How to perform a manual mini-reset of NetBackup issued certificates

Description

This article provides a set of instructions to obtain new NetBackup issued certificates in a NetBackup environment.

The steps in this article do not apply for domains that are using ECAs (custom certificates) from an external provider.

Note: NetBackup 8.x and 9.x environments may have additional requirements, please refer to the article below if the installed version is not 10.0 or higher:

https://www.veritas.com/support/en_US/article.100044601

Clients / Media servers:

Perform the following commands on each Media Server and Client to obtain the new certificate:

   UNIX/Linux: /usr/openv/netbackup/bin/nbcertcmd -getCACertificate
                       /usr/openv/netbackup/bin/nbcertcmd -getCertificate -force

      Windows:    <install_path>\NetBackup\bin\nbcertcmd -getCACertificate
                          <install_path>\NetBackup\bin\nbcertcmd -getCertificate -force

Note: If the NetBackup Clients are in cluster environments, perform the above commands on each node.

For NetBackup Primary servers:

== Non-Cluster Aware ==

UNIX/Linux:

1.    /usr/openv/netbackup/bin/nbwmc -terminate
2.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -u -i
3.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -m
4.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -t -f
5.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -s -f
6.    /usr/openv/wmc/bin/install/configureWmc
7.    /usr/openv/wmc/bin/install/configureCerts
8.    /usr/openv/wmc/bin/install/setupWmc
9.    /usr/openv/netbackup/bin/nbwmc -start
10.    /usr/openv/netbackup/bin/nbcertcmd -getCACertificate
11.    /usr/openv/netbackup/bin/nbcertcmd -getCertificate -force

• If the operation fails, perform the steps at the "Create a token" section below then return to this step.

12.   Remove the /usr/openv/var/global/vxss/nbcertservice/install_token file

Windows:

1.    set WEBSVC_PASSWORD=<nbwebsvc password>
2.    C:\Windows\System32\sc.exe stop "NetBackup Web Management Console"
3.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -u -i
4.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -m
5.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -t -f
6.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -s -f
7.    <Install_Path>\NetBackup\wmc\bin\install\configureWmc
8.    <Install_Path>\NetBackup\wmc\bin\install\configureCerts
9.    <Install_Path>\NetBackup\wmc\bin\install\setupWmc
10.    C:\Windows\System32\sc.exe start "NetBackup Web Management Console"
11.   <Install_Path>\NetBackup\bin\nbcertcmd -getCACertificate
12.   <Install_Path>\NetBackup\bin\nbcertcmd -getCertificate -force

• If the operation fails, perform the steps at the "Create a token" section below then return to this step.

13. Remove the <install_path>\NetBackup\var\global\vxss\nbcertservice\install_token file

== Cluster Aware ==

If the system is UNIX/Linux, freeze the cluster before starting.

UNIX/Linux: Clustered Master Server Active Node:

1.    /usr/openv/netbackup/bin/nbwmc -terminate
2.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -u -i
3.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -m
4.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -t -f
5.    /usr/openv/netbackup/bin/admincmd/nbcertconfig -s -f   
6.    /usr/openv/wmc/bin/install/configureWmc
7.    /usr/openv/wmc/bin/install/configureCerts
8.    /usr/openv/wmc/bin/install/setupWmc
9.    /usr/openv/netbackup/bin/nbwmc -start
10.    /usr/openv/netbackup/bin/nbcertcmd -getCACertificate
11.    /usr/openv/netbackup/bin/nbcertcmd -getCACertificate -cluster
12.    /usr/openv/netbackup/bin/nbcertcmd -getCertificate -cluster -force
13.    /usr/openv/netbackup/bin/nbcertcmd -getCertificate -force

• If the operation fails, perform the steps at the "Create a token" section below on this node then return to this step.

14.   Remove the /usr/openv/var/global/vxss/nbcertservice/install_token file

UNIX/Linux: Clustered Master Server Inactive Node:

   1. /usr/openv/netbackup/bin/nbcertcmd -getCACertificate
   2. /usr/openv/netbackup/bin/nbcertcmd -getCertificate -force
      If the operation fails, perform the steps at the "Create a token" section below on this node then return to this step.
   3. Remove the /usr/openv/var/global/vxss/nbcertservice/install_token file

Windows: Clustered Master Server Active Node:

1.    set WEBSVC_PASSWORD=<nbwebsvc password>
2.    Use Failover Cluster Manager to stop the "NetBackup Web Management Console"
3.    <install_path>\NetBackup\bin\admincmd\nbcertconfig -u -i
4.    <install_path>\NetBackup\bin\admincmd\nbcertconfig -m
5.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -t -f
6.    <Install_Path>\NetBackup\bin\admincmd\nbcertconfig -s -f     
7.    <install_path>\NetBackup\wmc\bin\install\configureWmc
8.    <install_path>\NetBackup\wmc\bin\install\configureCerts
9.    <install_path>\NetBackup\wmc\bin\install\setupWmc
10.   Use Failover Cluster Manager to start the "NetBackup Web Management Console"
11.   <install_path>\NetBackup\bin\nbcertcmd -getCACertificate
12.   <install_path>\NetBackup\bin\nbcertcmd -getCACertificate -cluster
13.   <install_path>\NetBackup\bin\nbcertcmd -getcertificate -cluster -force
14.   <install_path>\NetBackup\bin\nbcertcmd -getcertificate -force

•  If the operation fails, perform the steps at the "Create a token" section below on this node then return to this step.

15.  Remove the <install_path>\NetBackup\var\global\vxss\nbcertservice\install_token file

Windows: Clustered Master Server Inactive Node:

   1. <install_path>\NetBackup\bin\nbcertcmd -getCACertificate
   2. <install_path>\NetBackup\bin\nbcertcmd -getcertificate -force
       If the operation fails, perform the steps at the "Create a token" section below on this node then return to this step.
   3. Remove the <install_path>\NetBackup\var\global\vxss\nbcertservice\install_token file

Create a token:

  a. For Cluster Aware and Non-Cluster Aware:

    UNIX/Linux:  /usr/openv/netbackup/bin/bpnbat -login -loginType WEB
    Windows:     <install_path>\NetBackup\bin\bpnbat -login -loginType WEB

    You will be prompted to enter the information as the following example:

    Authentication Broker [MasterServer1 is default]:
    Authentication port [0 is default]:
    Authentication type (NIS, NISPLUS, WINDOWS, vx, unixpwd, ldap) [unixpwd is default]:
    Domain [MasterServer1 is default]:  example.netbackup.com
    Login Name [root is default]:
    Password:

  b. For Cluster Aware and Non-Cluster Aware:

    UNIX/Linux:  /usr/openv/netbackup/bin/nbcertcmd -createToken -name <token_name> -reissue -host <Master server name>
    Windows:     <Install_Path>\netbackup\bin\nbcertcmd -createToken -name <token_name> -reissue -host <Master server name>

 e.g. nbcertcmd -createtoken -name token1 -reissue -host MasterServer1

    Token EFITVNDRKTWHXRCM created successfully.

  c. For Non-Cluster Aware:

      UNIX/Linux: /usr/openv/netbackup/bin/nbcertcmd -getCACertificate
                  /usr/openv/netbackup/bin/nbcertcmd -getCertificate -token <token_ID> -force

      Windows:    <install_path>\NetBackup\bin\nbcertcmd -getCACertificate
                  <install_path>\NetBackup\bin\nbcertcmd -getCertificate -token <token_ID> -force

    e.g. nbcertcmd -getcertificate -token EFITVNDRKTWHXRCM -force

d. For Cluster Aware:

      nbcertcmd -getCACertificate
      nbcertcmd -getCACertificate -cluster
      nbcertcmd -getCertificate -cluster -token <token_ID> -force
      nbcertcmd -getCertificate -token <token_ID> -force