Deploying host ID-based certificates
Depending on the certificate deployment security level, a non-primary host may require an authorization token before it can obtain a host ID-based certificate from the Certificate Authority (primary server). When certificates are not deployed automatically, they must be deployed manually by the administrator on a NetBackup host using the nbcertcmd command.
The following topic describes the deployment levels and whether the level requires an authorization token.
Use the following procedure when the security level is such that a host administrator can deploy a certificate on a non-primary host without requiring an authorization token.
To generate and deploy a host ID-based certificate when no token is needed
- The host administrator runs the following command on the non-primary host to establish that the primary server can be trusted:
nbcertcmd -getCACertificate
- Run the following command on the non-primary host:
nbcertcmd -getCertificate
Note:
To communicate with multiple NetBackup domains, the administrator of the host must request a certificate from each primary server using the -server option.
Run the following command to get a certificate from a specific primary server:
nbcertcmd -getCertificate -server primary_server_name
- To verify that the certificate is deployed on the host, run the following command:
nbcertcmd -listCertDetails
Use the following procedure when the security level is such that a host requires an authorization token before it can deploy a host ID-based certificate from the CA.
To generate and deploy a host ID-based certificate when a token is required
- The host administrator must have obtained the authorization token value from the CA before proceeding. The token may be conveyed to the administrator by email, by file, or verbally, depending on the various security guidelines of the environment.
- Run the following command on the non-primary host to establish that the primary server can be trusted:
nbcertcmd -getCACertificate
- Run the following command on the non-primary host and enter the token when prompted:
nbcertcmd -getCertificate -token
Note:
To communicate with multiple NetBackup domains, the administrator of the host must request a certificate from each primary server using the -server option.
If the administrator obtained the token in a file, enter the following:
nbcertcmd -getCertificate -file authorization_token_file
- To verify that the certificate is deployed on the host, run the following command:
nbcertcmd -listCertDetails
Use the -cluster option to display cluster certificates.