Home
HCL Sametime® Administration Guide 12
Securing
This section provides information on securing your HCL Sametime environments.
Securing connections
The various interactions that occur on the Sametime server can be secured.

HCL Sametime® Administration Guide 12
- Accessibility features for Sametime
  Accessibility features help users who have a disability, such as restricted mobility or limited vision, to use information technology products successfully. HCL® strives to provide products with usable access for everyone.
- New features in Sametime 12
  The current version of HCL Sametime and HCL Sametime Premium includes new features and enhancements.
- Planning
  This section describes the system requirements and server configurations needed for HCL Sametime and HCL Sametime Premium.
- Installing
  This section provides information on installing and configuring the servers for HCL Sametime and HCL Sametime Premium.
- Configuring
  This section provides information on configuring the HCL Sametime server.
- Securing
  This section provides information on securing your HCL Sametime environments.
  - Encryption usage in Sametime
    HCL Sametime uses several types of encryption to protect data.
  - Securing connections
    The various interactions that occur on the Sametime server can be secured.
    - Choosing the TLS configuration scope
    - Securing connections between Sametime servers and LDAP
      When Sametime is configured to connect to an LDAP server, the Sametime servers makes five separate connections to the LDAP server.
  - Enabling Single Sign-on
    The HCL Sametime server installer enables required JSON Web Token (JWT) authentication. Additionally, the Sametime server supports Security Assertion Markup Language (SAML) and Lightweight Third Party Authentication (LTPA) Single Sign-on (SSO).
  - Enabling security in MongoDB
    To enable MongoDB securing, edit the mongod.conf file authorization: enabled setting.
  - Setting up TLS for the Mongo database
    You can update the MongoDB connection with the Sametime server to encrypt data flowing between the Sametime server and a TLS-enabled MongoDB. This step is optional but is recommended for multi-Kubernetes-cluster deployments.
  - Obtaining the cert.key and cert.crt files for Sametime
  - Replacing the TLS certificates for Web Chat and Meetings
    The Sametime server is pre-configured with a self-signed certificate. You can replace the self-signed certificate with a third-party certificate.
  - Applying Let's Encrypt certificates
    This topic describes how to replace the self-signed certificate with a third-party certificate.
- Administering
  This section provides information on administering on Sametime environments.
- Troubleshooting
  This section provides information on troubleshooting and supporting Sametime environments.
- Uninstalling Sametime
  In the event that Sametime must be uninstalled, follow these steps to uninstall the Community, Proxy, and Meetings servers.
- Migrating and Upgrading
  This section provides information on migrating data from an earlier release to Sametime 12.
- Notices

Securing connections

The various interactions that occur on the Sametime server can be secured.

Desktop client to Sametime server: These are connections from client to server that happen on port 1533 to the Sametime Multiplexer (Mux) by default. Sametime has legacy encryption enabled by default. These connections can be secured over TLS 1.2.
Sametime server to LDAP server: By default the LDAP operations are not encrypted. It is recommended to enable encryption using TLS to encrypt sensitive user data , such as names and passwords. The secure port for LDAPS is typically 636 but may be different in your environment.
Decrypting SAML assertions: When Sametime server is configured for SAML, the Sametime server can validate the encrypted assertions are from the Identity Provider (IdP). These settings is used for the decryption.
Configuration scope: Sametime server can be configured to use key and trust stores at the global level, where all certificates are shared among the different community services. As an option they can be configured to use separate key and trust stores.