Veritas NetBackup™ Virtual Appliance Documentation
- Getting to know the NetBackup Virtual Appliance
- NetBackup Virtual Appliance product description
- Preparing to deploy the appliance
- Deploying and configuring the appliance
- How to deploy and configure a NetBackup Virtual Appliance combined primary and media server
- How to deploy and configure a NetBackup Virtual Appliance media server
- How to deploy and configure a NetBackup Virtual Appliance primary server
- How to deploy and configure a NetBackup Virtual Appliance combined primary and media server
- Post initial configuration procedures
- Appliance common tasks
- Storage management
- About NetBackup Virtual Appliance storage configuration
- About viewing storage space information using the Show command
- About OpenStorage plugin installation
- About NetBackup Virtual Appliance storage configuration
- Deduplication pool catalog backup and recovery
- Network connection management
- Managing users
- About user name and password specifications
- About authenticating LDAP users
- About authenticating Active Directory users
- About authentication using Smart Cards and digital certificates
- About authenticating Kerberos-NIS users
- About user authorization on the NetBackup Virtual Appliance
- Creating NetBackup administrator user accounts
- Using the appliance
- About configuring Host parameters for your appliance on the NetBackup Virtual Appliance
- About Copilot functionality and Share management
- About NetBackup Virtual Appliance as a VMware backup host
- About running NetBackup commands from the appliance
- About mounting a remote NFS
- About Auto Image Replication from a NetBackup Virtual Appliance
- Monitoring the appliance
- About SNMP
- About Call Home
- Appliance security
- About Symantec Data Center Security on the NetBackup Virtual Appliance
- About data encryption
- Setting the appliance login banner
- Upgrading the appliance
- About upgrading to NetBackup Virtual Appliance software version 5.0
- Requirements and best practices for upgrading NetBackup appliances
- Methods for downloading appliance software release updates
- NetBackup client upgrades with VxUpdate
- Appliance restore
- Decommissioning and Reconfiguring
- Troubleshooting
- About disaster recovery
- About NetBackup support utilities
- Appliance logging
- About forwarding logs to an external server
- Commands overview
- Appendix A. Appliance commands
- Appendix B. Manage commands
- Appendix C. Monitor commands
- Appendix D. Network commands
- Appendix E. Reports commands
- Appendix F. Settings commands
- Appendix G. Support commands
- Appendix H. Available commands for a NetBackupCLI user
About SSL usage
The Secure Socket Layer (SSL) protocol creates an encrypted connection between the appliance web server and the appliance web console, and other local servers. This type of connection allows for a more secure information transfer without the problems of eavesdropping, data tampering, or message forgery.
SSL certificates are also supported for secure communications between the appliance and various external servers, such as LDAP, HTTPs proxy, and Syslog.
The appliance uses self-signed certificates for client and host validation. A host certificate issued by an internal CA is deployed on the primary and media servers during role configuration. The self-signed certificate is generated using a 2048 bit RSA public key that is hashed with the SHA256 algorithm and signed with RSA encryption. For secure communications, the appliance uses only TLS v1.2 and later protocols.
NetBackup Virtual Appliance also supports host certificates issued by an External Certificate Authority (ECA). You can use an ECA as an alternative to the internal CA to provide host verification and security to meet your organization's standards.
Refer to the following table for different types of external certificates used in NetBackup Virtual Appliance.
Table: Types of ECA certificates
Certificate type | Description |
---|---|
Host certificate | The appliance's host certificate is based on the X.509 or PKCS#7 standard. The certificate is encoded in either DER (binary) or PEM (text) format. Veritas recommends that you use RSA public and private keys of length 2048 bits or higher. Note: Ensure that the SubjectAlternativeName certificate extension contains all the appliance host names and IP addresses by which the appliance is reached. Include the fully qualified host names and the short names. |
Host private key (corresponding to the host certificate) | The appliance's host private key must be in PKCS#8 standard and encoded in PEM format. |
(Optional) Intermediary CA certificates | Intermediary CA certificates form a certificate chain from the appliance host certificate to the root CA certificate. These certificates are only required if the host certificates are issued by a CA other than the root CA. |
Root CA certificates | These include the root CA certificates of the Appliance certificate chain and its peers. If the appliance needs to interact with the hosts that have certificates from different CAs, you must have all those intermediary and root CA certificates ready in a file called cacerts.pem. |