Using an external certificate
By default, the appliance uses a Flex Appliance self-signed certificate for host communication. You can configure the appliance to use an external certificate instead.
To use an external certificate, you must have the following:
Host certificate: An X.509 certificate for the appliance, in PEM format. This certificate is different from the certificate for your NetBackup primary and media servers.
Private key: The PKCS #8 private key of the host certificate.
Passphrase: The passphrase of the private key if the key is encrypted.
To prevent errors while importing certificates, ensure that the external certificate files meet the following requirements.
All certificate files must have a suffix of .pem or .cer and include -----BEGIN CERTIFICATE----- at the beginning of the certificate.
All certificate files must contain the Flex Appliance Console FQDN in the common name or the subject alternative name (SAN) field of the certificate.
The subject name and common name fields must not be left empty.
Only ASCII 7 characters can be used in the subject and SAN fields of the certificate.
The private key must be in the PKCS #8 PEM format, and it must begin with a header line of -----BEGIN ENCRYPTED PRIVATE KEY-----, -----BEGIN PRIVATE KEY-----, or -----BEGIN RSA PRIVATE KEY-----.
Flex Appliance's web service uses the PKCS #12 standard and requires certificate files to be in the X.509 (.pem) format. If you obtained the certificate and private key in any other format you must first convert them to the X.509 (.pem) format.
To import an external certificate
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click External certificate.
- Upload the required files and click Next.
- Confirm the details and click Import.
Use the following procedure to remove an external certificate that you imported. Note that if you remove an external certificate, the appliance reverts to use the default Flex Appliance self-signed certificate for host communication.
To remove an external certificate
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click External certificate.
- Click Remove.