Front cover - IBM Redbooks

What are Notes cross-certificates
Given the certification hierarchies model that we’ve explained, a user’s
authentication of another user or server will not work should either be in a
different certification hierarchy (which is often referred to as a “naming tree”).
This problem arises in dynamic organizations, which are becoming the norm
these days (with mergers, acquisitions, consolidations, and reorganizations
being so common).
The question that comes up on a regular basis is: “How can we merge several
certification hierarchies, or naming trees?” The answer is that although it is not
possible to easily and effectively merge several existing certification trees into
one single certification hierarchy, it is possible to do something just as good.
Notes and Domino provide a way for people and servers to authenticate against
other servers in different certification hierarchies. As well, they also provide a
way for people from one certification hierarchy to effectively communicate with
and trust people in a different certification hierarchy.
This is accomplished by cross-certification, which is a form of peer-to-peer trust
(certification) model.
So, in short, Notes cross-certificates allow users and servers from different
hierarchically-certified organizations to access servers in each other’s
organizations, and to verify the digital signatures of users from the other
organization. Domino servers store cross-certificates in the Domino Directory. To
access Domino servers, Notes clients obtain cross-certificates for those servers
and store them in their Personal Address Books. These cross-certificates can be
used only by the user to whom they are issued.
Three types of cross-certification
Cross-certification can occur at various levels of an organization. There are three
types of cross-certification possible, as follows:
► Between two organizations (or organizational units)
► Between two users or servers
► Between an organization and a user or server.
Before we cover these in detail, there are a few concepts you need to
understand:
► Two-way cross-certification does not need to be symmetric. For example, one
organization can have a cross-certificate for an organizational unit certifier
and another organization can have a cross-certificate for an organization
certifier.
Chapter 6. Public key infrastructures 211