Deploy the service and an initial client endpoint

Complete the following steps to deploy the Veeam Backup & Replication service in CryptoHub.

Navigate to the Services page.

Locate the Veeam service template and select [ Deploy ].

In the deployment wizard, configure the service settings for your environment.

Review the deployment summary and select [ Confirm ] to deploy the service.

After deploying the Veeam Backup & Replication service in CryptoHub, set up a client endpoint. An endpoint is a device authorized to access the service. Use the Endpoints menu to view and manage these devices.

Navigate to the Endpoints menu for the Veeam Backup & Replication service you deployed.

In the Manage Endpoints menu, select [ Add New ].

In the Add Endpoint dialog:

Enter an identifier, or leave it empty for auto-generation.
Leave the auto-populated CryptoHub Hostname as is.
Set the Client Connection Type to RSA.

Select [ Add Endpoint ]. The browser prompts you to download a ZIP file that contains the following files:

File	Description
`ca-chain.pem`	CA certificate bundle
`client-cert.pem`	Client TLS certificate
`credential.txt`	Contains the name of the identity CryptoHub created for Veeam to use when connecting and authenticating through KMIP
`info.txt`	Includes the service name and address for connecting to the CryptoHub
`pki.p12`	Full Client PKI in encrypted PKCS #12 format (contains the CA chain, client certificate, and client private key)
`pki-password.txt`	Contains the password for the PKCS #12 file
`CryptoHub <number>.cer`	Auto-generated self-signed CA certificate used to issue client endpoint TLS certs (number is random)
`Futurex Test Root CA (ECC).cer` or `Futurex Test Root SSL CA.cer`	Futurex Test Root CA for embedded Futurex Test TLS certs (ECC or RSA, based on the algorithm configured for the KMIP connection pair)
`<number>-Prod-App-Alt.cer`	KMIP server TLS certificate (number is random)

The Veeam Backup & Replication integration requires the KMIP server TLS certificate to include CRL Distribution Points (CDP) and Subject Alternative Name (SAN) extensions. The next section details how to configure the KMIP server TLS certificate on the CryptoHub.This is noted here because you must deploy a new client endpoint after you configure the KMIP server TLS certificate. The new client endpoint contains the updated KMIP server TLS certificate. You can delete the endpoint ZIP file you downloaded in this step after you deploy the new client endpoint.Deploying the initial client endpoint in this step ensures that the auto-generated self-signed CA certificate exists, so the next section can use it to issue the KMIP server TLS certificate with the necessary extensions.

⌘I