Front cover - IBM Redbooks

456 Lotus Security Handbook
The Domino Registration Authority (RA) administrator is responsible for these
tasks:
► Register users, servers, and additional Notes certifiers.
► Approve or deny Internet certificate requests.
► Revoke certificates if they can no longer be trusted, such as if the subject of
the certificate leaves the organization, or if the key has been compromised.
Note: CAs and RAs must have at least Editor access to the master Domino
Directory for the domain.
Creating certifiers that use the CA process
When you create a certifier specifically for the CA process, you must make sure
that the CA process task is running on the server. Certifiers will not function if the
CA process is not running. To manage the CA process, you use Tell commands
at the server console.
If the CA process task is running when you create a certifier, the process
automatically adds newly-created certifiers when it refreshes, which takes place
every 12 hours. However, the time period in which the Administration Requests
database processes CA requests will vary. You can hasten the process by using
Tell commands to have AdminP process all requests, and then refresh the CA
process.
Note: To load the CA task automatically, add the parameter ca to the Server
setting in the NOTES.INI file.
The general process for creating a CA-process enabled certifier is as follows:
1. Migrate or create the certifier.
– If you are creating a new Notes certifier, you must first register the O or
OU level certifier and then migrate the certifier ID to the CA process.
– If you have an existing Notes certifer, you must first migrate the certifier ID
to the CA process.
– If you have an existing Internet certifier, you must first migrate the key ring
to the CA process.
2. Configure the certifer.
3. Add the certifier to the CA process.
4. For Internet certifiers, create a Certificate Requests database.