Search <book_title>...

NetBackup™ Security and Encryption Guide

Last Published: 2023-03-31

Product(s): NetBackup (10.2)

Using the Certificate Management utility to issue and deploy host ID-based certificates

The process for host ID-based certificate deployment varies based on the certificate deployment security level configured on the primary server. The levels are Medium, High, and Very High. By default, the security level is High.

A host ID-based certificate is automatically deployed on the primary server during upgrade or installation.

Host ID-based certificates are deployed on hosts after confirming the fingerprint. Whether an authorization token is required or not depends on the security level.

These levels determine the nature of the Certificate Authority (CA) checks that are performed when the CA receives a certificate request from a NetBackup host. Select the certificate deployment level according to the security requirements of your NetBackup environment.

See About NetBackup certificate deployment security levels.

In some scenarios, certificate deployment requires the use of authorization tokens that are managed by a NetBackup administrator. The NetBackup administrator creates and shares these tokens with the administrators of individual hosts for certificate deployment on their local hosts. Certificate deployment can happen easily, allowing for scalable deployment across multiple NetBackup hosts without requiring NetBackup administrator intervention.

Table: Deployment requirements at each certificate deployment level or scenario

Certificate deployment level or scenario	Is an authorization token required?	Deploy host ID-based certificate?
Certificate deployment level setting at Very High	Yes. All certificate requests require an authorization token. The primary server administrator creates a token to be used on the non-primary host: See Creating authorization tokens.	The host administrator of the non-primary server host must obtain an authorization token from the primary server administrator and use it to deploy the host ID-based certificate. See Deploying host ID-based certificates.
Certificate deployment level setting at High (default)	Maybe. Certificates are deployed without tokens on hosts that are known to the primary server. The following topic explains what it means to be known to the primary server: See About NetBackup certificate deployment security levels. If the host is not known to the primary server, the certificate must be deployed using an authorization token. The primary server administrator creates a token to be used on the non-primary server host. See Creating authorization tokens.	If a host ID-based certificate is deployed, no further action is required. If a token is required, the host administrator of the non-primary server host must to obtain one from the primary server administrator and use it to deploy the host ID-based certificate. See Deploying host ID-based certificates.
Certificate deployment level setting at Medium	No. Certificates may be deployed on all hosts that request one. See Automatic host ID-based certificate deployment. Note: A certificate may not be deployed if the primary server cannot verify that the requested host name matches the IP from which the certificate request originated.	If a host ID-based certificate is deployed, no further action is required. If the primary server cannot verify the host name, a host ID-based certificate must be deployed using a token. See Deploying host ID-based certificates.
Certificate reissue	Yes. A certificate reissue requires a reissue token in most cases.	See Creating a reissue token.
Hosts that cannot communicate with the primary server directly (an example of this is NetBackup hosts in a demilitarized zone (DMZ)).	Yes. NetBackup can automatically detect whether a host has connectivity with the primary server or not. If there is no connectivity, NetBackup attempts to use the built-in HTTP tunnel on a media server to route the certificate request to the primary server. See About the communication between a NetBackup client located in a demilitarized zone and a primary server through an HTTP tunnel.	See Deploying certificates on a client that has no connectivity with the primary server.
Certificate deployment and generation for NAT clients	Yes. During NetBackup certificate deployment on a NAT client, you must provide an authorization token is must, irrespective of the certificate deployment security level that is set on the primary server. This is because, the primary server cannot resolve the host name to the IP address from which the request is sent.	For more information about the support for NAT clients in NetBackup, refer to the NetBackup Administrator's Guide, Volume I.