PowerProtect Data Manager 19.17 for Cyber Recovery User Guide

Updating the TLS security certificate

Update a TLS security certificate in the Cyber Recovery deployment with a custom security certificate.

1. Log in to the Cyber Recovery management host.
2. Generate a certificate signing request (CSR), which is required to apply for a CA-signed certificate:
   1. Run the crsetup.sh --gencertrequest script.
   2. At each prompt, either enter the information for your deployment or press Enter to omit the information and go to the next prompt.
      NOTE:You have the option to omit the IP address and URI in the certificate. As a result, the resulting script does not expose the IP address or the URI.
   3. When prompted, confirm the information that you provided.
   4. Enter the lockbox passphrase.

   The script lists the DNS name of the Cyber Recovery management host , which is essential for the certificate. The script also lists the IP address and URI if you chose to enter them in step 2b.

   NOTE:You must use these exact values when you submit the CSR to the CA.
   The crsetup.sh script generates a certificate signing request file: CRSERVICE.csr.
3. Submit the CRSERVICE.csr file to the CA to apply for a CA-signed certificate.
   NOTE:

   • Ensure that you submit the exact information from the previous step to the CA.
   • The Cyber Recovery software uses the name CRSERVICE by default to generate the certificate. However, you can use any meaningful file name for your deployment.
   The CA returns a <certificatename>.crt file.
4. Add the CA-signed certificate to the Cyber Recovery deployment:
   1. Copy the <certificatename>.crt file (returned by the CA) into any directory on the Cyber Recovery management host.
   2. Run the crsetup.sh --addcustcert script.
      The script stops the Docker container services.
   3. At the prompt, enter the full path where the <certificatename>.crt files is located.
      For example:

      /opt/dellemc/cr/bin/<certificatename>.crt

   4. Enter the lockbox passphrase.

      The script displays an informational message that indicates that the signed certificate has been added successfully, and then restarts the Docker container services.

      NOTE:The Cyber Recovery software validates the certificate and key files and verifies the information from the CSR (as described in step 2). It also validates the certificate start date, which must be current, and the certificate duration, which must exceed one year.
   The script starts the Docker container services whether the addition of the certificate succeeds or fails.