Who moved my Domino keyfile.kyr files?
Daniel Nashed 24 September 2023 06:15:26
Domino security in 2023
Domino 12.0 introduced a new, standards based and open way to work with web server certificates.
Instead of using command-line tools like OpenSSL and the Domino kyrtool you can now manage all web server certificates in a domain wide certstore.nsf.
The new functionality based on the well known text based PEM standard for certificates provides simplified flows and automation options for all type of certificates.
Domino 12 also introduces the more modern ECDSA (sometimes referred as ECC) keys/certificates which are based on elliptic crypto which has dramatically less overhead.
Now that Domino 14 is around the corner, you should really switch to Domino V12.0.2 and take advantage of Domino 12 certificate management and many other new security features.
Moving from keyfile.kyr to certstore.nsf
The legacy kyr files can be automatically imported into certstore.nsf with a single command-line operation (load certmgr -importkyr all).
Moving to Domino V12 CertMgr would also be a good opportunity to revisit your SSL/TLS configuration and look into the new Let's Encrypt / ACME integration for external facing servers.
But in any case you should benefit of the new manual certificate flow, which automates full flow from key creation to CSR and finally importing the received leaf certificate and the whole certificate chain.
Call for action
If you are still using your old cook books for managing your web server certificates, you should really move on to the more modern way to renew your certificates once per year (actually 398 days).
My 2023 OpenNTF session with many details about Domino 12.0.2 security and CertMgr is a good starting point:
https://www.openntf.org/Public/presentations.nsf/0/56D662F26C6D9821862589580061AEAD/$FILE/openntf2023_domino_security_final.pdf
GitHub project
There is also a GitHub repository including a troubleshooting document for ACME challenges.
Let's try something new... We have just enabled discussions in the project to provide a central place for all kind of question, ideas and to support each other.
https://github.com/HCL-TECH-SOFTWARE/domino-cert-manager
-- Daniel
- Comments [0]
![[HCL Domino]](../lotus-domino.gif){kind=small}
![[Domino on Linux]](../domino-linux.gif){kind=small}
![[Nash!Com]](../nashcom.gif){kind=small}
![[Daniel Nashed]](../daniel-nsh.gif){kind=small}