To configure secure communication between AHV cluster and AHV access host:

1. Use the openssl s_client -connect <Nutanix Cluster FQDN>:9440 -showcerts < /dev/null command from a Linux system to obtain the Nutanix certificates.
2. Scroll to the end of the results and copy the last certificate which starts from:

   -----BEGIN CERTIFICATE----- 
   <Certificate> 
   -----END CERTIFICATE----- 
   

   Note:

   Ensure to copy the five dashes before and after the BEGIN and END CERTIFICATE.

3. Paste the information to a text file and then rename it as <certificate file name>.pem and copy it to a path to your backup host. Recommended path is:

   • For Linux: /usr/openv/netbackup.

   • For Windows: <Install drive>\Program Files\Veritas\Netbackup.

4. • For Linux: Enter the PEM file path ECA_TRUST_STORE_PATH=/usr/openv/netbackup/<certificate file name>.pem in the bp.conf on the backup host.

   • For Windows: Run the command <Install drive>\Program Files\Veritas\Netbackup\bin\nbsetconfig.

5. Use the nbsetconfig command to configure the following NetBackup configuration options on the access host:

   For more information on the configuration options, refer to the NetBackup Administrator's Guide, Volume I.

   ECA_TRUST_STORE_PATH	Specifies the file path to the certificate file that contains all trusted root CA certificates. This option is specific to file-based certificates. You should not configure this option if Windows certificate store is used. If you have already configured this external CA option, append the Nutanix AHV CA certificates to the existing external certificate trust store. If you have not configured the option, add all the required Nutanix AHV server CA certificates to the trust store and set the option.
   ECA_CRL_PATH	Specifies the path to the directory where the certificate revocation lists (CRL) of the external CA are located. If you have already configured this external CA option, append the AHV CRLs to the CRL cache. If you have not configured the option, first add all the required CRLs to the CRL cache. Then set the option.
   VIRTUALIZATION_HOSTS_SECURE_CONNECT_ENABLED	This option affects AHV, RHV, and VMware secure communication. Without this option, each workload and plug-in separately determine the secure or the insecure communication. For more information, refer to the respective workload administrator's guide. Disabling this option lets you skip the security certificate validation. It is recommended by NetBackup that secure communication should be enabled using the ECA_TRUST_STORE_PATH option.
   VIRTUALIZATION_CRL_CHECK	Lets you validate the revocation status of the virtualization server certificate against the CRLs. By default, the option is enabled.

   For more information on external CA support, refer to the NetBackup Security and Encryption Guide.