After performing total recovery of NetBackup client, the backup job may fail with Status 7641 (Fail to find a common CA Root for secure handshake.)

Problem

After performing total recovery of NetBackup client, the backup job may fail with Status 7641 (Fail to find a common CA Root for secure handshake.)

Error Message

7641 (Fail to find a common CA Root for secure handshake.)

[Job Details]
Error bpbrm (pid=504) [PROXY] Received status: 7641 with message Failed to find a common CA Root that is required for secure communication. Connector CAs (["f6b26d23-ff6d-4bae-9842-1e2a7a955f4a"]), Acceptor CAs (NULL). The external certificate cannot be automatically enrolled. Either the automatic enrollment is disabled or the mandatory ECA configuration options are not set for one or both the hosts.
Error bpbrm (pid=504) [PROXY] Encountered error (CERT_PROTOCOL_SELECT_COMMON_CA_ROOT) while processing(CertProtocol).
Error bpbrm (pid=504) bpcd on [client_name] exited with status 7641: Failed to find a common CA Root for secure handshake
Error bpbrm (pid=504) [PROXY] Connecting host: [primary_server_name]
Error bpbrm (pid=504) [PROXY] ConnectionId: {0C7306FD-E61C-4127-A6C2-B06CCD879EA2}:OUTBOUND
Error bpbrm (pid=504) [PROXY] pid: 3964
Error bpbrm (pid=504) [PROXY] Received status: 7641 with message Failed to find a common CA Root that is required for secure communication. Connector CAs (["f6b26d23-ff6d-4bae-9842-1e2a7a955f4a"]), Acceptor CAs (NULL). The external certificate cannot be automatically enrolled. Either the automatic enrollment is disabled or the mandatory ECA configuration options are not set for one or both the hosts.
Error bpbrm (pid=504) [PROXY] Encountered error (CERT_PROTOCOL_SELECT_COMMON_CA_ROOT) while processing(CertProtocol).
Error bpbrm (pid=504) cannot send mail because BPCD on [client_name] exited with status 61: the vnetd proxy encountered an error
Info bpbkar32 (pid=0) done. status: 7641: Failed to find a common CA Root for secure handshake
Error nbpem (pid=8088) backup of client [client_name] exited with status 7641 (Failed to find a common CA Root for secure handshake)
end writing
Failed to find a common CA Root for secure handshake.  (7641)

Cause

After rebooting the client as a final step in the recovery, the certificate is missing for the client.

The command outputs on the client are as follows:

nbcertcmd -listCAcertdetails
Operation completed successfully.
EXIT STATUS 5949: Certificate does not exist.

nbcertcmd -listcertdetails
Operation completed successfully.
EXIT STATUS 5949: Certificate does not exist.

Solution

The issue will be resolved after the certificate is obtained from the primary server by running the following commands on the client.

nbcertcmd -getCACertificate
nbcertcmd -getCertificate -token -server [primary_server_name]

* For authorization token, enter the reissue token issued on the primary server.

Related Links:

How to use NetBackup to perform a complete restore of Windows servers without IDR or BMR https://www.veritas.com/content/support/en_US/article.100045797