offload fails when connection fail in a certain state

[mcz]

Before offload process starts, backup server establishes a secure connection to object storage. If connection cannot be established (say, backup server cannot receive certificate), the operation will be retried. This does not apply to a situation where backup server receives an invalid certificate – in this case operation just fails.

If you experience different behaviour, kindly, collect fresh debug logs, create a separate support ticket and describe the issue there. Also, if you want to discuss this issue further here, please, create another forum thread with the problem description and support ticket number, cause current thread becomes a bit messy at this point.

Thanks!

Okay Vladimir, here is the new thread I have to quote the important part again:

This does not apply to a situation where backup server receives an invalid certificate – in this case operation just fails.

I do exactly experience the same behavings as you have described and now it seems to be clear to me: Somehow, when the connection gets lost or ended most likely during the certificate exchange, veeam treats it is an invalid certificate instead of a connection lost. I had hundrets of situations when our routing mechanism just re-routed outgoing connections or better said it ended the existing ones and routed the new session through a different interface and therefor it's very hard to simulate - even I can't tell you when exactly it got ended, but in the veeam logs you just saw those 'short read' failures and finally it told you 'invalid certificate'. I never expected a connection loss as the culprit.

Maybe this logic could be optimized so that it would do some retries. I mean, somehow it's clear that the certificate is invalid when it wasn't transfered in one piece but it's a ended session and not an invalid cert in the end...

Your thoughts on this? I know it isn't that important right now, but I bet there might be similar situations in the future somewhere else... Thanks!

[veremin]

Hi, Michael,

This does not seem like expected behaviour - connection drops should not lead to invalid certificate errors. Support team might help you to find the exact root cause, so feel free to reach them.

Thanks!

[mcz]

Hi Vladimir,

I had tickets open, but support was never able to get to the bottom of that. Only because I've detected the culprit in the network-stack I then was able to reconstruct the situation 'in my head'.
Of course I've fixed that issue on our side and suddenly the certificate issues were gone - no surprise if you know that story behind. So I almost can guarantee you that those connection drops have lead to those wrong error messages.

Please let me know if you need more input.

[veremin]

R&D team do not believe that dropped connection can result in invalid certificate error, it might have been something specific to your environment given the complex firewall setup. But to confirm this reliably we (as always) need debug logs. If you have this issue discussed in the existing ticket and happen to have the debug logs for it, let us know the case number and we will double check it.

[mcz]

it should be the case #04909110

[veremin]

OK, we will review the ticket and see whether we can find something interesting there.