Veeam Agent backup: Details: The remote certificate is invalid according to the validation procedure

[riahc3]

Hello

I am attempting to configure a Veeam Agent backup but I get this error:

Details: The remote certificate is invalid according to the validation procedure

This happens on:

Linux VMs on ESXi hosts
Linux VMs on Hyper-V hosts
Windows VMs on ESXi hosts
Windows VMs on Hyper-V hosts

I tried a couple of things Ive seen but none worked.

How do I solve this?

Thank you

[riahc3]

Noone?

[jorgedlcruz]

Hello John,
If you have support, I would recommend opening a support ticket.

I have not seen that error many times. It is very strange, but also, is this happening on the VBR Server when adding Agents? Or are you installing a standalone agent?

Every time I saw something similar to that, it was some strange SSL CA applied by GPO, etc.

You might try to regenerate the Veeam SSL certificate; perhaps that might help, under General Options.

[riahc3]

No, the standalone agents are installed on the servers already.

Ill try to regenerate the certificate.

[CorDarei]

Adding this in case it helps anyone in the future...

I recently had this issue and it was due to the backup server having its DNS changed.

I was troubleshooting a network issue and changed the DNS to public DNS IPs and failed to change it back to the internal DNS IPs.

In my particular case, I also found that I wasn't able to remote into the server because of NLA access, and it saying the server I'm connecting to could not contact the domain controller. That led me to the DNS changes I made in testing, and once I changed it back to the proper DNS IPs, RDP via hostname (and VEEAM backups) started working again.

[ITP-Stan]

I had this error on a Veeam Back & Replication instance that was using Microsoft 365 with basic authentication for SMTP.
When I would go in General Options and test the mail settings the B&R console would hang.
After a minute it showed a pop-up that the console was trying to connect to the backup server, with the option to cancel.
During this hang of the console, task manager would show high CPU usage for SQLsrvr.exe (where the Veeam B&R database resides on).
Pressing Cancel would kill & restart the console and the processes returned to normal.

I then changed the SMTP option to Microsoft 365 modern authentication (authorise it etc...) and afterwards the SMTP test worked fine.
So in my case it has to do with basic authentication, which Microsoft is disabling for over a year now.

I did not check if I could enable basic authentication again for the specific user account used for SMTP, since Modern authentication is available in the latest versions of B&R.

[johnwatson]

I had a similar issue with SMTP Server ( Basic authentication ) with SMTP2GO.

Error: Sending e-mail report Details: The remote certificate is invalid according to the validation procedure.

Fix:
1. General Options
2. E-Mail Settings
3. Change Mail Server from SMTP Server ( Basic authentication ) to Any Mail server and back to SMTP Server ( Basic authentication )
4. Click Apply ( Accept certificate )
5. Test Message

[OddShapedPizza]

Thanks to ITP-Stan and johnwatson! I had the exact same problem and this solved it!

[KurtSeattle]

Another shout-out to @ITP-Stan and @johnwatson. My Basic Auth email was working fine in VBR 11A, but this error started with v12. Microsoft 365 Authentication did work, but then I'd have to update the authorization every time I change my password. I got the Basic Authentication to work once I turned off SSL in Advanced. Microsoft 365 (Exchange Online servers) allows you to use Basic Auth and dummy from addresses (veeam@<domain>) when coming from fixed, pre-defined IPs (my fixed IP site) on Port 25 with no SSL.

[ITP-Stan]

There is a KB article now, but it does not explain what the cause is.

https://www.veeam.com/kb4455

[huafist]

I had this issue after renewing my vCenter certs. The fix was to open VBR, right click on my vCenter instance, and go to properties. I just walked through the process, and when I clicked next on the credentials page, it informed me that the certificate wasn't trusted. I installed the new cert, and the issue went away.

[3d0]

I had this error on a Veeam Back & Replication instance that was using Microsoft 365 with basic authentication for SMTP.
When I would go in General Options and test the mail settings the B&R console would hang.
After a minute it showed a pop-up that the console was trying to connect to the backup server, with the option to cancel.
During this hang of the console, task manager would show high CPU usage for SQLsrvr.exe (where the Veeam B&R database resides on).
Pressing Cancel would kill & restart the console and the processes returned to normal.

I then changed the SMTP option to Microsoft 365 modern authentication (authorise it etc...) and afterwards the SMTP test worked fine.
So in my case it has to do with basic authentication, which Microsoft is disabling for over a year now.

I did not check if I could enable basic authentication again for the specific user account used for SMTP, since Modern authentication is available in the latest versions of B&R.

Same behaviour on a Veeam Back & Replication server, going in General Options and test the mail settings, the B&R console would hang.

Solved following:
- no edit any parameter
- reboot the server
- going in General Options and test the mail settings (with original parameters)
- the certificate's pop-up is opening to propose the new cert
- accept the new cert

It worked for me

[MikeyM]

I had this issue after renewing my vCenter certs. The fix was to open VBR, right click on my vCenter instance, and go to properties. I just walked through the process, and when I clicked next on the credentials page, it informed me that the certificate wasn't trusted. I installed the new cert, and the issue went away.

I got rid of this issue using same method works every time and had this issue 2-3 times already after vcenter certs are renewed.

[jundis]

I have to re-accept the certificate on a weekly basis for clients using Google email, and every 2-3 months for Microsoft 365.

We had a support case where this was confirmed to be a bug, still waiting on a resolution for that.

[pmrafiq]

Dear friends..
Me to facing the same issue, Veeam Support ID = 03099920
where i need to add another email ID in Veeam B&R12 console to send daily notification email,
Basic authentication was selected with smtp.office365.com / outlook.office365.com, having same symptoms of hanging etc during sending the test email.

How it Fixed,
After cleaning DNS Cache,
I just changed the server from Microsoft (either authentication) to google.com and applied with same email ID and no smtp server,
Veeam B&R tries to reach to the googl but failed,
again i change the server to outlook.office365.com with existing sender and receiver email ID,
that goes to reach the server and feel the certificate changes,
i just accept the certificate either secure or non secure,
and press apply (General Option Email notification), and the test mail initiated,
if you are facing this kind of thing , dont forget to update the Veeam Enterprise manager certificate too,,,

https://Veeam.Server.Address:9443/
> apply UID & PWD
> Configuration
>Notification
>Server Setting

https://ibb.co/0KRPSLk
https://ibb.co/dBNgqGb
https://ibb.co/ydPyF3M
https://ibb.co/YR6n5Nz


Regards
Rafiq

[ecorec]

Same issue here, since I upgraded to 12.

I open general options -> e-mail settings, disable notification, reenable notification, get the message "certificate is untrusted", "continue", problem is fixed.
Then, after about a week, it's broken again.

Server is smtp.gmail.com:587 SSL

[Mildur]

Hello Valerio

This looks like a known issue regarding certificate change on the SMTP server. My information is, that our upcoming version should fix the issue.

If you want to confirm that it is this exact issue, I recommend to open a support case and let our support engineer check the logs. Please provide me with the case number so I can check the issue from our side.

Best,
Fabian

[Henrique.prezoto]

I had a similar issue with SMTP Server ( Basic authentication ) on the KINGHOST provider.

Error: Sending e-mail report Details: The remote certificate is invalid according to the validation procedure.

Fix:
1. General Options
2. E-Mail Settings
3. Advanced...
3. Don't mark "Connect using SSL"
4. Click OK
4. Click Apply
5. Test Message

[ITP-Stan]

I would not suggest disabling SSL/TLS since you are doing basic authentication and your username/password will now be sent over the internet in cleartext!

[ecorec]

If you want to confirm that it is this exact issue, I recommend to open a support case and let our support engineer check the logs. Please provide me with the case number so I can check the issue from our side.

I've just opened a case, it's 06381100.

[Mildur]

Thank you.
Let's wait for supports answer.

Best,
Fabian

[mr-manuel]

I have the same issue. I'm using a Let's Encrypt certificate for my SMTP server which renews every 60 days. Theoretically it should be valid, but I have to confirm it every 60 days...

The exact error is:

Code: Select all

Remote certificate name mismatch:
CN=mail.domain.tld

Since there are more SAN's (46 to be exact) in the certificate and "mail.domain.tld" is the last one, could it be that this is not verified? But the common name is still "CN = mail.domain.tld".

[Steben]

Thanks to ITP-Stan and JohnWatson, I changed from SMTP option to Microsoft 365 modern authentication (authorize it etc...) and applied. Ran test message and it works now.