Importing certificates from the deduplication shell
Use the following procedures to import NetBackup or external certificates from the deduplication shell.
To import a NetBackup certificate
- Open an SSH session to the server as the msdpadm user, or for NetBackup Flex Scale, as an appliance administrator.
- Run one of the following commands:
To request the NetBackup CA certificate from the primary server:
setting certificate get-CA-certificate
By default, the command uses the first primary server entry in the NetBackup configuration file. You can specify an alternate primary server with the primary_server parameter. For example:
setting certificate get-CA-certificate primary_server=<alternate primary server hostname>
To request a host certificate from the primary server:
setting certificate get-certificate [force=true]
Where [force=true] is an optional parameter that overwrites the existing certificate if it already exists.
By default, the command uses the first primary server entry in the NetBackup configuration file. You can specify an alternate primary server with the primary_server parameter. For example:
setting certificate get-certificate primary_server=<alternate primary server hostname>
Depending on the primary server security level, the host may require an authorization or a reissue token. If the command prompts that a token is required for the request, enter the command again with the token for the host ID-based certificate. For example:
setting certificate get-certificate primary_server=<alternate primary server hostname> token=<certificate token> force=true
To import external certificates
- Open an SSH session to the server as the msdpadm user, or for NetBackup Flex Scale, as an appliance administrator.
- Run one of the following commands:
To download and install both the external CA certificate and the host certificate:
setting certificate install-external-certificates cacert=<trust store> cert=<host certificate> private_key=<key> [passphrase=<passphrase>] scp_host=<host> scp_port=<port>
Where:
<trust store> is the trust store in PEM format.
<host certificate> is the X.509 certificate of the host in PEM format.
<key> is the RSA private key in PEM format.
[passphrase=<passphrase>] is an optional parameter for the passphrase of the private key. This parameter is required if the key is encrypted.
<host> is the hostname of the host that stores the external certificates.
<port> is the port to connect to on the remote host.
To download and install the external CA certificate:
setting certificate get-external-CA-certificate cacert=<trust store> scp_host=<host> scp_port=<port>
Where:
<trust store> is the trust store in PEM format.
<host> is the hostname of the host that stores the external certificates.
<port> is the port to connect to on the remote host.
To download and install the external host certificate:
setting certificate get-external-certificates cert=<host certificate> private_key=<key> [passphrase=<passphrase>] scp_host=<host> scp_port=<port>
Where:
<host certificate> is the X.509 certificate of the host in PEM format.
<key> is the RSA private key in PEM format.
[passphrase=<passphrase>] is an optional parameter for the passphrase of the private key. This parameter is required if the key is encrypted.
<host> is the hostname of the host that stores the external certificates.
<port> is the port to connect to on the remote host.
Note:
If an external host certificate already exists on the server, it is overwritten.
- (Optional) Run the following command to specify the revocation check level for the external certificates:
setting certificate set-CRL-check-level check_level=<DISABLE, LEAF, or CHAIN>
The check levels are as follows:
DISABLE: The revocation check is disabled. The revocation status of the certificate is not validated against the CRL during host communication.
LEAF: The revocation status of the leaf certificate is validated against the CRL. LEAF is the default value.
CHAIN: The revocation status of all certificates from the certificate chain is validated against the CRL.