Hi all,
I am working on a domino web access architecture for 400 users. Most of the users are located at the same place and access the domino server using a lan. The others are “on the road” and need to access their mail using internet.
I know nothing about secured internet protocols, could someone give me some little informations to start …
The goal is to use http on the lan, and a secure protocol on the internet.
Once again, thanks a lot for your help !
Subject: HTTP, HTTPS, SSL …
To enable SSL and secure your Domino server you first need to obtain a Certificate from a Certification Authority like Verisign. Otherwise you can create your own certificate called a self-signed certificate. In this procedure below I am explaining the way to enable SSL using self-signed certificates.
Creating Keyring with Self signed certificate
=============================================
Open a database called “server certificate admin” on your domino server.
Click “Create key ring with self certified certificate”
Give the file name as keyring.kyr
Fill in the other fields as applicable (details of your server name and location)
Click Create key ring with self certified certificate.
This will create two files called keyring.kyr and keyring.sth which are your certificates store and the stash files.
Copy these files to your data directory
Configuring Domino for SSL
==========================
Open your Server document in Domino
Go to Ports->Internet ports
Enable the SSL Port for the various protocols you want
Restart domino
That’s all! You Domino server is SSL enabled.
Note: Some clients may show a security warning that the certifier is not trusted. (This is because you created the certificate yourself!). If you don’t want the warning to appear, get the certificate from a CA like verisign or simply ask your users to add you as a trusted certifer.
Hope this helps…
Subject: RE: HTTP, HTTPS, SSL …
Thank you very much for your detailled response.
I have some more …
When you say that the user may show a security warning, you mean only one time, or each time he connects to the server.
When you say “simply ask your users to add you as a trusted certifier” what does it mean exactly ? (i have searched for this type of parameter in ie and haven’t found it) ?
Is there a way in a local area network to update the configuration of all ie to add my server as a trusted certifier ?
Is there other things that i should understand to decide wether i create my own certificate or wether i get one from a trusted certifier ?
is https equal to “http using ssl ?”
what does ssl really do ?
it encrypt data using a key obtained by the trusted server ?
Subject: RE: HTTP, HTTPS, SSL …
When the user sees the warning for the first time ask them to click view certificate (in that message) and in the window that opens ask them to click install certificate. This will ensure the warning is not shown again. You can do this if all your users are internal users. If you run a public website (like Yahoo!) you should obtain a certificate from a well-known CA like Verisign because all users may not know you or trust you.
Why doesn’t it show a warning for Verisign? Its because most browsers come pre-installed with popular CAs.
The use of SSL and Certificates is twofold. First is identification. It tells the users that your server is really who it claims to be and not some other server that pretends to be you by having the same name.
The second use is that any information submitted by the user to the server is encrypted in transit so no one else can “spoof” what is sent. As you said it encrypts the data using the public key of the server.
Subject: RE: HTTP, HTTPS, SSL …
Unfortunately, using the browser’s Install Certificate feature only suppresses the untrusted issuer warning for a few days (on my browser, anyway). To make it go away permanently, you have to manually install the issuing certificate as a trusted root cert in your browser by surfing to the domain certificate authority db and using the link there.
Subject: RE: HTTP, HTTPS, SSL …
HTTPS is HTTP using SSL, and provides encrypted traffic using a private/public key pair, where the public key is contained in the certificate.
There are theoretical security problems by using a certificate that is NOT issued by a trusted party (like verisign), the prime one being that you have no way of knowing whether the certificate is issued by the party that claims to have issued it. If you have a secure mathod of delivering the certificate, this should not be a problem.
For further info on HTTP and SSL try searching Google with a term like this:
define:https
http://www.google.com/search?num=20&hl=en&lr=&ie=UTF-8&newwindow=1&q=define%3Ahttps
Subject: RE: HTTP, HTTPS, SSL …
The limits are not only theoretical but practical as well.
Self Cert has too many to be realistic in a production environment. The main security risk is that you could inadvertantly distribute your private key.
Thus you compromise your security scheme altogether.
Regards
Rolf Pfotenhauer