No PVE Hypervisor workloads after inplace upgrade

[Dynamic]

Hi all,

Is it working as designed that Proxmox is no longer directly integrated after an inplace-upgrade from 12.3.2 to version 13.0.1?

My Proxmox workloads can no longer be activated, and I'm also unable to add Proxmox Hosts within the VBR Console.
The VeeamPVESvc service is present and running and the plugin for Proxmox is installed in version 13.3.0.237.

It's my Lab/NFR environment - so no big deal for me - just curious...
Anyone else can confirm this?

The upgrade to 13.0.1 was successful without any issues.
The Plugin was upgraded within the VBR upgrade procedure, from PVE 12.1.3.217 -> 13.3.0.237

A reboot was done after the upgrade.

Case #07892920

[Gostev]

It's not expected, thanks for opening a support case.

[Regnor]

Hi Markus,
In addition to the support case take a look at this article. And also try to restart the PVE service after all other services are started.
https://www.veeam.com/kb4687

[anpa]

I have the same issue after upgrade and rebooting the server, it seems to be certificate related:

Code: Select all

2025-11-20 10:29:33.9942 00010 [10192] ERROR | [DbProvider client]:  ==> Response "Put" "https://localhost:6172/api/proxies/58d815db-dce4-4a9a-b995-e5bef708b70a", "code: 400", duration: "73 msec", headers: "[]", cookies: "[]", body: "{"errorCode":"UnknownError","title":"Failed to generate child certificate from Veeam backup server certificate.","message":"Failed to generate child certificate from Veeam backup server certificate.","statusCode":400}"
2025-11-20 10:29:33.9942 00010 [10192] ERROR | [PlatformService]: Failure in the PlatformService API: An exception occurred while processing the API request. HttpErrorCode: BadRequest, HttpRequestError: . Message: Veeam.Vbf.Rest.Common.ClientGeneration.ApiException: Failed to generate child certificate from Veeam backup server certificate.

I noticed that my Veeam server certificate was originally from 2019, so I generated a new certificate (Options->Security->Install.. - I choose to generate a new one) and that cleared the error messages and I was able to run backups and add PVE servers again. I guess the old cert lacked permissions/features to be used as a CA/signing cert?

[Dynamic]

Hi Markus,
In addition to the support case take a look at this article. And also try to restart the PVE service after all other services are started.
https://www.veeam.com/kb4687

Thanks Max, I just checked your mentioned KB. The DWORD key was already present with the correct port.

I checked the Certificate Topic from @anpa (my whole installation was only ~4 months old) and created a new cert. The behaviour remains.

Code: Select all

2025-11-20 11:26:55.4263 00014 [17016] INFO  | [CertificateStoreBase]: Successfully found the certificate: "Service certificate: CN=hu-vbr-a-20, O=Veeam Software, OU=Veeam Software. EffectiveDate: 24.06.2025 19:38:15. ExpirationDate: 22.06.2035 19:38:15. Thumbprint:71E52729C9E8372AE7AB073A69F3492D640ECF45"
2025-11-20 11:26:55.4263 00014 [17016] INFO  | [VeeamPlatformAuthenticator]: VeeamAuth executable path: 'C:\Program Files\Veeam\Backup and Replication\Backup\VeeamAuth.exe'.
2025-11-20 11:26:55.4263 00014 [17016] INFO  | [VeeamPlatformAuthenticator]: Starting VeeamAuth: "C:\Program Files\Veeam\Backup and Replication\Backup\VeeamAuth.exe" /purpose:DATA /platformId:01208ee8-47fe-4ea8-8727-5115874da1ad
2025-11-20 11:26:56.1202 00016 [17016] ERROR | [VeeamPlatformAuthenticator]: Failed to authenticate using the VeeamAuth client: System.Exception: Failed to execute VeeamAuth: 'Veeam.Backup.Identity.Client.TokenAuthenticationException: Unable to perform authorization: The client does not have access permissions for the resource.

It seems that the new cert (from today) is not recognized by the PVE plugin, logs still shows the cert from 06/2025.
So I switched back to the original certificate.

Update:
I just removed the PVE Plugin and installed it again - this didn't change anything at all.

Additional info: this VBR system is also part of a VRO environment / VRO agent (now on V13) is running on this system.