New org and cross certification problem

HCL Domino Domino Forum
1

Hi,

We have two Domino servers (clustered), basic config is as follows:

Domain = XYZ.COM

Organisation = XYZ

Domino Server 1 = dom1/servers/xyz

Domino Server 2 = dom2/servers/xyz

I have registered a new organisation = ABC

I then registered a new OU using the ABC certifier = london/abc

I then registered a new person using the ‘london’ certifier = firstname lastname/london/ABC

I then set up a Notes client for this user but i’m unable to access dom1/servers/XYZ or dom2/servers/XYZ as ‘Your name and address book does not contain a cross certificate for this organisation’.

Now I know I need to create a cross certificate between XYZ and ABC which I did on dom1/servers/XYZ as follows:

  1. Select cross certify

  2. Select the cert.id of XYZ

  3. Then select the cert.id of ABC

The entry is then created under ‘cross certificates’ and all looks fine. Have I created this the correct way around?

This then replicates to the other server within the cluster all ok.

Despite having the cross certificate on the servers, i’m still receiving the prompt on the notes client that the address book does not contain a cross certificate for this organisation.

I am able to create the cross certificate on the clients local names.nsf file and the message is suppressed but ideally i’d like this set up on the server.

Any ideas?

2

Subject: New org and cross certification problem

At what level did you create the cross certificate? You would need to cross certify ‘/XYZ’ with ‘/ABC’ (ie. At the organization level). Anything at a lower level than this will fail (eg. ‘/servers/XYZ’ with ‘/ABC’ will fail).

You can check at what level the cross certification has been created by reviewing the cross certificate. If it’s incorrect you can delete the existing cross-cert and create a new one.

Also check the local address book for any existing cross certs and make sure these are correct or delete them if not. Try also rebuilding all views in the local address book by opening and holding down the ‘Ctrl + Shift + F9’ keys simultaneously.

Oh and one more thing you may need to check the ACL of the public address book in the XYZ domain to make sure the user from the other Domain has access has access.

Alex