Search <book_title>...

Veritas NetBackup™ Troubleshooting Guide

Last Published: 2020-09-14

Product(s): NetBackup (8.3.0.1)

Troubleshooting Windows certificate store issues

The web service certificate is issued by an unknown certificate authority when using Windows certificate store

Problem

The web service certificate cannot be trusted while enrolling the host certificate.

Cause

This issue is caused by one of the following:

The web service certificate that is used for communication is not configured properly.
The root certificate in the certificate chain of web service certificate is not present in the Trusted Root Certification Authorities of the Windows certificate store.

Solution

To resolve the issue, review the following causes and run the following command to determine the current state of the problem.

Install_Path/bin/ nbcertcmd -enrollCertificate -preCheck -server server_name

Install_Path refers to the following:

On Windows: VERITAS\NetBackup\bin

On Unix: /usr/openv/netbackup/bin

Solution for the cause: The web service certificate that is used for communication is not configured properly

Check if web server is configured with valid certificate along with its CA certificates.

Run the following command to list the certificates that are configured for the web server.
Install_Path/nbcertcmd -listallcertificates -jks
On Windows: C:\Program Files\ VERITAS\NetBackup\bin\nbcertcmd -listallcertificates -jks
On Unix: /usr/openv/netbackup/bin/netbackup/bin/nbcertcmd -listallcertificates -jks
Ensure that all the certificates in the chain (except the root CA certificate) are present in the jks.
Check the following parameters in the nbcertcmd -listallcertificates -jks output.
- Alias name: eca
- Entry type: PrivateKeyEntry
If they are not present, add the CA chain in the end of the entity certificate file that is the web service certificate file. The web service certificate should be at the top, its issuer CA certificate is below that, issuer of that CA certificate is below that, and so on.
If the certificate chain has only two certificates ( root certificate and web service certificate), the certificate file has only one certificate that is the web service certificate.
Run the configureWebServerCerts command.

Solution for the cause: The root certificate in the certificate chain of the web service certificate is not present in the Windows certificate store

Run the certlm.msc command.
In the certificate management window, open the store named Trusted Root Certificate Authorities.
The Trusted Root Certificate Authorities store contains all the self-signed certificates that are trusted by that machine.
- In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.
- File > Add Remove Snap in.
- Select the certificates from the left side.
- Click Add.
- Select the Computer account.
- Click Next > Finish > OK.
- Click Trusted Root Certification Authorities > Certificates.
- Check if the root CA certificate in the certificate chain used to configure the web service is present in the Trusted Root Certificate Authorities store.
If the root CA certificate is not present, click All Actions > Import, select .PEM / .CRT / .CER file of the certificate and click Import.
All the certificates should be imported in the local machine store and not in the current user store.
You can verify the current store in the certificate management window.

Problem

Certificate's public key algorithm is not supported.

The public key algorithm is not supported by NetBackup. Currently only the RSA algorithm is supported.

Cause

The certificate with given path exists in windows cert store but its signature algorithm is not supported.

Solution

You need to use the certificate with public key algorithm that is supported by NetBackup.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.

Problem

Private key for the given certificate is not available.

The certificate in specified by the path does not have a corresponding private key imported in Windows certificate store.

Cause

This is typically caused by importing a .crt, .cer, or .pem certificate manually in the Windows certificate store instead of .pfx.

Solution

Ensure that the certificate has its private key imported.

Run the certlm.msc command.
In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.
File > Add Remove Snap in
Navigate to your certificate.
Open your certificate by double-clicking it.
The certificate with the private key should have a message stating that you have a private key corresponding to this certificate.
If certificate is to be manually enrolled, import a .pfx file and not just the .cer or .crt file.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.

Problem

Certificate with the given subject name is not found

Could not find the certificate when a special keyword $hostname is used in ECA_CERT_PATH

Cause

The certificate does not exist in the local machine store for the given ECA_CERT_PATH.

One of the attributes from store name, issuer name, or subject name does not match the one in the local machine store.

Solution

Check if the certificate exists in the local machines store. Do the following:
- Run the certlm.msc command.
  In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.
  File > Add Remove Snap in.
- Check if the certificate exist
Verify that the following criteria are satisfied:
- Certificate location is a path or comma separated paths where each path is specified using store name, issuer name and subject name separated by (\) slash.
- Store name must exactly match the store your certificate is in.
- Issuer name and subject name should always be part of ECA_CERT_PATH. If nothing is specified for issuer name, it means any issuer can be considered.
- $hostname is special keyword and can be used in subject name. When finding the certificate $hostname is replaced with actual FQDN of the host.
- When using $hostname, the certificate must have FQDN as a part of CN.
- Double quotes to be used in case the backward slash (\) is present in the actual Store name, Issuer name or Subject name.
- Though the subject name is always part of ECA_CERT_PATH, CN=example CN is not allowed.
  The subject in ECA_CERT_PATH should be any sub-string of actual CN, OU, O, L, S, C and so on.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.