Invalid Remote Certificate: How to Identify and Fix in Veeam BR 9.x or Newer

I faced with “Invalid remote certificate”:

“Task Failed. Error: The remote certificate is invalid according to the validation process”

on some my replication jobs between two our vCenter servers and Veeam BR couldn’t validate our target vCenter server certificate.

I found a solution for resolving invalid remote certificate that I want to share it with you.

Here is my environment specifications and the configuration. The log file locations maybe different with you environment:

  • vCenter 6
  • ESXi Host 5.5 U3
  • Veeam B&R 9
  • Windows 2008R2 SP1

What Was “Invalid Remote Certificate” Issue?

When vCenter server is adding to Veeam BR, its certificate’s thumbprint will be added to configuration database and if the vCenter server’s certificate was changed (Invalid remote certificate), you have to re-validate it in Backup Infrastructure. So if the certificate isn’t valid, you will see the below error:

Invalid remote certificate
Task failed. Error: The remote certificate is invalid according to the validation process.

How Can Resolve It?

First step, disable all your backup and replication jobs that they are related to the vCenter and also stop Veeam BR service because invalid remote certificate doesn’t allow you

As I said before, you have to re-validate the certificate, so you should go to “Backup Infrastructure” and select your server then right click on the server and click on “Properties”.

Backup Infrastructure
Backup Infrastructure

Then, you will face with the below dialog:

Edit VMware Server
Edit VMware Server

Click “Next”.

At this window, you need to choose your credential, choosing previous credential is recommended.

Edit VMware Server - Credential
Edit VMware Server – Credential

When you click on “Next” at this window, Veeam BR will validating your credential and the server’s certificate and if it is valid, Veeam BR will save the server configuration otherwise you will face with the below prompt:

Edit VMware Server - Detecting Server Type
Edit VMware Server – Detecting Server Type
Edit VMware Server - Prompt
Edit VMware Server – Prompt

Click on “Connect” and your problem will be resolved and you will see the below window:

VMware Server - Save Configuration
VMware Server – Save Configuration

Now, enable your jobs and run one of them, if the job runs successfully, you have no problem otherwise follow the below step to troubleshooting and resolving the problem.

You have to check your jobs logs in this step, so go to the below path to find your job log:

C:\Program Data\Veeam\Backup\<Your Job Name>

Backup Log Path
Backup Log Path

Open the last log file and search “Mismatch!” word within that.

backup log2
Backup Log

If you found the word, it means that your server thumbprint is different with saved thumbprint on the database and it should be changed.

Now, you need to have access to your database. Copy saved thumbprint from the log file and then logon to your database server via Management Studio and run a select query on “dbo.Soap_creds” table:

SQL Query
SQL Query

At this step, you should replace the thumbprints with server’s thumbprint (You can copy it from log file) and also you should remove any records that its “creds” column is : 00000000-0……….

Invalid remote certificate
SQL Update

Now start Veeam BR service and enable your jobs and see the result.

If you faced with the below error:

  • The object has already been deleted or has not been completely created.

You have to edit your jobs, re-add the VMs or edit destination specifications or remove all snapshots from snapshot list:

Invalid remote certificate
New Error
edit job2
Edit Job

Hope, this post helps you to resolving same issues. If you had same issue on newer version, please share your experiences with me in comment or send by email.

Further Reading

Veeam Backup and Replication – How to Choose Best Transport Mode for vSphere Proxy?

Optimizing Data Protection: Unleashing the Power of Database Backup Best Practices in Virtualization Platforms

Veeam Backup & Replication Community Edition

External Links

Veeam Backup and Replication

Davoud Teimouri

Professional blogger, vExpert 2015/2016/2017/2018/2019/2020/2021/2022/2023, vExpert NSX, vExpert PRO, vExpert Security, vExpert EUC, VCA, MCITP. This blog is started with simple posts and now, it has large following readers.

19 Responses

  1. Sachin Pol says:

    Very well explained , got my problem resolved , Solution provided is to the point .
    Thanks Very much

  2. Haqi says:

    Thank you for your explained, my problem has been solved.

  3. Carl says:

    You blog post help me get my issues resolved. Happened after an upgrade to vCenter 6.7 … which I discovered after was not yet supported by Veeam. My fault for not performing my due filigence but it was an unscheduled upgrade in order to resolve another issue.

    I restored my vCenter server from Veeam to a host and corrected all related issues there. Then I tried my backups and ran into the invalid remote certificate issue (strangely with only one of my three hosts). The rescan did not work, however instead of accessing the database I removed the host from the backup infrastructure inventory and then added it again (I did get the untrusted certificate but clicking connect anyway worked).

    Thanks again for your post, it got me to my solution quickly and easily.

  4. Pavel says:

    Very well explained. Resolved the issue. Thanks.

  5. Waleed Najmi says:

    Issue has been resolved Thanks for you provided steps.:-)

  6. Pete says:

    Well Done! thank you for documenting this so effectively. Veeam support was no help and referred me to our certificate authority…what a waste of support. A little Googling and your fix resolved our issues at 3 sites in less than 5 minutes. THANK YOU.

  7. Peter Raifstanger says:

    Great solution. I fixed the issue in five minutes! I found I did not have to disable the Veeam Backup service because it kicked me out when I did. Thanks very much!

  8. Denis says:

    Import-Module Veeam.Backup.PowerShell
    $credentials = (Get-VBRCredentials -Name “credAccountName”)
    $VBRServers = Get-VBRServer -Type “ESXi”
    foreach ($VBRServer in $VBRServers) {Set-VBRESXi -Server $VBRServer -Credentials $credentials}

  9. Dee B says:

    Thank you so much, nice easy fix for a non veeam and VMWare expert.

  10. bahri sağırlı says:

    thanks lot kardesim

  11. Dany says:

    after renew all certificates in vcsa 6.5 u3 we had to use your solution.

  12. Yasser says:

    Hi Davoud,

    Thanks for your experience sharing with this issue and it’s solved my case for Bkp jobs
    but actually it’s not working with surebackup jobs.. Any Advise?

Leave a Reply

Your email address will not be published. Required fields are marked *