Certificate Issues
Situation
A backup or restore plan fails at startup with the SSL certificate issue is detected on the host ... error message:
Cause
The issue indicates that the SSL certificate of the backup storage provider or another backup-related network endpoint is being rejected on the client side. Probable causes are as follows:
- operating system
- security software activity
- user account settings.
Once this issue occurs, a set of actions should be performed to validate the certificate.
A general TLS/SSL description can be found in the corresponding Wikipedia article.
Educational videos on SSL/TLS:
Typical Issue Resolution
Solution 1
- Run the Backup application.
- In the application menu, open the storage account that is used in the failing backup plan.
- Select Advanced Settings.
- Then try to list backup prefixes in that storage by opening a drop-down list to initiate communication with the cloud storage provider:
5. A prompt to accept the rejected SSL certificate appears.
6. Click Allow.
Solution 2
Usually, the steps of Solution 1 are enough, but if the issue persists, do the following:
- Navigate to the Settings folder of the Backup application at the path "C:\ProgramData\COMPANYNAME\PRODUCTNAME”, where your company and product names are taken from the Management Console -> Settings -> General -> Company / Product Name.
- In this folder, delete or rename the following files:
- CertificateExceptions.list
- serviceConfig.xml
- Follow the Solution 1 steps again.
Solution 3
Sometimes certificate rejection can be caused by specific firewall/security software settings that could require troubleshooting in accordance with the instructions from the security software provider website. As an example, refer to FortiGate firewall settings.
Solution 4
The issue could also be caused by the expiration of an SSL certificate on the client side, which could be resolved by renewing the certificate or updating the software (typically, a gateway or firewall) that uses it. It could also be caused by certificate expiration on the cloud storage provider side in specific cases (usually for small-scale S3-compatible or OpenStack-compatible storage providers).