Hi folks,
I have a Domino server that authenticates users using X.509 client certificates issued by a third-party CA stored in a SmartCard over SSL to a specific application.
Currently I use the “Certificate Publications Request database” (certpub.ntf) so that users can publish their certificates to their Person documents.
What happens when these client certificates expire? How do I update them once their certificates are updated?.
Do users just ask their new certificates to be re-published using the initial process, and adminp overwrites them?
I haven’t found any information on the Domino Documentation regarding updating these client certificates.
We’ve tried manually deleting the certificate already there, and adding a new one using “Actions - Import Internet Certificates”, but Domino would not recognize the new certificate, only after rebooting the Domino server. (we tried refreshing the HTTP task, but did not work).
Does anyone have any pointers?
Thanks,
Daniel
Subject: Updating third-party CA client certificates in a Person record
Daniel,Be careful not to confuse “client certificate” with “server certificate”.
The first allows SSL trust between the Browser client (as master) and the server. The second one allows SSL trust between the server (as master) and the browser. They are a two-way trust.
The first part of your problem you are talking about client certificates.
The comments about “Actions - Import Internet Certificates” are talking about server certificates.
Regards
Rolf Pfotenhauer
Subject: RE: Updating third-party CA client certificates in a Person record
Hi Rolf,
but that action appears from inside the person view/person document… and it does exactly that, it imports the client’s Internet certificate to the Person Document, no?
Thanks
Daniel
Subject: Updating third-party CA client certificates in a Person record
You don’t actually need to delete the old certificate – you can specify any one of the list of certificates in the person record to be the user’s default X.509 encryption certificate.
Rebooting the server after adding new certificates is almost certainly overkill. After typing “tell adminp p a” at the server console, try updating the views in the directory with [Shift]+F9 and [Ctrl]+[Shift]+F9. That’s probably also overkill, but it might help fix your problem.
Due to SSL session resumption, if a user authenticates to the server before the certificate is changed, he will still be able to resume that previous session regardless of whether or not he has the new certificate. This will “expire” after a number of other users have authenticated to that service (https, pop3/ssl, etc), when that service has been restarted, or when the server has been restarted.
Hope that helps,
dave