Comprehensive data protection for all workloads
Pat490
Expert
Posts: 160
Liked: 25 times
Joined: Apr 28, 2015 7:18 am
Full Name: Patrick
Location: Germany
Contact:

Failed to check certificate expiration date

Post by Pat490 » Nov 21, 2018 6:49 am

Today I suddenly noticed an error message when launching VBR console: "Failed to check certificate expiration date"

which certificate? License information all seems correct. Internet works fine on the server also. What else could it mean? What do I need to do?

In console logfile I found:

Code: Select all

[21.11.2018 07:07:51] <01> Info     [LicenseExpirationUiMessagesFactory] Created CPerpetualLicenseUiMessages
[21.11.2018 07:07:51] <01> Info     Perpetual license, report skipped
[21.11.2018 07:07:51] <01> Info     VBR server certificate will expire on 28 days
[21.11.2018 07:07:51] <01> Error    Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt. (System.NullReferenceException)
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.Properties.Settings.get_CertificateExpirationDisplayDate()
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.NewFormMain.CheckCertificateExpirationDate()
[21.11.2018 07:07:51] <01> Error    Failed to check certificate expiration date   bei Veeam.Backup.UI.NewFormMain.CheckCertificateExpirationDate()
[21.11.2018 07:07:51] <01> Error       bei Veeam.Backup.UI.NewFormMain.NewFormMain_Shown(Object sender, EventArgs e)
[21.11.2018 07:09:09] <01> Info     Checking is upgrade required, includeCloudItems = True
[21.11.2018 07:09:09] <01> Info     Nothing to upgrade

systeembeheerder
Enthusiast
Posts: 44
Liked: 2 times
Joined: Dec 01, 2009 8:09 pm
Full Name: Addy
Contact:

Re: Failed to check certificate expiration date

Post by systeembeheerder » Nov 21, 2018 7:52 am

Ditto here!
Two Veeam servers, both show up with the same message.

SBarrett847
Service Provider
Posts: 308
Liked: 40 times
Joined: Feb 02, 2016 5:02 pm
Full Name: Stephen Barrett
Contact:

Re: Failed to check certificate expiration date

Post by SBarrett847 » Nov 21, 2018 8:28 am

Same here.

Microsaft
Lurker
Posts: 2
Liked: 1 time
Joined: Feb 15, 2017 5:48 am
Full Name: n.a.
Contact:

Re: Failed to check certificate expiration date

Post by Microsaft » Nov 21, 2018 8:41 am 1 person likes this post

Had the same … Support send me following link:

https://helpcenter.veeam.com/docs/backu ... tml?ver=95

Pat490
Expert
Posts: 160
Liked: 25 times
Joined: Apr 28, 2015 7:18 am
Full Name: Patrick
Location: Germany
Contact:

Re: Failed to check certificate expiration date

Post by Pat490 » Nov 21, 2018 10:31 am

thank you very much. that helped for me too. After generating a new cert, do I remove/delete the old cert from Windows Cert store?

SBarrett847
Service Provider
Posts: 308
Liked: 40 times
Joined: Feb 02, 2016 5:02 pm
Full Name: Stephen Barrett
Contact:

Re: Failed to check certificate expiration date

Post by SBarrett847 » Nov 21, 2018 11:18 am

Much obliged - fixed for me also.

Gostev
SVP, Product Management
Posts: 24787
Liked: 3520 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Failed to check certificate expiration date

Post by Gostev » Nov 27, 2018 12:51 pm

Does anyone have support case ID with debug logs, so that we could see what happened? The error makes no sense because we fall through to one with some unhandled exception, and devs would like to understand what exactly is happening. Because normally, you should get a clear message telling you that the certificate has expired.

tommyo
Influencer
Posts: 22
Liked: 4 times
Joined: Dec 28, 2016 3:42 pm
Contact:

Re: Failed to check certificate expiration date

Post by tommyo » Nov 27, 2018 1:31 pm

I do. Case 03300983. Logs were uploaded yesterday.

nitramd
Expert
Posts: 191
Liked: 43 times
Joined: Feb 16, 2017 8:05 pm
Contact:

Re: Failed to check certificate expiration date

Post by nitramd » Nov 27, 2018 2:40 pm

I received this message today. The cert expires on 12-27-2018.

Since the cert is still valid, should I generate a new one?

ekhouser614
Influencer
Posts: 14
Liked: never
Joined: Aug 19, 2015 5:23 pm
Full Name: Eric Houser
Contact:

Re: Failed to check certificate expiration date

Post by ekhouser614 » Nov 27, 2018 3:46 pm

Mine had a Dec 2018 exp date on it as well but after creating a new SS, it fixed the issue. Just an FYI

ian0x0r
Veeam Vanguard
Posts: 221
Liked: 41 times
Joined: Nov 11, 2010 11:53 am
Full Name: Ian Sanderson
Location: UK
Contact:

Re: Failed to check certificate expiration date

Post by ian0x0r » Nov 27, 2018 4:50 pm

I have this as well. Seen it at a few customer sites as well as on our in-house VBR server and separate Cloud Connect instance. Is generating a new certificate the only fix?

Cheers,

Ian
https://www.snurf.co.uk

flakpyro
Influencer
Posts: 20
Liked: 5 times
Joined: Feb 08, 2010 10:15 pm
Full Name: David M
Contact:

Re: Failed to check certificate expiration date

Post by flakpyro » Nov 27, 2018 6:26 pm

Same issue here on 2 servers.

nitramd
Expert
Posts: 191
Liked: 43 times
Joined: Feb 16, 2017 8:05 pm
Contact:

Re: Failed to check certificate expiration date

Post by nitramd » Nov 27, 2018 6:59 pm 1 person likes this post

Eric, thanks for the FYI.

Ian, this is the fix for this issue. I opened a case today, # 03302691, to add more data for developer troubleshooting. Support came back with the link posted above.

Dima P.
Product Manager
Posts: 10536
Liked: 858 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Failed to check certificate expiration date

Post by Dima P. » Nov 27, 2018 8:24 pm 1 person likes this post

Hi folks,

If you see 'Failed to check certificate expiration date' notifications in your Veeam B&R console please share:

1. Your Veeam B&R version
2. Rough estimate on the Veeam B&R installation date
3. Screenshot of the error
4. Support case ID if you already have one

This information will help us to identify the root cause.

Confirmed solution: Recreate the self-signed certificate in Manage Certificate wizard of Veeam B&R console. New certificate will be saved in Shared certificate store on the Veeam backup server automatically and the problem must go away.

Thank you in advance!

nitramd
Expert
Posts: 191
Liked: 43 times
Joined: Feb 16, 2017 8:05 pm
Contact:

Re: Failed to check certificate expiration date

Post by nitramd » Nov 27, 2018 9:09 pm 1 person likes this post

1. 9.5U3a

2. Install date on one of my B&R consoles ~ 4 October 2017. Approximate install date of 9.5 update 3: 27 December 2017. Approximate update 3a install 2 July 2018. The certificate on this console was set to expire on 27 December 2017.

3. I'm late finding your post, all consoles updated. The error message was nothing more than a pop-up window with the text Failed to check certificate expiration date after successfully logging into the console.

4. Case # 03302691

Thank you, Dima.

brf
Influencer
Posts: 16
Liked: 1 time
Joined: Nov 06, 2017 8:02 pm
Contact:

Re: Failed to check certificate expiration date

Post by brf » Nov 27, 2018 11:29 pm

1. 9.5.0.1922
2. November 2017
3. https://i.imgur.com/jdJ9RoE.png
4. Haven't created one

ChuckS42
Expert
Posts: 109
Liked: 13 times
Joined: Apr 24, 2013 8:53 pm
Full Name: Chuck Stevens
Contact:

Re: Failed to check certificate expiration date

Post by ChuckS42 » Nov 29, 2018 4:57 pm

1. 9.5.0.1922
2. November, 2015
3. Same as everyone else is seeing.
4. No case opened.

Regenerating certificates fixed it.

--Chuck

Dima P.
Product Manager
Posts: 10536
Liked: 858 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Failed to check certificate expiration date

Post by Dima P. » Nov 29, 2018 7:08 pm

Hi folks,

We keep investigating the issue, I'll update this post with KB article once we come to the conclusion on the root cause. Thanks for sharing the updates and you patience while we are working on the investigation. Cheers!

Grae Hunter
Lurker
Posts: 1
Liked: never
Joined: Nov 29, 2018 8:16 pm
Full Name: Graeme Hunter
Contact:

Re: Failed to check certificate expiration date

Post by Grae Hunter » Nov 29, 2018 8:22 pm

This worked for us as well - we sill had at least a month on the current certificate, but renewing it now took the message away. It should be noted that it warns that it connections between backup and mount servers could be affected.

Additionally all jobs e.g. *continuous backup copies* will be stopped, so be sure to stop any backups, and for me the **Veeam Backup Service** also stopped and didn't restart itself so I had to manually start the service.

BGA-Robert
Service Provider
Posts: 60
Liked: 8 times
Joined: Feb 03, 2016 5:06 pm
Full Name: Robert Wakefield
Contact:

Re: Failed to check certificate expiration date

Post by BGA-Robert » Nov 29, 2018 8:30 pm

I've check our various orgs and most of them have this issue.

If possible, Veeam should automate the repair or release a hot-fix so we don't have to spend too much time on this. I'm already in for about 45 minutes just checking...

Robert

Gostev
SVP, Product Management
Posts: 24787
Liked: 3520 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Failed to check certificate expiration date

Post by Gostev » Nov 29, 2018 9:53 pm

Installing a hot fix will definitely be more time consuming than a few clicks it takes to generate the new certificate... having said that, of course Update 4 will have the issue resolved.

BGA-Robert
Service Provider
Posts: 60
Liked: 8 times
Joined: Feb 03, 2016 5:06 pm
Full Name: Robert Wakefield
Contact:

Re: Failed to check certificate expiration date

Post by BGA-Robert » Nov 29, 2018 10:57 pm

Could this be scripted with Powershell?

Dima P.
Product Manager
Posts: 10536
Liked: 858 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Failed to check certificate expiration date

Post by Dima P. » Nov 30, 2018 8:49 pm

Robert,

Unfortunately add certificate wizard is not covered by Power Shell.

nitramd
Expert
Posts: 191
Liked: 43 times
Joined: Feb 16, 2017 8:05 pm
Contact:

Re: Failed to check certificate expiration date

Post by nitramd » Nov 30, 2018 9:32 pm

I've encountered a side-effect from regenerating a new certificate.

One of my B&R servers has a job that centrally manages five physical servers running VAW 2.2. After I created a new cert, my physical server backup job failed; each server listed in the notification email had an entry in the Details column that stated Error: Managed session <long hexadecimal number> has failed unexpectedly. I tried a variety of fixes but to no avail.

I opened a case with Support today, case #03308359. Support mentioned that one of the logs from an affected physical server had the following entry: Error No connection could be made because the target machine actively refused it <B&R console IP address>:10005

I knew that this was not a firewall issue so I decided to reboot the backup server. I then ran a test job on one of affected physical servers; result was a successful backup.

Hope this helps.

BGA-Robert
Service Provider
Posts: 60
Liked: 8 times
Joined: Feb 03, 2016 5:06 pm
Full Name: Robert Wakefield
Contact:

Re: Failed to check certificate expiration date

Post by BGA-Robert » Nov 30, 2018 10:23 pm

We're still figuring this one out, but I think I'm seeing where the Veeam Backup Service is stopped and restarted as part of the new cert wizard. I assume that would be bad to do while Veeam is active. But we've also seen were the service may fail to restart. A manual restart seems to fix it. At least twice we've had to restart the service after the wizard.

I'd recommend checking Veeam services are all running after running the cert wizard.

Robert

Gostev
SVP, Product Management
Posts: 24787
Liked: 3520 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Failed to check certificate expiration date

Post by Gostev » Dec 02, 2018 10:56 pm

Robert, your observation is correct: Veeam Backup Service is automatically restarted when the certificate is changed.

jamerson
Expert
Posts: 313
Liked: 18 times
Joined: May 01, 2013 9:54 pm
Full Name: Julien
Contact:

Re: Failed to check certificate expiration date

Post by jamerson » Dec 06, 2018 2:27 pm

It does fix the issue for me too.
probably the self signed certificate is valid for 1 year and it expired.

Dima P.
Product Manager
Posts: 10536
Liked: 858 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Failed to check certificate expiration date

Post by Dima P. » Dec 06, 2018 3:06 pm

Hello Julien,

Thank you for the confirmation! Here is a brief explanation from Gostev's weekly digest:
Gostev wrote:
Nov 26, 2018 9:10 pm
The first bug is very annoying, because it will impact everyone who's using the default self-signed certificates, which is unfortunately the majority. As a reminder, we use those certificates to implement secure communication between backup infrastructure components, as well as with managed backup agents. And while we do provide the ability to select or import your own certificate, most don't worry about this and just keep the default certificate that is automatically generated when you install Veeam Backup & Replication. This certificate is set to expire in 1 year from its creation date, and due to some bugs you will see artifacts of its expiration 1 year after your Update 3 installation date. Which means, this will hit many of you in the next few weeks, and may make it a not very merry Christmas, unless you act now!

Assuming you have Update 3a installed, first thing you will see at 11 months after Update 3 installation time will be the "Failed to check certificate expiration date" error message upon opening the backup console. The UI is trying to tell you that the certificate is about to expire, but the logic of this falls through to the universal message for all unhandled exceptions (which is why it does not make much sense). If you ignore this message, everything will continue to work fine for another month, after which the agent management functionality, as well as all granular restores will start failing. Luckily, the issue is super easy to fix by simply generating a new certificate, which takes just a few clicks. So don't wait, and do it at your earliest convenience. Needless to say, we've fixed the related bugs in the Update 4 (and also bumped the self-signed certificate expiration date to 10 years). Here's the official Veeam support KB article for this issue > KB2806

jim3cantos
Enthusiast
Posts: 52
Liked: 10 times
Joined: Jan 08, 2013 6:14 pm
Full Name: José Ignacio Martín Jiménez
Location: Madrid, Spain
Contact:

Re: Failed to check certificate expiration date

Post by jim3cantos » Dec 07, 2018 10:46 am 1 person likes this post

We generated the new certificate 4 days ago and the first try to restore a backup today ended with this error when trying to open veeam explorer for SQL server:
failed to connect to backup server localhost: failed to interact with backup server: unexpected thumbprint. Expected...
A manual restart of veeam backup service seems to do the trick, but I'm not sure that there was an automatic restart when new certificate was installed. It was too fast (unless the restart was done "silently" in the background). Version 9.5 U3 here.

Dima P.
Product Manager
Posts: 10536
Liked: 858 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Failed to check certificate expiration date

Post by Dima P. » Dec 07, 2018 12:07 pm

jim3cantos,

Thanks for the heads up. I'll ask QA team to double check your scenario, any chance you can share your Veeam B&R logs with me (via private download link or support team, what works the best for you)?

Post Reply

Who is online

Users browsing this forum: Ctek, DonZoomik, Google [Bot], iL1fe, nmdange, pablo.gutierrez and 40 guests