adding 8.1 certificates to multiple masters for trust relationships

[Stanleyj]

 I have 2 datacenters one is primary and one is a hot site for Diseaster recovery. 

Primary datacenter has 1 windows master and one 5230 appliance media server.

DR site has 1 5230 setup as a master server and is used for AIR and backup in that site.

All servers and clients were recently upgraded to version 8.1.  Everything has been working fine until today i needed to restore a file back to my primary DC from an AIR job located on my DR appliance and started recieving errors about  the certificates not be trusted.

Nov 13, 2017 10:04:18 AM - Error bpbrm (pid=22996) [PROXY] Received status: 7641 with message Failed to find a common CA Root to complete secure handshake: Connector CAs(["9936a514-d91e-4687-8f97-2e43075aeb05"]), Acceptor CAs(["dfd9c1d7-46a4-46a1-98f1-a1df4bb05c36"]).

Nov 13, 2017 10:04:18 AM - Error bpbrm (pid=22996) [PROXY] Encountered error (CERT_PROTOCOL_SELECT_COMMON_CA_ROOT) while processing(CertProtocol).

Nov 13, 2017 10:04:18 AM - Error bpbrm (pid=22996) bpcd on p190fil04.gfbmic.com exited with status 7641: Failed to find a common CA Root for secure handshake

Nov 13, 2017 10:04:18 AM - Info tar (pid=0) done. status: 7641: Failed to find a common CA Root for secure handshake

Nov 13, 2017 10:04:18 AM - Error bpbrm (pid=22996) client restore EXIT STATUS 7641: Failed to find a common CA Root for secure handshake  

Is there a way to add the cert to both masters so that they trust each other or is there some way to replace the cert on the my DR master to match the one in my primary?

[Marianne]

See if this helps:

https://vox.veritas.com/t5/NetBackup/NetBackup-Client-Token-for-second-master-server/m-p/841485

[binayb · Accepted solution]

Yes, you can add certificates from the other master to the client. I came across this same issue and I was able to fix by doing the below -

on client run nbcertcmd -getCACertificate -server <second_master> 

nbcertcmd -displayCACertDetail -server <second_master>  output should show as trusted.

Next check host ID by running - 

nbcertcmd -hostselfcheck -server  <second_master> output should say host ID not revoked. If it says certificates doesnt exist then run -

nbcertcmd -hostselfcheck -server <second_master>

After this I was able to complete my restore. Restart nbu services on client if required. 

[Marianne]

Seems @Stanleyj never came back to look for answers.... 

[shashikant123]

Hi,

Both commands are same- 

nbcertcmd -hostselfcheck -server  <second_master> output should say host ID not revoked. If it says certificates doesnt exist then run -

nbcertcmd -hostselfcheck -server <second_master>

Please provide correct command in case you missed/typo.

Regards,

Mayur Veralkar.

[onepranav]

Could you please provide the correct second command?
The commands look the same