Coexistence Manager for Notes 3.8.4


	NOTE: You can request a certificate using Web enrollment pages. For more information, see http://support.microsoft.com/kb/931351. If you need a multi-domain certificate: See To create a SAN certificate.

When you receive the certificate, you must install it on the appropriate server.

To configure the certificate for multi-domain support

The Free/Busy Connector can facilitate the exchange of free/busy information among multiple subdomains supported by both the Exchange and Domino servers. For a multi-domain scenario, ensure the certificate used on the CMN Web Server has subject alternate names for all associated autodiscover host names.

To request and install a certificate using IIS 7.0

To request a certificate using IIS 7.0:

From Internet Information Services, click Server Certificates.

From the Actions Pane, select Create Certificate Request.

Enter autodiscover.<smtpdomain> or <smtpdomain> for the primary domain and all required subdomains. Then click Next.

Accept the defaults, and click Next.

Specify the file name, and click Finish.

Request a certificate using a local CA or public CA. For more information, see To request a certificate from a local CA or To request a certificate from a public CA.

To install the certificate using IIS 7.0:

From Internet Information Services, click Server Certificates.

From the Actions Pane, select Complete Certificate Request.

Select the saved certificate file, and enter a friendly name for the certificate, then click OK.

To create an https binding for the web site using IIS 7.0:

From the Connection pane in IIS, select Default Web Sites.

From the Actions pane, select Bindings.

Select Add. Select https as the type for a secure site, and enter the IP address and port number.

Select the SSL certificate to pass the certificate into the computer account, and click View to view any certificate information.

To request and install a certificate using IIS 6.0

To request a certificate using IIS 6.0:

From Internet Information Services (IIS) Manager dialog box, right-click Default Web Site, and select Properties.

From the Directory Security tab, select Server Certificate to open the Web Server Certificate Wizard.

Click Next.

Select Create a new certificate request, and click Next.

Select Prepare the request now, but send it later, and click Next.

Accept the defaults. Ensure Select cryptographic service provider (CSP) for this certificate is checked, and click Next.

Select Microsoft RSA SChannel Cryptographic Provider, and click Next.

Select or enter your organization’s name and organizational unit, and click Next.

Enter autodiscover.<smtpdomain> —or— <smtpdomain> as the common name, for the primary domain and all required subdomains. Then click Next.

Enter the geographical information, and click Next.

Specify a file name to save the certificate request, and click Next.

Review the information, and click Next. Then click Finish.

Request a certificate using a local CA or public CA. For more information, see To request a certificate from a local CA or To request a certificate from a public CA.

To install the certificate using IIS 6.0:

From Internet Information Services (IIS) Manager dialog box, right-click Default Web Site, and select Properties.

From the Directory Security tab, select Server Certificate to open the Web Server Certificate Wizard, and click Next.

Select Process the pending request and install the certificate, and click Next.

Browse to the location of the text file, and click Next.

Leave the default port as 443, and click Next.

Review the certificate summary. Click Next, then click Finish.

From Internet Information Services (IIS) Manager dialog box, right-click Default Web Site, and select Properties.

From the Directory Security tab, select Edit.

Select the Require secure channel check box, and click OK.

To request a certificate from a local CA

From a web browser, enter https://<Local_Certification_Authority_computer>/certsrv

Click Request a certificate, then Advanced certificate request.

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Open the text file where you save the certificate request.

Copy and paste the text from the certificate request into the Saved Request box when you selected Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

In the Certificate Template box, select Web Server. Click Submit.

Select Base 64 Encoded, then select Download certificate.

Save the file.

To request a certificate from a public CA

Go to the web site of the public CA, and follow their instructions to request a certificate.

To create a SAN certificate

This procedure lets you configure a single certificate to answer for multiple addresses. First, you must enable the SAN (Subject Alternate Name) flag on your CA. On the machine running CA services, run these commands at the command prompt to enable the flag:

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc

When the SAN flag is enabled, you can create the certificate:

Open IIS on the machine running F/B and select the server. Scroll to the bottom, open Server Certificates, and click on Create Certificate Request.

For the common name, enter something appropriate for your larger domain. For example, for a domain alejandro.xyzcorp.com, the common name on the certificate is *.xyzcorp.com. (This is somewhat generic, as we will later add specific namespaces to the certificate.)

Accept the defaults and enter a name for the request.

Open the certificate request you just created, and select and copy all of the text.

Open the certificate web enrollment page for the CA of your domain—e.g., https://hostname/certsrv. Then select Request a Certificate, and then select Advanced Certificate Request.

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

In the Base-64-encoded certificate request box, paste all of the text that you copied from the text file in step 4 above.

For the Certificate Template, select Web Server.

In the Additional Attributes box, enter any alternate-domain information in this format:

san:dns=dns.name[&dns=dns.name]

... with &dns=dns.name appended for each alternate domain you want the certificate to handle.

For a multi-/subdomain environment, you can enter as many domains as you like:

san:dns=autodiscover.sub1.xyzcorp.com
&dns=autodiscover.sub2.xyzcorp.com
&dns=autodiscover.sub3.xyzcorp.com
&dns=autodiscover.sub[...].xyzcorp.com
&dns=autodiscover.sub[n].xyzcorp.com

When you are finished, click Submit.

Select the DER encoded radio button, and then select Download certificate chain.

Enter a name for this.

Go back to IIS and click Complete Certificate Request.

For the Filename containing the certification authority’s response, click the Browse button and select the certificate you just saved. (Be sure to change the file type to *.* instead of *.cer, or you won’t see the file you saved—since it is a .P7B extension.) Type a friendly name that is easy to remember and identify so you can find it later on the list. You should then see your new certificate on the list.

Select your new certificate and click View.

Click the Details tab, and scroll down to Subject Alternative Name. Highlight this field, and you should see all of your domains in the Details box.

Now bind your certificate to the HTTPS protocol on the default first website:

On the CMN F/B computer, in IIS Manager: Select Default Web Site.

In the Actions pane on the right, select Bindings.

Select https and click Edit.

In the Edit Site Binding window, in the SSL certificate drop-down list: Select the certificate you just created.

Click OK.

4-3: Configure trusted sites for computers hosting F/B components

Log in as the CMN account to be used with the F/B Connector (if you haven’t already). Then, in Internet Options (via Windows Control Panel or IE Tools):

Click the Security tab, then select Trusted sites and click the Custom level... button.

In Settings, scroll down to User Authentication | Logon, and click the radio button for Automatic logon with current user name and password.

Click OK to save the selection and return to the Security tab.

Add the Exchange Server EWS and Autodiscover URLs to the Trusted Sites.

Click OK to save your new Security settings and dismiss the Internet Options dialog box.

4-4 (optional): Configure logging for F/B components

By default, CMN is installed with the log4net utility to generate log files of CMN components’ activity. This information is critical to diagnosing any configuration issues that may arise. Logging is enabled by default for all CMN components.

The default configurations will be suitable for most organizations and circumstances, but you can customize logging features. The log4net utility may be configured to work a particular way with each CMN component. Configuration instructions are nearly identical for all components, so we present the instructions separately, in Appendix C of the User Guide.