About NetBackup certificate deployment security levels
Security levels for certificate deployment are specific to NetBackup CA-signed certificates. If the NetBackup web server is not configured to use NetBackup certificates for secure communication, the security levels cannot be accessed.
The NetBackup certificate deployment level determines the checks that are performed before the NetBackup CA issues a certificate to a NetBackup host. It also determines how frequently the NetBackup Certificate Revocation List (CRL) is refreshed on the host.
NetBackup certificates are deployed on hosts during installation (after the host administrator confirms the primary server fingerprint) or with the nbcertcmd command. Choose a deployment level that corresponds to the security requirements of your NetBackup environment.
Note:
During NetBackup certificate deployment on a NAT client, you must provide an authorization token irrespective of the certificate deployment security level that is set on the primary server. This is because, the primary server cannot resolve the host name to the IP address from which the request is sent.
For more information about NAT support in NetBackup, refer to the NetBackup Administrator's Guide, Volume I.
Table: Description of NetBackup certificate deployment security levels
Security level | Description | CRL refresh |
|---|---|---|
Very High |
An authorization token is required for every new NetBackup certificate request. | The CRL that is present on the host is refreshed every hour. |
High (default) |
No authorization token is required if the host is known to the primary server. A host is considered to be known to the primary server if the host can be found in the following entities:
| The CRL that is present on the host is refreshed every 4 hours. |
Medium | The certificates are issued without an authorization token if the primary server can resolve the host name to the IP address from which the request was originated. | The CRL that is present on the host is refreshed every 8 hours. |