Veritas Velocity™ User's Guide
- Getting to know Velocity
- Setting up Velocity
- How to set up the Velocity Storage Server
- How to set up the Velocity Client
- Setting up the Velocity on-premises management server
- Upgrading Velocity
- Velocity Storage Server
- Users and roles
- Oracle database ingestion using Velocity
- How to use copy preparation to mask or sanitize sensitive data
- Oracle database ingestion using NetBackup CoPilot
- Microsoft SQL Server database ingestion using Velocity
- Database sources and copies
- About scheduling ingestions for a database source
- Retention periods for database sources and copies
- Sandboxes
- Database recovery
- Alerts and logs
- Managing the Velocity physical appliance
- Configuring network address settings on the Velocity physical appliance
- About WAN optimization on the Velocity physical appliance
- About the Veritas Remote Management Console on the Velocity physical appliance
- About Velocity physical appliance storage
- About users on the Velocity physical appliance
- About Velocity physical appliance checkpoints
- About factory reset on the Velocity physical appliance
- Configuring network address settings on the Velocity physical appliance
- Monitoring the Velocity physical appliance
- Velocity physical appliance security
- About Velocity physical appliance user account privileges
- About the Velocity physical appliance intrusion detection system
- About Velocity physical appliance operating system security
- Recommended IPMI settings on the Velocity physical appliance
- Best practices
- Troubleshooting
- Glossary
- Context-sensitive topics
- Section I. Velocity shell menu commands
- Introduction
- Appendix A. Main > Manage > Storage
- Appendix B. Main > Manage > Cloud
- Appendix C. Main > Manage > Software
- Appendix D. Main > Monitor
- Appendix E. Main > Network
- Appendix F. Main > Settings
- Appendix G. Main > Support
Adding a Certificate Authority signed certificate to the Velocity Storage Server
By default, the Velocity Storage Server uses a self-signed certificate that Veritas provides. You can, however, replace the certificate with your own Certificate Authority (CA) signed certificate. To use your own certificate, you must create a new keystore file, install the certificate chain, and reference the new chain using the appropriate keystore alias.
Adding your own CA-signed certificate helps to ensure that your Oracle Database servers communicate only with the Velocity Storage Server.
To add a Certificate Authority signed certificate to the Velocity Storage Server
- Log on to your Velocity Storage Server.
- Type the following command to change the directory:
cd /opt/apache-tomcat/security
- Type the following command to create a new keystore file with a self-signed certificate and private key:
keytool -genkey -alias tomcat -keyalg RSA -keystore keystore.tomcat-velocity -keysize 2048
Note:
The private key that is generated is part of the CA signing request. It is important to save a copy of this file in a secure location for future use.
Make a note of the alias from the command. You must use the same value for the "-alias" flag throughout this procedure. In this example, the alias is "tomcat".
- Answer the questions with information about your organization and provide a password for the keystore.
- Type the following command on the newly created keystore file to produce the certificate request text file. The certificate request text file is used for the certificate signing request:
keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore keystore.tomcat-velocity
- Use the text that is included in the certreq.csr file to request a certificate from your certificate authority. The FQDN that you use for the Subject Alternative Name (SAN) field must be fully resolvable in your network's DNS namespace.
Warning:
You must use the correct FQDN in the SAN field. If you do not use the correct FQDN, the procedure fails.
- Once you have received the issued certificate chain, save the text in the following file:
/opt/apache-tomcat/security/cert.p7b
- Use the following command to change the directory to the original keystore work location:
cd /opt/apache-tomcat/security
- Import the new certificate chain into the newly generated keystore using the following command:
keytool -import -alias tomcat -trustcacerts -file cert.p7b -keystore keystore.tomcat-velocity
Where "file cert.p7b" is the certificate chain text that was issued from your CA and that you saved in step 7.
- Type the following command to save a copy of the file named keystore to keystore.orig:
cp keystore keystore.orig
- Type the following command to import the new keystore file, which now contains your CA-issued certificate chain, into the existing keystore:
keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore keystore.tomcat-velocity -srcstorepass appliance -alias tomcat
Note:
You may need to update the passwords in the command to match the commands that were used earlier in this procedure.
When you are prompted to overwrite the existing alias, select Yes.
- Type the following command to restart Velocity tomcat:
service tomcat-velocity restart
- Log on to the Oracle server as root.
- Navigate to /opt/veritas/velocity/etc/controller.conf and change the following values:
Change the "verifyhost" value from "false" to "true".
Change the "verifypeer" value from "false" to "true".
- Type the following command to restart the Velocity Client:
service vexecd restart