Search <book_title>...

Veritas NetBackup™ CloudPoint Install and Upgrade Guide

Last Published: 2022-03-28

Product(s): NetBackup (10.0)

Securing the connection to CloudPoint

In the CloudPoint server, you can upload CRLs of the external CA at /cloudpoint/eca/crl. The uploaded CRL does not work, if the crl directory is not present or empty.

For the data mover container, add this path against the ECA_CRL_PATH parameter in the /cloudpoint/openv/netbackup/bp.conf file.

Following three parameters are tuneable, you can add the entry under eca section in the /cloudpoint/flexsnap.conf file.

Table: ECA parameters

Parameter	Default	Value	Remarks
eca_crl_check	0 (Disabled)	0 (disabled) 1 (leaf) 2 (chain)	Certificate check level. Used to control the CRL/OCSP validation level for CloudPoint host connecting to On-prem/cloud workloads. 0 (disabled): No CRL/OCSP is performed during validation 1 (leaf): CRL/OSCP validation is performed only for leaf 2 (chain): CRL/OSCP validation is performed for the whole chain
eca_crl_refresh_ hours	24	Numerical value between 0 and 4830	Time interval in hours to update the CloudPoint CRLs cache from CA through the certificate CDP URL. Option is not applicable if `/cloudpoint/eca/crl` is present and contains CRL files. If it is set as 0, cache does not refresh.
eca_crl_path_sync_ hours	1	Numerical value between 1 and 720	Time interval in hours to update the CloudPoint CRL cache from `/cloudpoint/eca/crl`. Option is not applicable if `/cloudpoint/eca/crl` is not present or empty.

Parameter

Default

Value

Remarks

eca_crl_check

0 (Disabled)

0 (disabled)

1 (leaf)

2 (chain)

Certificate check level. Used to control the CRL/OCSP validation level for CloudPoint host connecting to On-prem/cloud workloads.

0 (disabled): No CRL/OCSP is performed during validation
1 (leaf): CRL/OSCP validation is performed only for leaf
2 (chain): CRL/OSCP validation is performed for the whole chain

eca_crl_refresh_ hours

Numerical value between 0 and 4830

Time interval in hours to update the CloudPoint CRLs cache from CA through the certificate CDP URL. Option is not applicable if /cloudpoint/eca/crl is present and contains CRL files. If it is set as 0, cache does not refresh.

eca_crl_path_sync_ hours

Numerical value between 1 and 720

Time interval in hours to update the CloudPoint CRL cache from /cloudpoint/eca/crl. Option is not applicable if /cloudpoint/eca/crl is not present or empty.

Note:

Cache is invalidated if any of ECA tuneable are added or modified manually inside the /cloudpoint/flexsnap.conf .

Note:

The scope of CRL is check is limited to Azure and Azure Stack only.