Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Flex Scale Administrator's Guide
  3. NetBackup Flex Scale security
  4. Deploying external certificates on NetBackup Flex Scale
  5. Considerations for performing other operations when ECA is deployed
NetBackup™ Flex Scale Administrator's Guide

Considerations for performing other operations when ECA is deployed

If ECA is deployed and you want to add a new node to the cluster:

  • Before starting an add node operation, generate a new certificate request which has the new node's storage server FQDN as an additional SAN entry.

  • Do not add the media server FQDN in the SAN entry.

  • Upload the new certificate and then add the new node. Otherwise, the add node operation will fail.

If ECA is deployed on a cluster where disaster recovery is configured and you want to add a new node to the cluster:

  • The ECA has to be renewed on the primary irrespective of whether you add the new node on the primary or secondary cluster.

  • The new certificate must contain FQDN of the storage server of the node which is going to be added.

  • A new CSR has to be generated which contains the FQDN of the new storage server as a SAN entry. A new certificate is generated with the new CSR which is used for ECA deployment/renewal.

  • Do not add the media server FQDN in the SAN entry.

If ECA is deployed and you want to add a new data network:

  • Add the new primary and storage server FQDNs to the CSR and deploy the new certificate before adding the new data network.

  • Do not add the media server FQDN in the SAN entry.

Feedback

Was this page helpful?
Previous

Log locations

Next

Configuring isolated recovery environment (IRE)

Feedback

Was this page helpful?