Hi, I’m hoping someone can help answer a really quick question in regards to ID files.
Here is the situation:
We currently have a situation where an employee has a copy of senior manager ID files.
As this is a security risk, we have taken the action to re-certify the ID files and give the new ID files to the senior managers.
However, this is the question. If I do re-certify the ID files, can the OLD ID files be used to access the mail databases of these senior managers?
Hope you can help!
Thanks!
Suzana
Subject: re-certify id file
Suzana,
Another option is to turn on password checking.
Subject: re-certify id file
If you are recertifying the ID with the same certifier I believe the old ID will still work unless you have Compare Public Keys turned on in the server doc. You can also Enable Password checking for the specific users, as suggested by Ronny
Subject: Use Key Rollover
Password checking would keep copies of the ID file with old passwords out of the server, but I’d recommend setting a key rollover security policy for the effected managers and turning on compare public keys on the server. That would not only keep the old ID files off the server, but would prevent the old ID file from decrypting any new encrypted mail sent to the victims after the rollover occurred, and after the grace period expired the old ID file would be unable to generate a signature that would verify correctly.
Recertification won’t help – the old ID file would just download the new certificate automatically, since none of the keys were changed, and the normal recertification procedure involves placing a new certificate in the user’s person document to be downloaded into the ID file.