Error connecting Sharepoint/Exchange online when installing VB for MS365

[sasilik]

Decided to try Veeam Backup for Microsoft 365 but got stuck with install when it configured Entra app and tried to connect Sharepoint/Exchange Online. First it could not configure Entra app but it was solved with running IISCrypto and disabling unnecessary stuff. After that Entra App creation was successful, Connected to MS Graph, EWS, Powershell but failed to connect to SP/EO with same error as previously:
[Warning] Warning: The SSL connection could not be established, see inner exception.
[Warning] Warning: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..
[Warning] Warning: An existing connection was forcibly closed by the remote host.

Looked at article about MSO and ciphers https://learn.microsoft.com/en-us/purvi ... encryption and IISCrypto output and needed cipher suites were in place:

Code: Select all

Configured Cipher Suites: TLS_CHACHA20_POLY1305_SHA256,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Firewall was OK, https inspection was disabled. Then found another article which mentioned that cipher suite order is also important
https://learn.microsoft.com/en-us/troub ... 12-support
And one in Veeam forums viewtopic.php?f=2&t=76311&start=0
Did - Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" -Position 0
And after that SP/EO connection was also successful. Is these things so self-evident that there is no need to mention it in User Guide or they are mentioned somewhere and I just missed them?

[Mildur]

Hi Markko,

I do not remember having to edit the cipher sort order manually on a Windows machine. Typically, it “just works” on a new Windows machine, as Windows handles the most secure sort order itself.

Regarding the cipher sort order, according to my research, the order is important because the first cipher that matches between the client (Windows client) and server (Microsoft 365 endpoints) is used for the connection.
Maybe your Windows machine had a cipher with a higher priority that was expected by Microsoft, but did not work during the backup job with Veeam Backup for Microsoft 365.
Have you tried accessing SharePoint outside of Veeam Backup for Microsoft 365 on that machine with the old sort order to confirm it was not a Veeam Backup for Microsoft 365 issue, but a general issue accessing SharePoint from that machine?

Confirming what really happened would require a case with our customer support team. Maybe using IISCrypto reconfigured too much stuff.

Best,
Fabian

[sasilik]

Yes, it seems trusting IISCrypto Best Practises was wrong in this case. It puts TLS_CHACHA20_POLY1305_SHA256 first one for some reason with server 2022 and above - https://www.nartac.com/Products/IISCryp ... uite-order
Maybe it's good to mention somewhere that don't mess with cipher suite order because I guess there are other people whose Best Practice is to use IISCrypto and it's Best Practice.
I guess it's relevant because with default settings I could not connect at all to Entra and register app. I could do it after running IISCrypto but then it failed to connect Sharepoint/EO because of TLS_CHACHA20_POLY1305_SHA256 suite being first.