Front cover - IBM Redbooks

210 Lotus Security Handbook
Two domains, one certification hierarchy
Alternatively, it is possible to manage one certification hierarchy with several
Domino domains, as shown in Figure 6-9. In this example, the Acme Corporation
has two subsidiaries, the Sprocket Corporation and the Widget Corporation.
There is one hierarchy (with Acme being the top level certifier), but this is split
between two domains, Sprocket and Widget.
This one hierarchy/two domains configuration might be useful in a situation
where a single domain (or Domino Directory) grows too large and you have to
tune the server performance up. However, given the scalability of Domino,
especially with version 6, and the power of servers available these days, this is
not a likely scenario. It is possible, though, so it is worth mentioning here.
Figure 6-9 One certification hierarchy in two domains
6.1.8 Notes cross-certification
Domino uses two types of cross-certificates: Notes and Internet. We cover Notes
cross-certificates in the present section and Internet cross-certificates in the
Internet PKI section later in this chapter.
Notes cross-certificates permit authentication and secure messaging, in that they
allow users in different hierarchically-certified organizations to access servers
and to receive signed mail messages. Internet cross-certificates, on the other
hand, are more focused on secure messaging, in that they allow users to receive
signed mail messages and send encrypted mail messages.