Search <book_title>...

Veritas NetBackup™ Appliance Security Guide

Last Published: 2018-07-02

Product(s): Appliances (3.1.1)

Platform: 5220,5230,5240,5330,5340

Implementing third-party SSL certificates

You can manually add and implement third-party certificates for the web service support. The appliance uses the Java KeyStore as the repository of security certificates. A Java KeyStore (JKS) is a repository of security certificates, like the authorization certificates or the public key certificates that are used for instance in SSL encryption. To implement the third-party certificates in the appliance you must log in as the root account.

Note:

Contact Veritas Technical Support if you need assistance with this procedure.

To implement third-party SSL certificates:

Prepare the keystore file for web services.

The procedure varies with the type of PKCS (Public-key Cryptography Standards) you use. And, no matter what PKCS type you choose, the keystore file must contain the following keywords:

SubjectAlternativeName [

DNSName: hostnames and IP addresses

Where hostnames is the fully qualified domain name of the appliance and IP address corresponds to the fully qualified domain name of the appliance.

]

The following table describes the steps to use PKCS# 7 and PKCS# 12 standard formats.

PKCS format	Preparing keystore files
PKCS#7 or X.509 format	You can use the following link: convert certificate
PKCS#12 format	Do the following: To convert PEM formatted x509 Cert and Private Key to a PKCS# 12, type the following commands: openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat -CAfile ca.crt -caname root For more information on openssl usage, refer to https://www.openssl.org/. Note: Ensure that you secure the PKCS #12 file with a password. When the password is not applied to the file, you may get a null reference exception when you try to import the file To convert the pkcs12 file to a Java Keystore, type the following commands: keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some- password -alias tomcat Note: Specify the same password for -deststorepass and -destkeypass options. Otherwise, you may get an exception when the web server starts. For the password, only alphanumeric characters are supported. The default password is appliance. Specify `tomcat` for the -alias option. Otherwise, you may get an exception when the web server starts. Note: For more information on keytool usage, refer to the following link: http://docs.oracle.com/javase/8/docs/technotes/tools/solaris/keytool.html

PKCS format

Preparing keystore files

PKCS#7 or X.509 format

You can use the following link:

convert certificate

PKCS#12 format

Do the following:

To convert PEM formatted x509 Cert and Private Key to a PKCS# 12, type the following commands:
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat -CAfile ca.crt -caname root
For more information on openssl usage, refer to https://www.openssl.org/.
Note:
Ensure that you secure the PKCS #12 file with a password. When the password is not applied to the file, you may get a null reference exception when you try to import the file
To convert the pkcs12 file to a Java Keystore, type the following commands:
keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some- password -alias tomcat
Note:
Specify the same password for -deststorepass and -destkeypass options. Otherwise, you may get an exception when the web server starts. For the password, only alphanumeric characters are supported. The default password is appliance.
Specify tomcat for the -alias option. Otherwise, you may get an exception when the web server starts.
Note:
For more information on keytool usage, refer to the following link:
http://docs.oracle.com/javase/8/docs/technotes/tools/solaris/keytool.html

Type the following commands to shut down the database and relevant services:
/opt/IMAppliance/scripts/infraservices.sh database stop
systemctl stop nginx
/opt/IMAppliance/scripts/infraservices.sh database stop
/opt/IMAppliance/scripts/infraservices.sh webserver stop
Replace the existing keystore file with your new keystore file in the following directory:
/opt/apache-tomcat/security/
Set the permissions to the new keystore file:
chmod 700 /opt/apache-tomcat/security
chmod 600 /opt/apache-tomcat/security/keystore
chown - R tomcat:tomcat /opt/apache-tomcat/security
Type the following command to update the web server configuration if you choose to use your own non-default password in the previous steps:
/opt/apache-tomcat/vrts/scripts/tomcat_instance.py update --keystore --password <your password>
Update the Tomcat_Keystore and Tomcat_Keystore_Passwd settings in the /etc/rc.d/init.d/as-functions file.
Import certificates to the mongo_server_part_pam file, and get server-Cert from /etc/vxos-ssl/cert.conf, and then import certificates to it.
/usr/bin/openssl pkcs12 -in server.p12 -out <server_cert> -passin pass:
<keyPassword> -passout pass: <keyPassword>
Import certificates to the client_part_pam file, and get client_cert from /etc/vxos-ssl/cert.conf, and then import certificates to it:
/usr/bin/openssl pkcs12 -nokeys -in server.p12 -out <server_cert> -passin pass:
<keyPassword> -passout pass: <keyPassword>
If the customized password is different than the pem_password in /etc/vxos-ssl/cert.conf, modify /etc/vxos-ssl/cert.conf to use the customized password.
Type the following commands to restart nginx:
/usr/sbin/update-nginx-conf.sh
service nginx stop
service nginx start
Type the following commands to restart the web service:
/opt/IMAppliance/scripts/infraservices.sh database start
/opt/IMAppliance/scripts/infraservices.sh webserver start
Type the following commands to restart the AutoSupport Service:
service as-alertmanager stop
service as-analyzer stop
service as-transmission stop
service as-alertmanager start
service as-analyzer start
service as-transmission start