- Veeam Support Knowledge Base
- Error "Failed to establish connection to Amazon S3 endpoint" or "Azure Cloud connection has returned an untrusted certificate."
Error "Failed to establish connection to Amazon S3 endpoint" or "Azure Cloud connection has returned an untrusted certificate."
| KB ID: | 3215 |
| Product: | Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 | 13 | 13.1 |
| Published: | 2020-06-30 |
| Last Modified: | 2026-05-12 |
Cheers for trusting us with the spot in your mailbox!
Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest
Oops! Something went wrong.
Please, try again later.
Challenge
When attempting to add an Object Storage Repository or use an existing Object Storage Repository the following errors occur:
- Connection to Amazon S3 object storage fails with the following error:
Failed to load Amazon S3 Compatible configuration: Failed to establish connection to Amazon S3 Compatible endpoint. See logs for details.
S3 Log Example
net| Retrieving certificate for s3.amazonaws.com:443 ok.
cli| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
cli| Result
cli| (EString) Certificate = -----BEGIN CERTIFICATE-----
....
cli| -----END CERTIFICATE-----
cli|
cli| (EBoolean) IsTrusted = true
cli| AmazonRest.S3.TestConnection
cli| (EGuid) ClientId = {abcf50ec-e8a7-4cd7-a186-22fa9447c676}
cli| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
aws| Creating HTTP client. API URI: [https://s3.amazonaws.com]
aws| WARN|HTTP request failed, retry in [1] seconds, attempt number [1], total retry timeout left: [5] seconds
aws| >> |WinHttpSendRequest: 12175: A security error occurred- Connection to Azure storage fails with the following error:
Azure Cloud connection has returned an untrusted certificate.
Azure Log Example
Info [PublicCloudCertificateLoader] Retrieved untrusted certificate from DefaultEndpointsProtocol=https;AccountName=<account>
Info [PublicCloudCertificateLoader] Certificate is not the part of the local chain. Validating.
Warning [CertificateError] Validation complete with warnings:
Warning Remote certificate chain errors:
Warning RevocationStatusUnknown (The revocation function was unable to check revocation for the certificate.)
Info [PublicCloudCertificateLoader] Validation result: certificate is untrusted
Error Failed to connect to Azure External configuration (region = 'AzureCloud', CredsId = <guid>)
Error Azure Cloud connection has returned an untrusted certificate. (System.Exception)Cause
Solution
Part 1: Identify the Machine Initiating the Connection to the Object Storage
To troubleshoot certificate errors, you must first determine which machine attempted to connect to the object storage. Check the connection mode settings for the object storage repository.
An Object Storage repository's connection type can be configured for 'Direct' or 'Through a gateway server' using the Choose... button, as shown below (the default is Direct).
As explained in the Connection Type window:
- Direct - "Backup proxies and agents will connect directly to object storage."
For the Direct mode, ensure backup proxies and backup agents have direct network access to object storage.
In this case, agents also refer to products like Veeam Agent for Microsoft Windows and Veeam Agent for Linux, which means those machines will require direct network access to the object storage.
- Through a gateway server - "The backup server will automatically determine the most suitable gateway server from the list."
When you select the "Through a gateway server" option, the list of machines becomes active. This list lets you select which servers should be used as gateways to object storage. All connections from a proxy or backup agent will first pass through the selected Gateway machine(s), which will then forward the data to the object storage.
Part 2: Ensure Connectivity for Certificate Validation
User Guide: Certificate Validation and Revocation Information
To complete the CRL retrieval tests in the next section, confirm basic connectivity requirements:
- The machine connecting to the object storage must have internet access.
Note: The domains associated with the CRL file may need to be included in your firewall allowlists to optimize connectivity. Additionally, note that access to CRL files requires connectivity to port HTTP (port 80), not HTTPS. - The machine connecting to the object storage must be able to access the certificate revocation lists (CRL) specified within the certificate details.
Examples:
- For AWS (Amazon Trust Services)
- For Azure (Azure Certificate Authority)
Part 3: Testing CRL Retrieval
Note: If connectivity errors persist after you have verified that the machine connecting to the object storage has connectivity to the CA over port 80 and verified that the Certificate Revocation Lists (CRL) can be retrieved using one of the methods below, open a case with Veeam Support.
For Windows Machines
The following steps will document how to use the native certutil tool to test for access to the CRL files.
Note: If the Veeam Backup Service is configured to use an account other than the default "Local System," the certutil tests must be run using the account assigned to the Veeam Backup Service. Or, in the case of Veeam Agent for Microsoft Windows, check the account used by the Veeam Agent for Microsoft Windows service.
In a Command Prompt or Windows PowerShell window, perform the following steps for each CRL to test the ability to retrieve them.
- Enter the following command, replacing <crl_URL> with the CRL file's URL.
certutil -url <crl_URL>- Within the URL Retrieval Tool that opens, click Retrieve
- Note the status that is reported
For Linux Machines
The following documents how to use wget to test for access to the CRL files.
Execute the following command for each CRL to test the ability to retrieve them.
Note: Replace <crl_URL> with the CRL file's URL.
wget --spider -vd <crl_URL>
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
