Skip to main content
NetApp Backup and Recovery

Set up CA certificates for NetApp Backup and Recovery

Contributors netapp-mwallis
PDFs

Set up CA certificates so NetApp Backup and Recovery can validate secure connections to StorageGRID or ONTAP. Follow the steps that apply to your environment and the systems you want to protect.

Create a CA certificate for StorageGRID

If communication between the NetApp Backup and Recovery containers and StorageGRID should verify the StorageGRID certificate, complete the following steps.

The generated certificate should use the same common name (CN) and Subject Alternative Name that you provided in NetApp Backup and Recovery when you activated the backup.

Steps

  1. Follow the steps in the StorageGRID documentation to create the StorageGRID certificate.

    StorageGRID information on configuring certificates

  2. Update StorageGRID with the certificate if you have not already done so.

  3. Log in to the Console agent as the root user. Run:

    sudo su

  4. Find the NetApp Backup and Recovery (Cloud Backup Service) Docker volume. Run:

    docker volume ls | grep cbs

    Output example:

    local service-manager-2_cloudmanager_cbs_volume"
    Note The volume name differs among Standard, Private, and Restricted deployment modes. This example uses Standard mode. Refer to NetApp Console deployment modes.

  5. Find the mount point of the NetApp Backup and Recovery volume. Run:

    docker volume inspect service-manager-2_cloudmanager_cbs_volume | grep Mountpoint

    Output example:

    "Mountpoint": "/var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data"
    Note The mount point differs among Standard, Private, and Restricted deployment modes. This example shows a Standard cloud deployment. Refer to NetApp Console deployment modes.

  6. Change to the mount point directory. Run:

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  7. If the StorageGRID certificate is signed by the root CA and an intermediate CA, append both pem files into one file named sgws.crt in the current location. Do not add the leaf certificate to this file.

Steps for the cloudmanager_cbs container

Enable StorageGRID server certificate verification in NetApp Backup and Recovery (Cloud Backup Service).

  1. Change to the Docker volume that you found in the earlier steps.

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  2. Change to the config directory.

    cd cbs_config

  3. Create and save a configuration file as shown below with one of the following names, based on your deployment environment:

    • production-customer.json for Standard mode and Restricted mode deployments

    • darksite-customer.json for Private mode deployments

      Refer to NetApp Console deployment modes.

      Configuration file

      {
  "protocols": {
    "sgws": {
      "certificates": {
        "reject-unauthorized": true,
        "ca-bundle": "/config/sgws.crt"
      }
    }
  }
}

  4. Exit the container. Run:

    exit

  5. Restart cloudmanager_cbs. Run:

    docker restart cloudmanager_cbs

Steps for the cloudmanager_cbs_catalog container

Next, enable StorageGRID server certificate verification for the Cataloging Service.

  1. Change to the Docker volume:

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  2. Configure the catalog. Run:

    cd cbs_catalog_config

  3. Create a configuration file as shown below with one of the following names, based on your deployment environment:

    • production-customer.json for Standard mode and Restricted mode deployments

    • darksite-customer.json for Private mode deployments

      Refer to NetApp Console deployment modes.

      Catalog configuration file

      {
  "protocols": {
    "sgws": {
      "certificates": {
        "reject-unauthorized": true,
        "ca-bundle": "/config/sgws.crt"
      }
    }
  }
}

  4. Restart the catalog. Run:

    docker restart cloudmanager_cbs_catalog

Update the Console agent certificate with the StorageGRID certificate based on the agent operating system

Ubuntu

  1. Copy the SGWS certificate to /usr/local/share/ca-certificates. Here is an example:

    cp /config/sgws.crt /usr/local/share/ca-certificates/

    where sgws.crt is the root CA certificate.

  2. Update the host certificates with the StorageGRID certificate. Run:

    sudo update-ca-certificates

Red Hat Enterprise Linux

  1. Copy the SGWS certificate to /etc/pki/ca-trust/source/anchors/.

    cp /config/sgws.crt /etc/pki/ca-trust/source/anchors/

    where sgws.crt is the root CA certificate.

  2. Update the host certificates with the StorageGRID certificate.

    update-ca-trust extract

  3. Update the ca-bundle.crt

    cd /etc/pki/tls/certs/
openssl x509 -in ca-bundle.crt -text -noout

  4. To check whether the certificates are present, run the following command:

    openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs | grep subject | head

Create a CA certificate for ONTAP

If communication between the NetApp Backup and Recovery containers and ONTAP should validate the ONTAP certificate, complete the following steps.

NetApp Backup and Recovery uses the cluster management IP address to connect to ONTAP. Enter the cluster IP address in the Subject Alternative Name fields of the certificate. Specify this value when you generate the CSR in System Manager.

Use the System Manager documentation to create a new CA certificate for ONTAP.

Steps

  1. Log in to the Console agent as root. Run:

    sudo su

  2. Find the NetApp Backup and Recovery Docker volume. Run:

    docker volume ls | grep cbs

    Output example:

    local service-manager-2_cloudmanager_cbs_volume
    Note The volume name differs among Standard, Private, and Restricted deployment modes. This example shows a Standard cloud deployment. Refer to NetApp Console deployment modes.

  3. Find the mount point for the volume. Run:

    docker volume inspect service-manager-2_cloudmanager_cbs_volume | grep Mountpoint

    Output example:

    "Mountpoint": "/var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data
    Note The mount point differs among Standard, Private, and Restricted deployment modes. This example shows a Standard cloud deployment. Refer to NetApp Console deployment modes.

  4. Change to the mount point directory. Run:

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  5. Complete one of the following steps:

    • If the ONTAP certificate is signed by the root CA and an intermediate CA, then append the pem files of both into one file named ontap.crt in the current location.

    • If the ONTAP certificate is signed by a single CA, then rename the pem file as ontap.crt and copy it in the current location. Do not add the leaf certificate to this file.

Steps for the cloudmanager_cbs container

Next, enable ONTAP server certificate verification in NetApp Backup and Recovery (Cloud Backup Service).

  1. Change to the Docker volume that you found in the earlier steps.

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  2. Change to the config directory. Run:

    cd cbs_config

  3. Create a configuration file as shown below with one of the following names, based on your deployment environment:

    • production-customer.json for Standard mode and Restricted mode deployments

    • darksite-customer.json for Private mode deployments

      Refer to NetApp Console deployment modes.

      Configuration file

      {
  "ontap": {
    "certificates": {
      "reject-unauthorized": true,
      "ca-bundle": "/config/ontap.crt"
    }
  }
}

  4. Exit the container. Run:

    exit

  5. Restart NetApp Backup and Recovery. Run:

    docker restart cloudmanager_cbs

Steps for the cloudmanager_cbs_catalog container

Enable ONTAP server certificate verification for the Cataloging Service.

  1. Change to the Docker volume. Run:

    cd /var/lib/docker/volumes/service-manager-2_cloudmanager_cbs_volume/_data

  2. Run:

    cd cbs_catalog_config

  3. Create a configuration file as shown below with one of the following names, based on your deployment environment:

    • production-customer.json for Standard mode and Restricted mode deployments

    • darksite-customer.json for Private mode deployments

      Refer to NetApp Console deployment modes.

      Configuration file

      {
  "ontap": {
    "certificates": {
      "reject-unauthorized": true,
      "ca-bundle": "/config/ontap.crt"
    }
  }
}

  4. Restart NetApp Backup and Recovery. Run:

    docker restart cloudmanager_cbs_catalog

Create a certificate for both ONTAP and StorageGRID

If you need to enable the certificate for both ONTAP and StorageGRID, then the configuration file looks like this:

Configuration file for both ONTAP and StorageGRID

{
  "protocols": {
    "sgws": {
      "certificates": {
        "reject-unauthorized": true,
        "ca-bundle": "/config/sgws.crt"
      }
    }
  },
  "ontap": {
    "certificates": {
      "reject-unauthorized": true,
      "ca-bundle": "/config/ontap.crt"
    }
  }
}