Blog, published September 21, 2023 by Justin Hill

Domino SSL Guide: Implementation & Renewal Made Simple

With the industry standard limiting SSL/TLS certificates to a one year expiration date, a streamlined approach is needed now more than ever to keep your sites secure. At Collabsphere 2023, our very own Avery Shaffer did a great presentation on SSL implementation and renewal so let’s explore the key point of it.

Why is SSL a pain now?

Who?

Future Change

While this 3 year validity already is a nightmare for admins, a reduction to 90 days will only make things worse.

One of the things that you do need to pay attention to when working with SSL keys is that uniformity is important as the entry is in several critical places: Internet Site Documents, Internet Ports, SMTP, LDAP, IMAP etc.

We would not recommend changing the name since there are several places where you will need to change that name and it will create extra hustle for you.

Also, if you miss only one, the whole thing will break, meaning even more work for you with restarting the server.

SSL Purchase and Renewal

There are two ways to acquire an SSL for Domino: you can either use Domino’s built-in Let’s Encrypt or you can purchase an SSL from a third-party provider. Each of those has its own pluses and minuses.

Let’s Encrypt

Image of a pros and cons list for Let's Encrypt. Left: pros include being free and supporting wildcards. Right: cons include no warranty.

Pros and cons chart of certificate validation: Pros include high validation levels and no port validation. Cons include cost and manual conversion.

Purchased SSLs

Where to buy SSL keys:

DNS Registrar

SSL Specialty Sites

Managed Hosting Providers

Generating your .csr and .key

Server Certificate Administration

We would not recommend you use this for the following reasons:

OpenSSL

Consistent Validation

Here is a pro tip from us in order to make your life easier: set up a mail-in database with just the basics because every paid version of SSL will ask you for an email adress. That way you don’t have to worry about people leaving, changing their emails etc. You don’t get a choice in who you put input it pulls from the Whois document so it pulls it from the technical contact for example. So in order to avoid any trouble just use a generic one mailing database to get your mail validation.

Installation Of Purchased Key Domino 9-11

Certificate Manager

The introduction of Cert Manager meant no more .kyr if you don’t want to.

Password setup interface with options for file format, input fields for file name, current, new, and verify passwords. Instructions in text.

Text displaying RSA private key and SSL certificates, including primary and intermediate certificates. Black text on a white background.

Let’s Encrypt!

Certificate Manager

Cipher Security by Domino Version

SSL Labs

It’s a fantastic free tool for testing your site security which you can use for checking:

You can find this great tool here: https://www.ssllabs.com/ssltest

Here are the results of a scan performed by us. You can see that things can be improved.

Domino TLS update info displayed. Support and disable notes for TLS versions. SSL cipher settings chart with overall B rating.

Once we selected them all, this is what came out on Domino 12.0.1; it depreciated all the old ciphers except for 4.

Security settings update image with SSL cipher list. Text highlights cipher suite changes. Overall rating "A" in green, with performance bars.

Also good to know is that Domino 12.0.2 deprecated most weak/outdated ciphers and

Domino 12 disables TLS 1.0 by default.

If you have made all changes but are still receiving an A in SSL Labs, HSTS is the answer! It was added on version 9.0.1 FP3 IF2.

This protocol is used to prevent man-in-the-middle attacks, downgrade attacks and cookie hijacking but it’s implementation comes with an error preventing that coveted A+

To resolve, add HTTP_HSTS_MAX_AGE=63072000 and HTTP_HSTS_INCLUDE_SUBDOMAINS=1 (for extra security) to the notes.ini.

Check out Darren’s blog for more info:

https://blog.darrenduke.net/darren/ddbz.nsf/dx/domino-adds-hsts-to-its-security-arsenal.htm

One other note is that TLS 1.3 is currently not supported by any version of Domino.

HCL has stated it is on the roadmap,but we have no current release date as of now.

Bonus Tips!

If after you have checked and cleaned up your ciphers you still get this error:

Server log screenshot: Remote console commands and SSL cipher errors are listed with timestamps. Text includes server initialization and HTTP restart.

Make sure you check the hidden views because most likely that is where the trouble is.

So, Configuration → Current Server Document to disable Internet Site Documents then save

Ports → Internet Ports → TLS Ciphers

To achieve an A+ in SSL Labs disable all but the top four.

Server configuration screen showing TLS cipher settings. Domain and server details are listed. Various TLS options and checkboxes are visible.

Certmgr – Port 80 Error

Settings screen showing TLS key file options. TCP/IP port status is "Redirect to TLS" in red. TCP and TLS authentication details visible.

Utilizing A Purchased SSL Key For Nomad

Ciphers Not Updating After HTTP Restart

If no matter what you change your Domino ciphers to does not reflect in SSL Labs,

Check for proxy and passthru servers in the environment that may be handling Encrypting the traffic.

Text interface showing TLS ciphers list with labels like "WEAK" in red. Colors and notes detail encryption strengths. Background is white.

Certificate Manager Renewal Deterred by Redirects

We recommend you also watch the recording of Avery’s presentation, it’s filled with lots of fun and animal images. 🙂

For any of your SSL trouble, Prominic is just an email away, so let’s talk and see how we can help you.

Filed under compliance, cybersecurity