Problem
Generate a CSR for Lotus Domino 4.x
Resolution
NOTE A key length of 1024 bit is the default, but Thawte recommends the use of a 2048 bit key.
If the request is intended for an Extended Validation certificate or a certificate with a validity period beyond December 31, 2013, the 2048 bit key length will need to be selected.
To generate a CSR for Lotus Domino 4.x follow the instructions follow the instructions below:
Step 1: Open Domino SSL Administration
These instructions assume that you have Domino up and running.
From your Notes station, File->Database->Open (Ctrl-O).
Select "Domino SSL Administration".
You'll see a window that is entitled "About Domino SSL Administration - Design".
At the bottom is says "Click to here to setup and manage SSL on your site".
Click on the text or keys.
Step 2: SSL Administration
The Domino SSL Administration Page has 5 top-level menu sections. They'll spread out across the page, so look carefully at the structure of the document before rushing in.
Create Key Ring - Self-Certification
Create Key Ring - Commercial Certification
Create Key Ring - Internal Certification
Certificate Authority - Create Certificate Authority Key Ring
Certificate Authority - Certify Certificate Request
You want number 2, "Create Key Ring - Commercial Certification". This has 3 steps. We will walk you through them carefully.
1. Create Key Ring and Certificate Request
Click on the button for "Create key ring and certificate request".
You'll see a dialog box pop up.
Fill in the Distinguished Name fields carefully.
The CommonName field must be the host part of your https URL's.
It can be an alias, like www.thawte.com. But it must be the full domain name of the server, not just the host name.
For a "Key Name" say "secure server key".
Whatever key ring password you choose, make sure it is secure and you will remember it.
The CSR is CertReq.txt, and the key is keyfile.kyr, and they are created in the Notes\Data directory.
Back up your key file (keyring.kyr) and certificate request (CertReq.txt).
Your certificate will be useless without keyfile.kyr.
