Dell EMC Avamar for VMware 19.7 User Guide

Import custom certificate in Avamar VMware Image Backup Proxy

After deploying a proxy appliance in vCenter and registering it with the Avamar server, you can manually replace the default self-signed certificate with a user certificate for port 443, 5480, and 5489 on Avamar VMware Image Backup Proxy.

1. Log in to the proxy using SSH with an admin account and switch to root account using su command.
   195proxy:~ # su -
2. Grant execute permission for pxychangecert.sh script.
   195proxy:~ # chmod +x pxychangecert.sh
3. For signed certificate:
   1. From proxy generate a private key and Certificate Signing Request (CSR) files using the following openssl commands:
      195proxy:~ # mkdir /tmp/certs
      195proxy:~ # openssl genrsa -out /tmp/certs/key.pem 3072
      195proxy:~ # openssl req -new -key /tmp/certs/key.pem -out /tmp/certs/`hostname -f`.csr -subj "/C=US/ST=California/L=Irvine/O=Dell Technologies/OU=Dell EMC/CN=`hostname -f`"
      NOTE:The `hostname -f ` will set Common Name (CN) to current hostname. Adjust Country (C), State (ST), Location (L), Organization (O), and Organization Unit (OU) as per your requirement or omit -subj so that openssl starts an interactive prompt to collect these values.
   2. Upload the /tmp/certs/<proxy hostname>.csr file to the commercial or internal Certificate Authority (CA).
   3. The CA must provide a valid signed certificate and a certificate chain file. Upload these the files to /tmp/certs directory.
4. For self-signed certificate:
   Run the following openssl command to generate a new private key and a self-signed certificate with expiration duration of one year:
   195proxy:~ # openssl req -x509 -new -newkey rsa:3072 -nodes -keyout /tmp/certs/key.pem -out /tmp/certs/cert.pem -days 365 -subj "/C=US/ST=California/L=Irvine/O=Dell Technologies/OU=Dell EMC/CN=`hostname -f `"
   NOTE: You can modify -days to adjust the duration of expiration.
5. Ensure matching private key, certificate, and certificate chain are located in the temp location of the proxy, and meet the following requirements:
   1. The private key must not be encrypted.
   2. The certificate must be in x509 format.
   3. The CN of the certificate must match the hostname of this proxy.
   4. The "keyUsage" extension of the certificate or the " keyUsage" must not contain digitalSignature, keyEncipherment, and keyAgreement properties.
   5. The "extendedKeyUsage" extension of the certificate or the "extendedKeyUsage" must not contain serverAuth and clientAuth properties.
   6. The certificate chain file must contain all trusted root CA for the certificate. If the certificate to be replaced is a self-signed certificate, use the same file for certificate and chain.
6. Replace the certificate by running the following command:
   195proxy:~ # ./pxychangecert.sh /tmp/certs/key.pem /tmp/certs/cert.pem /tmp/certs/chain.pem avam@r
   Where, avam@r is the default keystore password.