Configure a third-party CA certificate
You can use a self-signed or a third-party certificate to validate your CloudPoint server.
Consider the following points:
For Windows, you can give a certificate as a file path or install the third party certificate in the Trusted Root Certificates authorities.
To switch from a self-signed certificate to a third-party certificate for an already added CloudPoint server, you can update the tpconfig command or edit the CloudPoint server API or from NetBackup WebUI.
To configure a third-party CA certificate
- Generate the third party certificate and private key for your CloudPoint server.
- Run the ./cloudpoint/scripts/cp_certificate_management.sh script to upload your certificate and keys to the CloudPoint server.
- In NetBackup, create a certificate file and append the certificate of root and all intermediate CAs in the pem file.
- In the bp.conf file, create the following entries:
ECA_TRUST_STORE_PATH = /certificate.pem
(Optional) VIRTUALIZATION_CRL_CHECK = CHAIN
(Optional) ECA_CRL_PATH = /crls
Note:
The ECA_CRL_PATH option specifies the path to the directory where the Certificate Revocation Lists (CRL) of the external certificate authority (CA) are located. All files in ECA_CRL_PATH must be in pem format.
VIRTUALIZATION_CRL_CHECK option is only required if you want to check the revocation status of the certificate. By default, the VIRTUALIZATION_CRL_CHECK option is disabled.
You can disable, LEAF, or CHAIN the value of the VIRTUALIZATION_CRL_CHECK option. For LEAF, revocation status of the leaf certificate is validated against the CRL. For CHAIN, revocation status of all certificates from the certificate chain are validated against the CRL.
- Add the CloudPoint server to NetBackup or run the tpconfig command to update the certificate for a CloudPoint server already added to NetBackup.
Note:
Following should be the order in which the certificates are uploaded:
Leaf
Intermediate
Root
If the certificates are not uploaded in the correct order, the CloudPoint might not work.