SHA2 Support for Domino 8.5.3 FP6 Server?

Question

In this technote from IBM you can find the following answers:

Q1: Can I import the SHA-2 cert on a Domino 9.x server and then use that keyring on a Domino 8.5.x server? No. Domino 8.5.x lacks the cryptographic infrastructure for SHA-2. This means if you import the cert using 9.x and the Interim Fix and and KYRTool described above, you can use that keyring on a Domino 9.0 or above server, but not on a Domino server pre-Domino 9.0.

Q2: Can I get a hotfix on 8.5.x or earlier to support SHA-2? No. This is not possible since releases prior to Domino 9.0 lack the cryptographic infrastructure for SHA-2.

Is an update to Domino 9.x the only way the handle this issue? If so, how long it's time, before the relevant web browsers (ie, firefox and chrome) will cancel the support for SHA-1?

Answer 1

Yes, for long-term, upgrade to Domino 9 is the only solution. As a workaround you could use a reverse-proxy solution, (e.g. using Apache Web Server, NGINX or HAProxy), see https://frostillic.us/blog/posts/6AF303DE836BA02D85257D570058B1CA as an example.

Regarding browsers support of SHA-1:

• Microsoft: http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx
• Google: http://googleonlinesecurity.blogspot.co.uk/2014/09/gradually-sunsetting-sha-1.html
• Mozilla: https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/

Answer 2

In order to be able to get SHA-2 certificates with Domino 8.5.3 you could install a reverse- proxy in front of domino and let that one handle encryption. But of course then you have two machines and two different software- environments to maintain. And you still have a "very old" software running.

As of this Link the first to abandon SHA-1 Support will be Microsoft in January 2016. Chrome will show warnings long before that but still accept them. Firefox will not accept SHA-1 after January 2017. From that point Chrome will also treat them as "affirmatively insecure".

Best advice: update your servers to 9.0.1 as fast as possible. The effort is minimal and then you can natively handle TLS 1.2