Lotus Notes: issue when import Symantec/Verisign certificate

Question

In order to sign/encrypt Email I have installed Verisign S-Mime Certificate from Verisign and exported it from IE as a .pfx (PKCS #12).

My problem is when I tried to import it in Security > My Identity > your Certification > Import certificate I got this error:

The signature on the server is invalid, detail can be found in protocol

I have seen on the Internet that I have to be sure that the root certificate VeriSign_Class_1_Public_Primary_Certification_Authority _G3 and intermediate certificate Symantec Class 1 Individual Subscriber - G5 are installed.

In my case when I check in IE I find all the certificates but in Lotus Notes Fichier > security > identity of Other > certification > Internet All I see the root Verisign but I don't find the intermediate certificate (Symantec ...).

How can I import this intermediate certificate and does anyone have any idea if this is really the source of the issue?

I use Lotus Notes 8.5

Answer 1

The reason for the error is that in order to import a certificate into your ID you need the complete certificate chain to be trusted. By default some of the newer intermediate certificates are neither in the domino directory nor in your personal address book nor in your id file.

If you only need this for yourself, then use the dialog you already found to import the root and all intermediates in your id file by using the Your Certificates - Get Certificates - Import Internet Certificates button and add them (top to bottom, root -> intermediate -> personal) to your ID.

If you need this for more than one user, then directly add the intermediate certificate to the domino directory. Then it will be automatically used for every user. To do this open names.nsf on your server, go to Security\Certificates view and click on Actions - Import Internet Certificates. Then select the certificates and import them.

In order for certificates to work it is VERY important to:

• import them in the right order
• don't forget any intermediate
• make sure, that you have the COMPLETE and CORRECT chain

I will give one example (it is for server certificates, but the same is true for mime certificates):

If you have a Thawte 123 Server certificate, then you FIRST need the Thawte Premium Server:

    Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=[e-mail]
    Subject: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server CA/emailAddress=[e-mail]

This information can be extracted using the free openssl- tool with the command openssl x509 -in filenamewithcert.pem -text

You see: in this certificate issuer and subject are identical: This is the self signed root.

Then you need the thawte Primary Root:

    Issuer: C=ZA, ST=Western Cape, L=Cape Town, O=Thawte Consulting cc, OU=Certification Services Division, CN=Thawte Premium Server  CA/emailAddress=[e-mail]
    Subject: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA

You see: The ISSUER is the first imported cert. This is IMPORTANT, that they match.

And the last one -before your own server cert- is the Thawte DV SSL CA:

    Issuer: C=US, O=thawte, Inc., OU=Certification Services Division, OU=(c) 2006 thawte, Inc. - For authorized use only, CN=thawte Primary Root CA
    Subject: C=US, O=Thawte, Inc., OU=Domain Validated SSL, CN=Thawte DV SSL CA

That itself is signed by the Primary root.

Very often the signers of your certificates do not make it easy for you to find out, which certificates are used to sign your own. Use openssl to find out and "reverse engineer" the right order. If you import everything in THIS order and don't leave out any intermediate, then it will work.

Answer 2

After researching I would like to share with you the solution for my Problem.

The Notes version 8.5.x does not support SHA-2 and unfortunately they have no hotfix on 8.5.x to support SHA-2.

SHA-2 is only available in Domino 9.0.x because 8.5.x releases "lack the cryptographic infrastructure for SHA-2

That's why i get this error message.

I tested the same Certificate on Notes 9.0.1 and everything ist okey.

For Information :

Microsoft recommends that certificate authorities no longer sign newly generated certificates using the SHA-1 hashing algorithm and begin migrating to SHA-2.