Using the Certificate Management utility to issue and deploy host ID-based certificates
The process for host ID-based certificate deployment varies based on the certificate deployment security level configured on the master server. The levels are Medium, High, and Very High. By default, the security level is High.
A host ID-based certificate is automatically deployed on the master server during upgrade or installation.
Host ID-based certificates are deployed on hosts after confirming the fingerprint. Whether an authorization token is required or not depends on the security level.
These levels determine the nature of the Certificate Authority (CA) checks that are performed when the CA receives a certificate request from a NetBackup host. Select the certificate deployment level according to the security requirements of your NetBackup environment.
See About NetBackup certificate deployment security levels.
In some scenarios, certificate deployment requires the use of authorization tokens that are managed by a NetBackup administrator. The NetBackup administrator creates and shares these tokens with the administrators of individual hosts for certificate deployment on their local hosts. Certificate deployment can happen easily, allowing for scalable deployment across multiple NetBackup hosts without requiring NetBackup administrator intervention.
Table: Deployment requirements at each certificate deployment level or scenario
Certificate deployment level or scenario | Is an authorization token required? | Deploy host ID-based certificate? |
|---|---|---|
Certificate deployment level setting at Very High |
Yes. All certificate requests require an authorization token. The master server administrator creates a token to be used on the non-master host: | The host administrator of the non-master server host must obtain an authorization token from the master server administrator and use it to deploy the host ID-based certificate. |
Certificate deployment level setting at High (default) |
Maybe. Certificates are deployed without tokens on hosts that are known to the master server. The following topic explains what it means to be known to the master server: See About NetBackup certificate deployment security levels. If the host is not known to the master server, the certificate must be deployed using an authorization token. The master server administrator creates a token to be used on the non-master server host. | If a host ID-based certificate is deployed, no further action is required. If a token is required, the host administrator of the non-master server host must to obtain one from the master server administrator and use it to deploy the host ID-based certificate. |
Certificate deployment level setting at Medium | No. Certificates may be deployed on all hosts that request one. See Automatic host ID-based certificate deployment. Note: A certificate may not be deployed if the master server cannot verify that the requested host name matches the IP from which the certificate request originated. | If a host ID-based certificate is deployed, no further action is required. If the master server cannot verify the host name, a host ID-based certificate must be deployed using a token. |
Certificate reissue | Yes. A certificate reissue requires a reissue token in most cases. | |
Hosts that cannot communicate with the master server directly (an example of this is NetBackup hosts in a demilitarized zone (DMZ)). | Yes. NetBackup can automatically detect whether a host has connectivity with the master server or not. If there is no connectivity, NetBackup attempts to use the built-in HTTP tunnel on a media server to route the certificate request to the master server. | See Deploying certificates on a client that has no connectivity with the master server. |
Certificate deployment and generation for NAT clients | Yes. During NetBackup certificate deployment on a NAT client, you must provide an authorization token is must, irrespective of the certificate deployment security level that is set on the master server. This is because, the master server cannot resolve the host name to the IP address from which the request is sent. | For more information about the support for NAT clients in NetBackup, refer to the NetBackup Administrator's Guide, Volume I. |