8:19 PM
191 Posts
I'd just learn kyrtool
I can't say for sure that the database won't be augmented at some point, but kyrtool is the way forward for now. Here are some links to get you started.

http://www-01.ibm.com/support/docview.wss?uid=swg21418982
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/kyrtool
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/3rd_Party_SHA-2_with_OpenSSL_and_kyrtool
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Self-signed_SHA-2_with_OpenSSL_and_kyrtool
May 21, 2015, 8:42 PM
10 Posts
Issues with Kyrtool

I decided to soldier on and try Kyrtool. I am using 3rd party CA - RapidSSL.

When applying on CA site I was unclear whether to identify my server as Lotus Domino  or IBM HTTP. I took a guess and chose IBM HTTP.

I received my server certificate and one intermediate certificate from my CA (RapidSSL) in an email and then I merged them into 1 file - server.txt.

Then I executed:  kyrtool =c:\lotus\notes\notes.ini verify c:\lotus\notes\data\ssl\server.txt

This is the result:

No private key found in input file

ERROR: No private key found in c:\lotus\notes\data\ssl\server.txt

INFO: Successfully read 2 certificates

INFO: Issuer Name of cert 0 matches the subject name of cert 1

WARNING: Final certificate in chain is not self signed

 

Any suggestion as to where I have gone wrong?

 

Thank You

 

Update #1: I had not  merged the server.key file into the server.txt. I just now merged it - server.key + sever.pem + intermediate.pem==>server.txt

The verify tool is now happy - except the final warning is still in place - "Final certificate in chain is not self signed". Is that an issue?

 

Update #2:  Added a Global Certificate from CA into server.txt. Now kyrtool verify  passes with no warning. Onto the next step!

 

 

 

 

 

 

May 22, 2015, 3:39 PM
10 Posts
Google Chrome not quite happy with the result

Google chrome displays a green lock in the browser. Good.

When clicking on on the lock though  it says: Your connection is encrypted with obsolete cryptography

Here are some of the certifcate details

Signature algoithm  sha256RSA
Signature hash algorithm sha256
Thumbprint algortithm sha1

What can I do to make Google chrome not describe my brand new certificate as obsolete? I am under the impression that my certificate uses SHA-2

May 22, 2015, 6:05 PM
191 Posts
Check the key exchange mechanism reported by Chrome
On my system, I'm using one of the default ciphers provided in the latest version of 9.0.1: RSA_WITH_AES_128_GCM_SHA256. It's the RSA component that Chrome is complaining about, as the Chrome developers have deemed that only DHE_RSA, ECDHE_RSA, or ECDHE_ECDSA are modern. See the accepted answer here for details:

http://security.stackexchange.com/questions/83831/google-chrome-your-connection-to-website-is-encrypted-with-obsolete-cryptograph/83891#83891

You can enable a cipher on Domino that will satisfy Chrome's definition of modern by using the information provided here:

http://www-10.lotus.com/ldd/dominowiki.nsf/dx/TLS_Cipher_Configuration

Do read the information in the article about the performance penalty associated with DHE_RSA.

This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal