Skip to content

Commit 846130f

Browse files
Y0CossY0Coss
committed
Duplication
1 parent 7e2ee06 commit 846130f

File tree

13 files changed

+1963
-0
lines changed

13 files changed

+1963
-0
lines changed

‎pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/veeam_encrypt_backup_job_with_okms/guide.de-de.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: "Encrypting backup jobs with Veeam and OKMS"
3+
excerpt: "Learn how to configure encrypted backup jobs using Veeam and the OVHcloud Key Management Service (OKMS) to enhance data protection"
4+
updated: 2025-04-22
5+
---
6+
7+
## Objective
8+
9+
This guide explains how to configure encrypted backup jobs using the Veeam backup solution and the OVHcloud Key Management Service (OKMS).
10+
11+
## Requirements
12+
13+
- Access to the [OVHcloud Control Panel](/links/manager).
14+
- A [VMware on OVHcloud](/links/hosted-private-cloud/vmware) offer.
15+
- Read the following guides:
16+
- [Integrating a KMS with VMware on OVHcloud](/pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/vmware_overall_vm-encrypt).
17+
- [Getting started with OKMS](/pages/manage_and_operate/kms/quick-start).
18+
19+
## Instructions
20+
21+
### Step 1: Create a certificate in OKMS
22+
23+
You can create your access certificate in OKMS using either the [OVHcloud API](/links/api) or the [OVHcloud Control Panel](/links/manager).
24+
25+
#### Option 1: Using the API
26+
27+
1. Generate the private key using the API (no CSR):
28+
29+
> [!api]
30+
>
31+
> @api {v1} /okms POST / /okms/resource/{okmsId}/credential
32+
33+
2. Retrieve the certificate using a GET request:
34+
35+
> [!api]
36+
>
37+
> @api {v1} /okms GET /okms/resource/{okmsId}/credential
38+
39+
> [!primary]
40+
> This method is equivalent to selecting `I don't have a private key`{.action} in the [OVHcloud Control Panel](/links/manager) interface.
41+
> You may also submit a CSR if you already have your own private key.
42+
43+
3. Download the private key.
44+
45+
4. Download the certificate.
46+
47+
> [!primary]
48+
> The downloaded private key is used to generate the `.pfx` file in the next step.
49+
> You don't need to import it manually into Veeam, but it is required to convert the certificate into a compatible format.
50+
> Make sure to store it securely.
51+
52+
#### Option 2: Using the [OVHcloud Control Panel](/links/manager)
53+
54+
1. In the [OVHcloud Control Panel](/links/manager), click `Hosted Private Cloud`{.action} then `Identity, Security & Operations`{.action} and finally `Key Management Service`{.action}. Select your KMS.
55+
56+
![Console Dashboard](images/console_1.png){.thumbnail}
57+
58+
2. Select your KMS.
59+
60+
![KMS List](images/console_2.png){.thumbnail}
61+
62+
3. Open the `Access certificates`{.action} tab.
63+
64+
![Access certificates tab](images/veeam_okms_1.png){.thumbnail}
65+
66+
4. Click `Generate an access certificate`{.action}.
67+
68+
5. Fill in the required fields, then select `I don’t have a private key`{.action}.
69+
70+
![Generate Access Certificate - No Private Key](images/veeam_okms_2.png){.thumbnail}
71+
72+
> [!primary]
73+
> This is the same as generating a certificate without a CSR, like with the API.
74+
> You can also choose `I already have a private key` to generate a certificate using your own CSR.
75+
76+
6. Add user IDs to the certificate:
77+
- Click `Add user IDs`{.action}
78+
- Select the authorized users
79+
- Confirm to associate the certificate
80+
81+
> [!primary]
82+
> This step is required for the certificate to work with Veeam.
83+
84+
7. Download the private key and the certificate.
85+
86+
![Download Certificate](images/veeam_okms_3.png){.thumbnail}
87+
88+
### Step 2: Convert the PEM certificate to PFX format
89+
90+
To import the certificate into Veeam, convert it to `.pfx` format using the command below:
91+
92+
```bash
93+
openssl pkcs12 -export -out cert.pfx -inkey privatekey.pem -in certificate.pem
94+
```
95+
96+
### Step 3: Import the certificate into the Veeam Windows Certificate Store
97+
98+
- Open the Windows Certificate Store on your Veeam server.
99+
- Import the `.pfx` file generated in the previous step.
100+
- Check the option to make the certificate exportable.
101+
102+
![Import Certificate - Exportable](images/veeam_okms_4.png){.thumbnail}
103+
104+
### Step 4: Register the KMS in Veeam
105+
106+
- Open Veeam Backup & Replication and go to `Credentials & Passwords`{.action}, then click `Key Management Servers`{.action}.
107+
108+
![Veeam Key Management Servers](images/veeam_okms_5.png){.thumbnail}
109+
110+
- Click `Add`{.action} to add a new KMS server.
111+
112+
![Add KMS Server](images/veeam_okms_6.png){.thumbnail}
113+
114+
- Enter the following details:
115+
- Server address: `eu-west-rbx.okms.ovh.net`
116+
- Port: `5696`
117+
- Server certificate: `*.okms.ovh.net`
118+
- Client certificate: the `.pfx` file you just imported
119+
120+
![Add KMS Server Details](images/veeam_okms_7.png){.thumbnail}
121+
122+
### Step 5: Retrieve the server certificate
123+
124+
To retrieve the server certificate from OKMS, run the following command:
125+
126+
```bash
127+
openssl s_client -connect eu-west-rbx.okms.ovh.net:443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
128+
```
129+
130+
### Step 6: Configure backup job encryption
131+
132+
- Register the KMS server in your Veeam Backup & Replication console.
133+
- Select the desired backup job and enable encryption using the registered KMS.
134+
135+
![Configure Backup Encryption](images/veeam_okms_8.png){.thumbnail}
136+
137+
- Once the backup has run, a padlock icon appears next to its name.
138+
139+
![Encrypted Backup](images/veeam_okms_9.png){.thumbnail}
140+
141+
- If you encounter the error `Unsupported attribute: OPERATION_POLICY_NAME`, check the documentation or contact support.
142+
143+
![Operation Policy Name Error](images/veeam_okms_10.png){.thumbnail}
144+
145+
## Go further
146+
147+
If you need training or technical assistance to implement our solutions, contact your Technical Account Manager or click [this link](/links/professional-services) to request a quote and get personalized support from our Professional Services team.
148+
149+
Ask questions, share feedback, and interact directly with the Hosted Private Cloud team on our [Discord](https://discord.gg/ovhcloud) channel.
150+
151+
Join our [community of users](/links/community).

‎pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/veeam_encrypt_backup_job_with_okms/guide.en-asia.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: "Encrypting backup jobs with Veeam and OKMS"
3+
excerpt: "Learn how to configure encrypted backup jobs using Veeam and the OVHcloud Key Management Service (OKMS) to enhance data protection"
4+
updated: 2025-04-22
5+
---
6+
7+
## Objective
8+
9+
This guide explains how to configure encrypted backup jobs using the Veeam backup solution and the OVHcloud Key Management Service (OKMS).
10+
11+
## Requirements
12+
13+
- Access to the [OVHcloud Control Panel](/links/manager).
14+
- A [VMware on OVHcloud](/links/hosted-private-cloud/vmware) offer.
15+
- Read the following guides:
16+
- [Integrating a KMS with VMware on OVHcloud](/pages/hosted_private_cloud/hosted_private_cloud_powered_by_vmware/vmware_overall_vm-encrypt).
17+
- [Getting started with OKMS](/pages/manage_and_operate/kms/quick-start).
18+
19+
## Instructions
20+
21+
### Step 1: Create a certificate in OKMS
22+
23+
You can create your access certificate in OKMS using either the [OVHcloud API](/links/api) or the [OVHcloud Control Panel](/links/manager).
24+
25+
#### Option 1: Using the API
26+
27+
1. Generate the private key using the API (no CSR):
28+
29+
> [!api]
30+
>
31+
> @api {v1} /okms POST / /okms/resource/{okmsId}/credential
32+
33+
2. Retrieve the certificate using a GET request:
34+
35+
> [!api]
36+
>
37+
> @api {v1} /okms GET /okms/resource/{okmsId}/credential
38+
39+
> [!primary]
40+
> This method is equivalent to selecting `I don't have a private key`{.action} in the [OVHcloud Control Panel](/links/manager) interface.
41+
> You may also submit a CSR if you already have your own private key.
42+
43+
3. Download the private key.
44+
45+
4. Download the certificate.
46+
47+
> [!primary]
48+
> The downloaded private key is used to generate the `.pfx` file in the next step.
49+
> You don't need to import it manually into Veeam, but it is required to convert the certificate into a compatible format.
50+
> Make sure to store it securely.
51+
52+
#### Option 2: Using the [OVHcloud Control Panel](/links/manager)
53+
54+
1. In the [OVHcloud Control Panel](/links/manager), click `Hosted Private Cloud`{.action} then `Identity, Security & Operations`{.action} and finally `Key Management Service`{.action}. Select your KMS.
55+
56+
![Console Dashboard](images/console_1.png){.thumbnail}
57+
58+
2. Select your KMS.
59+
60+
![KMS List](images/console_2.png){.thumbnail}
61+
62+
3. Open the `Access certificates`{.action} tab.
63+
64+
![Access certificates tab](images/veeam_okms_1.png){.thumbnail}
65+
66+
4. Click `Generate an access certificate`{.action}.
67+
68+
5. Fill in the required fields, then select `I don’t have a private key`{.action}.
69+
70+
![Generate Access Certificate - No Private Key](images/veeam_okms_2.png){.thumbnail}
71+
72+
> [!primary]
73+
> This is the same as generating a certificate without a CSR, like with the API.
74+
> You can also choose `I already have a private key` to generate a certificate using your own CSR.
75+
76+
6. Add user IDs to the certificate:
77+
- Click `Add user IDs`{.action}
78+
- Select the authorized users
79+
- Confirm to associate the certificate
80+
81+
> [!primary]
82+
> This step is required for the certificate to work with Veeam.
83+
84+
7. Download the private key and the certificate.
85+
86+
![Download Certificate](images/veeam_okms_3.png){.thumbnail}
87+
88+
### Step 2: Convert the PEM certificate to PFX format
89+
90+
To import the certificate into Veeam, convert it to `.pfx` format using the command below:
91+
92+
```bash
93+
openssl pkcs12 -export -out cert.pfx -inkey privatekey.pem -in certificate.pem
94+
```
95+
96+
### Step 3: Import the certificate into the Veeam Windows Certificate Store
97+
98+
- Open the Windows Certificate Store on your Veeam server.
99+
- Import the `.pfx` file generated in the previous step.
100+
- Check the option to make the certificate exportable.
101+
102+
![Import Certificate - Exportable](images/veeam_okms_4.png){.thumbnail}
103+
104+
### Step 4: Register the KMS in Veeam
105+
106+
- Open Veeam Backup & Replication and go to `Credentials & Passwords`{.action}, then click `Key Management Servers`{.action}.
107+
108+
![Veeam Key Management Servers](images/veeam_okms_5.png){.thumbnail}
109+
110+
- Click `Add`{.action} to add a new KMS server.
111+
112+
![Add KMS Server](images/veeam_okms_6.png){.thumbnail}
113+
114+
- Enter the following details:
115+
- Server address: `eu-west-rbx.okms.ovh.net`
116+
- Port: `5696`
117+
- Server certificate: `*.okms.ovh.net`
118+
- Client certificate: the `.pfx` file you just imported
119+
120+
![Add KMS Server Details](images/veeam_okms_7.png){.thumbnail}
121+
122+
### Step 5: Retrieve the server certificate
123+
124+
To retrieve the server certificate from OKMS, run the following command:
125+
126+
```bash
127+
openssl s_client -connect eu-west-rbx.okms.ovh.net:443 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
128+
```
129+
130+
### Step 6: Configure backup job encryption
131+
132+
- Register the KMS server in your Veeam Backup & Replication console.
133+
- Select the desired backup job and enable encryption using the registered KMS.
134+
135+
![Configure Backup Encryption](images/veeam_okms_8.png){.thumbnail}
136+
137+
- Once the backup has run, a padlock icon appears next to its name.
138+
139+
![Encrypted Backup](images/veeam_okms_9.png){.thumbnail}
140+
141+
- If you encounter the error `Unsupported attribute: OPERATION_POLICY_NAME`, check the documentation or contact support.
142+
143+
![Operation Policy Name Error](images/veeam_okms_10.png){.thumbnail}
144+
145+
## Go further
146+
147+
If you need training or technical assistance to implement our solutions, contact your Technical Account Manager or click [this link](/links/professional-services) to request a quote and get personalized support from our Professional Services team.
148+
149+
Ask questions, share feedback, and interact directly with the Hosted Private Cloud team on our [Discord](https://discord.gg/ovhcloud) channel.
150+
151+
Join our [community of users](/links/community).

0 commit comments

Comments
 (0)