Finding and communicating the fingerprint of the certificate authority
The master server administrator must find the fingerprint of the CA certificate and communicate it to the administrator of the individual host so that the host can add the CA certificate to its trust store.
To find the fingerprint of the CA certificate
- The master server administrator can find the fingerprint using the NetBackup Administration Console or the command line:
Using the NetBackup Administration Console:
Using the command line:
Run the following command on the master server to view the Root Certificate Fingerprint:
nbcertcmd -listCACertDetails Subject Name : /CN=nbatd/OU=root@cayce.rm.com/O=vx Start Date : Sep 16 10:37:58 2016 GMT Expiry Date : Sep 11 11:52:58 2036 GMT SHA1 Fingerprint : C3:5E:2E:21:78:DF:47:0D:FF:6A:45:7A:0E: 7F:1B:98:B1:F2:92:CAIf multiple CA certificates are displayed, use the Subject Name to identify the certificate for the desired master.
- The master server administrator communicates the fingerprint to the host administrator by email, by file, or on an internal web site.
The host administrator uses this fingerprint to verify the fingerprint that displays when the host runs nbcertcmd -getCACertificate.
The vssat command can also be used to view the CA certificate fingerprint. Use vssat with the following options:
vssat showcred -p nbatd
However, note the following differences between using nbcertcmd -listCACertDetails and vssat:
vssat displays the fingerprint as a hash and does not include colon separators.
If the host trusts multiple Certificate Authorities, the nbcertcmd command displays all CA certificates. The Subject Name displays the identity of the CA.