Export keys in Enterprise Manager

[ned]

How can I automate exporting encryption keys (.pem files) from Veeam Enterprise Manager? (EM / Configuration / Key_Management / Export)

Thanks, Ned

[veremin]

Enterprise Manager does not have PowerShell snap-in or PowerShell module. Its RESTful APIs do not allow key export. So, currently there is no way to achieve what you're after. Thanks!

[ned]

Was this added to v10?

[oleg.feoktistov]

No changes in regards to it so far. Thanks!

[ned]

Any update in VBR v11?

[oleg.feoktistov]

No update on this matter yet. Thanks!

[falkob]

Any plans on supporting this in the near future or next versions ? Key lifecycle management would be great if it would be achievable through PWSH or REST. Thanks !

[oleg.feoktistov]

Hi Falko,

We remember about it, cannot promise that it can be implemented in the near future though.

Thanks,
Oleg

[hwextreme]

Hi Veeam

I do not see any references in the Rest AIP in V12 that can do this. Any plans for this to be added?

I will be raising this with our account manager as a feature request as this is required for any enterprise environment. You cannot rely on a manual process to confirm that encryption keys are safe.

Phil

[falkob]

This i still something I would love to see in the Enterprise Manager, like I've written before, key lifecycle management is crucial to some enterprise customers. At the moment this is a complete manual task, despite the fact, that you do not get an E-Mail / Notifications / Veeam ONE Alarm as well if someone rotates the key. So in summary what I would love to see is:

- Triggering key management via PowerShell / REST
- Getting an E-Mail / Notifications / Veeam ONE Alarm or any other form of information so that Administrators know that the key has changed

This information is crucial in a DR scenario where you would need to go for challenge response or import the key again.

Personally, I did (and do) always advise at the cusomters to copy the configuration backup files to one or more locations, because configuration backup is still not HA capable. You unfortunately need to use File COpy (without a retention option as well...) to copy the configuration backup files to another location. Within the same job I always process the exported keysets from enterprise manager to have both things a.) the config backup and b.) the last used key handy in a DR scenario.

Hope this gives some more insights, as I think this is very important.

Cheers
Falko