Veritas NetBackup™ Appliance Security Guide

To create and implement an external IPMI SSL certificate

1. Generate the private key.

   Note:

   A pass phrase is required to generate the key. This example procedure uses "1234". The pass phrase can be removed later.

   Perform the following tasks to generate the private key:

   • Log in to the NetBackup Appliance Shell Menu (shell menu) and enter the maintenance mode with the following command:

     Support > Maintenance

   • Enter the name of the private key file with the following command, followed by the pass phrase when prompted:

     openssl genrsa -aes256 -out privkey5250.pem 2048

   • Display the private key file content with the following command:

     cat privkey5250.pem

   • Check the private key file with the following command, followed by the pass phrase when prompted:

     openssl rsa -in privkey5250.pem -check - noout

2. Generate the CSR for the IPMI.

   The CSR file is created as a .req file and is uploaded to the CMP request.

   • Enter the name of the CSR with the following command, followed by the pass phrase when prompted:

     openssl req -new -key privkey5250.pem - sha256 -out csr_ipmi.req -subj/CN=<HostFQDN>/OU=<>/O=<>/C=<>/L=<>/ST=<>

     Where CN is the server IPMI FQDN name, OU is the organizational unit, O is the organization, C is the country, L is the location, and ST is the state. The output file name result is ipmi5250.req.

   • Verify the CSR with the following command:

     openssl req -in ipmi5250.req -subject -verify - noout

   • Display the CSR file content with the following:

     cat ipmi5250.req

     These contents are used in the CSR request on the CMP website.

   • You will receive the new certificate in an email. Save the certificates for IPMI and name the file as ipmi5250.cer.

   • Display and view the certificate details with the following command:

     openssl x509 -text -in certificate.cer

3. Implement the IPMI certificate as follows:

   • Remove the pass phrase from the private key with the following command, followed by the pass phrase when prompted:

     openssl rsa -in privkey5250.pem -out privkey.pem

   • If the Remote Management Console (RMM) uses version BMC 2.86 or later, concatenate the CA root certificate, the CA intermediate certificate, and the server certificate into a single .pem file. For example:

     cat ipmi5250.cer root-cacert.pem root-intermediatecert.pem > ipmi5250certificate.pem

     If the RMM uses a BMC version earlier than 2.86, you must only use the server certificate that you received from the third-party certificate authority to upload.

   • Copy the ipmi5250certificate.pem file to a Windows server where you can connect to the RMM console from the web browser.

   • Log in to the RMM console and click Configuration > SSL Certification on the left screen menu.

   • Click Choose file. When prompted for a new SSL certificate, select ipmi5250certificate.pem for New SSL certificate and privkey.pem for New Private Key.

   • Click Upload. When a prompt appears to indicate that the certificate already exists, click OK. A message appears to indicate that the certificate was uploaded successfully.

   • The RMM console reboots automatically. Wait a few minutes, then log in and reload the webpage to confirm that the certificate has been applied successfully.