Search <book_title>...

NetBackup™ Snapshot Manager for Data Center Administrator's Guide

Last Published: 2023-10-23

Product(s): NetBackup (10.3.0.1, 10.3)

Securing the connection to NetBackup Snapshot Manager for Data Center

Supported scenarios:
- Primary server and Snapshot Manager for Data Center must be with ECA or NBCA.
- For NBCA and ECA mixed mode continue with ECA mode for NetBackup Snapshot Manager for Data Center installation.
Unsupported scenario: Primary with NBCA and NetBackup Snapshot Manager for Data Center with ECA and vice versa.

In the NetBackup Snapshot Manager for Data Center, you can upload CRLs of the external CA at /cloudpoint/eca/crl file. The uploaded CRL does not work, if the crl directory is not present or is empty.

Following three parameters are tuneable, you can add the entry under eca section in the /cloudpoint/flexsnap.conf file.

Table: ECA parameters

Parameter	Default	Value	Remarks
eca_crl_check	0 (Disabled)	0 (disabled) 1 (leaf) 2 (chain)	Certificate check level. Used to control the CRL/OCSP validation level for NetBackup Snapshot Manager for Data Center host connecting to On-prem/cloud workloads. 0 (disabled): No CRL/OCSP is performed during validation. 1 (leaf): CRL/OSCP validation is performed only for leaf. 2 (chain): CRL/OSCP validation is performed for the whole chain.
eca_crl_refresh_ hours	24	Numerical value between 0 and 4830	Time interval in hours to update the NetBackup Snapshot Manager for Data Center CRLs cache from CA through the certificate CDP URL. Option is not applicable if the `/cloudpoint/eca/crl` file is present and contains CRL files. If it is set as 0, cache does not refresh.
eca_crl_path_sync_ hours	1	Numerical value between 1 and 720	Time interval in hours to update the NetBackup Snapshot Manager for Data Center CRL cache from `/cloudpoint/eca/crl` file. Option is not applicable if the `/cloudpoint/eca/crl` file is not present or empty.

Parameter

Default

Value

Remarks

eca_crl_check

0 (Disabled)

0 (disabled)

1 (leaf)

2 (chain)

Certificate check level. Used to control the CRL/OCSP validation level for NetBackup Snapshot Manager for Data Center host connecting to On-prem/cloud workloads.

0 (disabled): No CRL/OCSP is performed during validation.
1 (leaf): CRL/OSCP validation is performed only for leaf.
2 (chain): CRL/OSCP validation is performed for the whole chain.

eca_crl_refresh_ hours

Numerical value between 0 and 4830

Time interval in hours to update the NetBackup Snapshot Manager for Data Center CRLs cache from CA through the certificate CDP URL. Option is not applicable if the /cloudpoint/eca/crl file is present and contains CRL files. If it is set as 0, cache does not refresh.

eca_crl_path_sync_ hours

Numerical value between 1 and 720

Time interval in hours to update the NetBackup Snapshot Manager for Data Center CRL cache from /cloudpoint/eca/crl file. Option is not applicable if the /cloudpoint/eca/crl file is not present or empty.

For more information, refer to the following sections of the NetBackup™ Security and Encryption Guide.

About the host ID-based certificate revocation list
When an authorization token is required during certificate deployment.

Note:

Cache is not validated if any of the ECA tuneable are added or modified manually inside the /cloudpoint/flexsnap.conf file.

Certificate revoking for Snapshot Manager for Data Center

For detailed information on NetBackup CA and certificates, refer to the "NetBackup CA and NetBackup certificates" chapter of NetBackup™ Security and Encryption Guide.

The following table provides the regeneration steps to be performed for revoking the certificates in Snapshot Manager for Data Center:

Use case	Commands
CA migration	NBCA to ECA: # flexsnap_configure renew --ca /eca2/trusted/cacerts.pem --key /eca2/private/key.pem --chain /eca2/cert_chain.pem Enrolling external CA certificates with NetBackup... Snapshot Manager certificate is renewed. ECA to NBCA: # flexsnap_configure renew --token <reissue-token> Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed.
Post revoke certificate regeneration for NBCA	# flexsnap_configure renew --token <reissue-token> Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed.
Post revoke certificate regeneration for ECA	# flexsnap_configure renew --ca /eca2/trusted/cacerts.pem --key /eca2/private/key.pem --chain /eca2/cert_chain.pem Enrolling external CA certificates with NetBackup... Snapshot Manager certificate is renewed.
Post migration regenerate certificates for ECA/NBCA	# flexsnap_configure renew --hostnames new-nbsm.veritas.com --token <authentication-token> Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed. Please run 'flexsnap_configure renew --internal --hostnames <nbsm_fqdn> to renew Snapshot Manager's internal CA and certificates.
Certificate regeneration for extension	# flexsnap_configure renew --extension --primary <nbsm_fqdn> --token <extension_token>
Certificate rotation	# flexsnap_configure renew --force Generating new NetBackup Host-ID certificate... Snapshot Manager certificate is renewed.
Internal flexsnap CA certificate in case of migration, disaster recovery scenarios	# flexsnap_configure renew --internal --hostnames <nbsm_fqdn> Renewed Flexsnap CA ... skip Renewed rabbitmq certificate ... done Renewed postgresql certificate ... done Renewed listener certificate ... done Renewed workflow certificate ... done Renewed scheduler certificate ... done Renewed agent certificate ... done Renewed client certificate ... done Renewed certmaster certificate ... done Renewed agent certificate ... done Renewed notification certificate ... done Renewed client certificate ... done Renewed client certificate ... done Renewed mongodb certificate ... done Renewed coordinator certificate ... done Renewed config certificate ... done Renewed idm certificate ... done Renewed agent certificate ... done Renewed client certificate ... done Renewed policy certificate ... done Snapshot Manager's CA and certificates are renewed. Restart the Snapshot Manager stack using 'flexsnap_configure restart' to take effect.