Domino Server SSL Certificate Installation Guide

1. Obtain an SSL certificate

1.1, create a key ring file

Domino server deployment does not support importing private key files generated by external or third parties. You need to create a private key file on the Domino server.

1) Open the Lotus Domino management client, select "File" - "Applications" - "Open", then select the "Server Certificate Management" application (certsrv.nsf), and click "Create Key Ring":

p>

2) Fill in the server keyring information:

 

After filling in the above information, click the "Create Key Ring" button at the bottom of the page. In the following window, click "OK", and the server key ring file is created.

1.2, create a CSR file

1) Click "Create Certificate Request" to generate a CSR.

2) Select the keyring file created before, select "Paste into from on CA's site" as the Method, click "Create Certificate Request", and enter the keyring password.

3) Copy the CSR content and submit it to the Wotong application certificate CSR submission interface.

Second, install the SSL certificate

2.1. Obtain SSL certificate

After the certificate is downloaded, decompress the domain.com_sha256.zip archive, and you will get three archives: for Nginx.zip, for Apache.zip, for Other Server.zip. The Domino server needs to use the certificate in for Other Server, extract for Other Server.zip, get the following files:

2.2, import SSL certificate

1) Click "Install Trusted Root Certificate Into Key Ring"

2) Import the certificates into the keyring file in the order of root.crt-->cross.crt-->issuer.crt. There are two ways to select the file and paste the content.Enter the keyring password.

3) Click "Install Certificate Into Key Ring", import the user certificate public key domain.com.crt file into the key ring file, and enter the key ring password during the import process.

 

2.3, configure SSL certificate

1) Put the key ring file after importing the certificate to the server data directory (IBM/[Lotus]/Notes/Data). The key ring file contains keyfile.kyr and keyfile.sth.

2) Open the server configuration file, select the "Port" - "Internet Port" tab, and select the keyring file for configuration.

Three, test SSL access

Open the browser, enter https://yourdomain.com (the actual domain name bound to the certificate), if the address bar of the browser displays an encrypted lock, it means that the certificate configuration is successful.If it is displayed that the connection cannot be made, please ensure that the firewall or security group and other policies allow port 443 (SSL configuration port).

Fourth, backup SSL certificate

Please back up the downloaded .zip archive and the self-generated private key .key file to prevent loss and affect subsequent use!