SECURING
When a CA signs an Internet client certificate, the CA adds a digital signature to the certificate and, if you are using a Domino® CA, adds the public key to the Domino Directory. If you are using a third-party CA, you must complete additional steps to add the public key to the Domino Directory.
About this task
You do not need to complete these steps if you are using a Notes® client and the CA issued certificates in the Person document of the Domino Directory. Notes automatically adds Internet certificates stored in the Person document to the Notes ID file when the user authenticates with the server.
The steps you follow to sign and add an Internet client certificate to the Domino Directory depend on whether the certificate is issued from a Domino server-based certification authority, a Domino 5 Certificate Authority, or a third-party CA.
Before you approve client certificates for signing:
Domino server-based certification authority
The steps are completed by the Domino CA. You must be a registration authority (RA) to approve client certificates for signing.
Procedure
1. From the Domino Administrator, click Files, and open the Domino Certificate Requests application.
2. Transfer the certificate request into the Administration Requests database.
b. If the view shows that the request has been Submitted to Administration Process, go to the next step. If it is still in the Pending state, highlight the request and click Submit Selected Requests.
c. You should see a Successfully submitted 1 request(s) to the Administration Process message. Click OK.
b. Open the request and verify the information in it.
c. Click Edit Request, and then click either Approve Request or Reject Request. Press F9 to make sure that the request changes state, from New to Approved (or Rejected).
b. Open the Issued/Rejected Certificates view and locate the client request (you may need to refresh the view).
b. If you did not enable the option for email confirmation upon completion of the client request, then you need to click Send Confirmation Mail to notify the requester of the outcome.
Note: If the Certificate Requests database is configured for automatic request processing, then client requests are sent to the Administration Requests database automatically by the database. The Registration Authority only to approve or reject the request.
Domino 5 Certificate Authority
The Internet certificate request appears in the Client Certificate Requests view in the Domino Certificate Authority application. When the CA signs a certificate, the CA can automatically send email to the client. This email describes where to pick up the certificate and includes a pickup ID, which the client must use to identify the certificate during the pickup process. Domino automatically generates the pickup ID.
Note: The following steps apply to signing client certificates issued by a Domino CA. The steps are completed by the Domino CA.
1. From the Domino Administrator, click Files, and open the Domino Certificate Authority application.
2. Click Client Certificate Requests.
3. Open the request you want to sign.
4. Review the user information and distinguished name. Make sure the information provided complies with your organization's security policy.
5. Leave the option Register certificate in the Domino Directory selected to add the client's public key automatically to the Person document.
b. If you do not want to send the person email, deselect Send a notification email to the requester. Otherwise, the Domino Certificate Authority application sends the person email indicating that you denied the request and the reason why you denied the request.
c. Click Deny.
b. If you do not want to send the client email indicating that the client can now pick up the certificate, deselect Send a notification email to the requester. Otherwise, the Domino Certificate Authority application sends an email with a URL indicating the location to pick up the certificate.
c. Click Approve and enter the password for the CA key ring file. This places a request in the Administration Requests database. When the Administration Process next runs, it processes the request and adds the certificate to the client's Person document in the Domino Directory.
If a user obtains an Internet certificate from a third-party CA using the Notes client, the certificate is automatically added to their Person document.
If a user obtains an Internet certificate from a third-party CA through a browser, the certificate must then be added to their Person document.
Related tasks Setting up a Person document for an Internet user using SSL client authentication Setting up Notes and Internet clients for SSL client authentication Publishing third-party CA client certificates in a Person record Creating Internet certificates for Notes S/MIME clients Setting up the Administration Process