Veeam Deployment Kit certificate lifetime

[MaartenA]

Hi,

We have Case #07921903 open because the AAP is not working with persistent guest agent when only installing the Veeaminstaller Service (like it was in V12) from the MSI that is on the V13 Windows installation ISO (we use the appliance)
After reading https://helpcenter.veeam.com/docs/vbr/u ... tml?ver=13 again it seems the certificate needed for AAP to work comes via this Deployment KIT.

I am wondering what will happen when this certificate will expire because it is only valid for one year. Will Veeam auto-renew this certificate or do we need to mass deploy this Kit / certificates again to all systems?

[david.domask]

Hi MaartenA,

The temporary certificate included with the Deployment kit should be replaced on the first backup that uses AAIP with the persistent guest agent option enabled in the job -- I just checked on one of my VMs and the replacement certificate is valid for 10 years -- are you seeing differently for your machines?

Basically, the initial certificate installed with the Deployment Kit is not meant to be permanent, it should be replaced as soon as a backup job with AAIP + Persistent Agent option is run or once one of the other uses for Deployment Kits are utilized (e.g., Agent deployment)

[MaartenA]

A great, yes i see a new certificate getting placed indd. thanks
FYI. i think support is not fully aware of this new requirement.

[david.domask]

Glad to assist.

I will work with our TechWriters to update the existing User Guide with more information on the handling of the temporary / permanent certificates, and also reached out to Support to share the information.

Thanks for bringing this gap in documentation to our attention.

[david.domask]

To close out this topic, we've updated the Persistent Agent User Guide page with more details on the deployment kit certificate handling.

Thanks again Maarten for the questions

[JPMS]

...and also reached out to Support to share the information.

You need to reach out again. I was in exactly the same position as the OP.

Case #07962334opened on 23rd January. Support agent was absolutely no help at all and I ended up working it out for myself (partly with the assistance of your updated online documentation). Really annoying wasting all this time when this is a known change for v13 which support should be aware of and should be documented in the release notes.

[Moderator: Replaced Support Id with Case Id]

I even specifically said when I opened the case, "Veeam installer service and Veeam guest agent manually installed. VM backup is configured to "Use persistent guest agent"."

[david.domask]

Hi JPMS,

Thank you for the update and sorry to hear about the challenges on the case and that the release notes did not give enough information to avoid the time researching the issue.

To be clear, the changes in v13 should not interrupt Guest Processing but there are edge cases, will review how to better disseminate such information.

[JPMS]

To clarify, it does seem that "changes in v13 should not interrupt Guest Processing", it's the way you deploy it that has changed.

In the past, to avoid port issues etc, we have always set up a new server by manually installing the Veeam Installer and Veeam guest agent before adding the server to Veeam and selecting "Use persistent guest agent". This no longer works as v13 requires the certificates to be installed on the new server as well. This is what has changed and seems to be the same issue as the OP, @MaartenA.