Article Number: 000192537
如果在将新证书添加为云信任证书之前发生 Azure 存储证书更改(从 2022 年 7 月开始),在 Azure 中配置了云层的 Data Domain 系统的云设备将变为连接断开状态:
# alert show current Id Post Time Severity Class Object Message ----- ------------------------ -------- ----- ------------------------ ------------------------------------------------------------------------- m0-76 Mon Apr 19 15:34:03 2021 CRITICAL Cloud CloudUnit=azure-unit EVT-CLOUD-00001: Unable to access provider for cloud unit azure-unit. ----- ------------------------ -------- ----- ------------------------ ------------------------------------------------------------------------- There is 1 active alert. # cloud unit list Name Profile Status -------------- --------- ------------ azure-unit azure Disconnected -------------- --------- ------------
如果 Data Domain Virtual Edition (DDVE) 部署在对象存储 (ATOS) 上具有活动层的 Azure 上,则会禁用文件系统,并显示以下警报消息:
Alert History ------------- Id Post Time Clear Time Severity Class Object Message ----- ------------------------ ------------------------ -------- ----------------- ------ -------------------------------------------------------------------------------------- m0-26 Tue Apr 6 13:58:41 2021 Tue Apr 6 13:59:03 2021 ERROR Filesystem EVT-FILESYS-00008: Filesystem has encountered an error and is restarting. m0-27 Tue Apr 6 14:19:59 2021 Tue Apr 6 14:20:03 2021 ALERT Filesystem EVT-FILESYS-00002: Problem is preventing filesystem from
Microsoft Azure 存储服务进行了更新,以使用链接到 DigiCert Global G2 根的证书颁发机构 (CA) 的 TLS 证书。但是,与此同时,当前证书(由 Baltimore 网络信任根颁发)继续使用。
此更改从 2022 年 7 月开始,预计将于 2022 年 10 月底完成。我们建议在 2022 年 6 月 30 日之前安装新证书,不要删除当前证书。
要访问 Blob 容器(对于 Data Domain 云层或 DDVE ATOS),Data Domain 系统需要新的 DigiCert Global G2 根 CA 证书,而不是当前的 Baltimore Cyber-Trust 根 CA 证书作为云信任证书。
有关该主题的更多详细信息,请参阅以下官方 Azure Security Blob:
Azure Storage TLS:关键变化几乎都在这里!(...以及为什么您应该关心这些变化)— Microsoft 技术社区。
要在 2022 年 7 月开始推送更改时尽可能顺利地过渡到新的 Azure 存储安全证书,必须将受信任的“Baltimore Cyber-Trust root CA”证书保留为 Data Domain 中云的受信任证书,并添加新的“DigiCert Global G2 Root CA”证书,该证书同样受云信任, 而不是用另一个替换。
保留这两个证书不会产生任何问题,并允许 Data Domain DDVE 系统信任与 Azure 存储的连接,无论任一个 CA 颁发的证书如何,从而避免任何宕机,因为从 2022 年 7 月开始的某个时间点,新证书首次呈现给 Data Domain/DDVE 系统。
以下步骤适用于为使用 ATOS 部署在 Azure 云平台上的 Cloud Tier 或 DDVE 配置的 Data Domain 系统支持 DigiCert Global G2 根证书。此外,还建议添加 DigiCert 全局 G3 根证书和 Microsoft ECC 或 RSA 根证书颁发机构证书,以避免将来发生中断。
根据以下示例,确认 Data Domain DDVE 系统具有云应用程序的“Baltimore Cyber-Trust Root”:
sysadmin@dd01# adminaccess certificate show
Subject Type Application Valid From Valid Until Fingerprint
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
选项 1:有关使用 Microsoft Windows 工作站
安装证书的说明 对于演示,请单击以下视频:
在 YouTube 上观看。
在本地工作站上创建文件夹。
例如:
C:\MS-AZ-certificates
从以下页面下载 DigiCert Global Root G2/G3 证书:
DigiCert 根证书 - 下载和测试 | DigiCert.com
右键单击 Download PEM (下载 PEM),并将链接另存为:
DigiCertGlobalRootG2.crt.pem
SHA1 指纹:DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4
DigiCertGlobalRootG3.crt.pem
SHA1 指纹:7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E
下载 Microsoft RSA 和 ECC 证书。
右键单击 Download PEM (下载 PEM),并将链接另存为:
Microsoft RSA 根证书颁发机构 2017
(指纹:73a5e64a3bff8316ff0edccc618a906e4eae4d74)
Microsoft ECC 根证书颁发机构 2017
(指纹:999a64c37ff47d9fab95f14769891460eec4c3c5)
转到命令行并运行以下步骤。这些命令是从 Windows 主机运行的,但是,可以从 Linux 主机运行类似的命令。
C:\MS-AZ-certificates>dir Volume in drive C is OS Volume Serial Number is E4AE-2A04 Directory of C:\MS-AZ-certificates 15/10/2021 09:30 AM <DIR> . 15/10/2021 09:30 AM <DIR> .. 15/10/2021 09:29 AM 1,294 DigiCertGlobalRootG2.crt.pem 15/10/2021 09:29 AM 839 DigiCertGlobalRootG3.crt.pem 15/10/2021 09:30 AM 605 Microsoft ECC Root Certificate Authority 2017.crt 15/10/2021 09:30 AM 1,452 Microsoft RSA Root Certificate Authority 2017.crt 4 File(s) 4,190 bytes
使用 .pem 重命名 DigiCertGlobalRootG2 文件,如下所示。
C:\MS-AZ-certificates>rename DigiCertGlobalRootG2.crt.pem DigiCertGlobalRootG2.pem C:\MS-AZ-certificates>rename DigiCertGlobalRootG3.crt.pem DigiCertGlobalRootG3.pem
将 Microsoft ECC RSA 根证书颁发机构证书从 crt 转换为 pem 格式,如下所示:
C:\MS-AZ-certificates>certutil -encode "Microsoft ECC Root Certificate Authority 2017.crt" ms-ecc-root.pem Input Length = 605 Output Length = 890 CertUtil: -encode command completed successfully. C:\MS-AZ-certificates>certutil -encode "Microsoft RSA Root Certificate Authority 2017.crt" ms-rsa-root.pem Input Length = 1452 Output Length = 2054 CertUtil: -encode command completed successfully. C:\MS-AZ-certificates>dir Volume in drive C is OS Volume Serial Number is E4AE-2A04 Directory of C:\MS-AZ-certificates 15/10/2021 10:25 AM <DIR> . 15/10/2021 10:25 AM <DIR> .. 15/10/2021 09:29 AM 1,294 DigiCertGlobalRootG2.pem 15/10/2021 09:29 AM 839 DigiCertGlobalRootG3.pem 15/10/2021 09:46 AM 605 Microsoft ECC Root Certificate Authority 2017.crt 15/10/2021 09:45 AM 1,452 Microsoft RSA Root Certificate Authority 2017.crt 15/10/2021 10:25 AM 890 ms-ecc-root.pem 15/10/2021 10:25 AM 2,054 ms-rsa-root.pem 6 File(s) 7,134 bytes
使用 PowerProtect DD System Manager UI 从文件夹导入所有 PEM 格式的证书文件。
选项 2:使用 Linux 工作站安装证书的说明
以 .pem 格式下载以下两个 DigiCert 证书。
https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem SHA1 指纹:DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4
https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem SHA1 指纹:7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E
下载以下两个根证书采用 DER CRT 格式。
Microsoft RSA 根证书颁发机构 2017
Microsoft ECC 根证书颁发机构 2017
(指纹:999a64c37ff47d9fab95f14769891460eec4c3c5)
示例:
使用 Linux wget 实用程序下载证书:
$ mkdir certs $ cd certs $ wget https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem --2021-10-18 20:10:52-- https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem . . 2021-10-18 20:10:53 (16.5 MB/s) - ‘DigiCertGlobalRootG2.crt.pem’ saved [1294/1294] $ wget https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem --2021-10-18 20:32:21-- https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem . . 2021-10-18 20:32:21 (41.1 MB/s) - ‘DigiCertGlobalRootG3.crt.pem’ saved [839/839] $ wget https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt --2021-10-18 20:31:44-- https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt . . 2021-10-18 20:31:45 (73.2 MB/s) - ‘Microsoft RSA Root Certificate Authority 2017.crt’ saved [1452/1452] $ wget https://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt --2021-10-18 20:31:16-- https://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt . . 2021-10-18 20:31:16 (15.7 MB/s) - ‘Microsoft ECC Root Certificate Authority 2017.crt’ saved [605/605] admin@linux:~/certs$ ls -l total 155 -rw-rw-rw-. 1 admin admin 178 Oct 18 20:32 cert.list -rw-rw-rw-. 1 admin admin 1294 Dec 6 2017 DigiCertGlobalRootG2.crt.pem -rw-rw-rw-. 1 admin admin 839 Sep 22 12:36 DigiCertGlobalRootG3.crt.pem -rw-rw-rw-. 1 admin admin 605 Jan 22 2020 Microsoft ECC Root Certificate Authority 2017.crt -rw-rw-rw-. 1 admin admin 1452 Jan 22 2020 Microsoft RSA Root Certificate Authority 2017.crt
使用以下命令将两个根证书转换为.pem 格式。
admin@linux:~/certs$ openssl x509 -inform der -in Microsoft\ ECC\ Root\ Certificate\ Authority\ 2017.crt -out ms-ecc-root.pem admin@linux:~/certs$ openssl x509 -inform der -in Microsoft\ RSA\ Root\ Certificate\ Authority\ 2017.crt -out ms-rsa-root.pem admin@linux:~/certs$ ls -l total 155 -rw-rw-rw-. 1 admin admin 178 Oct 18 20:32 cert.list -rw-rw-rw-. 1 admin admin 1294 Dec 6 2017 DigiCertGlobalRootG2.crt.pem -rw-rw-rw-. 1 admin admin 839 Sep 22 12:36 DigiCertGlobalRootG3.crt.pem -rw-rw-rw-. 1 admin admin 605 Jan 22 2020 Microsoft ECC Root Certificate Authority 2017.crt -rw-rw-rw-. 1 admin admin 1452 Jan 22 2020 Microsoft RSA Root Certificate Authority 2017.crt -rw-rw-rw-. 1 admin admin 875 Oct 18 2021 ms-ecc-root.pem -rw-rw-rw-. 1 admin admin 2021 Oct 18 2021 ms-rsa-root.pem
复制 Data Domain 系统上的 .pem 证书文件。
admin@linux:~/certs$ scp *.pem sysadmin@dd01.example.com:/ddr/var/certificates/ DigiCertGlobalRootG2.crt.pem 100% 1294 13.6KB/s 00:00 DigiCertGlobalRootG3.crt.pem 100% 839 8.8KB/s 00:00 ms-ecc-root.pem 100% 875 9.2KB/s 00:00 ms-rsa-root.pem 100% 2021 21.2KB/s 00:00
按如下所示安装证书:
adminaccess certificate import ca application cloud file <file-name> Certificates should be stored in /ddr/var/certificates before you run the adminaccess command.
admin@linux:~/certs$ ssh sysadmin@dd01.example.com
sysadmin@dd01# adminaccess certificate import ca application cloud file DigiCertGlobalRootG2.crt.pem The SHA1 fingerprint for the imported CA certificate is: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4 Do you want to import this certificate? (yes|no) [yes]: y CA certificate imported for application(s) : "cloud". sysadmin@dd01# adminaccess certificate import ca application cloud file DigiCertGlobalRootG3.crt.pem The SHA1 fingerprint for the imported CA certificate is: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E Do you want to import this certificate? (yes|no) [yes]: y CA certificate imported for application(s) : "cloud". sysadmin@dd01# adminaccess certificate import ca application cloud file ms-ecc-root.pem The SHA1 fingerprint for the imported CA certificate is: 99:9A:64:C3:7F:F4:7D:9F:AB:95:F1:47:69:89:14:60:EE:C4:C3:C5 Do you want to import this certificate? (yes|no) [yes]: y CA certificate imported for application(s) : "cloud". sysadmin@dd01# adminaccess certificate import ca application cloud file ms-rsa-root.pem The SHA1 fingerprint for the imported CA certificate is: 73:A5:E6:4A:3B:FF:83:16:FF:0E:DC:CC:61:8A:90:6E:4E:AE:4D:74 Do you want to import this certificate? (yes|no) [yes]: y CA certificate imported for application(s) : "cloud".
从 DD DDVE 命令行检查新证书信息:
sysadmin@ddve# sysadmin@ddve# adminaccess cert show
Subject Type Application Valid From Valid Until Fingerprint
--------------------------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
dd01.example.com host https Tue Mar 26 10:38:34 2019 Wed Jan 31 10:48:38 2024 30:78:FE:93:DF:2F:9D:B5:08:D7:EC:5E:9E:89:E2:BD:16:13:E1:BA
dd01.example.com ca trusted-ca Wed Mar 27 17:38:34 2019 Wed Jan 31 10:16:38 2024 CB:9D:64:39:56:48:FB:58:C6:93:40:FB:29:91:56:9A:BD:08:7A:C8
Baltimore CyberTrust Root imported-ca cloud Fri May 12 11:46:00 2000 Mon May 12 16:59:00 2025 D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74
DigiCert Global Root G2 imported-ca cloud Thu Aug 1 05:00:00 2013 Fri Jan 15 04:00:00 2038 DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4
DigiCert Global Root G3 imported-ca cloud Thu Aug 1 05:00:00 2013 Fri Jan 15 04:00:00 2038 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E
Microsoft ECC Root Certificate Authority 2017 imported-ca cloud Wed Dec 18 15:06:45 2019 Fri Jul 18 16:16:04 2042 99:9A:64:C3:7F:F4:7D:9F:AB:95:F1:47:69:89:14:60:EE:C4:C3:C5
Microsoft RSA Root Certificate Authority 2017 imported-ca cloud Wed Dec 18 14:51:22 2019 Fri Jul 18 16:00:23 2042 73:A5:E6:4A:3B:FF:83:16:FF:0E:DC:CC:61:8A:90:6E:4E:AE:4D:74
--------------------------------------------- ------------- ----------- ------------------------ ------------------------ -----------------------------------------------------------
如果意外为“云”以外的“应用程序”添加了任何证书,请从访问管理 UI 下的证书颁发机构证书中将其删除。
对于配置了云层文件系统的 Data Domain 系统,可能需要重新启动才能重新建立与云单元的连接。安排停机时间并运行以下命令以重新启动文件系统:#filesys restart
对于在 Azure 平台上运行的 Data Domain 系统,重新启动 DDVE:#system reboot
Data Domain, Integrated Data Protection Appliance Family
16 Jan 2024
6
Solution