HCL Notes and Domino 9.0 Social Edition Forum - Embedded experiences SSL issue

May 30, 2013, 9:23 PM

34 Posts

RE: Embedded experiences SSL issue

Hi Anders,

First and foremost, I want to point you to the Deployment Cookbook, which provides far more details than the SHOW110 session did. http://www-10.lotus.com/ldd/dominowiki.nsf/dx/IBM_Domino_9.0_Social_Edition_OpenSocial_Deployment_Cookbook

For the benefit of others who may read this thread, the reason your wild card SSL certificate for *.company.se did not work for *-locked.gadgets.company.se is because of the way SSL certificate matching works. Matches are only valid for a single domain component or component fragment. See the fourth paragraph of http://www.ietf.org/rfc/rfc2818 for more information.

To get to your actual question, you have 3 options moving forward.

1) Obtain a wildcard SSL cert for your locked domain, i.e., *.gadgets.company.se

From a security standpoint this is the ideal option. From a practical standpoint this may not be an option if cost is prohibitive. If this is not an option, consider #2 and #3 below carefully.

2) Disable HTTPS for gadgets

One can disable HTTPS for all OpenSocial gadgets by following the instructions here: http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Server-centric_settings_OSC90#Gadget+iframe+Scheme

One can set the scheme to always be HTTP. Browsers may complain about this if the parent page is using HTTPS but the gadgets in a child iframe are using HTTP. Depending on the browser being used and the way it handles the scheme mismatch, this option too may be prohibitive. If that is the case, consider #3 very, very carefully.

3) Disable locked domains

This is the last option and should only be used if #1 and #2 aren't feasible for some reason. This option is outlined in more detail here: http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Server-centric_settings_OSC90#Locked+Domains

In a development or proof of concept environment, this option is OK. In a production environment, this needs to be considered very carefully from a security perspective.

-Stanton