22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

452 Lotus Security Handbook<br />

install it in a key ring. A server certificate, a binary file that uniquely identifies the<br />

server, is stored on the server's hard drive and contains a public key, a name, an<br />

expiration date, and a digital signature. The key ring also contains root<br />

certificates used by the server to make trust decisions.<br />

For more information about the Domino public-key infrastructure (PKI) and<br />

enabling SSL on Domino, see Chapter 6, “Public key infrastructures” on<br />

page 187, and the <strong>IBM</strong> Redpaper “The Domino Certificate Authority.”<br />

11.5.1 Domino server-based certification authority<br />

New for<br />

Domino 6<br />

Note: You can enable SSL on a server when you initially register the server if<br />

you already have a Domino server-based certification authority running in the<br />

Domino domain.<br />

In Domino 6, you can set up a Domino certifier that uses a server task, the CA<br />

process, to manage and process certificate requests. The CA process runs as an<br />

automated process on Domino servers that are used to issue certificates. You<br />

can enable both Notes and Internet certifiers to use the CA process. When you<br />

set up either type of certifier, you link it to the CA process on the server in order<br />

to take advantage of CA process activities. Only one instance of the CA process<br />

can run on a server; however, the process can be linked to multiple certifiers.<br />

Once you have set up a Domino server-based CA, you manage the CA process<br />

from the Domino console with a set of server Tell commands.<br />

The advantages of the Domino 6 server-based certification authority include that<br />

it:<br />

► Provides a unified mechanism for issuing Notes and Internet certificates.<br />

► Supports the registration authority (RA) role, which you use to delegate the<br />

certificate approval/denial process to lower-echelon administrators in the<br />

organization.<br />

► Does not require access to the certifier ID and ID password. After you enable<br />

certifiers for the CA process, you can assign the registration authority role to<br />

administrators, who can then register users and manage certificate requests<br />

without having to provide the certifier ID and password.<br />

► Simplifies the Internet certificate request process through a Web-based<br />

certificate request database.<br />

► Issues certificate revocation lists, which contain information about revoked or<br />

expired Internet certificates.<br />

► Creates and maintains the Issued Certificate List (ICL), a database that<br />

contains information about all certificates issued by the certifier.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!