To migrate NetBackup CA after installation or upgrade

1. Run the following command to initiate the CA migration process:

   nbseccmd -nbcaMigrate -initiateMigration -keysize key_value

   A new NetBackup CA is deployed with this command.

   For information about commands, see the NetBackup Commands Reference Guide.

2. Run the following command to reissue certificates to the host.

   nbcertcmd -reissueCertificates

3. Stop the NetBackup Web Management Console (nbwmc) service before reissuing the certificate to the NetBackup web server.
4. Run the following command to reissue the certificate to the NetBackup web server:

   configureCerts -renew_webserver_keys

5. Start the nbwmc service.
6. Run the following command to ensure that all hosts have the new CA certificates in their trust stores.

   nbseccmd -nbcaMigrate -hostsPendingTrustPropagation

7. Ensure that the command returns zero (0) hosts as the output.

8. Warning:

   If one or more NetBackup hosts are at 8.2 or earlier versions, backups of such hosts fail after activation. Therefore, you must ensure that all NetBackup hosts in the domain are upgraded to 8.3 before activating the new CA.

   Run the following command to activate the new CA that can start issuing NetBackup certificates going forward:

   nbseccmd -nbcaMigrate -activateNewCA

9. Run the following command to renew host certificates using the new CA.

   nbcertcmd -renewCertificate

10. Run the following command to ensure that all hosts have certificates that the new CA has renewed:

    nbseccmd -nbcaMigrate -hostsPendingRenewal

    Ensure that the command returns zero (0) hosts as the output.

11. Restart the NetBackup Messaging Broker (nbmqbroker) service on this host.
12. Run the following command to complete the CA migration process:

    nbseccmd -nbcaMigrate -completeMigration

13. After completing the NetBackup CA migration process and ensuring that the hosts use certificates that the new CA has issued, you can safely decommission the old NetBackup CA.

    This clean-up task is optional.

    See Decommissioning the inactive NetBackup CA .