Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2017-09-25

Product(s): NetBackup (8.1)

Using the Certificate Management utility to issue and deploy host ID-based certificates

The process for host ID-based certificate deployment varies based on the certificate deployment security level configured on the master server. The levels are Medium, High, and Very High. By default, the security level is High.

A host ID-based certificate is automatically deployed on the master server during upgrade or installation.

Host ID-based certificates are deployed on hosts after confirming the fingerprint. Whether an authorization token is required or not depends on the security level.

These levels determine the nature of the Certificate Authority (CA) checks that are performed when the CA receives a certificate request from a NetBackup host. Select the certificate deployment level according to the security requirements of your NetBackup environment.

See About certificate deployment security levels.

In some scenarios, certificate deployment requires the use of authorization tokens that are managed by a NetBackup administrator. The NetBackup administrator creates and shares these tokens with the administrators of individual hosts for certificate deployment on their local hosts. Certificate deployment can happen easily, allowing for scalable deployment across multiple NetBackup hosts without requiring NetBackup administrator intervention.

Table: Deployment requirements at each certificate deployment level or scenario

Certificate deployment level or scenario	Is an authorization token required?	Deploy host ID-based certificate?
Certificate deployment level setting at Very High	Yes. All certificate requests require an authorization token. The master server administrator creates a token to be used on the non-master host: See Creating authorization tokens.	The host administrator of the non-master server host must obtain an authorization token from the master server administrator and use it to deploy the host ID-based certificate. See Deploying host ID-based certificates.
Certificate deployment level setting at High (default)	Maybe. Certificates are deployed without tokens on hosts that are known to the master server. The following topic explains what it means to be known to the master server: See About certificate deployment security levels. If the host is not known to the master server, the certificate must be deployed using an authorization token. The master server administrator creates a token to be used on the non-master server host. See Creating authorization tokens.	If a host ID-based certificate is deployed, no further action is required. If a token is required, the host administrator of the non-master server host must to obtain one from the master server administrator and use it to deploy the host ID-based certificate. See Deploying host ID-based certificates.
Certificate deployment level setting at Medium	No. Certificates may be deployed on all hosts that request one. See Automatic host ID-based certificate deployment. Note: A certificate may not be deployed if the master server cannot verify that the requested host name matches the IP from which the certificate request originated.	If a host ID-based certificate is deployed, no further action is required. If the master server cannot verify the host name, a host ID-based certificate must be deployed using a token. See Deploying host ID-based certificates.
Certificate reissue	Yes. A certificate reissue always requires a token.	See Creating a reissue token.
Hosts that cannot communicate with the master server directly (an example of this is NetBackup hosts in a demilitarized zone (DMZ)).	Yes. NetBackup can automatically detect whether a host has connectivity with the master server or not. If there is no connectivity, NetBackup attempts to use the built-in HTTP tunnel on a media server to route the certificate request to the master server. See About the communication between a NetBackup client located in a demilitarized zone and a master server through an HTTP tunnel.	See Deploying certificates on a client that has no connectivity with the master server.