TLS Certificate Expiry and KB2806

[Frosty]

I had a "TLS Certificate is due to expire" type of message when starting the VBR Console today, both on my PC and also when I tried to run it on our backup server.

Googling the error led me to this KB article:
https://www.veeam.com/kb2806

Wasn't an exact match, however seemed close enough. The thing that interested me though is that the article advises "The issue is fixed in Veeam Backup and Replication 9.5 Update 4". This can't be 100% correct, since I was already running v9.5 U4.

When I went into the General Options, Security and tried to look at the certificate, it seemed to be showing me a cert issued today with a 10-year expiry. So that wasn't looking quite right either.

My best guess is that v9.5 U4 had tried, perhaps partially successfully, to replace the certificate. Perhaps it just had not taken effect yet, e.g. maybe because the Veeam Backup Service hadn't been restarted?

Anyway, I manually generated a new cert, manually restarted the service, and tested. Seems okay.

But perhaps the KB article needs tweaking slightly?

[Mike Resseler]

Hey Frosty,

First: Happy to see that the issue is fixed. You are using a self-cert I assume?
Second: You are right, the KB is not an exact match of what you have. The KB talks about the fact that you already created or imported a new certificate but that B&R still complains about it being expired because the old one remains in the cache.

What I think happened in your case is indeed that the services didn't restart or that you upgraded where B&R remains using the certificate of before instead of renewing it.
Did you do an upgrade?

M/

[kapple]

Hi,
When I launched the console on the B&R server this morning, I also had a pop-up warning that the TLS cert will expire in 28 days, yet the cert on the server states it is valid from 6/2/2019 to 6/2/2029. I upgraded to 9.5 Update 4a on 5/1/2019.

Did this end up being an issue where the Veeam services need to restart (though I think I rebooted the server after I upgraded)? Did you go ahead and generate a new self-signed cert?

Thanks,
Ken

[Mike Resseler]

I assume you did restart after the upgrade. But it looks like the certificate has changed a month after the upgrade, so before you create a support call, I would restart the services of the Veeam server and see if that fixes it. If not, a support call is needed I think