Front cover - IBM Redbooks

214 Lotus Security Handbook
Figure 6-11 Cross-certification between two users (servers)
Cross-certification between an organization and a user
In this case, the cross-certification can be for a user and a whole organization or
a server and an organization.
Let’s assume a scenario in which the Acme and Widget organizations want to
replicate a database that contains information of common interest. The Widget
organization is much smaller than the Acme organization and thus doesn’t have
any problems with giving access to all their servers to the Acme organization, but
because Acme deals with many organizations that are competitors to Widget,
they only want to give access to a specific Domino server, as per their security
policy.
Here, one of the organizations wants the most restrictive form of
cross-certification and another organization is comfortable with the most liberal of
cross-certification, in that they want one server in the Acme organization to
authenticate and replicate with any server in the Widget organization. The
following steps will accomplish this:
1. The Acme server (Server/Acme) obtains a cross-certificate for the Widget
organization certifier (/Widget) and stores it in the Acme server Personal
Address Book;
2. The Widget organization certifier (/Widget) obtains a cross-certificate for the
Acme server (Server/Acme) and stores it in Widget's Domino Directory.
As a result of this procedure, a special relationship (that is, “the Acme server and
the Widget organization trust each other”) is established. This is illustrated in
Figure 6-12. In this cross-certification model, the Acme server is trusted by the