New algorithms for importing and exporting S/MIME and TLS credentials

Domino 12.0.1 adds more flexibility and security by supporting new algorithms for the PKCS#12 and PEM functionality used for importing and exporting S/MIME and TLS credentials.

This enhancement applies to the new 12.0.1 TLS import and export features Upgrading TLS credentials and Exporting credentials to a file. It also applies to the PKCS#12 functionality for existing import and export features such as Exporting and importing Internet certificates.

Importing credentials Importing credentials from an encrypted PEM or PKCS#12 file now supports AES-CBC with 128, 192, and 256 bit keys and a SHA-2 PRF (hmacWithSHA256, hmacWithSHA384, and hmacWithSHA512). The older 3DES-CBC and SHA-1 (hmacWithSHA1) algorithms are still supported for backward compatibility.

Exporting credentials Exporting credentials to a PEM or PKCS#12 file uses PBES2 with 256 bit AES, 4096 iterations, and HMAC-SHA2, in accordance with current best practices.

If you need to export PKCS#12 formatted credentials for use with an older version of Notes or Domino or a different product that does not support PKCS#12 files that are encrypted with AES, use the following notes.ini setting:

PKCS12_EXPORT_LEGACY=1

This setting downgrades all of the PKCS#12 files exported to use SHA-1 and 3DES instead of SHA-2 and AES-256. An example of a product that does not currently support PKCS#12 files encrypted with AES is HCL Sametime V11. Use this setting on the client or server that you use to do the export. If you export from a Person document, certstore.nsf, or the Notes client, add the setting to the Notes client. If you export using server console commands, add the setting to the server.