NetWorker：如何匯入或更換 NMC 的認證授權單位簽署憑證

# openssl version

1. 從 Windows 檔案總管前往 openssl.exe 位置。此路徑可能會有所不同，具體取決於 OpenSSL 的安裝方式。
2. 打開 openssl.exe 檔，然後前往詳細資料標籤。產品版本欄位會詳細說明 OpenSSL 版本：

1. 從 PFX 檔案擷取私密金鑰和 CA 簽署憑證。

# openssl pkcs12 -in <file>.pfx -out <server>.key -nodes -nocerts

# openssl x509 -in ICA.crt -outform pem -out ICA.crt.pem

4. 結合 server.key.pem、根 CA.crt、中繼憑證 （若適用），並將已簽署的伺服器憑證放入 cakey.pem NMC 的檔案：

1. 從 PFX 檔案擷取私密金鑰和 CA 簽署憑證。

%openssl% pkcs12 -in <file>.pfx -out <server>.key -nodes -nocerts

4. 結合 server.key.pem 和 sever.crt.pem 進入 cakey.pem 用於 NMC 的檔案。為此，建議使用下列 PowerShell 命令：

copy "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt" "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt_orig"
copy "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key" "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key_orig"
copy <server>.crt "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.crt"
copy <server>.key "C:\Program Files\EMC NetWorker\Management\GST\apache\conf\server.key"

6. 啟動 NMC 伺服器的 gst 服務：

net start gstd

7. 監控 NMC 伺服器的 C:\Program Files\EMC NetWorker\Management\GST\logs\gstd.raw 對於任何錯誤。

NetWorker：如何使用nsr_render_log呈現.raw紀錄檔

驗證：

當 NMC 伺服器的 gst 服務正在執行中，請從 NMC 伺服器上的 PowerShell 執行下列命令，更換 連接埠。為連接埠 9000 執行一次，為連接埠 9001 執行一次。

param(
    [string]$Server = "localhost",
    [int]$Port = PORT
)

$tcp = [System.Net.Sockets.TcpClient]::new()
$tcp.Connect($Server, $Port)

# Accept any certificate so we can inspect it (this is inspection only)
$ssl = [System.Net.Security.SslStream]::new(
    $tcp.GetStream(),
    $false,
    { param($sender, $cert, $chain, $errors) $true }
)

try {
    # SNI/target host is the $Server value
    $ssl.AuthenticateAsClient($Server)

    $remoteCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)

    # Some keys use CNG and PublicKey.Key can be $null; fall back safely
    $keySize = try { $remoteCert.PublicKey.Key.KeySize } catch { $null }
    if (-not $keySize) { $keySize = ($remoteCert.PublicKey.EncodedKeyValue.RawData.Length * 8) }

    "=== Certificate (from $($Server):$Port) ==="
    "Subject                 : $($remoteCert.Subject)"
    "Issuer                  : $($remoteCert.Issuer)"
    "NotBefore               : $($remoteCert.NotBefore)"
    "NotAfter                : $($remoteCert.NotAfter)"
    "Public Key              : $($remoteCert.PublicKey.Oid.FriendlyName) ($keySize-bit)"
    "Signature Algorithm     : $($remoteCert.SignatureAlgorithm.FriendlyName)"
}
finally {
    $ssl.Dispose()
    $tcp.Dispose()
}

範例：

PS C:\Users\Administrator.NETWORKER> param(
>>     [string]$Server = "localhost",
>>     [int]$Port = 9001
>> )
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> $tcp = [System.Net.Sockets.TcpClient]::new()
PS C:\Users\Administrator.NETWORKER> $tcp.Connect($Server, $Port)
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> # Accept any certificate so we can inspect it (this is inspection only)
PS C:\Users\Administrator.NETWORKER> $ssl = [System.Net.Security.SslStream]::new(
>>     $tcp.GetStream(),
>>     $false,
>>     { param($sender, $cert, $chain, $errors) $true }
>> )
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> try {
>>     # SNI/target host is the $Server value
>>     $ssl.AuthenticateAsClient($Server)
>>
>>     $remoteCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)
>>
>>     # Some keys use CNG and PublicKey.Key can be $null; fall back safely
>>     $keySize = try { $remoteCert.PublicKey.Key.KeySize } catch { $null }
>>     if (-not $keySize) { $keySize = ($remoteCert.PublicKey.EncodedKeyValue.RawData.Length * 8) }
>>
>>     "=== Certificate (from $($Server):$Port) ==="
>>     "Subject                 : $($remoteCert.Subject)"
>>     "Issuer                  : $($remoteCert.Issuer)"
>>     "NotBefore               : $($remoteCert.NotBefore)"
>>     "NotAfter                : $($remoteCert.NotAfter)"
>>     "Public Key              : $($remoteCert.PublicKey.Oid.FriendlyName) ($keySize-bit)"
>>     "Signature Algorithm     : $($remoteCert.SignatureAlgorithm.FriendlyName)"
>> }
>> finally {
>>     $ssl.Dispose()
>>     $tcp.Dispose()
>> }
=== Certificate (from localhost:9001) ===
Subject                 : CN=win-srvr02.networker.lan, OU=DPD, O=Dell Technologies, L=Toronto, S=Ontario, C=CA
Issuer                  : CN=dc.networker.lan, OU=DPD, O=Dell Technologies, L=Toronto, S=Ontario, C=CA
NotBefore               : 03/09/2026 15:42:43
NotAfter                : 06/11/2028 15:42:43
Public Key              : RSA (2048-bit)
Signature Algorithm     : sha256RSA

PS C:\Users\Administrator.NETWORKER> param(
>>     [string]$Server = "localhost",
>>     [int]$Port = 9000
>> )
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> $tcp = [System.Net.Sockets.TcpClient]::new()
PS C:\Users\Administrator.NETWORKER> $tcp.Connect($Server, $Port)
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> # Accept any certificate so we can inspect it (this is inspection only)
PS C:\Users\Administrator.NETWORKER> $ssl = [System.Net.Security.SslStream]::new(
>>     $tcp.GetStream(),
>>     $false,
>>     { param($sender, $cert, $chain, $errors) $true }
>> )
PS C:\Users\Administrator.NETWORKER>
PS C:\Users\Administrator.NETWORKER> try {
>>     # SNI/target host is the $Server value
>>     $ssl.AuthenticateAsClient($Server)
>>
>>     $remoteCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate)
>>
>>     # Some keys use CNG and PublicKey.Key can be $null; fall back safely
>>     $keySize = try { $remoteCert.PublicKey.Key.KeySize } catch { $null }
>>     if (-not $keySize) { $keySize = ($remoteCert.PublicKey.EncodedKeyValue.RawData.Length * 8) }
>>
>>     "=== Certificate (from $($Server):$Port) ==="
>>     "Subject                 : $($remoteCert.Subject)"
>>     "Issuer                  : $($remoteCert.Issuer)"
>>     "NotBefore               : $($remoteCert.NotBefore)"
>>     "NotAfter                : $($remoteCert.NotAfter)"
>>     "Public Key              : $($remoteCert.PublicKey.Oid.FriendlyName) ($keySize-bit)"
>>     "Signature Algorithm     : $($remoteCert.SignatureAlgorithm.FriendlyName)"
>> }
>> finally {
>>     $ssl.Dispose()
>>     $tcp.Dispose()
>> }
=== Certificate (from localhost:9000) ===
Subject                 : CN=win-srvr02.networker.lan, OU=DPD, O=Dell Technologies, L=Toronto, S=Ontario, C=CA
Issuer                  : CN=dc.networker.lan, OU=DPD, O=Dell Technologies, L=Toronto, S=Ontario, C=CA
NotBefore               : 03/09/2026 15:42:43
NotAfter                : 06/11/2028 15:42:43
Public Key              : RSA (2048-bit)
Signature Algorithm     : sha256RSA