Removing trust between a host and a primary server
A NetBackup host can trust multiple Certificate Authorities (primary servers) at any time. For various reasons, it may be necessary for a NetBackup host to remove trust from a primary server that previously had been trusted.
For example, if a NetBackup client is moved from one primary server to another, it is advisable to remove trust from the first primary server. Security best practices suggest trusting the fewest entities required to function correctly. Also, if a NetBackup host no longer needs to communicate with hosts from a specific NetBackup domain, remove the CA certificate for that primary from the trust store of the host.
Note:
Removing a CA certificate does not remove the host ID-based or host name-based certificates that the host may have obtained from that CA. The nbcertcmd -listCertDetails continues to show the host ID-based certificate.
When the CA certificate is removed from a host, the host ID-based certificate issued by that CA will not automatically renew because the host no longer trusts the CA. The host ID-based certificate eventually expires.
Removing trust between a host and a primary server
- The administrator of the non-primary host runs the following command on the host to determine the CA certificate fingerprint of the primary server:
nbcertcmd -listCACertDetails
In this example output, the host has certificates from two primary servers:
nbcertcmd -listCACertDetails Subject Name : /CN=nbatd/OU=root@master1.abc.com/O=vx Start Date : Aug 23 14:16:44 2016 GMT Expiry Date : Aug 18 15:31:44 2036 GMT SHA1 Fingerprint : 7B:0C:00:32:96:20:36:52:92:E8:62:F3:56: 74:8B:E3:2E:4F:22:4C Subject Name : /CN=nbatd/OU=root@master2.xyz.com/O=vx Start Date : Aug 25 12:09:55 2016 GMT Expiry Date : Aug 20 13:24:55 2036 GMT SHA1 Fingerprint : 7A:C7:6E:68:71:6B:82:FD:7E:80:FC:47:F6: 8D:B2:E1:40:69:9C:8C - The administrator wants to remove trust to the second primary server and runs the following command on the host:
nbcertcmd -removeCACertificate - fingerprint 7A:C7:6E:68:71: 6B:82:FD:7E:80:FC:47:F6:8D:B2:E1:40:69:9C:8C
Include the entire fingerprint, including the colons.
- The NetBackup BAR Console on the primary server displays the certificate state as Active. However, that certificate does not automatically renew and eventually expires. The NetBackup administrator should revoke the certificate of the host if the host is no longer going to be part of the NetBackup domain.