Veritas NetBackup™ Appliance Security Guide

To create a minimal self-signed certificate on a Linux computer and import it into the RMM console:

1. Run the following command to generate the private key called ipmi.key:

   $ openssl genrsa -out ipmi.key 2048
   	
   Generating RSA private key, 2048 bit long modulus
   	
   .....+++
   
   	.+++
   
   	e is 65537 (0x10001)
   

2. Generate a certificate signing request called ipmi.csr using ipmi.key, filling in each field with their appropriate values:

   Note:

   To avoid extra warnings in your browser, set the CN to the fully qualified domain name of the RMM console. You are about to enter what is called a Distinguished Name or a DN.

   $ openssl req -new -key ipmi.key -out ipmi.csr
   

   Refer to the following guidelines to enter information to be incorporated into your certificate request:

   Country Name (2 letter code) [AU]:	Enter your Country's name. For example, US.
   State or Province Name (full name) [Some-State]:	Enter your State's or Province's name. For example, OR.
   Locality Name (eg, city) []:	Enter your Locality name. For example, Springfield.
   Organization Name (eg, company) [Internet Widgits Pty Ltd]:	Enter your Organization's name. For example, Veritas.
   Organizational Unit Name (eg, section) []:	Enter your Organization Unit's name.
   Common Name (eg, YOUR name) []:	Enter hostname.your.company.
   Email Address []:	Enter your email address. For example, email@your.company .
   A challenge password []:	Enter the appropriate challenge password, which is the extra attribute to be sent with your certificate request.
   An optional company name []:	Enter the appropriate optional company name, which is the extra attribute to be sent with your certificate request.

   Note:

   Enter '.', to leave any field blank.

3. Sign ipmi.csr with ipmi.key and create a certificate called ipmi.crt that is valid for 1 year:

   $ openssl x509 -req -in ipmi.csr 
   
   -out ipmi.crt -signkey ipmi.key 
   
   -days 365
   
   	Signature ok
   
   	subject=/C=US/ST=OR/L=Springfield
   
   /O=Veritas/OU=Your OU/
   
   CN=hostname.your.company/
   
   emailAddress=email@your.company
   	
   
   Getting Private key
   

4. Copy the generated self-signed certificate and the private key files to a host that has access to the appliance RMM console.
5. Log in to the RMM console.
6. Click Configuration > SSL Certification.

   The appliance displays the SSL Upload page.

7. From the SSL Upload page, do the following:

   • Click New SSL Certificate and select the copied self-signed certificate file.

   • Click New Private Key and select the copied key file.

   • Click Upload.

8. A warning may appear that states an SSL certificate already exists. Press OK to continue.
9. A confirmation appears stating that the certificate and the key were uploaded successfully. Press OK to restart the web service.
10. Close and reopen the RMM console to verify that the new certificate is being presented.