Additional steps on CRS if encryption is enabled NetBackup primary server
Below are the additional steps to be done on Cloud Recovery Server, if the encryption is enabled on Netbackup primary server.
When KMS encryption is enabled, you can share the images in S3 bucket to the Cloud Recovery Server host with manual KMS key transfer.
On-premises KMS key changes:
In case of KMS key changes, for the given group for on-premises storage server after the Cloud Recovery Server host is set up, you must export the key file from on-premises KMS server and import that key file on the cloud recovery host.
On-premises NetBackup master server: Exports the key group with a passphrase to a file:
/usr/openv/netbackup/bin/admincmd/nbkmsutil -export -key_groups <key-group-name> -path <key file path>
Cloud Recovery Server host (cloud side):
Copy the exported key to the Cloud Recovery Server host.
Config KMS server:
/usr/openv/netbackup/bin/nbkms -createemptydb /usr/openv/netbackup/bin/nbkms /usr/openv/netbackup/bin/nbkmscmd -discovernbkms -autodiscoverImport keys to KMS service.
/usr/openv/netbackup/bin/admincmd/nbkmsutil -import -path <key file path> -preserve_kgnameOnce this is done we need to restart the NetBackup.
Refer below link for more details.