Veritas NetBackup™ Virtual Appliance Documentation

About implementing ECA certificates

NetBackup Virtual Appliance's web service uses the PKCS#12 standard and requires certificate files to be in the X.509 (.pem) format. If the certificate files are in the .der, .DER, or .p7b formats, NetBackup Virtual Appliance automatically converts the files to an accepted format.

To prevent errors while importing certificates, ensure that the external certificate files meet the following requirements.

Although optional, you can use the Settings > Security > Certificate > CertificateSigningRequest > Create command to generate a CSR. Copy the CSR content from the command line to your ECA portal to obtain the required external certificate files.

Example:
Enter specified value or use the default value.
Common Name (eg, your name or your server's hostname) [Default nbapp2ao]:
Organizational Unit Name (eg, section) []:Appliance
Organization Name (eg, company) [Default Company Ltd]:Veritas
Locality Name (eg, city) [Default City]:Beijing
State or Province Name (full name) []:Beijing
Country Name (2 letter code) [XX]:CH
Email Address []:support@veritas.com
Please enter the following 'extra' attributes
to be sent with your certificate request.
-----
A challenge password []:123456
An optional company name []:VRTS
Subject Alternative Name (DNS Names and/or IP Addresses comma separated):
nbapp2ao,nbapp2ao.engba.veritas.com
Subject Alternative Name (email comma separated):
Certificate Signing Request Name [Default nbapp2ao.csr]:
Validity period (in days) [Default 365 days]:
Ensure that the Distinguished Name (DN) is specified as a string consisting 
of a sequence of key=value pairs separated by a comma:
Then the generated certificate signing request will be shown on the screen. 
The private key file is /root/privkey.pem.

Starting from version 4.1, you can register an ECA on both NetBackup Virtual Appliance and NetBackup using the Settings > Security > Certificate > Import command.

Perform the following steps to import the host certificate, host private key, and trust store to register the ECA on NetBackup and NetBackup Virtual Appliance. Both NetBackup and NetBackup Virtual Appliance layers use the same host certificate, host private key, and trust store.

A detailed example of how to import the certificates is provided here.

Before you use the Copilot feature on an appliance deployed with external certificates, ensure the following:

Run the following commands on each of the associated appliances:

rm /etc/vxos-ssl/servers/certs/<FQDN_hostname>-self.cert.pem

cp /etc/vxos-ssl/servers/certs/server.pem 
/etc/vxos-ssl/servers/certs/<FQDN_hostname>-self.cert.pem

tpconfig -delete -nb_appliance <Short_hostname>

/opt/NBUAppliance/scripts/copilot_users.pl --add

You can manage external certificates on NetBackup Virtual Appliance using the Certificate commands.

You can use the Settings > Security > Certificate > Add CACertificate command to add a server CA, HTTPS proxy CA, or LDAP CA certificate to the certificate authority list. Ensure that you paste the CA certificate content in the PEM or P7B format. The Appliance appends this CA certificate to the certificate authority list. Before appending the CA certificate, the appliance verifies whether the CA certificate is already being used on the appliance. If yes, the appliance quits with a message. The newly added CA certificate is updated to the System wide trust store, Tomcat key store and NetBackup trust store.

You can use the Settings > Security > Certificate > Remove CACertificate command to remove a server CA certificate from the certificate authority list. The available CA certificates are listed and you can select the certificate that you want to remove. The System wide trust store, Tomcat key store, and NetBackup trust stores are updated to remove the CA certificate.