Skip to main content
The CryptoHub App TLS CA issues the KMIP server and client certificates. Veeam rejects the KMIP server certificate if it cannot retrieve the CA’s certificate revocation list (CRL). This section explains how to export the CRL from CryptoHub and publish it to your CDP server.

​
Before you begin

Verify the following before starting this procedure:
  • You configured the KMIP server certificate and added a CRL Distribution Points extension. See Configure the KMIP server certificate.
  • You know the CRL URL embedded in that extension, in the format http://HOSTNAME-OR-IP_ADDRESS/cryptohub.crl.
  • You operate a CDP server that publishes files at that URL, and the Veeam Backup & Replication server can reach it.
The filename and path you publish the CRL under on your CDP server must exactly match the URL in the certificate’s CRL Distribution Points extension. If the path differs, Veeam cannot retrieve the CRL and rejects the server certificate.

​
Export the CRL from the CryptoHub App TLS CA

1
Log in to CryptoHub with your administrator identities.
2
Go to PKI and CA > Certificate Management.
3
Select the plus (+) icon to expand the “Client App TLS CA” X.509 Certificate Container.
A randomly-generated 10-digit number is appended to the end of the “Client App TLS CA” name.
4
Right-click the CryptoHub [10_digit_number] self-signed CA certificate, and select CRL > Export.
5
Select [ OK ]. You should see a confirmation message that the CRL was successfully written. Select [ OK ] to close the confirmation message. Your browser then downloads the file, and you choose where to save it locally.

​
Publish the CRL to your CDP server

1
Copy the exported CRL file to your CDP server.
2
Place the file at the path that matches the URL in the certificate’s CRL Distribution Points extension. For example, for http://crl.example.com/cryptohub.crl, publish the file as cryptohub.crl at the web root of crl.example.com.
3
Confirm that the CDP server serves the file over the same protocol and port specified in the certificate URL (port 80 for an http:// URL).

​
Verify that Veeam can retrieve the CRL

1
From the Veeam Backup & Replication server, open the CRL URL in a browser or download it with a command-line tool.Examples:
  • PowerShell: Invoke-WebRequest http://crl.example.com/cryptohub.crl -OutFile cryptohub.crl
  • Linux: curl -o cryptohub.crl http://crl.example.com/cryptohub.crl
2
Confirm that the file downloads successfully and is not empty.
The Veeam server retrieves the CRL from the CDP URL without errors.
After the CRL is published and reachable, Veeam can validate the KMIP server certificate’s revocation status. Continue with Adding the KMS server in Veeam.