SSL and Password Encryption

HCL Domino Domino Forum
1

Hello!We are enabling SSL and we did the test as follow:

  1. Created Domino Certicate Authority

  2. Installed server certificate, enabled SSL. (all the configuration from Domino Administrator Help).

  3. Enabled SSL on the database

  4. Accept this authority in browser

We installed a sniffer at on computer2 between computer1 and server.

When I access the database that requires SSL, show the certificate (security lock) on browser, but the sniffer capture the password that is not encrypted.

What did i miss??

Is there another configuration in the domino document?? Or in the application (database)??

Thank so much for help!

2

Subject: SSL and Password Encryption

I would say that you are probably accessing the database via http still.

Have you set the database to force SSL?

Simon

3

Subject: RE: SSL and Password Encryption

Thank you Simon.Yes, I checked the option “Require SSL connection”. One thing that I figured out :

  1. When I access, for example, google web mail, the sniffer stop saving the data. When I access my database the sniffer creates a fake certificate and send to user browser to accept it. And the password is save in plain text.

Thanks for help!