When will server start using new SSL certificate?

HCL Domino Domino Forum
, , ,
1

Hi,

We use Certificate Manager (Domino 12.0.2) to manage SSL certificates. They are imported from a 3rd party CA and seem to be working fine.
We do this once a year, as the certificates must be renewed annually.
When I import new certificates, the server still uses the old certificate (which expires in a few days).

How do I force the server to use the new certificate without deleting the old one (in case something goes wrong)?

If I just do nothing, will the server start using the new certificate when the old one is marked as expired ?

/Jesper

2

Hello Jasper,

It seems you have created a new TLS Credentials document and created a new CSR and got certificates based on the new CSR that you imported in certificate store database. You must have requested the certificate for the same host name. Is that correct?

If my understanding is correct then you can take backup of certstore.nsf database and you can delete the old TLS Credentials document so that new one will start taking effect immediately.

You can also check certificate information using 'tell certmgr show certs'. This should show you active TLS Credentials in certificate store database.

Kindly share your observations.

Thanks and Regards

Niraj V Jani

3

Hello Niraj,

Thanks for your reply.

Yes, you're correct - I have used the same hostname. Only reason for the update is that the old one is about to expire.

The command "tell certmgr show certs" shows both certificates.

My question is: Will the new certificate become the active one when the old one expires ? Or do I have to delete the old one ?

/Jesper

4

Hello Jasper,

As far as new certificate shows 'issued' and 'valid', it is expected to take effect. However I cannot confirm it without testing it.

But it is confirmed that if you remove the old TLS Credentials document then new one will surely take effect immediately.

Hope this helps.

Thanks and Regards

Niraj V Jani

5

Hello Jesper,

Refer to the last step in the example section from the below document.

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0102662

You need to modify the server document or internet site document to have the TLS host name instead of your old keyring file.

After the changes restart the Domino server. It should pick the SSL cert from the certstore.nsf.

Thank you

Regards

Shrikant J

6

Hello Shrikant,

Thanks for your reply.

The problem is not the switch from keyring file to certstore - that has been working for 2 years. The problem is switching to new certificate with same hostname. Will the new one become the active one when the old one expires ?

/Jesper

7

Hi Jesper,

Having the duplicate TLS credentials with the same host name is not recommended. If the new certs is valid before the date of the old certificate expiry. Then you could delete the old TLS certs and have the new TLS cert document in the certstore database that should work.

Please have the backup of the certsore.nsf before deleting the old certs. Thank you.

Regards

Shrikant J

8

Hi Jespser,

I had a test for duplicate certs for the same host issued from Lets Encrypt (ACME) one which expires on 7th Oct and another on 21st Nov, 2024

Community-Pasted-Attachment-1724412971451.png1172×232 78.1 KB

Community-Pasted-Attachment-1724413163076.png688×158 62.9 KB

Test1: Before taking the OS time to ahead of current TLS cert expiration (7th Oct) it shows the existing cert expiration of 07th Oct, 2024 as below.

Community-Pasted-Attachment-1724413509029.png998×495 110 KB

I changed the OS date ahead to 8th Oct, 2024 and restarted the Domino server.

tell certmgr show certs command showed as follows.

Community-Pasted-Attachment-1724413351530.png1177×283 86 KB

However, when accessed the server over browser it took new expiration from the new certs as 21st Nov, 2024 for the host "domsrv.notesdomtech.com".

Community-Pasted-Attachment-1724413645648.png940×436 102 KB

So you have both the suggestion if it continues to work after current cert expiration. You can delete the expired one. If it doesn't work you can delete the old and keep the new TLS document in the certstore which from the third party.

Thank you

Shrikant J

9

Hello Jesper,

We have a very good Webinar lined up on HCL Domino Certificate Store on 28th August, 10 AM ET.

You can register and join to learn more about it at below link

https://support.hcltechsw.com/community?id=community_Event&sys_id=4aabd80f1b801250534c4159cc4bcb86

Thanks and Regards

Niraj V Jani

10

Hi Jesper,

I was curious about this too a few months ago. I waited until the certificate expired at 6:59:59pm and reloaded the web page after about 5 minutes. The new cert was being used automatically! A few days later I deleted the expired cert in Certificate Manager.

I also noticed this entry in the server log around the time of the change:

TLSCache-HTTP: Info: TLS Credentials Cache reloaded

11

I know this question is old and has an accepted answer. However, I believe I have a better option for "forcing the server to use the new certificate without deleting the old one".

After you have issued the new certificate, you can set the Status field of the old certificate to "Archived". This almost immediately updates the certificate store, and removes that certificate from the list. You can easily set it back to "Issued" if there is a problem.