WoonBlog

Tags: keyring kyrtool x509 ssl certificate openssl domino sha2
When creating the CSR directly through the SSL Vendor's website you need to combine the key and certificate into the Domino keyring file, and when the private key is not in RSA format it needs to be converted.

This post is based on my experience with a certificate created through TransIP's website.

After creating the request I received a .zip file which contained the following:

Cabundle.crt
Certificate.crt
Certificate.key
Certificate.p7b

To create a new Domino keyring using kyrtool use the following command:

Kyrtool create –k c:\cert\keyfile.kyr -p password

Unfortunately the certificate.key file provided by TransIP is not in RSA format which is not supported by kyrtool.
In this case the format was easily determined by looking at the first line of the file, instead of starting with ------BEGIN RSA PRIVATE KEY----- the file started with  ------BEGIN ENCRYPTED PRIVATE KEY------

Posted by Ninke Westra At 4:28 PM Location Neverlands | Permalink | Comments (6)

Tags: SHA2 Domino CA keyring ca process kyrtool
Ever wondered how to use the new keyring tool with your Domino based Internet Certificate Authority?

This should work

First we create a new keyring using the 'new'  kyrtool

kyrtool create -k c:\ibm\keyring.kyr -p mypassword

Then we create a private key and csr using openssl

openssl genrsa -out server.key 4096
openssl req -new -sha256 -key server.key -out server.csr

Open the certificate request database of your Domino based internet CA in your browser and select 'Request server certificate'  and paste the contents of server.csr and click submit to request the certificate.

Once the certificate has been signed, pick it up in the browser using the pickup id (you should have received this ID by email)

Select RAW format and copy paste into a file, in  this example server.cer

Next we combine the private key, the signed certificate and CA certificate into a single file.

copy server.key+server.cer+cacert.cer combined.txt

(cacert.cer = base64bit encoded )

Finally we import this combined file into the Domino keyring

kyrtool import all -k c:\ibm\keyring.kyr -i combined.txt

Posted by Ninke Westra At 3:17 AM Location Neverlands | Permalink | Comments (0)