Front cover - IBM Redbooks

In version 6, the Notes ID file that contains the native Notes certificates is also
used as the container for storing X.509 v3 certificates. When a certificate is
requested from a Web CA (whether the Domino CA, if one is implemented within
the organization, or a third-party CA), it is requested via the Notes browser. Once
the request for a client certificate has been approved, it is stored in the Notes
user ID file.
Notes has a facility for creating safe copies of Notes user ID files. A safe copy is
basically the public key and the associated signed certificates. There are no
facilities in the current version of Notes for creating safe copies of X.509
certificates. It is therefore not possible to import or export S/MIME client
certificates in or out of Notes, except by using PKCS #12.
To sign e-mail messages with S/MIME, the user has to install his or her own
X.509 certificate in his or her Notes ID file. It is possible for the user to use either
a certificate issued by Notes, a certificate issued by the Domino CA, or a
certificate issued by any other third-party, commercial CA. The procedure is
exactly the same as what was described at length in the Domino CA section.
For the user to be able to verify the signature on a received S/MIME signed
e-mail, the user needs a certificate of a trusted root CA for the signer or a
cross-certificate to the recipient's certificate in the user’s Personal Address Book
or in the Domino Directory.
Prior to being able to encrypt a message, as mentioned earlier, it is necessary for
the user to obtain the recipient’s certificate. The Notes client will encrypt the
message using the recipient's public key. In Lotus Notes 6, the client certificates
of the recipients are stored in the Domino Directory.
Sending and receiving encrypted S/MIME messages
When a Lotus Notes 6 user attempts to send an encrypted message, the
recipient’s X.509 certificate is used, based on the choice the user has made
whether to use MIME format or Notes format for sending mail directly to the
Internet or for messages that are addressed to Internet addresses. Conversely,
users also can control the format of incoming mail in their user preferences. The
message format determines the choice of encryption method.
Notes uses S/MIME encryption for outgoing mail in the following situations:
► The user selects “directly to Internet” in the “Send outgoing mail” field in the
Mail tab of the current Location document (as shown in Figure 6-29 on
page 278). Mail messages sent from this location will use MIME format.
Chapter 6. Public key infrastructures 277