Connections
Upgrading containerd from 1.7 to 2.x? Read this first! 
By Martijn de Jong | 7/9/26, 3:07 PM | Infrastructure - Connections | Added by Roberto Boccadoro
Since Kubernetes 1.20 deprecated Dockershim (and removed it entirely in Kubernetes 1.24), containerd has become the de facto container runtime for Kubernetes environments. HCL Connections Component Pack runs on Kubernetes, making containerd a critical dependency for Connections deployments.
Although HCL generally follows the Kubernetes release lifecycle in its Component Pack (CR) releases, containerd 1.7 remained the highest supported version for a long time. This changed with HCL Connections 8 CR14, which introduced support for Kubernetes 1.35 and, consequently, containerd 2.2.x. At the same time, support for containerd 1.7.x was dropped for Kubernetes 1.35 deployments.
PDF conversion failed after installation HCL Connections 8 CR14
By Rainer Brandl | 7/9/26, 3:06 PM | Infrastructure - Connections | Added by Roberto Boccadoro
After installing CR14 I received the information that the conversion of Wikis, Forum entries or Blogs is no longer working.During a remote session with HCL Support ( thx a lot to Ale !! ) we could find the cause and we also could solve it.It seems that the installation changed some setting in the custom properties for IC360 – it was set to “wasadmin” what caused the PDF conversion to stop working.
Migrating Connections Ingress to Traefik – beware of these outdated Helm values
By Martijn de Jong | 6/30/26, 6:38 AM | Infrastructure - Connections | Added by Roberto Boccadoro
As the Ingress Nginx controller is has officially been retired in March 2026, HCL has moved the Ingress controller for the HCL Connections Component Pack to Traefik. The documentation lists a tarball with a script and yaml-file for the migration and deployment of Traefik.
The documentation lets you install the latest version of Traefik. At the time of writing the latest stable Traefik branche is 3.7. This branch has different helm values from the version that HCL apparently used when creating the tarball. A couple of helm values in the provided cnx-ingress-traefik-values.yml are no longer valid. These are the culprits:
HCL Connections 8 PDF Export and WebSphere Application Server FP28
By Rainer Brandl | 4/15/26, 6:37 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Yesterday I installed WAS 8.5.5 FP28 on a customer environment with 2 interim fixes ( IFPH68976 and IFPH69757 ) because of some security issues.Today I received the information that the PDF export for Wikis is no longer working.Looking in the SystemOut.log I could see a lot of the following errors:java.security.cert.CertificateException: No subject alternative DNS matching hostname found.
Standards are Standards until they are not
By Stephan Wissel | 4/13/26, 8:10 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Standards are Standards until they are not - In my junior developer days, literally last century, a senior developer enlightened me: 'An open standard is only complete once its wording allows all participants to faithfully implement it to be absolutely incompatible to each other'.
Ambiguity is king. Our modern software is build on a few standard, each of them have rock solid parts (nobody questions a <h1>) and parts of, let's call them disagreements. I'll pick on JWT as an example
Fun time with kubernetes and dns | Urs Meli's Blog
By Urs Meli | 3/17/26, 7:20 AM | Infrastructure - Connections | Added by Wannes Rams
We had installed the component pack for HCL Connections 8 in a brand new kubernetes environment. All the containers started and looked fine. Once we routed the traffic through the mw-proxy, Connections stopped working.
Check db2 HADR status with multiple instances
By Wannes Rams | 3/9/26, 5:41 AM | Infrastructure - Connections | Added by Wannes Rams
Check db2 HADR status with multiple instances
Those of you that have to deal with multiple db2 instances on 1 machine know that it is annoying to get a quick overview of the HADR status in 1 go. You need to switch accounts, run the commands, etc...
I created a script you can run as root that will give you an overview, I added some color coding for convenience as well
HCL Sametime Chat on Windows - Metrics Deployment
By Milan Matejic | 12/27/25, 7:31 AM | Infrastructure - Connections | Added by Roberto Boccadoro
A step-by-step guide on enabling Metrics for HCL Sametime Chat on Windows.
It’s always good to monitor the usage of any service you deploy. HCL Sametime offers a predefined Grafana Dashboard which helps you gain valuable insights, such as the number of logins and chats at any given time. To enable metrics on HCL Sametime Chat for Windows, there are a few mandatory steps to complete, which I will outline below.
Redirects in HCL Connections: Using HCEC, Customizer, and JavaScript
By Milan Matejic | 11/7/25, 6:55 AM | Infrastructure - Connections | Added by Roberto Boccadoro
We have recently faced the following challenge, our goal was simple:
Users in a specific LDAP organization should see a specific HCEC homepage.
All other users should be redirected to the global “My Communities” page.
Removing security-auditlog indexes from your OpenSearch cluster
By Martijn de Jong | 7/18/25, 1:21 AM | Infrastructure - Connections | Added by Roberto Boccadoro
After my previous article on Querying the OpenSearch index, a colleague and I used the script to take a good look at the OpenSearch index in our environment. That environment, is a large Connections installation (45K users) in the Netherlands. We found two disturbing facts:
The cluster status was yellow, due to the QuickResults index not having a replica of all its shards
There was a huge amount of secruity-auditlog indexes, one per day. There were as many as the days passed since our migration to Connections 8
It turns out these two issues were closely related.
Querying your OpenSearch index
By Martijn de Jong | 7/2/25, 4:30 PM | Infrastructure - Connections | Added by Roberto Boccadoro
n the old days of Connections, we would check our ElasticSearch indexes through Kibana, but Kibana is no longer part of an HCL Connections Component pack installation. In HCL Connections 8, OpenSearch is a core component powering features like Orient Me, Type-Ahead Search, and Metrics. As an administrator, it’s critical not just to ensure that OpenSearch is running, but to verify that it’s indexing, storing, and serving content correctly.
WebSphere 8.5.5 FP27 & HCL Connections… beware!
By Martijn de Jong | 5/5/25, 3:49 AM | Infrastructure - Connections | Added by Roberto Boccadoro
HCL Connections 8.0 CR9 currently lists in its system requirements WebSphere 8.5.5 FP26 as its highest supported WebSphere version. However, I suspect that CR10 will try to support FixPack 27, which became available on April 21st. Brave companies might just update their servers with the latest fixpack, and usually that works just fine. This fixpack, however, has introduced changes in outbound TLS certificate hostname validation. What it does is if WebSphere will make a connection to https://example.acme.org, it will check if the certificate that example.acme.org returns contains my server.acme.org in either the hostname or as a subject alternative name (SAN). If it doesn’t, you’ll be greeted with a message:
Troubleshooting IBM WebSphere LDAP Security
By Christoph Stoettner | 4/14/25, 4:54 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Most of the LDAP connections from IBM WebSphere Application Server are configured with TLS. So you need to have the root certificate in the WebSphere truststore to connect.
In the past I had several issues where MS Active Directory certificates for LDAPS are only valid for one year. They were automatically recreated on the AD side, and the certificate is not using the domain root certificate but a self-signed one.
Migrate MongoDB 5 to 7 for HCL Connections 8 CR9 update
By Christoph Stoettner | 4/14/25, 4:53 AM | Infrastructure - Connections | Added by Roberto Boccadoro
For HCL Connections 8 CR9, it is mandatory to update MongoDB to version 7. During my first migrations, I encountered some issues and would like to provide workarounds and additional troubleshooting tips to help others with this process.
Better Navigation in Connections Scripts
By Christoph Stoettner | 4/14/25, 4:47 AM | Infrastructure - Connections | Added by Roberto Boccadoro
I haven’t touched the Connections scripts
for a long time, but I recently made some minor updates to fix compatibility issues with newer versions and added small scripts to speed up configuration. I also got the documentation script running from the menu.
HCL Connections – Docs (Proxy) not Working After Installing IFPH63778 IBM WebSphere Application Server Fix
By Milan Matejic | 2/7/25, 2:23 AM | Infrastructure - Connections | Added by Roberto Boccadoro
If you're like me and want to keep your IBM WebSphere Application Servers up to date with the latest patches, you might want to skip the installation of IFPH63778 for 8.5.5.26 version of WebSphere, or at least exercise caution before doing so.
After installing IFPH63778 on my WebSphere servers hosting HCL Connections Docs applications, Docs Proxy application was unable to communicate with the required application servers, effectively breaking my HCL Connections Docs deployment.
HCL Connections – Component Pack Update – MongoDB Security Settings Update Issue
By Milan Matejic | 2/6/25, 3:19 AM | Infrastructure - Connections | Added by Roberto Boccadoro
During the HCL Connections Component Pack 8.0 CR8 update, some security settings are modified for the MongoDB replica set used by the HCL Connections Component Pack. This is managed by the check-and-update-mongo5-security Kubernetes (K8s) job, which creates the check-and-update-mongo5-security-* pod to change the security settings of the replica set. Once the job completes successfully, the K8s pod and the corresponding job are marked with the status complete(d)
However, in one of the HCL Connections environments I am working on, the job didn’t complete successfully. During my initial analysis, I found the following error in the log of the check-and-update-mongo5-security pod....
Indefinitely growing homepage.sr_index_docs table and forgotten search nodes
By Christoph Stoettner | 1/24/25, 3:17 AM | Infrastructure - Connections | Added by Roberto Boccadoro
The last weeks I had twice the issue of a huge homepage database with HCL Connections. Both systems weren’t installed by me, but I reviewed them.
So I know this issues quite well since I faced it the first time years ago. This always happens when you migrate Connections environments side-by-side, and you forget to remove the old search nodes.
sr_index_docs is used to make all search nodes indexing newly upload files. When each search node has indexed the file, the entry gets removed from the database. As the old nodes are no longer running, they can’t index, and so these entries never get deleted.
In larger environments the table grows to millions of documents and the database size grows from some GB into the hundreds of GB. You see this growth mainly during database backup, or when you want to move the data to a new machine. So often nobody recognizes the huge waste of space.
Creating an IBM HTTP Server key db from a .pfx file
By Martijn de Jong | 1/7/25, 2:41 AM | Infrastructure - Connections | Added by Roberto Boccadoro
It’s a question that I get quite often. “Can you create a IHS key database for me from this pfx certificate”? Multiple of our customers use IBM HTTP Server. Either for HCL Connections, but also as a reverse proxy for other services. Most of those customers use a wildcard certificate for their IHS server that has to be renewed each year. As I hate this kind of repetitive work, I created a script to do it for me. As it could be of use to others, I decided to create a blog article about it.
Disable PDF Export in HCL Connections 8
By Christoph Stoettner | 12/3/24, 7:47 AM | Infrastructure - Connections | Added by Roberto Boccadoro
PDF Export sometimes uses a lot of resources and disabling helps to stabilize the environment
I had some issues with PDF export functionality in HCL Connections the last weeks.
The server became unresponsive multiple times due to high load from PDF exports. To quickly address the issue, the simplest solution is to disable the PDF export feature by configuring the icxt.pdfexport.access.requiredrole property in the Resource Environment Entries.
Changing the file size limit for a community
By Martijn de Jong | 11/30/24, 3:27 AM | Infrastructure - Connections | Added by Roberto Boccadoro
By default, a HCL Connections community can contain 500 MB of files in the Files widget. Depending on what kind of content is posted in the community, that might not be enough. It’s possible to change the file limit, both for communities and for personal files.
Apple push notification certificates expire on 4th of July 2024
By Christoph Stoettner | 6/24/24, 8:23 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Push notifications certificates in HCL Connections 8 CR5 and CR6 need an update before 4th of July
Last week I checked some HCL Connections 8 CRx downloads in Flexnet and recognized these packages available since 2024-06-13: APNS (Apple Push Notification Service) certificates renewal for 2025.
Sounds normal, these updates need to be installed each year. First, I checked for the knowledge base document mentioned in the file name . It’s not published until now.
So I downloaded the package and extracted the content. The included certificates are valid from 2024-04-25 to 2025-05-25, so they start and end in the middle of the year.
Installing Huddo Boards on WebSphere-only Connections
By Martijn de Jong | 6/24/24, 8:21 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Let me clarify what this article is about. Huddo (also known as ISW) is selling 2 versions of their Boards product:
Kudos Boards – The Java application that can be installed on WebSphere. Active development has stopped a few years ago
Huddo Boards – The product consisting of several containers, which can be installed on Kubernetes or a container engine like Docker. A version with limited functionality is part of the HCL Connections component pack and known as Activities Plus. This product is actively being developed and also available for other platforms.
Although the Connections Component pack was introduced in version 6 already, many companies refrained from installing it due to the serious amount of extra infrastructure needed to run these components, which includes a Kubernetes cluster. We call these the WebSphere-only Connections installations, as they only include the WebSphere stack part of Connections.
So what if you would like to use the full power of Huddo Boards without having to install a Kubernetes cluster? That’s what this article is about.
Be careful with search-admin role in HCL Connections
By Christoph Stoettner | 5/3/24, 5:37 AM | Infrastructure - Connections | Added by Roberto Boccadoro
I showed, in several slides and sessions, how you can use the search-admin role in the search application of HCL Connections for troubleshooting and reviewing some key configurations.
In several environments, my user or other administrative users have this role, just to access the link to /search/serverStatus for example.
Be aware, when you assign the search-admin role in the search application to a user, the advanced search will not return any result.
Installing wireguard on CentOS Stream 9
By Martijn de Jong | 1/15/24, 3:37 AM | Infrastructure - Connections | Added by Roberto Boccadoro
As I do a lot of my research on new Domino versions, Connections versions and HCL DX on my own server at home and as I’m often not at home, I figured I needed a VPN tunnel to my server, so I can work as if I am home. Wireguard has become kind of the de facto standard for these kind of situations, so I looked into installing it on my CentOS Stream 9 host.
Troubleshooting Top Updates in HCL Connections
By Christoph Stoettner | 12/5/23, 2:25 AM | Infrastructure - Connections | Added by Roberto Boccadoro
Orient Me shows Top Updates on the startpage of Connections, but sometimes this view is empty, how is this generated?
Last week, I had three systems with issues displaying the Top Updates in the Orient Me. So I tried to find out which applications and containers are involved in generating the content for this view.
First, we need to know that Top Updates are part of the Component Pack, and the content of Latest Updates is the Activity stream data, which is read from the homepage database.
If the Top Updates tab is not visible after deploying the Component Pack, check LotusConnections-config.xml; the serviceReference for orientme needs to be enabled. There is only one serviceReference allowed for an application in this file, so check for duplicate definitions when the tab is still missing.
Hide widget from Highlights
By Christoph Stoettner | 11/30/23, 2:53 AM | Infrastructure - Connections | Added by Roberto Boccadoro
With HCL Connections 6.5 and later, we got the add-on HCL Connections Engagement Center (aka CEC, HCEC, ICEC or XCC) included in a normal HCL Connections deployment.
The HCL Connections license contains the supplement that HCEC can be used within Communities and is the base for the Highlights application. All other options are hidden and could be enabled in LotusConnections-config.xml (set <genericProperty name="icec.light">false</genericProperty>), but then you need to order the HCL Connections Engagement Center license.
Couple of things to watch out for when applying CR’s to HCL Connections
By Wannes Rams | 11/7/23, 10:14 AM | Infrastructure - Connections | Added by Wannes Rams
I was updating a couple of Connections environments to CR4 and some of them are using SSO using OIDC and a custom database name for ICEC ( so not ESSAPPS)
Security Directory Integrator connecting to Active Directory LDAPS
By Unknown Author | 11/3/23, 2:28 AM | Infrastructure - Connections | Added by Roberto Boccadoro
I had one Connections’ environment that I wanted to switch from OpenLDAP to Active Directory LDAP. The old OpenLDAP environment used LDAPS to connect, and so I assumed that the change was done quickly.
Migrate MongoDB in HCL Connections Component Pack 8
By Christoph Stoettner | 9/22/23, 3:31 AM | Infrastructure - Connections | Added by Roberto Boccadoro
The official documentation, “Migrating data from MongoDB 3 to 5”,
wants to dump the MongoDB databases in 3.6 and then restore this data into the newly deployed MongoDB 5.
One issue with this process is that we can’t run the two MongoDB versions in parallel on Kubernetes because the provided helm charts and container for MongoDB 3.6 stop running after Kubernetes 1.21. On the other side, the helm chart providing MongoDB 5 can’t be installed on those old Kubernetes versions. So the process to update is:
Migration process
Dump databases in MongoDB 3.6 (version delivered with Connections 7)
Update Kubernetes to 1.25 or 1.27
Restore MongoDB databases to version 5.0
So, you have to plan the process in advance because it is difficult to get the data when you forget something.
width=device-width,initial-scale=1,user-scalable=no Migrate MongoDB in HCL Connections Component Pack 8 · stoeps 49.642538;8.638950 DE Heppenheim, Germany 49.642538, 8.638950 Heppenheim The official documentation, “Migrating data from MongoDB 3 to 5”, wants to dump the MongoDB databases in 3.6 and then restore this data in