Recent
OpenNTF - OpenNTF Board Elections 2026 
By OpenNTF | 9/22/26, 2:54 PM | Business - Events / People | Added by Serdar Basegmez
OpenNTF - OpenNTF Board Elections 2026: OpenNTF members and contributors will be voting for the next Board of Directors. If you represent a member company or are a registered contributor, keep an eye on your inbox. Ballot emails will start going out today.
When Upload through IHS fails: a 30 second NFS mystery – Martijn's Blog 
By Martijn de Jong | 9/22/26, 5:07 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Two environments. Same Connections version, same CR level, byte-identical application JARs, byte-identical mod_ibm_upload.so. On one of them, Upload through IBM HTTP Server (IHS) works perfectly. On the other, every upload above the configured threshold returns HTTP 500.
It took two days to find out why, and the answer had nothing to do with Connections, WebSphere or IHS. It was in the NFS mount options, and not the ones you would expect.
Lotus Evangelist: Optimizing Domino Cluster Failover for Seamless High Availability
By Keith Brooks | 9/22/26, 5:05 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Ensuring high availability in an HCL Domino environment requires meticulous configuration of cluster failover mechanisms. Proper tuning not only guarantees seamless user access during server outages but also optimizes overall server performance.
This guide delves into key settings and parameters essential for effective cluster failover management.
HCL Connections Desktop Plug-ins for Windows - Detecting Server-in-Maintenance
By Milan Matejic | 9/22/26, 5:02 AM | Infrastructure - Connections | Added by Roberto Boccadoro
With the HCL Connections Desktop Plug-ins for Windows Version 26.08 update, we got a handy new feature.
First, the plug-in will alert users only once if it detects that HCL Connections is offline. Previously, users would get continuous alerts via pop-ups until HCL Connections was reachable again.
Second, we now have the ability to activate the “maintenance mode” for the HCL Connections Desktop Plug-ins, which will tell the plug-in not to alert the users at all.
Installation of HCL CNX 8 CR15 failed
By Rainer Brandl | 9/22/26, 5:01 AM | Infrastructure - Connections | Added by Roberto Boccadoro
I had the issue that I was not able to install the latest CR15 of HCL Connections 8 in a customer environment using the GUI of the Installation Manager. I always received the following error message when validating the connection to the Deployment Manager:CLFRP0005E: Cannot get SSL certificate from the Deployment Manager.
New Project: OpenNTF Java SDK for HCL Domino REST API - LotusNotus Blog
By Serdar Basegmez | 9/11/26, 5:41 AM | Development - Notes / Domino | Added by Serdar Basegmez
OpenNTF Java SDK for HCL Domino REST API — early preview simplifying Java access to Domino REST; JWT auth, async/sync API. Get it on GitHub.
Renewing expired OpenSearch and Mongo certificates in HCL Connections Component Pack – Martijn's Blog
By Martijn de Jong | 8/28/26, 8:03 AM | Infrastructure - Connections | Added by Roberto Boccadoro
n the past, I’ve written about expiring certificates in your Kubernetes environment. These will hit you if you don’t update your Kubernetes environment within a year. Today, we were hit by other expiring certificates. Those of OpenSearch and Mongo, as part of the HCL Connections Component Pack.
HCL Domino - Web Federated Login Issue with Keycloak v26.6.0+ ·
By Milan Matejic | 8/7/26, 11:39 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
If you are using Keycloak as an Identity Provider (IdP) for HCL Domino and have Web Federated Login enabled, exercise caution before upgrading to Keycloak v26.6.0 or newer. Starting with v26.6.0, Keycloak possibly changed how it validates the RFC8707 resource parameter, which effectively breaks Domino Web Authentication over OIDC. Downgrading to Keycloak v26.5.7 resolves the issue while the root cause is investigated.
Configuring A Domino OIDC Provider With One-Touch Setup
By Jesse Gallagher | 7/30/26, 2:59 PM | Development - Notes / Domino | Added by Roberto Boccadoro
HCL released Fixpack 1 for 14.5.1 the other day, and they decided to toss in a few features. While I imagine the RAG thing had a bunch of people clamoring for it and the proxy port one is a natural small feature to add, the addition to One-Touch Setup stands out a bit. It gains a new property in the configuration JSON but has a pretty-limited scope: it lets you stash a created document's UNID and use it in another doc.
I'm not sure what other use cases people have had for this, but I actually had one specific one that this surprisingly solves: configuring Domino as an OIDC Provider and registering a client
Sanitize xpages input fields
By Patrick Kwinten | 7/30/26, 7:39 AM | Development - Notes / Domino | Added by Patrick Kwintensson
In case you have xpages applications open in the web the chances are that someone, someday, somehow wants to act malicious. Of course we don't want that so besides on the infrastructure site you also should add protection on the application side. Especially applications with input fields (text, text area, radiobuttons etc) are vulnerable for exploitation. Tools like Burp suite do not make this a tedious task. So how can we protect us from malicious data-entry?
Upgrading containerd from 1.7 to 2.x? Read this first!
By Martijn de Jong | 7/9/26, 3:07 PM | Infrastructure - Connections | Added by Roberto Boccadoro
Since Kubernetes 1.20 deprecated Dockershim (and removed it entirely in Kubernetes 1.24), containerd has become the de facto container runtime for Kubernetes environments. HCL Connections Component Pack runs on Kubernetes, making containerd a critical dependency for Connections deployments.
Although HCL generally follows the Kubernetes release lifecycle in its Component Pack (CR) releases, containerd 1.7 remained the highest supported version for a long time. This changed with HCL Connections 8 CR14, which introduced support for Kubernetes 1.35 and, consequently, containerd 2.2.x. At the same time, support for containerd 1.7.x was dropped for Kubernetes 1.35 deployments.
PDF conversion failed after installation HCL Connections 8 CR14
By Rainer Brandl | 7/9/26, 3:06 PM | Infrastructure - Connections | Added by Roberto Boccadoro
After installing CR14 I received the information that the conversion of Wikis, Forum entries or Blogs is no longer working.During a remote session with HCL Support ( thx a lot to Ale !! ) we could find the cause and we also could solve it.It seems that the installation changed some setting in the custom properties for IC360 – it was set to “wasadmin” what caused the PDF conversion to stop working.
Lotus Evangelist: ClamAV and Domino
By Keith Brooks | 6/30/26, 6:41 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
I am not an expert on Anti-virus things and Domino, that would be Daniel Nashed.
But if HCL Domino has something new, I test it out and set it up on my server.
In this case, I had heard that ClamAV would now work with Domino as of 14.5.1.
Having used Clam for many years at the OS level, I wanted to play with this in Domino.
My server is Windows, not Linux, ClamAV Linux instructions are pretty common, Windows, not as much.
Boy was this the hardest "easy' thing to do ever.
Upgrading to Domino Nomad
By Hogne B. Pettersen | 6/30/26, 6:39 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
So what do you do if you work in an organisation where you don't want to administer the Notes client, but still need to give people access to Notes applications? You start using Nomad! Here is how I did it.
Migrating Connections Ingress to Traefik – beware of these outdated Helm values
By Martijn de Jong | 6/30/26, 6:38 AM | Infrastructure - Connections | Added by Roberto Boccadoro
As the Ingress Nginx controller is has officially been retired in March 2026, HCL has moved the Ingress controller for the HCL Connections Component Pack to Traefik. The documentation lists a tarball with a script and yaml-file for the migration and deployment of Traefik.
The documentation lets you install the latest version of Traefik. At the time of writing the latest stable Traefik branche is 3.7. This branch has different helm values from the version that HCL apparently used when creating the tarball. A couple of helm values in the provided cnx-ingress-traefik-values.yml are no longer valid. These are the culprits:
Developing Jakarta Apps Via NSF File Server, Take 2
By Jesse Gallagher | 6/23/26, 11:01 AM | Development - Notes / Domino | Added by Roberto Boccadoro
Just about a year ago today, I posted about some tinkering I was doing with the then-new support in the NSF File Server for live modifying the files in the virtual "WebContent" folder of an NSF.
With that post, I was going the route of developing a project with Maven and then SCP'ing up the build results. That worked for an initial push, but had some big caveats. For one, it took deploying the entire app with every change. The other, bigger problem was that it wouldn't delete files that were no longer part of the app, so old pages and classes would float around until you went in and deleted them.
New Release: XPages Jakarta EE 3.7.0
By Jesse Gallagher | 6/21/26, 12:02 PM | Development - Notes / Domino | Added by Roberto Boccadoro
Yesterday, I released version 3.7.0 of the XPages JEE project, which is another incremental release that improves a number of things for the apps I've been making with it, as well as just generally bumping implementation versions to keep up to date.
Unhealthy "health probes"
By Cormac McCarthy | 6/21/26, 12:01 PM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Recently enough I was troubleshooting a web performance issue for a customer (spoiler – there were multiple bottlenecks outside of Domino).
One thing I thought I’d highlight, when turning on some debug parameters, Domino began throwing “SSL handshake errors”.
Many of them. As in all the time.
Migrating using an empty Sametime ST_COMMUNITY_ID
By Remco Angioni | 6/9/26, 11:23 AM | Infrastructure - Sametime | Added by Roberto Boccadoro
Why is this so important to mention and create a blog about it?The ST_COMMUNITY_ID parameter, in sametime.ini, is used for connecting your Contactlist to one or more Sametime Community servers.
https://www.angioni.nl/wp-content/plugins/w3-total-cache/pub/js/lazyload.min.js width=device-width, initial-scale=1 http://gmpg.org/xfn/11 Migrating using an empty Sametime ST_COMMUNITY_ID | Angioni's Blog Why is this so important to mention and create a blog about it?The ST_COMMUNITY_ID parameter, in sametime.ini, is used for connecting your Contactlist to one or more Sametime Community servers. Until Sametime V9 you could create a Sametime cluster and connect several servers to each other. The procedure tells me to set the ST_COMMUNITY_ID parameter max-image-preview:large angioni zPaeQYhhiPjaQcXtkn9BhbN8zYadx57jY-yzpZrdRbk community,cont
Creating an SBOM for a Domino application and performing a security check on it
By Patrick Kwinten | 6/8/26, 2:57 AM | Development - Notes / Domino | Added by Patrick Kwintensson
In a previous post i wrote about how to use the OWASP Vulnerability Check to scan your Domino application (rather it's ODP than the NSF) for vulnerabilities and generate a report for it. As you would expect there are more solutions for it, and HCL has it's own AI powered offering for this.
Owasp vulnerability check on a Domino application
By Patrick Kwinten | 6/4/26, 6:56 AM | Development - Notes / Domino | Added by Patrick Kwintensson
I was watching the video OWASP Top 10: The Big Picture on Pluralsight in which the OWASP Vulnerability Check (OVC) was mentioned and recommended so I wondered if this would be of interest for my applications? Whether you are just getting started, a seasoned developer, or someone who is curious about secure development the OWASP…
Building your own (Domino) containers? Don’t forget to prune Docker
By Martijn de Jong | 5/29/26, 7:13 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
If you regularly build or pull images on a Docker host, disk usage can creep up quickly.
Most people know that Docker (and Podman) keeps old images around unless you prune them. What’s less obvious is the build cache. When you build images, like the Domino container, Docker stores intermediate layers, so future builds can be faster.
Even if you build with --no-cache (as the Domino build script does), Docker still writes layers to the build cache. They’re just not reused. Over time, that cache can grow significantly.
In my case, it explained why my root disk was filling up: 25+ GB of build cache.
Make Tika on Domino v12 Save Again – Kwintessential Notes
By Patrick Kwinten | 5/26/26, 10:29 AM | Development - Notes / Domino | Added by Patrick Kwintensson
If you are still on a HCL Domino v12 server you are probably aware that you wont be able to run the latest and greatest Tika version. So what options do you have? Upgrade to the last v2 version? That would be v2.9.4 but then you still cope with some vulnerabilities in Tika core.
Replacing CKEditor with Quill – Kwintessential Notes
By Patrick Kwinten | 5/26/26, 10:27 AM | Development - Notes / Domino | Added by Patrick Kwintensson
In some gray applications (traditional Domino applications who haven't become updated lately) we have CKEditor 4 as rich-text editor embedded. CKEditor 4 reached its End-of-Life in June 2023 so time for an upgrade :-) If you can't run the open source license and need to avoid any priced license you need to search for alternatives.…
When a “Successful” Install… isn’t: A Domino on Linux Gotcha
By Martijn de Jong | 4/27/26, 3:40 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
While preparing for my Linux Installfest session for Engage, I figured I’d better walk through the Domino installation steps myself, just to make sure everything worked as expected.
That might sound routine, but here’s the catch: I almost never install Domino manually anymore. I usually rely on a script Daniel built, which saves a ton of time and effort. But for this session, the goal was to help participants understand what’s actually happening behind the scenes. So, back to basics it was, command line and all.
That’s when things got interesting.
HCL Connections 8 PDF Export and WebSphere Application Server FP28
By Rainer Brandl | 4/15/26, 6:37 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Yesterday I installed WAS 8.5.5 FP28 on a customer environment with 2 interim fixes ( IFPH68976 and IFPH69757 ) because of some security issues.Today I received the information that the PDF export for Wikis is no longer working.Looking in the SystemOut.log I could see a lot of the following errors:java.security.cert.CertificateException: No subject alternative DNS matching hostname found.
Standards are Standards until they are not
By Stephan Wissel | 4/13/26, 8:10 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
Standards are Standards until they are not - In my junior developer days, literally last century, a senior developer enlightened me: 'An open standard is only complete once its wording allows all participants to faithfully implement it to be absolutely incompatible to each other'.
Ambiguity is king. Our modern software is build on a few standard, each of them have rock solid parts (nobody questions a <h1>) and parts of, let's call them disagreements. I'll pick on JWT as an example
Old School Domino Web Dev - a very simple way to upload multiple files, ...just one word
By Jesper Kiær | 4/13/26, 8:07 AM | Development - Notes / Domino | Added by Roberto Boccadoro
I am working in an old Domino web application and to my surprise it is now very easy to upload several files in one go.
I remember it used to be such a hassle, but now with evolved HTML and modern browsers, it is so easy...and of course Domino supporting it.
Shortened Validity Periods for SSL/TLS Certificates
By Manfred Dillmann | 3/22/26, 7:58 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro
I would like to inform you about an important change that affects all web server operators and possibly your HCL Domino Servers: The maximum validity periods of SSL/TLS certificates will be drastically shortened in stages.
Quick Tip: how to fix "No component found with ID ... to handle the submit event."
By Oliver Busse | 3/19/26, 3:25 AM | Development - Notes / Domino | Added by Roberto Boccadoro
Lately I stumbled upon a problem with the file download control and the delete button to remove attachments.