Managing Certification Authorities (CA) for NetBackup Cloud
NetBackup supports only X.509 certificates in .PEM (Privacy-enhanced Electronic Mail) format.
You can find the details of the Certification Authorities (CAs) in the cacert.pem bundle at the following location:
Windows:
<installation-path>\NetBackup\var\global\cloudUNIX:
/usr/openv/var/global/cloud/
Note:
In a cluster deployment, the NetBackup database path points to the shared disk, which is accessible from the active node.
You can add or remove a CA from the cacert.pem bundle.
After you complete the changes, when you upgrade to a new version of NetBackup, the cacert.pem bundle is overwritten by the new bundle. All the entries that you may have added or removed are lost. As a best practice, keep a local copy of the edited cacert.pem file. You can use the local copy to override the upgraded file and restore your changes.
Note:
Ensure that you do not change the file permission and ownership of the cacert.pem file.
To add a CA
You must get a CA certificate from the required cloud provider and update it in the cacert.pem file. The certificate must be in .PEM format.
- Open the
cacert.pemfile. - Append the self-signed CA certificate on a new line and at the beginning or end of the
cacert.pemfile.Add the following information block:
Certificate Authority Name
==========================
- - - - - BEGIN CERTIFICATE - - - - -
<Certificate content>
- - - - - END CERTIFICATE - - - - -
- Save the file.
To remove a CA
Before you remove a CA from the cacert.pem file, ensure that none of the cloud jobs are using the related certificate.
- Open the
cacert.pemfile. - Remove the required CA. Remove the following information block:
Certificate Authority Name
==========================
- - - - - BEGIN CERTIFICATE - - - - -
<Certificate content>
- - - - - END CERTIFICATE - - - - -
- Save the file.
Starfield Services Root Certificate Authority - G2
Baltimore CyberTrust Root
DigiCert Assured ID Root CA
DigiCert Assured ID Root G2
DigiCert Assured ID Root G3
DigiCert Global CA G2
DigiCert Global Root CA
DigiCert Global Root G2
DigiCert Global Root G3
DigiCert High Assurance EV Root CA
DigiCert Trusted Root G4
D-Trust Root Class 3 CA 2 2009
GlobalSign Root CA
GlobalSign Root CA - R3
COMODO RSA Certification Authority
AAA Certificate Services
Go Daddy Root Certificate Authority - G2
ISRG Root X1