Solution to SMTP not working following certificate change

[Mika56]

Hi,

My SMTP notifications have stopped working a few weeks ago.
Turns out my SMTP provider, Mandrill, has renewed its certificate.

Back when I installed Veeam, the server was unable to check the CRL so I has to manually trust the certificate, which can easily be done when testing SMTP settings.
However, when the certificate changes, Veeam behaves weirdly: the job logs says "Sending e-mail report Details: The remote certificate is invalid according to the validation procedure." (which isn't unexpected). Testing the SMTP settings leads to the console stopping responding. Wireshark shows that it is connecting to the SMTP server on a loop, failing after enabling StartTLS.

I was able to find additional information inside Svc.VeeamBackup.log:

Code: Select all

[21.12.2023 10:08:13.927] <10> Info         [CReportMailer] Sending e-mail notification, server 'SMTP Server 'smtp.mandrillapp.com', port '587', timeout '100000', use ssl 'True'', to '<redacted>'
[21.12.2023 10:08:14.103] <10> Error        Certificate check failed, thumbprint mismatch.
[21.12.2023 10:08:14.105] <10> Error        Saved thumbprint: 68F0363765C96017E1D67C676D802FD23804330F
[21.12.2023 10:08:14.107] <10> Error        [ConfigService] Failed to send test mail message.
[21.12.2023 10:08:14.107] <10> Error        The remote certificate is invalid according to the validation procedure. (System.Security.Authentication.AuthenticationException)

Turns out, Veeam stores the certificate thumbprint, but does not offer to accept any new certificat after that.

To fix this issue:

• Stop Veeam Backup Service
• Open SQL Server Management Studio
• Connect to the SQL Server, open the VeeamBackup database
• Get your SMTP settings: #Edited by Mod: Please do not post SQL queries. They are only supported with the guidance of our support team.
• Copy the XML to a text editor, and remove the following path: CMailOptions.CertificateThumbprint
• Update your SMTP settings: #Edited by Mod: Please do not post SQL queries. They are only supported with the guidance of our support team.
• Start Veeam Backup Service
• Launch B&R Console and test your SMTP settings

It would be nice if Veeam was to handle properly being presented a new certificate, more so that the new certificate was valid (and the system is now able to download the CRL).

[Mildur]

Hi Mika

Which version are you running? This sounds like a known issue which should be solved in v12.1.

I removed your SQL queries. Please don't post them to this forum. SQL queries must be run under guidance of our support team.

Best,
Fabian

[Mika56]

I failed to find the mentioned post because it did not contain my specific error messages.
I've not updated to 12.1 yet, looks like it's not declared on dev.veeam.com yet?

[Mildur]

Hi Mika

You can download v12.1 from our download center. We have released it on December 5th 2023:
https://www.veeam.com/de/download-version.html

We update our dev.veeam.com server a few weeks after a new release. First we want to make sure that there are no major issues with a new version.

Best,
Fabian