Search <book_title>...

Veritas NetBackup™ Appliance Security Guide

Last Published: 2019-12-16

Product(s): Appliances (3.0, 2.7.3, 2.7.2, 2.7.1)

Platform: NetBackup Appliance OS

Implementing third-party SSL certificates

You can manually add and implement third-party certificates for the web service support. The appliance uses the Java KeyStore as the repository of security certificates. A Java KeyStore (JKS) is a repository of security certificates, like the authorization certificates or the public key certificates that are used for instance in SSL encryption. To implement the third-party certificates in the appliance you must log in as the root account.

Note:

Contact Veritas Technical Support if you need assistance with this procedure.

To implement third-party SSL certificates:

Prepare the keystore file for web services.
This task varies with the type of PKCS (Public-key Cryptography Standards) you use. No matter which PKCS type you choose, the certificate must contain the following extension:
SubjectAlternativeName [
DNSName: localhost
IP addresses: 127.0.0.1
Ensure that the SubjectAlternativeName certificate extension contains all the appliance hostnames and IP addresses by which the appliance can be reached, including localhost and 127.0.0.1. You must include the fully qualified hostnames and the short names.
The following describes the preparation required to use PKCS# 7 and PKCS# 12 standard formats:
- PKCS#7 (X.509) format
  Use the following link:
  convert certificate
- PKCS#12 format
  Do the following:
  - To convert a PEM formatted x509 Cert and Private Key to a PKCS# 12, type the following commands:
    openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat -CAfile ca.crt -caname root
    For more information on openssl usage, refer to https://www.openssl.org/.
  - At the bottom of the certificate file server.crt, make sure that you append the chain of intermediary certificate authority (CA) certificates, up to and including the root CA certificate.
  - Make sure that you secure the PKCS #12 file with a password. When the password is not applied to the file, you may get a null reference exception when you try to import the file.
  - To convert the PKCS #12 file to a Java Keystore, type the following commands:
    keytool -importkeystore -deststorepass appliance -destkeypass appliance -destkeystore keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass yourpassword -alias tomcat
    Note:
    Make sure to specify the same password for the -deststorepass and -destkeypass options. Otherwise, you may get an exception when the web server starts. For the password, only alphanumeric characters are supported. The default password is appliance. Also, make sure to specify tomcat for the -alias option. Otherwise, you may get an exception when the web server starts.
    For more information on keytool usage, refer to the following link:
    http://docs.oracle.com/javase/8/docs/technotes/tools/solaris/keytool.html
Type the following command to shut down the database and relevant services:
/opt/IMAppliance/scripts/infraservices.sh database stop
/opt/IMAppliance/scripts/infraservices.sh webserver stop
Backup the existing web server keystore file with the following command:
cp /opt/apache-tomcat/security/keystore /opt/apache-tomcat/security/keystore.orig
Replace the existing keystore file from the /opt/apache-tomcat/security/ directory with the new keystore file.
Set the permissions to the new keystore file:
chmod 700 /opt/apache-tomcat/security
chmod 600 /opt/apache-tomcat/security/keystore
chown - R tomcat:tomcat /opt/apache-tomcat/security
Type the following command to update the web server configuration if you choose to use your own non-default password in the previous steps:
/opt/apache-tomcat/vrts/scripts/tomcat_instance.py update --keystore --password <your password>
Update the Tomcat_Keystore and Tomcat_Keystore_Passwd settings in the /etc/rc.d/init.d/as-functions file.
The server-side and client-side certificates of the MongoDB are stored in /config/mongodb_ssl_keycert.pem. Import the certificates to the file as follows:
/usr/bin/openssl pkcs12 -in server.p12 -out /config/mongodb_ssl_keycert.pem -passin pass: <keyPassword> -passout pass: <keyPassword>
Edit the line containing sslPEMKeyPassword in /etc/mongod.conf and specify the passphrase of the private key (typically appliance).
Type the following commands to restart the web service:
/opt/IMAppliance/scripts/infraservices.sh database start
/opt/IMAppliance/scripts/infraservices.sh webserver start
Type the following commands to restart the AutoSupport Service:
service as-alertmanager stop
service as-analyzer stop
service as-transmission stop
service as-alertmanager start
service as-analyzer start
service as-transmission start