SnTT - WildCard SSL Certs and Domino....needs 32bit Windows?

This post is for me, and you, to make life easy. 

Some of you out there are only now adding SSL certificates to your servers, I know because you are asking me to help you, and so I present today's Show n Tell Tuesday post.

There are some excellent SSL and Domino posts on this topic already from Gab Davis, Mats Ekman, and Sean Cull, IBM documentation is a bit lacking in this use case so I will not point you to it.
EDIT : Jared Roberts, also a fellow IBM Champion, wrote an excellent post on the wildcard and you should go use his, it is found here. (My blog post was written over a few months so I had missed Jared's post)

I used Gab's post a few times over the last few months and always in a situation where the customer had a stand-alone (individual server) SSL certificate and you can't mess it up, well you could typo the syntax, but her post is the easiest way to get this accomplished. Thank you, Gab!

However, a Wildcard SSL certificate is a little different and this is when I found Mat and Sean's post very helpful and I am taking from them to add my 2 cents.

Along the way of following their posts, I found that the IBM required tool only runs on a 32 bit Windows environment. Let's just say were it not for my TV PC, I would have to create a VM just to run this tool. 

You have been warned.

Everything else runs on 64 bit and you will need your Domino server and your Admin Client accessible. 
EDIT from Chuck's Comment below: You should be using at least a 9.0.1FP6 Notes client, not necessarily an Admin client but you may find it easier to do so.

This is how we include a wildcard 4096 bit cert issued from a registrar with a .PFX and .CSR file into Domino. (Always make sure to get the password used for the key, you WILL need it.)

What do you do with a .PFX file? You convert it into a .PEM file using OpenSSL.
EDITED FEB 9, 2022 after prior update of Nov 30, 2017 NOTE: If you have a .pfx file, an IBM HCL technote makes this much easier than the steps below. https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0029841 but I will leave it all for those who want to know more. Thanks Ted H. for the link.

What? Why? Never mind that now, but the steps to do the magic are below:

Steps:
1) Download the OpenSSL software (taken from Mat's post)
Homepage: https://www.openssl.org/source/
Easy precompiled: https://slproweb.com/products/Win32OpenSSL.html
The one Mat used: https://slproweb.com/download/Win64OpenSSL_Light-1_1_0g.exe
NOTE: These are direct links, so if it doesn't work, go to https://slproweb.com/products/Win32OpenSSL.html for 32 and 64 bit.

2) Download the KYRTool (again taken from Mat's Post)
Fixcentral short: http://ibm.co/1SAYX5E
Fixcentral long: http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ELotus&product=ibm/Lotus/Lotus+Domino&release=9.0.1.2&platform=All&function=fixId&fixids=KYRTool_9

3) Install the OpenSSL into its own directory (include the binaries)

4) Go to C:\OpenSSL-Win64\bin\openssl then run the openssl to get the command window you need so you can type in. (This took me a while to figure out, you are welcome):

5) this is all one line pkcs12 -in C:\location of mypfxfiles\wildcard_company_com.pfx -out  c:\somelocation\wildcard_cmpany_com.pem -nodes -chain

Remember, Domino requires both the .KYR file and the .STH files to be placed inside the \Domino\data directory.

As always have fun, ask for help when you need it and don't give up, as you can see, many of us have been in your shoes before.

Day 2 of Impact 2013

So what did I do on Day 2 of Impact? Today was The World in Motion.

Business calls most of the morning, bad wifi upstairs, bad wifi in OGS and the exhibit hall. A frustrating problem because if you needed 30,000 IP addresses or so, what would you do?

Duh, grab a Z series! Okay not exactly but it is a problem which should have been addressed Sunday.

Which brings me to what I did Tuesday, meetings, interviews, an ignite speech and a session I did with 3 other IBM Champions and a night cap of Matchbox 20.

So the OGS had BMI, one of the music publishing and royalties companies, explaining what they do and how they leverage IBM products while dropping song snippets from numerous artists. As an ex-ASCAP person it was nice to see and hear the industry has come a long way since the paper trails I used to audit.

Westjet had a video that explained what they needed IBM for and how they accomplished so much in such a short time. Nicely done.

Today's 4 things to know are:

1. 3.6B $ is spent on process reinvention
2. 25% productivitry improvement due to social interactions and software
3. 47% cloud process growth 
4. $100B big data business

There was also a demo of what a mobile app could be doing in the near future around auto insurance and an accident of a viper.

I then ventured off to the Social Playground, great name given we are in Las Vegas, and powered up my now worn down laptop and phone. Caught up on some emails met some people, committed to do another Google+ hangout and prepared for my Ignite talk.

The Ignite talk was fun, for me, and was not supposed to be a sales thing, but others did do it that way. I think I had the best slide though (see the slides here):

Afterwards I spent the rest of the afternoon in meetings or doing interviews with the Redbooks team, GWC (Global Websphere Community), Websphere Socmed team all before heading to my session.

We had an open panel on mobile plans and services. Fellow IBM Websphere Champions Yuki Kurosawa, Andrew Paier, Ashraf Souleiman and myself were joined by Phil Kelly of IBM as the moderator. Hope no one took my "Buy Apple" as a forward looking announcement or stock tip. 

We left there and headed to the BP reception which preceded the Matchbox20 concert. We had great VIP seats upfront, thanks Daphne! The band played for about an hour and a half and I now have Matchbox20 Twitter groupies following me. No doubt they are also following the other 9,000 people that tweeted tonight.

And the day ends with me finding out The Venetian does not do late checkout. Really? In Las Vegas? Oh well what can you do. Tomorrow I head home on the red eye. A day of meetings and hopefully some sessions is ahead of me. 

PS - The video we shot on Sunday debuts at the OGS on Wen. morning.