Veeam Backup & Replication 13 Does Not Trust ARTESCA’s Root CA Certificate

Problem Description

Veeam Backup & Replication 13 does not trust the ARTESCA’s Root CA Certificate, so when ARTESCA’s leaf certificates are renewed, Veeam Backup & Replication 13 is not able to validate the new leaf certificates.

Root Cause

Starting from Veeam Backup & Replication 13, if you want to use a certificate signed by an internal Certificate Authority (CA), you must have the Certificate Revocation List (CRL) service enabled.

Certificate Revocation List is supported by ARTESCA since version 4.1.0.

If your ARTESCA initial deployment was done with version 4.1.0 or later, the CRL service is enabled by default.

If your ARTESCA initial deployment was done with a version before 4.1.0, the CRL service was not enabled. This is why Veeam Backup & Replication 13 does not trust ARTESCA’s Root CA Certificate.

Problem Resolution

To ensure service continuity when using ARTESCA built-in Certificate Authority, you need to upgrade ARTESCA to version 4.1.0 or later and manually enable the Certificate Revocation List service.

Note

If using the ARTESCA+ Veeam Unified Software Appliance, make sure to update the Veeam Virtual Machine /etc/hosts file to resolve the ARTESCA’s CRL endpoint.