To disable an external CA

1. Ensure that each host in the domain is configured to use NetBackup host ID-based certificates.
2. Remove all the external certificate configuration options from the configuration file (bp.conf on UNIX or Windows registry), which exists on the host.

   For example, ECA_CERT_PATH.

   See Configuration options for external CA-signed certificates for a virtual name.

3. Remove the external CA support from the primary server.

   • Remove all the external certificate configuration options from the configuration file (bp.conf on UNIX or Windows registry), which exists on the primary server.

     For example, ECA_CERT_PATH.

     See Configuration options for external CA-signed certificates for a virtual name.

4. Delete all external certificate entries from the NetBackup database.

   Run the following command:

   nbcertcmd -deleteECACertEntry -subject subject name of the certificate

5. Remove the external CA support from the web server.

   configureWebServerCerts -removeExternalCert

   For more information about the commands, refer to the NetBackup Commands Reference Guide.

6. Remove the certificate enrollment using the following command:

   nbcertcmd -removeEnrollment