Wasabi Failed to Retrieve Certificate

[dhayes16]

Hello All..I have been banging my head on this one and went through all the posts I found everywhere on this one. We have a Veeam 11a (latest patches, etc) deployed on a Windows 10 Pro box running the Veeam VBR Console. The performance tier is a linux hardened repo and it works perfectly. We added Wasabi Object storage like we have done for other sites and created the SOBR. The backup works fine to the linux repo but fails offloading to Wasabi with the error in the subject. Others have mentioned this could be the firewall and it is a Sophos UTM 9 fully patched with latest firmware. We disabled every function on this firewall neutering it to be just a NAT firewall. All services are disabled. We went through all the logs on the firewall and nothing is being logged that would indicate an issue. It does create the Veeam folder in the bucket during the initial setup. It is just the SOBR tiering that is failing. There are no proxy servers in place at all. We have tried multiple Wasabi Buckets in multiple locations. We have disabled the Windows 10 firewall as well.

Any ideas as to what could be causing this issue?

Thanks everyone
Dave

[Mildur]

Hi Dave

If you analyzed anything on your side and didn't find an answer in the forum, my suggestion will be opening a support case. Our support team will be able to tell you why you see this issues.
Please share the case number with us. Without a case number this topic could be deleted by a moderator.

Thanks
Fabian

[Regnor]

You've said that the firewall doesn't log anything, but to be sure; the Web Protection also doesn't check the Wasabi connections?
Could be related to SSL inspection and Veeam complains about getting the wrong certificate. This could also be caused be an Antivirus/Endpoint Security solution.

If you ruled that out, then open a support case like Fabian said.
After providing the logs, you can ask support if your problem is related to #05634023 and could be solved by the hotfix provided in that case.

[dhayes16]

Thanks everyone...So I am going to spend a little more time in the firewall...We have several Sophos XG firewalls out there and do not have this issue. This firewall is a Sophos UTM 9 so perhaps there is something going on there. Again all services such as web protection, AV, IPS, etc are disabled. I am going to attempt a couple of other things and if I do not have any luck I will open a veeam ticket. I do not want to waste there time without doing 100% due diligence on this.

I will post back in 24 hours

Thanks again for your help

[dhayes16]

Hello All..We tried everything on the Sophos UTM firewall and are still having the issue. I generated all the logs and uploaded to case # 05775603

I have not reached out to Wasabi yet and I am hoping the logs sent to Veeam will help. I can contact Wasabi if needed as well. I am wondering if I should try setting up a backblaze bucket as a test as well.

Thanks all for your responses. Much appreciated.
Dave

[veremin]

At this point it's better to continue working with the support team. The debug logs should allow them to spot the root cause. Thanks!

[dhayes16]

Hello All...HUGE thanks once again to Veeam support! Super fast response and resolution. For other people having this issue, I needed to explicitly specify the gateway server in the S3 bucket creation wizard in Veeam.

See below:
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Once I checked the box to explicitly select the gateway server all worked perfectly.

Thanks again to all who responded.

Dave

[Mildur]

I‘m glad to hear that is solved. Thanks for updating the topic with the solution.
When you don‘t choose a dedicated gateway server, the backup server is automatically used as a gateway server.

Best,
Fabian

[Gostev]

Still curios to learn the root cause: why the certificate can be obtained from one server but not from the other?

[mcz]

Just for information for everyone who find this thread: Our firewall does deep packet inspection and intrusion prevention, antivirus, etc. Veeam in combination with wasabi does NOT complain about it (as long as it's trusting the firewall's CA certificate).

Maybe in your case your veeam server didn't trust sophos CA certificate?