Transport Layer Security (TLS) is a security protocol that provides communications privacy and authentication for Domino® server tasks that operate over TCP/IP.

TLS offers these security benefits:

• Data is encrypted to and from clients, so privacy is ensured during transactions.
• An encoded message digest accompanies the data and detects any message tampering.
• The server certificate accompanies data to assure the client that the server identity is authentic.
• The client certificate accompanies data to assure the server that the client identity is authentic. Client authentication is optional and may not be a requirement for your organization.

You must set up the Domino server and then set up TLS. You can use TLS security for Internet clients who use one of the following Internet protocols to connect to the Domino server:

• Web server and Web Navigator (HTTP)
• Internet Inter-ORB Protocol (IIOP)

  The Java™ applet that uses this protocol must be set up to use SSL.

• Internet Message Access Protocol (IMAP)
• Lightweight Directory Access Protocol (LDAP)
• Post Office Protocol 3 (POP3)
• Simple Authentication and Security Layer (SASL)

  Domino uses SASL automatically if TLS with client authentication is set up on the server and if the LDAP client supports the protocol. No additional configuration is necessary.
  
  
  
  

• Simple Mail Transport Protocol (SMTP)

  Managing TLS certificates with Certificate Manager
  HCL Domino 12 introduces a new server task, Certificate Manager (CertMgr), that works with a new database, Certificate Store (certstore.nsf) to manage TLS certificates in your Domino environment.

  TLS port configuration
  The TLS protocol always provides an encrypted, integrity-checked, communications channel and authenticated server identity. TLS servers can be optionally configured to request various forms of client identity authentication.

  Requiring a TLS connection to a server
  Require TLS connections when you want to make sure that clients use a secure connection to access databases on the server. You do this by redirecting connection requests that come in over the TCP/IP port to the TLS port. If you do not require an TLS connection, clients can use either TLS or TCP/IP to connect to the server.

  Creating an Internet cross-certificate for server-to-server TLS
  One server can obtain an Internet cross-certificate from another server for the purposes of establishing trust. For example, if one server needs to access Directory Assistance on another server.

  Setting up database access for TLS clients
  After you set up TLS on a Domino server, you must give the clients access to databases on the server.

  Modifying TLS cipher restrictions
  TLS uses public, private, and negotiated session keys. Every set of TLS credentials has one pair of keys -- a public key and private key -- and an X.509 certificate that enable certificate owners to identify themselves over the network and to use S/MIME to encrypt and sign messages. Certificates contain only the public half of the key pair. The private key is kept in the ID file for the Notes® client, and is kept in the key ring file or cerstore.nsf database in the case of the TLS server. Starting with Domino 12, Domino supports both RSA and ECDSA keys. For more information, see ECDSA cryptography support for ACME accounts and for host keys.

  Authenticating Web TLS clients in secondary Domino and LDAP directories
  When a Web client authenticates with a server, by default, the server checks the primary HCL Domino Directory to see if the client certificate exists in the Person document. If your organization uses a secondary Domino Directory and/or an LDAP directory to verify client certificates, you can set up Domino to check those additional directories. To do so, you set up the secondary Domino and LDAP directories as trusted domains in the Directory Assistance database.

  TLS session resumption
  TLS session resumption greatly improves performance when using TLS by recalling information from a previous successful TLS session negotiation to bypass the most computationally intensive parts of the TLS session key negotiation. HTTP is the protocol that benefits the most from TLS session resumption, but other Internet protocols may benefit as well.

  Managing TLS certificates without Certificate Manager
  If you do not manage certificates with Certificate Manager (CertMgr) and the Certificate Store (certstore.nsf) database, you generate and manage certificates manually, as described in this section.