Front cover - IBM Redbooks

194 Lotus Security Handbook
doesn’t require a Certifier ID. This is a flat Notes ID that contains little
information and will not be of any use the moment the Notes client tries to
connect to a server in the domain.
Notes certificates
Lotus Notes authentication relies in large part on Notes certificates, which are
stored in Notes IDs.
Casually speaking, a certificate is an electronic “stamp” that indicates a trust
relationship among the entities in the Notes world.
More formally, a certificate is a unique, digitally signed message added by a
certifier to a Notes ID file that identifies a user or server. While the client can
store and work with both Notes and Internet certificates, the rest of this section
refers specifically to Notes certificates.
When a Lotus Notes user attempts to connect to a Lotus Domino server, whether
it is a mail server or another type of Domino server in the organization, that
person needs a certificate to identify himself (or herself) to that server, and the
server needs a certificate to identify that person. Thus, the Notes client and the
Domino server involved in the authentication process present their certificates to
each other. By examining the certificates, the Notes client will identify and
authenticate the Domino server, and the Domino server will identify and
authenticate the user.
In order to permit this trust relationship to be established, a number of pieces of
information must be present in the certificates. A Notes certificate, like a Notes
ID, contains a number of elements, such as:
► The name of the certifier that issued the certificate.
► The name of the user or server to whom the certificate was issued.
► A public key that is stored in both the Domino Directory and the ID file. Notes
uses the public key to encrypt messages that are sent to the owner of the
public key and to validate the ID owner's signature.
► A digital signature.
► The expiration date of the certificate.
The whole thing is then certified, meaning that it is digitally signed by the certifier
using the certifier's private key, in order to prove its authenticity.
Figure 6-3 illustrates the structure of a Notes certificate within a Notes ID.