NetWorker: How to Import or Replace Certificate Authority Signed Certificates for NMC

These instructions describe how to replace the default NetWorker self-signed certificate with a CA-signed certificate for the NetWorker Management Console (NMC). This KB provides instructions for both Windows and Linux NMC servers.

The process for replacing the NetWorker server authentication service (authc) and NetWorker Web User Interface (NWUI) self-signed certificates with CA-signed ones are detailed in the following operating system specific KBs:

• NetWorker: How to Import or Replace Certificate Authority Signed Certificates for "Authc" and "NWUI" (Linux)
• NetWorker: How to Import or Replace Certificate Authority Signed Certificates for "Authc" and "NWUI" (Windows)

Certificates Involved:

• <server>.csr: NetWorker Management Console Server certificate signing request

• <server>.key: NetWorker Management Console Server private key

• <server>.crt: NetWorker Management Console Server CA-signed certificate

• <CA>.crt: CA root certificate

• <ICA>.crt: CA intermediate certificate (optional if it is available)

Before you start:

This process uses the OpenSSL utility. This utility is provided by default on Linux operating systems; however, is not included on Windows systems. Consult with the system administrator regarding installing OpenSSL. The required version of OpenSSL differs depending on the NetWorker version installed.

• NetWorker 19.8 and prior require openssl version 1.0.2
• NetWorker 19.9 through 19.11 require openssl version 1.1.1n 
• NetWorker 19.12.0.0 (Linux only) supports openssl version 3.0.14
• NetWorker 19.12.0.2 (Windows only) supports openssl version 3.0.14

The OpenSSL version can be identified following:

Linux:

# openssl version

Windows:

1. From Windows File Explorer, go to the openssl.exe location. This path can differ depending on how OpenSSL was installed.
2. Open the openssl.exe file and go to the Details tab. The Product Version field details the OpenSSL version:

Alternatively if the openssl.exe file path is part of the system PATH variable you can run the `openssl version` command from and Administrative command prompt; otherwise, you can change directory (cd) to the openssl.exe directory.

Generate a private key and certificate signing request (CSR) file to provide to your CA.

1. On the NMC server, use the OpenSSL command-line utility to create the NetWorker server private key file (<server>.key) and CSR file (<server>.csr).
   Linux:

# openssl req -new -newkey rsa:4096 -nodes -out /tmp/<server>.csr -keyout /tmp/<server>.key

Windows:

set openssl="<Full system path to the openssl.exe file>"
%openssl% req -new -newkey rsa:4096 -nodes -out "C:\tmp\<server>.csr" -keyout "C:\tmp\<server>.key"

2. Send the CSR file (<server>.csr) to the CA to generate the CA-signed certificate file (<server>.crt). The CA should provide the CA-signed certificate file (<server>.crt), the root certificate (<CA>.crt), and any intermediate CA certificates (<ICA>.crt).

Linux NetWorker Management Console (NMC) Servers:

1. Get the CA signed certificates in either individual key files or a single file in PFX format.
2. If the CA signed certificates are in a single PFX file, the private key and CA signed certificate can be extracted as with OpenSSL tool (Windows may not have OpenSSL installed, it can be installed separately).

# openssl pkcs12 -in <file>.pfx -out <server>.key -nodes -nocerts

# openssl pkcs12 -in <file>.pfx -out <server>.crt -nokeys

B. Verify the integrity of the server.key and server.crt.

# openssl pkey -in <server>.key -pubout -outform pem | sha256sum

# openssl x509 -in <server>.crt -pubkey -noout -outform pem | sha256sum

C. Convert Private Key, CA signed server certificate, root CA (and any intermediate certificates) to PEM format.

# openssl rsa -in <server>.key -outform pem -out server.key.pem

# openssl x509 -in <server>.crt -outform pem -out server.crt.pem

# openssl x509 -in CA.crt -outform pem -out CA.crt.pem

# openssl x509 -in ICA.crt -outform pem -out ICA.crt.pem

# cat server.key.pem CA.crt.pem ICA.crt.pem server.crt.pem > cakey.pem

3. Shut down the NMC server's gst service:

# systemctl stop gst

4. Make a copy of the existing cakey.pem file, then replace the default file with the one created in step 2, D.

# cp /opt/lgtonmc/etc/cakey.pem /opt/lgtonmc/etc/cakey.pem_orig
# cp cakey.pem /opt/lgtonmc/etc/cakey.pem

5. Make a copy of the NMC server's server.crt and server.key files, then replace the original files with the signed server.crt and server.key:

# cp /opt/lgtonmc/apache/conf/server.crt /opt/lgtonmc/apache/conf/server.crt_orig
# cp <server>.crt  /opt/lgtonmc/apache/conf/server.crt
# cp /opt/lgtonmc/apache/conf/server.key /opt/lgtonmc/apache/conf/server.key_orig
# cp <server>.key /opt/lgtonmc/apache/conf/server.key

6. Start the NMC server's gst service:

# systemctl start gst

7. Monitor the NMC server's /opt/lgtonmc/logs/gstd.raw for any errors.

NetWorker: How to use nsr_render_log to render .raw log file

Verification:

When the NMC server's gst service is running, compare the fingerprint of the CA signed certificate with the certificate finger print of the NMC's gst service port (9000):

# openssl x509 -in <server>.crt -fingerprint -sha256 -noout
# openssl x509 -in <(openssl s_client -connect localhost:9000 -prexit 2>/dev/null </dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p') -fingerprint -sha256 -noout

The SHA256 fingerprint of these two commands should match.

Example:

[root@lnx-srvr01 ~]# openssl x509 -in lnx-srvr01.crt -fingerprint -sha256 -noout
sha256 Fingerprint=33:FF:25:13:A2:C7:59:1C:F0:D6:F3:F7:5D:10:6A:83:7A:2C:4E:20:4B:52:DD:3C:FA:D4:59:1B:6B:44:D6:A2

[root@lnx-srvr01 ~]# openssl x509 -in <(openssl s_client -connect localhost:9000 -prexit 2>/dev/null </dev/null | sed -n -e '/BEGIN\ CERTIFICATE/,/END\ CERTIFICATE/ p') -fingerprint -sha256 -noout
sha256 Fingerprint=33:FF:25:13:A2:C7:59:1C:F0:D6:F3:F7:5D:10:6A:83:7A:2C:4E:20:4B:52:DD:3C:FA:D4:59:1B:6B:44:D6:A2

Windows NetWorker Management Console (NMC) Servers:

1. Get the CA signed certificates in either individual key files or a single file in PFX format.
2. If the CA signed certificates are in a single PFX file, the private key and CA signed certificate can be extracted as with OpenSSL tool (Windows may not have OpenSSL installed, it can be installed separately).

%openssl% pkcs12 -in <file>.pfx -out <server>.key -nodes -nocerts

%openssl% pkcs12 -in <file>.pfx -out <server>.crt -nokeys

B. Verify the integrity of the server.key and server.crt.

%openssl% pkey -in <server>.key -pubout -outform pem | %openssl% dgst -sha256

%openssl% x509 -in <server>.crt -pubkey -noout -outform pem | %openssl% dgst -sha256

C. Convert Private Key, CA signed server certificate, root CA (and any intermediate certificates) to PEM format.

%openssl% rsa -in <server>.key -outform pem -out C:\tmp\server.key.pem

%openssl% x509 -in <server>.crt -outform pem -out C:\tmp\server.crt.pem

PS C:\tmp> Get-Content server.key.pem,server.crt.pem | Out-File cakey.pem -Encoding ascii

3. Shut down the NMC server's gst service:

net stop gstd

4. Make a copy of the original cakey.pem, then place the combined CA signed cakey.pem in its place:

copy "C:\Program Files\EMC NetWorker\Management\GST\etc\cakey.pem" "C:\Program Files\EMC NetWorker\Management\GST\etc\cakey.pem_orig"
copy C:\tmp\cakey.pem "C:\Program Files\EMC NetWorker\Management\GST\etc\cakey.pem"

5. Make a copy of the NMC server's server.crt and server.key files, then replace the original files with the signed server.crt and server.key:

copy "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt" "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt_orig"
copy "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key" "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key_orig"
copy <server>.crt "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt"
copy <server>.key "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key"

net start gstd

%openssl% x509 -in <server>.crt -fingerprint -sha256 -noout
%openssl% s_client -connect localhost:9000 -showcerts 2>nul | %openssl% x509 -noout -fingerprint -sha256

C:\tmp>%openssl% x509 -in win-srvr02.crt -fingerprint -sha256 -noout
SHA256 Fingerprint=B9:4A:1E:64:AA:1A:38:88:7B:D3:72:70:A2:32:D5:9A:D1:33:50:93:00:35:D6:9B:8D:AE:59:92:B1:66:46:DE

C:\tmp>%openssl% s_client -connect localhost:9000 -showcerts 2>nul | %openssl% x509 -noout -fingerprint -sha256
SHA256 Fingerprint=B9:4A:1E:64:AA:1A:38:88:7B:D3:72:70:A2:32:D5:9A:D1:33:50:93:00:35:D6:9B:8D:AE:59:92:B1:66:46:DE

Even after the NMC's self-signed certificate has been replaced with a CA signed certificate, you may see the following warning during connection to an NMC server from the NMC launcher:

Click "View Certificate Details." The certificate details validate that the CA signed certificate is used. 

The warning is appearing because the signed certificate is missing from the NMC client's Trusted Root Certificates.
 

This warning can be ignored; optionally, the NMC server's CA signed certificate can also import into the NMC client's Trusted Root Certificates:

1. Put the NMC server's CA signed certificate (<server>.crt) on the NMC client host in a folder of your choosing.
2. Open the CA signed certificate properties.
3. Click Install Certificate.
4. Select Local Machine.
5. Select Place all certificates in the following store.
6. Click Browse.
7. Select Trusted Root Certification Authorities, then click OK.
8. Click Next.
9. Click Finish.
10. A message appears stating if the import failed or was successful, click OK.
11. On the CA signed certificate properties, click OK.

During the next NMC launch, the Security Warning does not appear.