How to enable SSL-encryption for database on a server with multiple Internet-Sites?

HCL Domino Domino Forum
1

Hello,

I am trying to enable SSL encyption for a specific database that is available by a specific URL. But until now I didn’t come up with a proper solution.

This is the situation:

We have a Domino Server 7.0.2 where we enabled the SSL-port in the servers document and also checked that internet configuration should be loaded from the “Server\Internet Site” documents.

Furthermore there are eight Internet-Site-Documents that handle different header mappings (like www.thisSiteOne.com → folder1/applicationOne.nsf or www.thisSiteTwo.com → folder2/applicationTwo.nsf). The IP-address for all these URL-header-mappings is the same.

www.thisSiteOne.com is defined as default mapping, when requests can not be mapped to other sites.

In order to try out if SSL-encryption can be assigned to one or more databases I created for all existing Internet Site documents self-certified certificates. So there is one certificate for www.thisSiteOne.com (the default Site) and another one for www.thisSiteTwo.com … and so on …

I pasted these certificates (*.kyr + *.sth files) as told in the data directory of the server and thought this would be an easy task to enable SSL-encyption for one database.

But now there is that part where I am close to beg for hard drugs:

Every Internet-Site document has now the information about its own *.kyr file withing the tab “Security” > section “SSL Options”. But I can not even load one of the URLs by using the https-protocol. Doing this, I get an network time out error (web site took to long to respond).

Calling the URL by using the http-protocol works fine… until checking the option “requires SSL connection” in the database properties.

What am I missing?

The only thing I want to achieve is:

Within the Web-Site www.thisSiteFour.com there are two databases: ProdCatalogue.nsf and CustomerData.nsf. When calling the database CustomerData.nsf I would prefer to SSL-enable the communication between server and browser.

Maybe there is someone out there that can give me a hint to solve this.

Thanks in advance,

Pantelis

2

Subject: How to enable SSL-encryption for database on a server with multiple Internet-Sites?

Well, have you enabled the SSL section and port in the DOmino Web Engine tab?

Run this commands from the console…

‘show tasks’

‘tell http show security’

And post the result.

It seems you did everything right. It’s not working for any of the sites?

3

Subject: RE: How to enable SSL-encryption for database on a server with multiple Internet-Sites?

SSL is attached to an IP rather to an URL. So it is not possible to create different certificates (even if there are different URLs) for one IP.

Knowing this, we created a “Base”-Certificate for the “Base”-Web-Site. This certificate can be used by all other websites that use the same IP.

The only thing we need to take care:

Inform the user, that the certificate warning is “normal” because the certificate is issued for the base-web-site (this is checked by the SSL-protocol) and not for the currenty opened URL (even if it has the same IP).

I don’t want to bother about this stupid rules. This is how SSL works! :slight_smile:

4

Subject: RE: How to enable SSL-encryption for database on a server with multiple Internet-Sites?

So, did you solve it? :slight_smile:

The warning is normal unless you have a certificate signed by a CA.

5

Subject: RE: How to enable SSL-encryption for database on a server with multiple Internet-Sites?

Yes.

And as far as I did some research (for weeks), this is the only possible solution in that case.