Configure a third-party CA certificate
You can use a self-signed or a third-party certificate to validate your CloudPoint server.
Consider the following points:
For Windows, you can give a certificate as a file path or install the third party certificate in the Trusted Root Certificates authorities.
To switch from a self-signed certificate to a third-party certificate for an already added CloudPoint server, you can update the tpconfig command or edit the CloudPoint server API or from NetBackup WebUI.
To configure a third-party CA certificate
- Generate the third party certificate and private key for your CloudPoint server.
- Run the /cloudpoint/scripts/cp_certificate_management.sh script to upload the certificate, key and trust store to the CloudPoint server.
- In NetBackup, create a certificate file and append the certificate of root and all intermediate CAs in the pem file.
- In the
bp.conffile, at/cloudpoint/openv/netbackup/, create the following entries:ECA_TRUST_STORE_PATH = /cloudpoint/eca/trusted/cacerts.pem
(Optional) VIRTUALIZATION_CRL_CHECK = CHAIN
(Optional) ECA_CRL_PATH =/cloudpoint/eca/crl/
Note:
The CA certificates and CRLs should be present under
/cloudpoint/eca/trusted/cacerts.pemfor trust-store, and/cloudpoint/eca/crlfor CRL.The ECA_CRL_PATH option specifies the path to the directory where the Certificate Revocation Lists (CRL) of the external certificate authority (CA) are located. All files in ECA_CRL_PATH must be in DER, PEM, and P7B formats.
VIRTUALIZATION_CRL_CHECK option is only required if you want to check the revocation status of the certificate. By default, the VIRTUALIZATION_CRL_CHECK option is disabled.
You can disable, LEAF, or CHAIN the value of the VIRTUALIZATION_CRL_CHECK option. For LEAF, revocation status of the leaf certificate is validated against the CRL. For CHAIN, revocation status of all certificates from the certificate chain are validated against the CRL.
Note:
Following should be the order in which the certificates are uploaded: Leaf > Intermediate > Root. If the certificates are not uploaded in the correct order, CloudPoint might not work.
- Add the CloudPoint server to NetBackup or run the tpconfig command to update the certificate for a CloudPoint server already added to NetBackup.