Search <book_title>...

Veritas NetBackup™ Cloud Administrator's Guide

Last Published: 2017-07-24

Product(s): NetBackup (8.0)

NetBackup CloudStore Service Container security certificates

The NetBackup CloudStore Service Container requires a digital security certificate so that it starts and runs. How the security certificate is provisioned depends on the release level of NetBackup, as follows:

NetBackup 8.0 and later

The NetBackup hosts that run the CloudStore Service Container require both a host ID-based certificate and a host name-based certificate. You may have to install the certificates on those hosts.

See Deploying host name-based certificates.

See Deploying host ID-based certificates.

If the NetBackup master server is clustered, you must ensure that the active node and the passive nodes have both host named-based and host-ID based certificates. See the NetBackup Security and Encryption Guide for NetBackup 8.0 or later:

http://www.veritas.com/docs/DOC5332

NetBackup 7.7 and 7.7.x

The NetBackup hosts that run the CloudStore Service Container require a host name-based certificate. You must use a command to install it on a media server.

See Deploying host name-based certificates.

Note:

You do not need to generate a security certificate, if you have already generated it before configuring the cloud storage.

The host name-based security certificates expire after one year. NetBackup automatically replaces existing certificates with new ones as needed.

Note:

The security certificates that are provisioned for other NetBackup features or purposes satisfy the certificate requirement for the NetBackup CloudStore Service Container. The NetBackup Access Control feature uses security certificates, and the NetBackup Administration Console requires security certificates for interhost communication.

If the NetBackup master server is clustered, you must ensure that the active node and the passive node have host named-based certificates. See the 7.7.x version of the NetBackup Security and Encryption Guide:

http://www.veritas.com/docs/DOC5332

NetBackup releases earlier than 7.7

The NetBackup CloudStore Service Container generates a self-signed certificate for authentication. The certificate expires after 365 days. The NetBackup CloudStore Service Container automatically replaces existing certificates with new ones as needed.

The NetBackup CloudStore Service Container in NetBackup releases earlier than 7.7 does not recognize the certificates that a NetBackup 7.7 or later master server generates. If your security policy prohibits self-signed certificates, you must run NetBackup 7.7 or later on the media servers that you use for cloud storage.

Where the media server security certificates reside depend on the release level of NetBackup, as follows:

NetBackup 7.7 and later

The certificate name is the host name that you used when you configured the NetBackup media server software on the host. The path for the certificate is as follows, depending on operating system:

UNIX/Linux: /usr/openv/var/vxss/credentials
Windows: install_dir\Veritas\NetBackup\var\VxSS\credentials

NetBackup releases earlier than 7.7

The following are the pathnames to the certificate, depending on operating system:

UNIX/Linux: /usr/openv/lib/ost-plugins/cssc.crt
Windows: install_path\Veritas\NetBackup\bin\ost-plugins\cssc.crt

If the certificate becomes corrupt or expires, delete the old certificate and restart the service to regenerate a new certificate.

See About the NetBackup CloudStore Service Container.