Getting CA-Signed Certificate

CommunityEnterprise

Note

Creating TLS certificates is not required to encrypt communications between Bacula components. TLS-PSK is enabled by default when TLS certificates are not configured and uses the Bacula password as the pre-shared key. For Bacula Enterprise 18.2.5, we recommend a strong, randomly generated password of at least 32 characters. The following procedure applies when you choose to use certificate-based TLS. For more information, see Bacula TLS – Communications Encryption.

The process of getting a certificate that is signed by a CA is quite a bit more complicated. You can purchase one from a number of PKI vendors, but that is not at all necessary for use with Bacula.

To get a CA signed certificate, you will either need to find a friend that has setup his own, trusted CA, or to become a CA yourself, and thus you can sign all your own certificates. The book OpenSSL by John Viega, Matt Mesier & Pravir Chandra from O’Reilly explains how to do it, or you can read the documentation provided in the Open-source PKI Book.

See also

Previous articles:

• TLS Configuration Directives

• Creating Self-Signed Certificate

Next articles:

• Example TLS Configuration Files

Go back to: Bacula TLS - Communications Encryption.