Mail encryption error after changing public keys

HCL Domino Domino Forum
1

Hello,

after upgrading our Domino Servers to 8.5.1, we thought it would be appreciated to change the public keys (generated with Notes / Domino 4.6). So i created a dynamic policy for these public key rollover to the clients only (1024bit N/D 6 and above), to test the situation on some Persons.

First there were some problems with the Client, because the 8.5.1 Client never ask for importings the keys in the id-File and so there were some log-Messages about the different public keys (betwene Addressbook and id-File). But now after the keys are correctly stored in the id-File you can not send any encrypted Mail anymore and your not able to encrypt Dokuments with some old symmetric keys. If you address the mail the following error message appears:

"Mail encryption failed for this:

The recipient’s Notes public key is not compatible with the configures encryption settings."

I do not know where to search for the solution. I think the Client trys to encrypt with FIPS but this is not supported by the Server, as long as the certificate of the server-id is not renewed?!But i don’t understand why. If you go to an older 7.04 Client you can encrypt Mails with the same ID, if you switch to an 8.5.0 Client on Ubuntu you can not!

I will be grateful for any help and suggestions.

Thanks

Harald

2

Subject: Sounds like you have the FIPS 140-2 settings turned on

The “big red button” in a user’s security settings will prevent use of non-FIPS 140-2 algorihms, which would prevent use of old (RC2-based) symmetric keys and would prevent sending encrypted mail to users who don’t have 1024 bit RSA keys.

If you turn off that setting, all of your users should be able to interoperate again – that setting is only intended for environments that have completely upgraded to 8.0.1+ and all of their users have rolled over to 1024 bit keys and need to enforce the use of FIPS 140-2 compliant algorithms.

3

Subject: problem solved

Dear Dave,

thank you very much for your answer. I unchecked these option and now everything is allright again (after reassigning the security policy to the testusers). I misunderstood these option by far. I thought the client would only with this option be able to use FIPS and NOT ONLY use it.

There is only one question left:-)

Why couldn’t we send a encrypted Mail from one testuser with 1024 RSA key to another with just the same key strength on a Domino 8.5.1 Server?

But again, the problem is solved, thank you very much