Domino server rating from F to A+ in seconds

Server running 9.0.1 FP4 and up

Running SSL Labs test on
Gives You low rating

Increase rating

Gather OCSP information
Goto Site and View certificate

Go to Intermediate certificate next to Your own and View Certificate

Go to Details and Authority Information and under Alternative name write down the URL.
In our case it is

Update notes.ini from console with the following, remember to replace the value of OCSP_RESPONDER with Your value from Step1.!!

set config DISABLE_SSLV3=1
set config HTTP_HSTS_MAX_AGE=17280000
set config OCSP_RESPONDER=
set config OCSP_CLOCKSKEW=10
set config OCSP_LOGLEVEL=31
set config SSLCipherSpec=C030009FC02F009EC028006BC0140039C0270067C013

Restart HTTP task with following command:
restart task http

Now You can test Your server again and everything should be running fine

IBM Connections using Active Directory and Nested Groups

Original blogpost here:

Customer wants to use nested groups in Access control for Communities, also it should be reflected in I’m a Member when user is looking for their communities and so on. Connections was 4.5CRx

Google search Links that where tried, but did not work for me (for some reason unknown).

Found something that worked for me (seems logical looking at the description).
coming from thread

All groups specified user belongs to, including due to group nesting (Notes 10, 19)
eg. (member:1.2.840.113556.1.4.1941:=cn=Jim Smith,ou=West,dc=Domain,dc=com)
All members of specified group, including  due to group nesting (Note 10)
eg. (memberOf:1.2.840.113556.1.4.1941:=  cn=Test,ou=East,dc=Domain,dc=com)
Note 10.
The string 1.2.840.113556.1.4.1941 specifies LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. This is an extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. This reveals group nesting. It is available only on domain controllers with Windows Server 2003 SP2 or Windows Server 2008 (or above).

All of this is of course done in the context of Deployment Manager.
After doing the changes a full resynch needs to be done with all nodes in the cluster (sometimes also take down node and use synchNode from the node) and restart the node.

Solution is to change my setting in Websphere to reflect this:

Also changed for performance reasons the following (optional):
Solution is to change according to instructions

How does it look in the files before and after the change, here are snippets of this:

wimconfig.xml before the change:
<config:memberAttributes name=”member” objectClass=”group” scope=”nested”/>
<config:membershipAttribute name=”memberof” scope=”nested”/>

wimconfig.xml after the change:
<config:memberAttributes name=”member:1.2.840.113556.1.4.1941:” objectClass=”group” scope=”nested”/>
<config:membershipAttribute name=”memberOf:1.2.840.113556.1.4.1941:” scope=”nested”/>

security.xml before the change (you can not cut and paste any of these because some parameters are unique to your environment):
<userRegistries xmi:type=”security:WIMUserRegistry” xmi:id=”WIMUserRegistry_1″ serverId=”” serverPassword=”{xor}” realm=”defaultWIMFileBasedRealm” ignoreCase=”true” useRegistryServerId=”false” primaryAdminId=”wasadmin” registryClassName=””/>

security.xml after the change (you can not cut and paste any of these because some parameters are unique to your environment):
<userRegistries xmi:type=”security:WIMUserRegistry” xmi:id=”WIMUserRegistry_1″ serverId=”” serverPassword=”{xor}” realm=”defaultWIMFileBasedRealm” ignoreCase=”true” useRegistryServerId=”false” primaryAdminId=”wasadmin” registryClassName=””>
<properties xmi:id=”VMMURProperty_1″ name=”” value=”1″/>

Shortcut to this document: http://
Thats all folks

Wildcard SSL certificate from P12/PFX file into Domino (SHA2 as well)

New article on this here
(Moved this page to our new blogsite
Just made a key file from scratch using a file exported from another webserver.
I am using iKeyman for Sametime/Connections and the tools provided by Domino all the time, but this is explicitly to describe the process of using already bought wildcard certificates used by other parts of your organisation and extending the use of them to also include Domino servers, instead of having to request a new wildcard certificate just for Domino and paying the certificate authority one more time. Of course you must follow the agreement made on how many servers you can use the certificate for, but still it gives you the option of not paying more than one time and include your Domino servers in the same package.

This article and the comments as well as discussion on notesnet provided me with information to start with.

The objective of this article is to provide an example on how to  do this with hopefully no discussions and no questions unanswered. Of course this example is based on a particular situation with a special certificate provider but can hopefully be translated to any other situation with other certificate authorities.

Because of the nature of this instruction a PDF file will be provided to use as a checklist. I highly recommend using this (screenshotsforblogP12)

1. What do I need
2. Import your P12/PFX file into your browser
3. Export root and any intermediate certificates to file
4. Run iKeyman to create new kyrfile and then Add and Import certificate information
5. Check your file and add sth file to enable it for Domino use
6. Implement the files on the server
7. Check out if it works
8. Conclusion

What do I need:
1. One instance of a 32 bit Windows operating system, I used 32 bit Windows XP running on my laptop with VMware 10. You can not use 64 bit Windows for this task.
2. GSK5 that you can download from This should be unzipped inside your XP virtual machine.
3. An exported P12/PFX file from in my case IIS, containing the wildcard certificate private key as well as the certification path to it, more on this later on.

Import your P12/PFX file into your browser
This should contain private key as well as all certificates in the certification path if possible.
Open the file with Crypto Shell Extensions and Import into your browser, to import you need a password provided by the administrator that exported the file.
Examine the newly imported certificate in Internet Explorer under Content\Certificates..\Personal
View the certificate and each certificate in the path and write down the labels to easily find them under Intermediate… and Trusted Root… later as well as using them inside iKeyman when labelling them.

Export root and any intermediate certificates to file
Find the different certificates under Intermediate Certification Authorities or Trusted Root Certification Authorities using the labels noted in the step above.
Export them to file.

Run iKeyman to create new kyrfile and then Add and Import certicate information
You must be Administrator on your machine to run this, make sure you are.
Go to the directory where you unzipped your files in a Command Prompt.
1. notepad readme.txt and read it
2. gskregmod.bat Add
3. runikeyman.bat
4. Create new keyring file
5. Add Signer Certificates from the earlier exported Trusted Root and any Intermediate in this order starting with the top meaning trusted Root first and then Intermediate.
6. Import Personal Certificates using the first provided P12/PFX file
7. View this key information to make sure that it is looking good.

Check your file and add sth file to enable it for Domino use
1. Copy the kyr file to your data directory on the notes client
2. Open or create the Server Certificate Admin application
3. View & Edit Key Rings
4. Select key Ring to Display and check that you can read it using the password set by you earlier.
5. Change Key Ring Password and follow the procedure
6. Check that you have received an sth file with the same name as the kyr file in your data directory
7. Check your certificate in Server Certificate Admin

Implement the files on the server
1. Copy both files to your servers data directory
2. Add the kyrfile name to your internet sites document or server document depending how your server is configured
3. Modify the cipher part
4. Make sure the SSL port is enabled in the Internet Ports.. section
5. Restart your http task on the server, use sh ta onl and check that http listens to both 80 and 443

Check out if it works
1. Use your browser and connect to your server via https
2. Look at your certificate information
3. Congratulations

Doing this task is not more complicated than any other task that involves certificates using any other platform.
Domino can use the same wildcard certificates already used by others, you do not have to pay twice.
Use the checklist with screenshots included above to make sure that you understand the instructions.screenshotsforblogP12
I think IBM needs to either change Domino server SSL implementation to use the same files for this as the rest of IBM products, meaning same structure as eg. WebSphere Application Server or it must include support for Keyring files into the latest versions of GSK. Keeping instances of old operating systems for this task only could not be a good solution.
Also got this working with SHA2 and my internal Domino 9 server, but then I had to work with multiple GSK kits, but ended up with a valid kyr file. This is not documented here, but I could do it if it is still interesting after this Poodle issue. I guess not, because TLS is more important now.
OK here we go, Instead of creating a kyr file directly under Windows XP I first created a CMS – kbd file with the GSK kit provided by IBM HTTP servers, that I had on another server. Then I copied the kbd file into Windows XP and GKS kit version 5 and opened it there and saved as kyr file and then proceeded to:
1. Copy the kyr file to your data directory on the notes client

Link directly to this document:

How to auto-configure mobile apps for IBM Connections/IBM Sametime

IBM is spending a lot of time and effort to develop and deliver top notch  iOS/Android apps for their social/collaboration solutions. IBM has developed mobile apps for the following products:

– IBM Connections
– IBM Sametime
– IBM Sametime Meetings

These apps can be downloaded from Apple/Google app stores. When you open one of these apps on your mobile device for the first time, you are prompted to add the hostname to the Connections/Sametime server,  the correct port, give the configuration a name and so on. This can be a little tricky for the user and can generate some unnecessary support calls to your Help-desk.

But there is a way to make this easier for the user. You can send or publish a URL, that  then clicked on will automatically configure the app with the correct server settings and so on. The user will then only need to enter her/his username and password to get connected to Connections or Sametime services. Below you have some examples on how these URLs can look like:

[Sametime Chat]
Please install IBM Sametime Meetings app and open the relevant link below to create a configuration for Greenhouse”
On Apple devices, use:

[Sametime Meeting]
Please install IBM Sametime app and open the relevant link below to create a configuration for “Greenhouse”
On Apple devices, use:

[IBM Connections]
Please install IBM Connections app and open the relevant link below to create a configuration for “Greenhouse Community”
For both iOS and Android devices use:

These URLs can then be sent by email to users or published on the corporate intranet (Connections of course…). The user then opens the email or intranet page on their mobile device and click on the link and the app gets auto configured :-)

The above URLs are just a few examples on how to configure this apps. It is possible to add more logic to the URL, like users domain or even username. For more information about that, visit IBMs documentation, see below.

IBM Notes 9.0 and Ubuntu 64

(Moved this to our new blogsite
Customer running 64 bit Ubuntu 12.04 LTS as their primary client platform.
Customer wants Notes 9.0 to be their primary collaboration client.

I googled on this and got no satisfactory solution for implementing this in a corporate production environment as all of the solutions were using force to install and some ended up with broken dependencies and so on.
The goal for me was to install this without broken dependencies and a fully functional operating system without warnings inside update manager.

To install Notes 9 in Ubuntu 64 I’m assuming the following:

1. You are using an administrative account and you are using Ubuntu 12.04 LTS 64 bit

2. No other Notes installations are present to begin with.
To check out if there are any other ibm/lotus installations present use the following command in a terminal window (open it an expand it to see all information):
sudo dpkg -l ‘ibm*’:i386 | grep ii (in 32 bit it is sudo dpkg -l ‘ibm*’ | grep ii)

If you have earlier installations you should be able to uninstall them one by one with the following:
sudo dpkg -r <packagename>
sudo dpkg –purge <packagename>

Unpack your downloaded tar files and extract the file ibm-notes-9.0.i586.deb to ibm-notes-9.0.i586 folder and the rename ibm-notes-9.0.i586.deb to original-ibm-notes-9.0.i586.deb

Change the package
Go into the ibm-notes-9.0.i586 folder and into the DEBIAN folder
(here it is a good idea to show hidden files, done by pressing Ctrl+H while in file browser)
Open the file control in edit mode and remove the following:

gdb, coreutils, unzip, bash, procps, grep, sed,

from the Depends line, control file should now look lihe this:

Screenshot from 2013-07-26 11:38:18save the file and leave the editor

If you have a hidden file called control~ after editing the actual control file delete the file control~

NOTE: To keep things clean inside your packages always show hidden files and all files created with the ~ ending should be deleted before recompiling the package.

Before creating the new package you should also consider to change the file plugin_customization.ini that is located under the same folder ibm-notes-9.0.i586 but under opt/ ibm/notes/framework/rcp to make it more customized for your needs. See example further down in this document.

Repacking/compressing the new package
Now in a terminal window go to the folder where you first unpacked your tar file.
In that folder the ibm-notes-9.0.i586 folder should now be available and the file ibm-notes-9.0.i586.deb must not be there. Issue the command:

sudo dpkg-deb -b ibm-notes-9.0.i586

If everything goes well a new ibm-notes-9.0.i586.deb file is created.

Installing files that installation depends on
Now, still present in the control file inside the package there are still dependencies that must be installed before proceeding with the installation of the Notes 9.0 client. This is also true for the 32 bit version of Ubuntu even if the deb file doesn’t need to be changed there.

Install for 64 bit dependencies
In a terminal window issue the command:

sudo apt-get update; sudo apt-get install ia32-libs libgnomeprint2.2-0:i386 libgnomeprintui2.2-0:i386 libbonobo2-0:i386 libbonoboui2-0:i386 libgconf2-4:i386 libgnome-desktop-2-17:i386 libgnomevfs2-bin:i386 libgnomeui-0:i386 libjpeg62:i386 libpam0g:i386 libxkbfile1:i386 ttf-xfree86-nonfree t1-xfree86-nonfree -y

or if you want to put it inside a script:
(if the script is already in sudo, remove sudo before apt-get)

sudo apt-get update
sudo apt-get install ia32-libs -y #NOT to be used in 32 bit Ubuntu
sudo apt-get install libgnomeprint2.2-0:i386 -y
sudo apt-get install libgnomeprintui2.2-0:i386 -y
sudo apt-get install libbonobo2-0:i386 -y
sudo apt-get install libbonoboui2-0:i386 -y
sudo apt-get install libgconf2-4:i386
sudo apt-get install libgnome-desktop-2-17:i386 -y
#sudo apt-get install libgnome-desktop-3-2:i386 -y #for 32 bit it works instead of 2-17
sudo apt-get install libgnomevfs2-bin:i386
sudo apt-get install libgnomeui-0:i386 -y
sudo apt-get install libjpeg62:i386
sudo apt-get install libpam0g:i386
sudo apt-get install libxkbfile1:i386
sudo apt-get install ttf-xfree86-nonfree
sudo apt-get install t1-xfree86-nonfree

Using this in 32 bit version the :i386 must be removed because it is already i386 also ia32-libs should NOT be installed in 32 bit version

Checking that there are no dependencies left
Install the program GDebi Package Installer from Ubuntu Software Center.
In a window Right click on the ibm-notes-9.0.i586.deb and choose Open With GDebi Package Installer.
Don’t use this to install only to see that there are no more dependencies left.
(you can use this to install but not to uninstall in 64 bit)

Installing the client
This is the commands to install but you can always choose to not install all of these features, but you must start with ibm-notes-9.0.i586.deb.

sudo dpkg -i ibm-notes-9.0.i586.deb
sudo dpkg -i ibm-cae-9.0.i586.deb
sudo dpkg -i ibm-feedreader-9.0.i586.deb
#sudo dpkg -i ibm-connections-4.5.0.i586.deb #See instructions further down
sudo dpkg -i ibm-activities-9.0.i586.deb
sudo dpkg -i ibm-sametime-9.0.i586.deb
sudo dpkg -i ibm-opensocial-9.0.i586.deb

As we all know the full Activities and Status Update package (IBM Connections Plug-ins for IBM Notes) is delivered as an update instead of being included in the activities package for Linux. The only thing included in the activities package is the Business card component. Further down in this document I will give an unsupported solution to install the “” as an install package directly instead of using provisioning to install it as a plug-in.

Uninstalling the client
Try to uninstall packages in reverse order from installing them this means ibm-notes-9.0.i586.deb goes last.Here are the commands to do this:

Check what is installed with sudo dpkg -l ‘ibm*’:i386
could look like this:
Screenshot from 2013-07-26 13:46:48

based on this uninstall looks like this
sudo dpkg -r ibm-notes:i386
sudo dpkg –purge ibm-notes:i386

Example of plugin_customization.ini
This example assumes that you are using Domino Directory and have Sametime Community in a separate Domain from the Domino Directory and using LDAP. Sametime is 8.5.2 IFR1 and with meeting proxy and so on. As for the Connections parameters in this it is only for hiding sidebars so that can install them but hide them by default. Connection configuration for the client could be done from Domino policys after this. The example gets you going with Notes client and Sametime in a SSO (if you have configured it correctly) scenario and you can build on this to do the same with Activities and Status Updates. This example also open up the Application install so that it is available for clients when needed. Sametime Community servers should also be able to respond to any client request coming on port 1352 regardless of the Domino server names as we are using them (clustered configuration) to authenticate the clients for SSO.\!8\!5,18,400,20,43,400,20
# IBM Sametime Config
# Community Server<your COMMUNITY_ID><your community server FQDN>
# Sets timeformat
# Meeting Server<your meeeting server FQDN><your community server FQDN>
# Handles the contact list conflict popup
# Activates chat logging
# Handles the a media manager popup error message
# Path for file transfer\\SametimeFileTransfer
# IBM Connections Config
# Status Updater Fix to show profile pictures
# Fix Getting Started page
# Install Application Menu

IBM Connections Plug-ins for IBM Notes as an installer instead of a plug-in (unsupported solution but still nice to have)

Extract and go into the updateSiteforLinux folder and copy the file to folder of your choice where you want to work with it.
Copy the file ibm-activities-9.0.i586.deb (from the installation kit) to the same folder as the above where copied to.

Extract the ibm-activities-9.0.i586.deb to the ibm-activities-9.0.i586 folder
Rename the ibm-activities-9.0.i586 folder to ibm-connections-4.5.0.i586

Go into the folder ibm-connections-4.5.0.i586 and delete all files in features and plugins folders in the opt/ibm/notes/framework/shared/eclipse sub three but leave the folders.

Extract the to the updateSite folder.
Extract all of the jar files in the features folder.Move all of the newly crated folders into the features folder of ibm-connections-4.5.0.i586 above.
Copy the jar files from the updateSite plugins folder to the plugins folder of ibm-connections-4.5.0.i586 above

Go into the DEBIAN folder of ibm-connections-4.5.0.i586
Open the file control in gedit and change:
Package: ibm-connections-plugin
save the file and leave the editor.

Change the contents of 2 files in the following folder of ibm-connections-4.5.0.i586:
/opt/ibm/notes/framework/rcp/deploy folder contains 2 xml files that needs to be changed:

Replacing the content of install.ibm_activities.xml

<?xml version=”1.0″?>
<domain-object name=””>
<install version=”″>
<installfeature mergeaction=”add” require=”true” default=”false” description=”%Activities.description” id=”Activities” name=”” required=”false” show=”true” version=”″>
<feature id=”” version=”″ shared=”true” action=”install” download-size=”2452″ match=”greaterOrEqual” mergeaction=”add” size=”2101″/>
<feature id=”” version=”″ shared=”true” action=”install” download-size=”2452″ match=”greaterOrEqual” mergeaction=”add” size=”2101″/>
<feature id=”” version=”4.5.0″ shared=”true” action=”install” download-size=”2452″ match=”greaterOrEqual” mergeaction=”add” size=”2101″/>
<feature id=”” version=”″ shared=”true” action=”install” download-size=”2452″ match=”greaterOrEqual” mergeaction=”add” size=”2101″/>

Replacing the content of uninstall.ibm_activities.xml

<?xml version=”1.0″?>
<domain-object name=””>
<install version=”″>
<installfeature default=”false” description=”%Activities.description” id=”Activities” name=”” required=”false” show=”true” version=”″>
<feature action=”uninstall” id=”” match=”greaterOrEqual” shared=”true” version=”1.0.0″/>
<feature action=”uninstall” download-size=”2452″ id=”” match=”greaterOrEqual” shared=”true” size=”2101″ version=”″/>
<feature action=”uninstall” download-size=”2452″ id=”” match=”greaterOrEqual” shared=”true” size=”2101″ version=”″/>
<feature action=”uninstall” download-size=”2452″ id=”” match=”greaterOrEqual” shared=”true” size=”2101″ version=”4.5.0″/>
<feature action=”uninstall” download-size=”2452″ id=”” match=”greaterOrEqual” shared=”true” size=”2101″ version=”″/>

Repacking/compressing the new package

Open a terminal window and go to the working directory of your choice.
Issue the command:

sudo dpkg-deb -b ibm-connections-4.5.0.i586

If everything is OK a ibm-connections-4.5.0.i586.deb file is created.

Installing the new package

sudo dpkg -i ibm-connections-4.5.0.i586.deb

Uninstalling the new package

Check what is installed with sudo dpkg -l ‘ibm*’:i386
could look like this:
Screenshot from 2013-07-26 15:57:29

based on this uninstall looks like this
sudo dpkg -r ibm-connections-plugin:i386
sudo dpkg –purge ibm-connections-plugin:i386


It seems to me that the installation of the Notes 9.0 client in a 64 bit Ubuntu environment is not going to be done without changing and repacking/compressing the package(s) as well as installing some dependencies from the 32 bit environment. On the other hand, from experience, other client environments like Windows usually involve this type of changes to include own versions of eg. plugin_customization.ini so this is not so much different than customizing and testing any other package in any other environment as you do inside larger corporate environments.

Shortlink to this document:

Din molntjänst kommer vara en hybrid.

Till att börja med några av argumenten för molnbaserade tjänster:

  • Säker mobil access (“Vi kunde omöjligt hänga med takten på nya mobila enheter och förändringar i webbläsare med vår egen IT-personal.”).
  • Enhetliga tjänster – funktionell symmetri.
  • Efterlevnad av lagar och regler samt säkerhet.
  • Servicegrad, högre SLA i molnet.
  • Ingen geografisk närvaro, tjänster som lämpar sig för moln, t.ex. filhantering över geografiskt spridda platser.
  • Kostnadsbesparingar såsom infrastruktur och underhåll.

Vad det gäller Notes Domino tjänster finns det saker att funderar på när du överväger fördelarna med molntjänster. Det som gör det annorlunda från organisationer som använder Exchange, Novell Groupwise eller Oracle är ett antal skäl:

Den mest betydelsefulla skillnaden är att Notes Domino handlar inte enbart om e-post och kalender, det har det aldrig gjort. Visst är de viktiga tjänster men dessa funktioner är underordnade Dominos egentliga värde och det är.

De flesta verksamheter som har investerat i Domino har åtminstone något beroende till Domino/Lotus Notes-applikationer (databaser). Även i organisationer som inte anser sig tunga Domino Apps konsumenter finns det nästan alltid ett par kritiska applikationer.

En annan viktig omständighet är att Domino tenderar att fungera som en länk mellan flera viktiga system i en organisation tack vare dess enkelhet att driftsätta och schemaläggning av kod.

Tyvärr för de flesta (läs: alla) som tänker sig övergången från Domino appar kommer de att upptäcka att de program som var lätta och billigt att bygga på Domino plattformen tenderar att vara dyra och svåra att återskapa på andra plattformar.

Allt detta innebär oavsett molnplattform som du väljer kommer Domino-servrar och eventuellt Notes-klienter förbli en del av din miljö för en lång tid framöver.

Den molnlösning du väljer kommer sannolikt att vara en hybrid av andra anledningar:
Antag att din organisation är mer än ett par hundra användare så kommer allt inte existerar helt och hållet i molnet – exempel:

  • Producenter av innehåll <-> Konsumenter.
  • Heltidsanställda <-> säsongs/timanställda, entreprenör, ombud, konsulter, agenter.
  • Mobil (+BYOD) <-> kontor.

Åtminstone kommer du att ha infrastruktur för användarkatalogen, provisionering, autentisering och SMTP (för t.ex. relay) på plats och förmodligen mycket mer.
Mer än troligt att du kommer fortfarande att ha applikationer, mottagande e-post och andra verktyg kvar hemma.

För att inte nämna ta vara på redan gjorda investeringar. För Notes Domino (8.5.1) kunder finns möjligheten att behålla delar av infrastrukturen intakt hemma och samtidigt blanda med IBMs molnbaserade tjänster – bland annat m.h.a. pass thru.

Tips: testa IBM SmartCloud Engage Advanced gratis i 60 dagar  (+ gratis externa konton).