Configuring the cloud connector for Azure and Azure Stack
The cloud connector component connects to the workloads through a secure mechanism. You need to perform the following configurations.
By default, peer and host validations are enabled. You can disable peer and host validations only for Azure Stack.
To disable peer and host validation, set the parameter VIRTUALIZATION_HOSTS_SECURE_CONNECT_ENABLED=NO in the /cloudpoint/openv/netbackup/bp.conf file in the CloudPoint server. You must use HTTPS protocol, even after you disable peer and host validation.
For cloud workloads, the public root certificates are a part of the container image. NetBackup maintains the cacert.pem file which has root certificates of public cloud, at the following location:
/usr/openv/var/global/wmc/cloud/cacert.pem
For Azure Stack, you must specify the file path of the root certificates using the ECA_TRUST_STORE_PATH parameter in the /cloudpoint/openv/netbackup/bp.conf file in the CloudPoint server. The value of ECA_TRUST_STORE_PATH must be in the /cloudpoint/eca/trusted/cacerts.pem file.
CRL validations are done when the NetBackup primary or media server connects to the CloudPoint server. Also, when the CloudPoint server connects to cloud workloads, and when the data mover container from the CloudPoint server connects to the NetBackup media server.
Certificate Revocation List (CRL) validations are disabled by default when the NetBackup primary or media server connects to the CloudPoint server and when the CloudPoint server connects to the workload.
CRL validations between the data mover container present in the CloudPoint server and NetBackup media server CRL validations are enabled by default.
You can specify one of the following values in the VIRTUALIZATION_CRL_CHECK parameter, in the /cloudpoint/openv/netbackup/bp.conf file in the CloudPoint server.
DISABLE (or 0): Disables revocation check. Revocation status of the certificate is not validated against the CRL during host communication. This is the default value.
LEAF (or 1): Revocation status of the leaf certificate is validated against the CRL.
CHAIN (or 2): Revocation status of all certificates from the certificate chain is validated against the CRL.
If you enable CRL validations, you need to specify the path to the directory containing revoked certificates of the external CA.
In the ECA_CRL_PATH parameter in the /cloudpoint/openv/netbackup/bp.conf file in the CloudPoint server, specify the path to the directory where the certificate revocation lists (CRL) of the external CA are located. The path must be /cloudpoint/eca/crl.
If the ECA_CRL_PATH option is not specified, NetBackup downloads the CRLs from the URLs that are specified in the CRL Distribution Point (CDP) and uses them to verify revocation status of the peer host's certificate.