Failed to check certificate expiration date

[Pat490]

Today I suddenly noticed an error message when launching VBR console: "Failed to check certificate expiration date"

which certificate? License information all seems correct. Internet works fine on the server also. What else could it mean? What do I need to do?

In console logfile I found:

Code: Select all

[21.11.2018 07:07:51] <01> Info     [LicenseExpirationUiMessagesFactory] Created CPerpetualLicenseUiMessages
[21.11.2018 07:07:51] <01> Info     Perpetual license, report skipped
[21.11.2018 07:07:51] <01> Info     VBR server certificate will expire on 28 days
[21.11.2018 07:07:51] <01> Error    Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt. (System.NullReferenceException)
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.Properties.Settings.get_CertificateExpirationDisplayDate()
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.NewFormMain.CheckCertificateExpirationDate()
[21.11.2018 07:07:51] <01> Error    Failed to check certificate expiration date   bei Veeam.Backup.UI.NewFormMain.CheckCertificateExpirationDate()
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.NewFormMain.NewFormMain_Shown(Object sender, EventArgs e)
[21.11.2018 07:09:09] <01> Info     Checking is upgrade required, includeCloudItems = True
[21.11.2018 07:09:09] <01> Info     Nothing to upgrade

[systeembeheerder]

Ditto here!
Two Veeam servers, both show up with the same message.

[SBarrett847]

Same here.

[Microsaft]

Had the same … Support send me following link:

https://helpcenter.veeam.com/docs/backu ... tml?ver=95

[Pat490]

thank you very much. that helped for me too. After generating a new cert, do I remove/delete the old cert from Windows Cert store?

[SBarrett847]

Much obliged - fixed for me also.

[Gostev]

Does anyone have support case ID with debug logs, so that we could see what happened? The error makes no sense because we fall through to one with some unhandled exception, and devs would like to understand what exactly is happening. Because normally, you should get a clear message telling you that the certificate has expired.

[tommyo]

I do. Case 03300983. Logs were uploaded yesterday.

[nitramd]

I received this message today. The cert expires on 12-27-2018.

Since the cert is still valid, should I generate a new one?

[ekhouser614]

Mine had a Dec 2018 exp date on it as well but after creating a new SS, it fixed the issue. Just an FYI

[ian0x0r]

I have this as well. Seen it at a few customer sites as well as on our in-house VBR server and separate Cloud Connect instance. Is generating a new certificate the only fix?

Cheers,

Ian

[flakpyro]

Same issue here on 2 servers.

[nitramd]

Eric, thanks for the FYI.

Ian, this is the fix for this issue. I opened a case today, # 03302691, to add more data for developer troubleshooting. Support came back with the link posted above.

[Dima P.]

Hi folks,

If you see 'Failed to check certificate expiration date' notifications in your Veeam B&R console please share:

1. Your Veeam B&R version
2. Rough estimate on the Veeam B&R installation date
3. Screenshot of the error
4. Support case ID if you already have one

This information will help us to identify the root cause.

Confirmed solution: Recreate the self-signed certificate in Manage Certificate wizard of Veeam B&R console. New certificate will be saved in Shared certificate store on the Veeam backup server automatically and the problem must go away.

Thank you in advance!

[nitramd]

1. 9.5U3a

2. Install date on one of my B&R consoles ~ 4 October 2017. Approximate install date of 9.5 update 3: 27 December 2017. Approximate update 3a install 2 July 2018. The certificate on this console was set to expire on 27 December 2017.

3. I'm late finding your post, all consoles updated. The error message was nothing more than a pop-up window with the text Failed to check certificate expiration date after successfully logging into the console.

4. Case # 03302691

Thank you, Dima.

[brf]

1. 9.5.0.1922
2. November 2017
3. https://i.imgur.com/jdJ9RoE.png
4. Haven't created one

[ChuckS42]

1. 9.5.0.1922
2. November, 2015
3. Same as everyone else is seeing.
4. No case opened.

Regenerating certificates fixed it.

--Chuck

[Dima P.]

Hi folks,

We keep investigating the issue, I'll update this post with KB article once we come to the conclusion on the root cause. Thanks for sharing the updates and you patience while we are working on the investigation. Cheers!

[Grae Hunter]

This worked for us as well - we sill had at least a month on the current certificate, but renewing it now took the message away. It should be noted that it warns that it connections between backup and mount servers could be affected.

Additionally all jobs e.g. *continuous backup copies* will be stopped, so be sure to stop any backups, and for me the **Veeam Backup Service** also stopped and didn't restart itself so I had to manually start the service.

[BGA-Robert]

I've check our various orgs and most of them have this issue.

If possible, Veeam should automate the repair or release a hot-fix so we don't have to spend too much time on this. I'm already in for about 45 minutes just checking...

Robert

[Gostev]

Installing a hot fix will definitely be more time consuming than a few clicks it takes to generate the new certificate... having said that, of course Update 4 will have the issue resolved.

[BGA-Robert]

Could this be scripted with Powershell?

[Dima P.]

Robert,

Unfortunately add certificate wizard is not covered by Power Shell.

[nitramd]

I've encountered a side-effect from regenerating a new certificate.

One of my B&R servers has a job that centrally manages five physical servers running VAW 2.2. After I created a new cert, my physical server backup job failed; each server listed in the notification email had an entry in the Details column that stated Error: Managed session <long hexadecimal number> has failed unexpectedly. I tried a variety of fixes but to no avail.

I opened a case with Support today, case #03308359. Support mentioned that one of the logs from an affected physical server had the following entry: Error No connection could be made because the target machine actively refused it <B&R console IP address>:10005

I knew that this was not a firewall issue so I decided to reboot the backup server. I then ran a test job on one of affected physical servers; result was a successful backup.

Hope this helps.

[BGA-Robert]

We're still figuring this one out, but I think I'm seeing where the Veeam Backup Service is stopped and restarted as part of the new cert wizard. I assume that would be bad to do while Veeam is active. But we've also seen were the service may fail to restart. A manual restart seems to fix it. At least twice we've had to restart the service after the wizard.

I'd recommend checking Veeam services are all running after running the cert wizard.

Robert

[Gostev]

Robert, your observation is correct: Veeam Backup Service is automatically restarted when the certificate is changed.

[jamerson]

It does fix the issue for me too.
probably the self signed certificate is valid for 1 year and it expired.

[Dima P.]

Hello Julien,

Thank you for the confirmation! Here is a brief explanation from Gostev's weekly digest:

The first bug is very annoying, because it will impact everyone who's using the default self-signed certificates, which is unfortunately the majority. As a reminder, we use those certificates to implement secure communication between backup infrastructure components, as well as with managed backup agents. And while we do provide the ability to select or import your own certificate, most don't worry about this and just keep the default certificate that is automatically generated when you install Veeam Backup & Replication. This certificate is set to expire in 1 year from its creation date, and due to some bugs you will see artifacts of its expiration 1 year after your Update 3 installation date. Which means, this will hit many of you in the next few weeks, and may make it a not very merry Christmas, unless you act now!

Assuming you have Update 3a installed, first thing you will see at 11 months after Update 3 installation time will be the "Failed to check certificate expiration date" error message upon opening the backup console. The UI is trying to tell you that the certificate is about to expire, but the logic of this falls through to the universal message for all unhandled exceptions (which is why it does not make much sense). If you ignore this message, everything will continue to work fine for another month, after which the agent management functionality, as well as all granular restores will start failing. Luckily, the issue is super easy to fix by simply generating a new certificate, which takes just a few clicks. So don't wait, and do it at your earliest convenience. Needless to say, we've fixed the related bugs in the Update 4 (and also bumped the self-signed certificate expiration date to 10 years). Here's the official Veeam support KB article for this issue > KB2806

[jim3cantos]

We generated the new certificate 4 days ago and the first try to restore a backup today ended with this error when trying to open veeam explorer for SQL server:

failed to connect to backup server localhost: failed to interact with backup server: unexpected thumbprint. Expected...

A manual restart of veeam backup service seems to do the trick, but I'm not sure that there was an automatic restart when new certificate was installed. It was too fast (unless the restart was done "silently" in the background). Version 9.5 U3 here.

[Dima P.]

jim3cantos,

Thanks for the heads up. I'll ask QA team to double check your scenario, any chance you can share your Veeam B&R logs with me (via private download link or support team, what works the best for you)?