Jump to main content

Product Documentation

Customer Support

Domino Early Access documentation

Welcome to the documentation for the HCL Domino Early Access Program
New features in the current drop
One-touch Domino setup
Security features and enhancements
Stand-alone Domino directory enhancements
DAOS enhancements
Replication enhancements
Enhancements for developers
Domino on Docker
Notices

Home
Security features and enhancements
These are the security features and enhancements provided through the Early Access program.

Security features and enhancements
These are the security features and enhancements provided through the Early Access program.
- Automating certificate management
  HCL Domino® 12 introduces a new server task, Certificate Manager (CertMgr), that works with a new database, Certificate Store (certstore.nsf) to automate generation of TLS certificates from the Let's Encrypt® certificate authority (CA) or another third-party CA.
- Time-based one-time password (TOTP) authentication
  When users log on to a Domino Web server, you can require that they provide time-based one-time passwords in addition to their user names and passwords.
- TLS 1.0 is disabled by default
  This Early Access drop disables Domino's support for TLS 1.0 by default, leaving TLS 1.2 as the currently supported TLS protocol version.
- Support for PEM-formatted TLS host keys and certificates
  When configuring a Server document or Web Site document with a path to a keyring file, administrators can now specify text files containing PEM-formatted keys and certificates instead of ".kyr" files in the proprietary format.
- New template signing ID uses 2048-bit keys
  A new template signing ID, CN=Domino Template Development/O=Domino, provides stronger encryption using 2048-bit keys. Templates that ship with Notes and Domino 12 will be signed with the new ID.
- Two new curves supported for TLS 1.2 ciphers that use ECDHE for forward secrecy
  The TLS 1.2 ciphers that use Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) for forward secrecy now support two new curves for forward secrecy: X25519 and X448.
- NRPC port encryption supports forward secrecy using X25519
  Support for forward secrecy (https://en.wikipedia.org/wiki/Forward_secrecy) using X25519 (https://en.wikipedia.org/wiki/Curve25519) has been added to NRPC port encryption.

Security features and enhancements

These are the security features and enhancements provided through the Early Access program.

Automating certificate management
HCL Domino® 12 introduces a new server task, Certificate Manager (CertMgr), that works with a new database, Certificate Store (certstore.nsf) to automate generation of TLS certificates from the Let's Encrypt® certificate authority (CA) or another third-party CA.
Time-based one-time password (TOTP) authentication
When users log on to a Domino Web server, you can require that they provide time-based one-time passwords in addition to their user names and passwords.
TLS 1.0 is disabled by default
This Early Access drop disables Domino's support for TLS 1.0 by default, leaving TLS 1.2 as the currently supported TLS protocol version.
Support for PEM-formatted TLS host keys and certificates
When configuring a Server document or Web Site document with a path to a keyring file, administrators can now specify text files containing PEM-formatted keys and certificates instead of ".kyr" files in the proprietary format.
New template signing ID uses 2048-bit keys
A new template signing ID, CN=Domino Template Development/O=Domino, provides stronger encryption using 2048-bit keys. Templates that ship with Notes and Domino 12 will be signed with the new ID.
Two new curves supported for TLS 1.2 ciphers that use ECDHE for forward secrecy
The TLS 1.2 ciphers that use Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) for forward secrecy now support two new curves for forward secrecy: X25519 and X448.
NRPC port encryption supports forward secrecy using X25519
Support for forward secrecy (https://en.wikipedia.org/wiki/Forward_secrecy) using X25519 (https://en.wikipedia.org/wiki/Curve25519) has been added to NRPC port encryption.

Share: Email
Twitter

Disclaimer
Privacy
Terms of use
Cookie Preferences