Front cover - IBM Redbooks

190 Lotus Security Handbook
Since Lotus Notes and Domino 6 cannot create new flat server and user IDs, it is
necessary to have a Notes R4 client in order to generate new IDs.
Hierarchical certificates
Where hierarchical certification is concerned, the server and user IDs have only
one organization certifier, and optionally up to four layers of organizational unit
certifiers under the organizational certifier. When users or servers are registered
with a hierarchical certifier, they receive a certificate signed by that hierarchical
certifier and inherit the certification hierarchy of the layers above.
For example, consider the certification hierarchy shown in Figure 6-1. This shows
an organization named Acme, subdivided into three organizational units,
Switzerland, USA, and UK. The USA organizational unit is subdivided into two
organizational units, East and West.
Figure 6-1 Hierarchical certification
When registering Sandy as a new user, the Administrator of Switzerland/Acme
registers her. One of the results of this process is a new, randomly-generated,
RSA private/public key pair. The administrator then creates a certificate for
Sandy by signing her new public key using the Switzerland/Acme certifier private
key. As a result, Sandy's user ID inherits the certification hierarchy of the
Switzerland/Acme certifier.
In the case of Dave, it’s very similar. When registering Dave as a new user, the
Administrator of West/USA/Acme registers him. One of the results of this
process is a new, randomly-generated, RSA private/public key pair. The
administrator then creates a certificate for Dave by signing his new public key
using the West/USA/Acme certifier private key. As a result, Dave's user ID
inherits the certification hierarchy of the West/USA/Acme certifier.