Avamar：安装Avamar 证书颁发机构 （CA） 或将其替换为用户提供的证书颁发机构 （CA）

Summary: 如何将默认自签名管理控制台服务 （MCS） 根证书颁发机构 （CA） 替换为其自己的 gsan/mcs/avagent CA。

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

背景

Avamar 会公开多个安装了证书的端口。

Avamar 上的 Web 服务器使用 ssl 证书公开以下端口： 
Port     Service
7778    Java Remote Method Invocation (RMI)
7779    Java Remote Method Invocation (RMI)
7780    Java Remote Method Invocation (RMI)
7781    Java Remote Method Invocation (RMI)
443      Apache Webserver
9443    MCSDK (MCS Developer Kit SOAP API)
8543    Tomcat/DTLT/EMT
7543    Avinstaller/Jetty


启用会话安全性后，以下端口会加载 SSL 证书： 
Port   Service
29000  GSAN secure listening port
30001  Avagent/MCS secure registration port
30002  Avagent/MCS secure port (when replication destination is configured)
30003  Avagent/MCS secure registration port


启用会话安全性后，备份客户端会在以下端口上加载 SSL 证书： 
Port   Service
30002  Avagent/MCS secure listening port (backup client)



本操作方法知识库文章旨在介绍在为客户端注册、备份和复制启用会话安全性时，在所用安全端口上更换证书颁发机构的正确上下文。

场景

第一种情形：
如果您想要替换 Avamar Web 服务器证书，请参阅以下知识库文章：
000198691 |Avamar 19.2+：为 avinstaller、aam/flr/dtlt、mcsdk、rmi 和 apache aui

安装签名的 Web 服务器证书第二种情景：
如果要替换用于备份/复制/注册 （gsan/mc root ca） 的证书：
请按照以下步骤将 Avamar CA 替换为您自己的 CA。

会话安全背景

摘自《产品安全指南

》会话安全功能
Avamar 会话安全功能由 Avamar 安装、Avamar Virtual Edition （AVE） 配置、升级工作流程序包和独立会话安全配置工作流提供。
会话安全功能包括针对 Avamar系统进程之间的通信的安全改进。
Avamar系统使用会话票证来保护 Avamar系统进程之间的所有通信。在 Avamar 系统进程接受来自另一个 Avamar 系统进程的传输之前，需要有效的会话票证。
会议票证具有以下一般特征：
- 会议票证经过加密和签名以防止修改。
- 会议门票在短时间内有效。
- 每个会话票证都包含唯一的签名，并且仅分配给一个 Avamar 系统进程。
- 会话票证的完整性受到加密保护。
- 每个 Avamar 系统节点单独验证会话票证签名。
- 如果需要，会话可以延长到会话票证的生命周期之外。

Avamar Server 身份验证
安装会话安全功能后， Avamar 系统将充当专用证书颁发机构 ，并为 Avamar 系统生成唯一的服务器证书。
Avamar系统会在向 AvamarServer 注册的每个 AvamarClient 上安装服务器证书的公钥。Avamar Client 使用公钥对来自 Avamar 系统的传输进行身份验证。

对于当前已注册的客户端，服务器证书的公钥和其他必需的证书文件将在安装后一小时内传播到客户端。Avamar 系统还会自动与 Avamar 存储节点共享 Avamar Server 证书。共享证书允许实用程序节点和存储节点提供相同的证书进行身份验证。

下面提供了一篇补充知识库文章，其中包含有关会话安全性的更多信息：

000222278 |Avamar：会话安全性

检查会话安全设置

使用 ssh

登录 Avamar Server 以根用户身份运行以下命令： 
enable_secure_config.sh --showconfig

如果任何设置返回 true，则会话安全性处于启用状态。

如果您需要更改会话安全设置的其他帮助，请参阅以下知识库文章：

000222234 |Avamar：从 CLI
管理会话安全设置000222279 |Avamar：使用 Avinstaller 安装包 （AVP）

管理会话安全设置笔记

替换 Web 服务器证书与 gsan/mcs 根证书之间的区别：
- 使用 aui 替换了 Web 服务器证书。
- Web 服务器证书可以使用公共或内部链式 ca。
- Web 服务器证书安装带有相应私钥的叶/服务器/终端实体证书。
- Web 服务器证书的服务器证书具有 CA 的基本约束：False，指示证书不能用于颁发进一步的下游 CA 证书（如另一个中间 CA）
— 在 Avamar Utility Node 上使用 importcert.sh 脚本替换了 gsan/mcs 根证书。
- gsan/mcs 根证书是 CA 证书，而不是叶/服务器/终端实体。
- gsan/mcs 根证书具有 CA 的基本约束：True

什么是基本约束？
基本约束是 X.509 版本 3 证书扩展，用于标识证书持有者或主题的类型。
如果证书是根 CA 或中间 CA，则它应该具有 CA 布尔值设置为 True 的基本约束扩展。这将允许证书对其他证书和证书吊销列表 （CRL） 进行签名，验证已颁发证书的签名，并可以选择对已颁发证书的配置设置限制或约束。
如果证书是叶/服务器/终端实体证书，则它应该具有 CA 布尔值设置为 False 的基本约束扩展。最终实体证书无法为后续的下游证书签名。

替换 GSAN/MC 根 CA 证书时，它们将替换为另一个证书颁发机构 （CA）。可能是内部的，因为没有公开信任的 CA 会将其 CA 私钥移交给最终客户。

将 Avamar CA 替换为用户提供的 CA

的步骤1.准备根/中间证书文件：
    - 私钥：与能够颁发证书的最下游 CA 证书对应的私钥。
    - “server”证书：隐私增强邮件 （PEM） 格式的最下游 CA 证书，能够颁发证书。
    - 链证书：一个包含串联 PEM 格式的中间/根 CA 证书的文件，用于构建信任链。

2.以 root 用户身份运行 importcert.sh 脚本，以安装新用户提供的 CA： 
importcert.sh <private key> <cert> <chain>
该脚本将：
- 停止 MCS 和备份计划程序。
- 验证密钥和证书是否匹配。
- 验证链文件是否为证书构建了信任链。
- 将文件导入 Avamar 密钥库。
- 刷新 GSAN 证书。
- 启动 MCS
- 尝试重新注册所有客户端。
- 与 Data Domain 重新同步。
- 恢复备份调度程序服务。

例

准备
的三个文件 int_key.pem — PKCS1 格式
的内部中间 CA 私钥 int_cert.crt — 内部中间 CA 证书
root_ca.crt — 内部根 CA 证书

int_key.pem 
root@ser-ave03:/home/admin/#: cat int_key.pem
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAorFbO4McgCv8tFrQVyzcjBQdOAT/bYVNG5SjWH895MHM9OFU
B2sQcCTvGJRdSXEheuqHtRVWt761CReXk+yhf51XGtU+0OQdPWecHeSyWfzsLihy
ZfCRYcoSP7OW6IAOiigWTZqroZc2jWOygZevyM8HPmpmOa7C2TYCHZNgAQnbw+IU
XRDR/Yofsj+IjOit+Fw0zAE2GBm6pViNIv1nHwxTtXkjlu9g4qcHML1/0WkJ2d+p
lmnE8qMZtdzOSWZeuBDiOsyTHbjAZFhDetWOjcUZ8z7zmvTjtgSMcSJCQnuNL9Y2
[key_contents_retracted_for_privacy]
w1JY6IaQO6GhzLInet2uguuZ9rBBnYxcsz9/PV6Y+ZMTGX1ySLXAhfht0rtfN3qq
3SFzXagwB/v42rEHDRI7Tin7v5oNpD5hWSTwW9jIFikJJZuYCMagwH+to6Pa6CFY
AOdHAoGAGCvK9QjJW5BRHAwjgzH3aQijKK9lKtQH4v5YJsEqQK4lFg3S8m6KxgTA
XyMzkOFx5+3CFRrXCbNyS3hLDen7IMAZbY35QhvW2DO0Sow+t3dVOxk26RGeAopo
ZmemuZ3TR4Esqrd9rdAwHy/YwJ1ZWcLRQmfab4MoQPmK0iuSA6A=
-----END RSA PRIVATE KEY-----

int_cert.crt 
root@ser-ave03:/home/admin/#: cat int_cert.crt
-----BEGIN CERTIFICATE-----
MIIDRzCCAi+gAwIBAgIQfpAycyHdgHTR+JiDuTZLNzANBgkqhkiG9w0BAQsFADAX
MRUwEwYDVQQDDAx0b255X3Jvb3RfQ0EwHhcNMjIxMDIxMTQ1ODU2WhcNMjUwMTIz
MTQ1ODU2WjAfMR0wGwYDVQQDDBR0b255X2ludGVybWVkaWF0ZV9DQTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKKxWzuDHIAr/LRa0Fcs3IwUHTgE/22F
TRuUo1h/PeTBzPThVAdrEHAk7xiUXUlxIXrqh7UVVre+tQkXl5PsoX+dVxrVPtDk
HT1nnB3ksln87C4ocmXwkWHKEj+zluiADoooFk2aq6GXNo1jsoGXr8jPBz5qZjmu
wtk2Ah2TYAEJ28PiFF0Q0f2KH7I/iIzorfhcNMwBNhgZuqVYjSL9Zx8MU7V5I5bv
YOKnBzC9f9FpCdnfqZZpxPKjGbXczklmXrgQ4jrMkx24wGRYQ3rVjo3FGfM+85r0
47YEjHEiQkJ7jS/WNsr/i7+ID/OUsf9yemLW00tfLEXSgWcaVEHhH+cCAwEAAaOB
hjCBgzAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTaUhUnUx2JL/SGVARyaGuQESLC
7DBHBgNVHSMEQDA+gBRXocE7ZbX0UU6YbhaT7hYG5N+zeKEbpBkwFzEVMBMGA1UE
AwwMdG9ueV9yb290X0NBggkA1Ru7coWIaxYwCwYDVR0PBAQDAgEGMA0GCSqGSIb3
DQEBCwUAA4IBAQAWTZjFYHIfz6r8N9EtMqweTOfSdNAPfwEKLmIfKJq27oYaE2Il
+2xCWBlsa4tz95Rr6Ve0gLT1NmFZki81GcikTS1NG/qeRmPq4orNrMz3HGmU2C/F
lFnNOvuJeg8n/0Bl9SWijs4t95ddFty99vU3yWvUrnD/tfwfuMm4v2txRHGaZfSn
90oR6Iy/RwZ3+khcw7NojZ8/UUMHSGX+wk/Lo9pTWM6rxDgDYBGI8z2YLmuiBniO
tU8ByLnwCpyFjvho5/ja+rwrs4Qw50n0ZTSbRyoOHRdr73hG8g7sZaReLlq/As9u
+CBakbNCeywsmUDVrFifGGkVoadBjjGUpYkC
-----END CERTIFICATE-----
root@ser-ave03:/home/admin/#: openssl x509 -noout -text -subject -issuer -in int_cert.crt | grep "CA:\|subject\|issuer"
                CA:TRUE
subject= /CN=tony_intermediate_CA
issuer= /CN=tony_root_CA

root_ca.crt 
root@ser-ave03:/home/admin/#: cat root_ca.crt
-----BEGIN CERTIFICATE-----
MIIDODCCAiCgAwIBAgIJANUbu3KFiGsWMA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV
BAMMDHRvbnlfcm9vdF9DQTAeFw0yMjEwMjExNDUyMzZaFw0zMjEwMTgxNDUyMzZa
MBcxFTATBgNVBAMMDHRvbnlfcm9vdF9DQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBANJrB+YHwQPKWdt19nH5IaxEwz198gfJvfVtoG/Qt7HKiDHb6XAa
g7nP6MHLZmbNdIv2FB9S9UrOARgOZuxJ4EvqP2Q188ArNFnkUZoo1ylO2JyZ2f7D
C21eOGfuupvczdYlB/Tklfs207RIPhEvds5JrMEKmPrP1g8O3kCpiPqoi1Ul+0AG
WW8k/EViEaZgsmhMzd3TWm9vcrO5lxzeFnSO8DUL/pAkbvngEErROe02dWayZ3R9
y+tZQ0hDNm0e3qp7iSaDeEOXtXAnr6j/126qaI+q2Mk3/NQpjxYjKuYrW/8dcIOZ
LIuISYIpcbc2WU/p0sQVwDo93bBUd1IBbuUCAwEAAaOBhjCBgzAMBgNVHRMEBTAD
AQH/MB0GA1UdDgQWBBRXocE7ZbX0UU6YbhaT7hYG5N+zeDBHBgNVHSMEQDA+gBRX
ocE7ZbX0UU6YbhaT7hYG5N+zeKEbpBkwFzEVMBMGA1UEAwwMdG9ueV9yb290X0NB
ggkA1Ru7coWIaxYwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAu+Wgs
yWIQT4jIaVX0ddyvrTyXxeMgLovmRyOHC+sa7BPhoyOoGPDlBkaS0s1VABtAoiml
Ioqf4UrYsVXFFvrhfTny0FE9Ryw4Q3Az0msj0gELfMuHWkKitW+d/z578g8ngxC4
WDOMwbIzHPa2TbIFoH+plNhnbpxWZj0WRaUBN9uW5U7lG/+OCMgs5+/kjPqrhfyy
yNC2/2AgO1QhyZ7wcEltQ5iTQLfni3NVzbLGImOWCbNgKeKYn2pApq5EwUIvyqK5
KPFBXMelDDGcbieJW+7QbDtSnsghsp5i0R6bG5DElYfYODECQMdq3v5/dk/7oDqT
9WHdPFSNlZp0AVtQ
-----END CERTIFICATE-----
root@ser-ave03:/home/admin/#: openssl x509 -noout -text -subject -issuer -in root_ca.crt | grep "CA:\|subject\|issuer"
                CA:TRUE
subject= /CN=tony_root_CA
issuer= /CN=tony_root_CA

安装 
root@ser-ave03:/home/admin/#: importcert.sh int_key.pem int_cert.crt root_ca.crt
The script will re-generate and replace Avamar RootCA. The mcs will be restarted, and ddboost service on datadomain will be restarted if there are datadomains attached. Do you want to continue N/y? [N]:Y
0. Stop backup scheduler
Identity added: /home/admin/.ssh/admin_key (/home/admin/.ssh/admin_key)
dpnctl: INFO: Suspending backup scheduler...
dpnctl: INFO: Backup scheduler suspended.
1. Stop MC Server
=== BEGIN === check.mcs (poststart)
check.mcs                        passed
=== PASS === check.mcs PASSED OVERALL (poststart)
Stopping REST API Service...
REST API Service stopped.

Administrator Server shutdown initiated.
Stopping Administrator Server at Tue Oct 25 20:19:46 GMT 2022 ...
Administrator Server stopped at Tue Oct 25 20:19:48 GMT 2022.
=== Stop Avamar Certificate Service ===
Avamar Certificate Service stopped.
Stopping the database server.
Database server stopped.
2. Vefify key cert if match
Key cert matched OK
3. Verify cert by chain
Verify OK
4. Import key&cert&chain into keystore
Import to keystore OK
5. Refresh tls cert
Refresh tls OK
6. Refresh gSAN cert
7. Start MC server
Starting the database server.
Waiting for postmaster to start ..Started
Start MCDB: processing time = 2 s.
Check MCS: processing time = 4 s.
INFO: Starting messaging service.
INFO: Started messaging service.
Start Message Broker: processing time = 11 s.
=== BEGIN === check.mcs (prestart)
check.mcs                        passed
=== PASS === check.mcs PASSED OVERALL (prestart)
Starting Administrator Server at Tue Oct 25 20:20:39 GMT 2022 ...
Upgrade MCS Preference: processing time = 196ms
Upgrade MCDB: processing time = 436ms
Check node list: processing time = 659ms
Prepare MC SSL Properties: processing time = 1ms
Init node: processing time = 340ms
Install service: com.avamar.mc.prefs.MCSPreferencesService, processing time = 9ms
Install service: com.avamar.mc.message.MessageEventService, processing time = 11ms
Event Size: 18548
Install service: com.avamar.mc.event.EventService, processing time = 5619ms
Install service: com.avamar.mc.jms.push.JmsPushService, processing time = 98ms
Install service: com.avamar.mc.dpn.DPNProxyService, processing time = 7262ms
Install service: com.avamar.mc.datatap.MCDataTapService, processing time = 9ms
Install service: com.avamar.mc.cm.ClusterManagerService, processing time = 6ms
Install service: com.avamar.mc.wo.WorkOrderSchedulingService, processing time = 305ms
Install service: com.avamar.mc.sch.ScheduleService, processing time = 229ms
Install service: com.avamar.mc.um.UserManagerService, processing time = 49ms
Install service: com.avamar.mc.ldap.LdapManagerService, processing time = 105ms
Install service: com.avamar.mc.datadomain.DataDomainService, processing time = 414ms
Install service: com.avamar.mc.cr.ClientRegistryService, processing time = 4054ms
Install service: com.avamar.mc.burm.BackupRestoreManagerService, processing time = 67ms
Initiated VC: /myvc.dell.com  Ver: null-null.  (Total time - 50359 ms)
VmwareService is ready. (Total time - 50362 ms)

Install service: com.avamar.mc.vmware.VmwareService, processing time = 53459ms
Wait VC cache pool synchronized done for vc /nc-ave01.dell.com at Tue Oct 25 20:21:54 GMT 2022  Total time(ms) - 0
Install service: com.avamar.mc.pdm.ProxyDeploymentManagerService, processing time = 37ms
Install service: com.avamar.mc.mon.MonitorService, processing time = 457ms
Install service: com.avamar.mc.mcsm.MCSManagerService, processing time = 135ms
Install service: com.avamar.mc.lm.LicenseManagerService, processing time = 118ms
Install service: com.avamar.mc.rpt.ReportService, processing time = 180ms
Install service: com.avamar.mc.ws.MCWebServices, processing time = 154ms
Install service: com.avamar.mc.ws.MCJettyService, processing time = 1272ms
Install service: com.avamar.mc.repl.ReplicationService, processing time = 87ms
Install service: com.avamar.mc.st.SessionTicketService, processing time = 1171ms
Install service: com.avamar.mc.ras.McEbmsService, processing time = 3698ms
Install service: com.avamar.mc.migration.MigrationService, processing time = 56ms
Start service container: processing time = 79083ms
log4j:WARN No appenders could be found for logger (org.apache.axiom.util.stax.dialect.StAXDialectDetector).
log4j:WARN Please initialize the log4j system properly.
Init crontab: processing time = 4075ms
Update axion system table: processing time = 4ms
Update connect emc email subject: processing time = 12ms
Administrator Server started at Tue Oct 25 20:22:06 GMT 2022.
Start MC Java Process: processing time = 88 s.
INFO: Starting Data Domain SNMP Manager....
INFO: Connecting to MCS Server: ser-ave03 at port: 7778...
INFO: Successfully connected to MCS Server: ser-ave03 at port: 7778.
INFO: No trap listeners were started, Data Domain SNMP Manager didn't start.
Other Task: processing time = 7 s.
Starting REST API Service........
REST API Service started.
Start MC Rest: processing time = 16 s.
=== Start Avamar Certificate Service ===
Avamar Certificate Service started.
8. Re-register all clients
0,22237,Client invited to activate with server.
Attribute Value                                                                                                                                                                                                                                                                                                                                                                                                                       
--------- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
summary   Partial-sucessfullly activiated clients.
, succeed activated clients:
client1.dell.com
ser-ave03
client2.dell.com
, failed  activated clients:
ser-ave04, caused by  Unable to contact: /clients/ser-ave04 on port: 28009
client3.dell.com, caused by  Unable to contact: /clients/client3.dell.com on port: 28002
client4.dell.com, caused by  Unable to contact: /clients/client4.dell.com on port: 28002


10. Start backup scheduler
Identity added: /home/admin/.ssh/admin_key (/home/admin/.ssh/admin_key)
dpnctl: INFO: Resuming backup scheduler...
dpnctl: INFO: Backup scheduler resumed.
dpnctl: INFO: No /usr/local/avamar/var/dpn_service_status exist.


安装

后安装脚本完成后，可能需要手动重新注册某些基于代理的客户端和 VMware 代理。
如果要检查 Avamar 密钥库的内容以查看运行脚本的结果，请运行以下命令： 
keytool -list -v -keystore /usr/local/avamar/lib/avamar_keystore -storepass $(avlockbox.sh -r keystore_passphrase)
别名：
Mcrsaroot 应该是具有基本约束 CA 的仅 CA 别名：真 
keytool -export -keystore /usr/local/avamar/lib/avamar_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias mcrsaroot -rfc | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"
示例 
        Issuer: CN=tony_root_CA
        Subject: CN=tony_intermediate_CA
                CA:TRUE

Mcrsatls 应是由用户提供的下游 CA 颁发给 Avamar Server 的完整链式终端实体证书 
keytool -export -keystore /usr/local/avamar/lib/avamar_keystore -storepass $(avlockbox.sh -r keystore_passphrase) -alias mcrsatls -rfc | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"
示例 
        Issuer: CN=tony_intermediate_CA
        Subject: C=US, ST=California, L=Irvine, O=EMC Corp, OU=BRS Division, CN=Avamar Server RSA TLS, CN=ser-ave03.dell.com
                CA:FALSE

如果要验证证书是否已被替换，您可以使用 openssl 作为安全客户端连接到 Avamar Utility Node，以获取 gsan/mcs/registration 端口的证书内容。
  
Port     Certificate
29000    /home/admin/chain.pem (exported PEM copy of mcrsaroot)
30001    mcsrsatls (chained)
30002    new avamar client certificate
30003    mcrsatls   (chained)


  
openssl s_client -connect localhost:29000 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"
openssl s_client -connect localhost:30001 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"
openssl s_client -connect localhost:30002 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"
openssl s_client -connect localhost:30003 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | egrep "Subject:|Issuer:|CA:"


故障 排除

如果在脚本运行期间遇到以下错误，则可能是由于尝试安装终端实体证书，而不是能够颁发证书的 CA。

5. Refresh tls cert
Refresh tls ERROR


如果脚本成功完成后 Avamar Utility Node 上的端口 30002 仍显示旧证书，请重新启动 Avagent。

service avagent restart

Affected Products

Avamar
Article Properties
Article Number: 000204629
Article Type: How To
Last Modified: 30 May 2024
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.