NetBackup™ Web UI Cloud Administrator's Guide
- Managing and protecting cloud assets
- About protecting cloud assets
- Limitations and considerations
- Configure Snapshot Manager's in NetBackup
- Managing intelligent cloud groups
- Protecting cloud assets or intelligent cloud groups
- Cloud asset cleanup
- Cloud asset filtering
- AWS and Azure government cloud support
- About protecting Microsoft Azure resources using resource groups
- About the NetBackup Accelerator for cloud workloads
- Configuring backup schedule for cloud workloads
- Backup options for cloud workloads
- Snapshot replication
- Configure AWS snapshot replication
- Using AWS snapshot replication
- Support matrix for account replication
- Protect applications in-cloud with application consistent snapshots
- Protecting PaaS assets
- Prerequisites for protecting PaaS assets
- Installing the native client utilities
- Configuring the storage server for instant access
- About incremental backup for PaaS workloads
- Limitations and considerations
- Discovering PaaS assets
- Viewing PaaS assets
- Managing PaaS credentials
- View the credential name that is applied to a database
- Add credentials to a database
- Add protection to PaaS assets
- Perform backup now
- Recovering cloud assets
- Performing granular restore
- Troubleshooting protection and recovery of cloud assets
Configure a third-party CA certificate
You can use a self-signed or a third-party certificate to validate your Snapshot Manager.
Consider the following points:
For Windows, you can give a certificate as a file path or install the third party certificate in the Trusted Root Certificates authorities.
To switch from a self-signed certificate to a third-party certificate for an already added Snapshot Manager, you can update the tpconfig command or edit the Snapshot Manager API or from NetBackup WebUI.
To configure a third-party CA certificate
- Generate the third party certificate and private key for your Snapshot Manager.
- Run the /cloudpoint/scripts/cp_certificate_management.sh script to upload the certificate, key and trust store to the Snapshot Manager.
- In NetBackup, create a certificate file and append the certificate of root and all intermediate CAs in the pem file.
- In the
bp.conffile, at/cloudpoint/openv/netbackup/, create the following entries:ECA_TRUST_STORE_PATH = /cloudpoint/eca/trusted/cacerts.pem
(Optional) VIRTUALIZATION_CRL_CHECK = CHAIN
(Optional) ECA_CRL_PATH =/cloudpoint/eca/crl/
Note:
The CA certificates and CRLs should be present under
/cloudpoint/eca/trusted/cacerts.pemfor trust-store, and/cloudpoint/eca/crlfor CRL.The ECA_CRL_PATH option specifies the path to the directory where the Certificate Revocation Lists (CRL) of the external certificate authority (CA) are located. All files in ECA_CRL_PATH must be in DER, PEM, and P7B formats.
VIRTUALIZATION_CRL_CHECK option is only required if you want to check the revocation status of the certificate. By default, the VIRTUALIZATION_CRL_CHECK option is disabled.
You can disable, LEAF, or CHAIN the value of the VIRTUALIZATION_CRL_CHECK option. For LEAF, revocation status of the leaf certificate is validated against the CRL. For CHAIN, revocation status of all certificates from the certificate chain are validated against the CRL.
Note:
Following should be the order in which the certificates are uploaded: Leaf > Intermediate > Root. If the certificates are not uploaded in the correct order, Snapshot Manager might not work.
- Add the Snapshot Manager to NetBackup or run the tpconfig command to update the certificate for a Snapshot Manager already added to NetBackup.