Before you begin
Verify the following before starting this procedure:- You have administrator access to the Veeam Backup & Replication console (desktop version).
- You have the endpoint ZIP file you created in the last section for the Veeam Backup & Replication service on the CryptoHub.
- OpenSSL is installed on the computer you are using in this section.
- Network connectivity exists between the Veeam server and CryptoHub on port 5696.
Preparing certificates
Veeam requires certificates in specific formats. Use the procedures in this section to verify and convert certificates before import.Extract the endpoint zip
1
Move the endpoint zip file into an empty directory.
2
Open a new terminal and navigate into the directory where the endpoint zip file is stored.
3
Extract the endpoint zip file:In Windows PowerShell, use this command:In Linux bash, use this command:
PowerShell
Bash
4
Extract the client private key from the
pki.p12 file using OpenSSL. Enter the PKCS#12 password when prompted.The
pki-password.txt file contains the password for the pki.p12 file. Use this password when prompted by OpenSSL.OpenSSL
5
Convert the PKCS#8 client private key to PKCS#1 format:
OpenSSL
client-privatekey-pkcs1.pem— Veeam client private key in PKCS#1 formatclient-cert.pem— Veeam client TLS certificate<CryptoHub-IP-or-FQDN>.cer— KMIP server TLS certificateCryptoHub <number>.cer- Client App TLS CA certificate used to issue the KMIP client and KMIP server TLS certs (number is random)
Import the CA certificate into the Trusted Root store
The KMIP server and KMIP client TLS certificates are issued by the Client App TLS CA (CryptoHub <number>.cer). Import this CA certificate into the Trusted Root Certification Authorities store on the Veeam Backup & Replication server so that Windows trusts the CryptoHub certificate chain when you add the KMS server. If you skip this step, Veeam reports a certificate trust error when it validates the connection.
Import the certificate into the Local Computer store (not the current user store). The Veeam Backup & Replication service must trust the CA, and services run in the machine context rather than under your user account.
1
On the Veeam server, open the Microsoft Management Console. Select Start, type
mmc, and press Enter.2
In the console, select File > Add/Remove Snap-in.
3
Select Certificates from the list of available snap-ins, then select Add.
4
When prompted, choose Computer account, select Next, choose Local computer, then select Finish. Select OK to close the snap-in dialog.
5
In the console tree, expand Certificates (Local Computer) > Trusted Root Certification Authorities.
6
Right-click Certificates, then select All Tasks > Import to launch the Certificate Import Wizard.
7
Select Next, then Browse to the
CryptoHub <number>.cer file. Select the file, then select Next.8
On the Certificate Store page, verify that Place all certificates in the following store is selected and that the store is Trusted Root Certification Authorities. Select Next, then select Finish.
You can also import the CA certificate with PowerShell. Run the following command in an elevated (Run as administrator) PowerShell session:
PowerShell
The
CryptoHub <number>.cer certificate appears under Trusted Root Certification Authorities > Certificates in the Local Computer store. Veeam Backup & Replication can now validate the CryptoHub certificate chain when you add the KMS server.Adding the KMS server
Complete the following steps to register CryptoHub in Veeam Backup & Replication.1
Open the Veeam Backup & Replication console.
2
From the main menu, select Credentials and Passwords > Key Management Servers.
3
In the Key Management Servers window, select Add.
4
In the Server field, enter the fully qualified domain name (FQDN) or IP address of CryptoHub.Example:
cryptohub.example.com5
In the Port field, verify that the port number is 5696. Change this value only if your CryptoHub KMIP service uses a non-standard port.
6
In the Server certificate field, select Browse.
7
Choose the Import certificate from a file method, and complete the following steps in the import wizard:a. Select the KMIP server TLS certificate file (
<CryptoHub-IP-or-FQDN>.cer) from your local system.b. It is not password-protected (PFX), so leave the Password field blank.c. Select Next, then select Finish.8
In the Client certificate field, select Browse.
9
Choose the Import certificate from a PEM file method, and complete the following steps in the import wizard:a. Select the Veeam client TLS certificate file (
client-cert.pem) from your local system.b. Select the Veeam client private key file (client-privatekey-pkcs1.pem) from your local system.c. Select Next, then select Finish.10
In the Description field, enter a descriptive name for the KMS server.Example:
CryptoHub Production - Data Center 111
Select OK to save the KMS server configuration.
CryptoHub appears in the Key Management Servers list. Veeam validates connectivity and certificate trust during the save operation. If validation fails, see Troubleshooting connection failures below.