The NetBackup cacert.pem file is present on both NetBackup primary and media server in following locations:

On media server versions 7.7.x to 8.1.2, if the NetBackup cacert.pem file is not present, run the nbcertcmd -getCACertificate on the primary server. After running this command, restart the NetBackup CloudStore Service Container.

See the NetBackup Commands Reference Guide for a complete description of the command.

The NetBackup cacert.pem file is same on the NetBackup primary and media server.

For media server versions 7.7.x to 8.1.2, the machine certificate is present in following locations:

If the security certificate is not present, run the bpnbaz -ProvisionCert on the primary server. After running this command, restart the NetBackup CloudStore Service Container on the primary and media server.

See Deploying host name-based certificates.

For media server versions 7.7.x to 8.1.2, the NetBackup CloudStore Service Container is active.

See Stopping and starting the NetBackup CloudStore Service Container.

The Enable insecure communication with 8.0 and earlier hosts option on the NetBackup primary server is selected if the media server is of the version 8.0 or earlier. The option is available in the NetBackupweb UI in the Settings > Global security > Secure communication.

On the media server, if the certificate deployment security level if set to Very High, automatic certificate deployment is disabled. An authorization token must accompany every new certificate request. Therefore, you must create an authorization token before deploying the certificates.

See the "Creating authorization tokens" topic in the NetBackup Security and Encryption Guide for detailed steps.