Configuring the plug-in for an external certificate
The plug-in communicates with the NetBackup master server securely by means of certificate-based authentication. By default, the master server uses NetBackup CA-signed certificates. As an alternative, the master server can be configured to use an externally issued certificate. In that case, use the following procedure to configure the plug-in for the external certificate.
Configure the plug-in for an external certificate
- Enter the following command on the master server:
Windows
install_path\NetBackup\wmc\bin\install\configureCertsForPlugins.bat -registerExternalCert -certPath "path_to_external_certificate_file" -privateKeyPath "path_to_certificate_key_file" -trustStorePath "path_to_ca_certificate_file"
UNIX, Linux
/usr/openv/wmc/bin/install/configureCertsForPlugins -registerExternalCert -certPath "path_to_external_certificate_file" -privateKeyPath "path_to_certificate_key_file" -trustStorePath "path_to_ca_certificate_file"
For example:
configureCertsForPlugins -registerExternalCert -certPath "c:\server.pem" -privateKeyPath "c:\key.pem" -trustStorePath "c:\intermediateOrRootCA.pem"
This command configures the plug-in to use the external certificate by importing the certificate into the keystore on the master server. The command options are as follows:
-certPath: Specifies the path to the certificate for the web server. This file should have a single certificate in PEM format.
-privateKeyPath: Specifies the path to the private key for the web server certificate.
-trustStorePath: Specifies the path to the certificate of the intermediate or root certification authority that has issued the web server certificate. This file should have a single certificate in PEM format. The subject of this certificate should match the issuer of the web server certificate.
For further information on external certificates, see the NetBackup Security and Encryption Guide.
- Restart the NetBackup Web Management Console service on the master server.
In the Activity Monitor of the NetBackup Administration Console: Click the Daemons tab, right-click the service, and click Stop Daemon. When the service has stopped, click Start Daemon.
- Renew the authentication token on the master server:
See Renewing an authorization token.
Note:
Perform this step for each plug-in that needs to communicate with the master server.
- On the plug-in, remove the existing master server and then add the master server that now has the renewed token:
See Authorizing the NetBackup plug-in to restore virtual machines.
If you use external-CA signed certificates and want to add a new vCenter server along with the VMware vSphere plug-in, use the manageClientCerts -create option on the master server to generate a new certificate for the client. You can then use the newly generated certificate when you add the NetBackup master server to the VMware vSphere plug-in.