Hi,
We are standing before the following situation which are new to us: Our security department have plans to implement a client certificate infrastructure for other environments at our site (websphere based). A CA will issue an organisational certificate which we will use. Since we will also have Domino on the DMZ, we need to be able to handle this as well.
The CA also issues client certificate for organisations that will work against our systems (including Domino), so the registration of users will take place elsewhere (they will not reside in our DD). The only thing we will have is our organisational certificate (on our servers).
How does a scenario like this usually work. Am i wrong to assume that we need to setup a DA against the issuer to verify the client certificates when calls are made through https? Or can a client certificate be “trusted” as long as it origins from the same certifier (and there would not be any need to further check this client certificate against an LDAP catalogue or the DD).
Basically what we wonder is if it is possible to hit our DMZ with a client certificate (ssl), having the server acknowledge this certificate and let the user in, knowing his/hers identity (which username, etc) so that it can be used in ACL:s?
Do you guys have any good advice/pointers regarding this?
kind regards
Daniel