About root CA certificates of NetBackup primary server and NetBackup Cloud Recovery Server
To interact with the external entities and to establish secure communication, you need to download root Certificate Authority (CA) certificates for NetBackup primary server and NetBackup Cloud Recovery Server. Follow the steps mentioned below to download the certificate:
To download the root CA certificates for NetBackup primary server and NetBackup Cloud Recovery Server
- From a terminal, run the below command to view CA certificates of your primary server:
openssl s_client -showcerts -connect myprimaryserver.com:port_number
The default value of port_number for NetBackup primary server is 1556. The default value of port_number for NetBackup Cloud Recovery server is 443.
- Perform the below steps, if the issuer for the certificate presented by the primary server host is NetBackup certificate authority named 'broker':
a. Execute the public API security/cacert exposed by NetBackup to obtain the root CA certificate.
curl -X GET "https://myprimaryserver.com:1556/netbackup/security/cacert" -H "accept: application/json;"
myprimaryserver.com is the host name of the NetBackup primary server.
b. Look for webRootCertificateData > webRootCert field from the API output and copy the contents to a text file.
You might have to replace the '\n' character with actual new lines to convert it into a valid .PEM file.
c. Validate the file with the below command:
openssl x509 -in root_ca.pem -noout -text
- Perform the below steps, if the certificate presented by the NetBackup primary server is issued by an external certificate authority:
a. Refer ECA_TRUST_STORE_PATH from below location:
Windows NetBackup primary server registry: HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\NetBackup\CurrentVersion\Config
Unix NetBackup primary server file: /usr/openv/netbackup/bp.conf
b. Locate the root and all intermediate certificates (if required) from the location pointed by ECA_TRUST_STORE_PATH.
Verify that you can connect to the NetBackup primary server using the extracted certificate chain. You can use below command:
openssl s_client -servername myprimaryserver.com -connect myprimaryserver.com:port_number -CAfile my_cert_chain.pem
The host name of the NetBackup primary server is myprimaryserver.com.
The default value of port_number for NetBackup primary server is 1556. The default value of port_number for NetBackup cloud recovery server is 443.
The command output should indicate below output: Verify return code: 0 (ok)
After the certificate is downloaded successfully, navigate to Settings >> Product Settings >> Certificate Management to install the certificate for NetBackup primary server. Refer See Add root and intermediate CA certificate. topic.