Configuring Server Certificate

When you configure Veeam Service Provider Console Server certificate, you can specify what TLS certificate must be used. Veeam Service Provider Console offers the following options:

• Import an existing TLS certificate from the certificate store. This is the recommended option.
• Keep the default self-signed TLS certificate generated by Veeam Service Provider Console during installation or upgrade.
• Generate a new self-signed TLS certificate.

Importing Certificate from Certificate Store

To establish a secure connection with Veeam Service Provider Console management agents, a Veeam Service Provider Console Server certificate must be a multi-domain or wildcard TLS certificate signed by a CA and located in the Microsoft Windows certificate store. The certificate must meet the following requirements:

• For a multi-domain certificate:
• The certificate subject is equal to the fully qualified domain name (FQDN) of the Veeam Service Provider Console server. For example: CN = vac.domain.local.
• The Subject Alternative Name field must contain the FQDN of the Veeam Service Provider Console server. For example: DNS:vac.domain.local.  If you want the certificate to cover cloud gateways, the filed must also contain all cloud gateway FQDNs.

• For a wildcard certificate:
• The certificate subject is equal to the wildcard domain entry of the Veeam Service Provider Console server. For example: CN = *.domain.local.
• The Subject Alternative Name field must contain the wildcard domain entry of the Veeam Service Provider Console server. For example: DNS:*.domain.local.  If you want the certificate to cover cloud gateways, the field must also contain the wildcard domain entries of cloud gateways. Otherwise, these cloud gateways will not be trusted. Management agents will not use them for communication with Veeam Service Provider Console server.

• The minimum key size is 2048 bits. 4096 bits is recommended.

• The following key usage extensions are enabled in the certificate: Digital Signature, Non-Repudiation, Key Encipherment, Data Encipherment.

• The enhanced key usage must be Server Authentication (1.3.6.1.5.5.7.3.1).

To import a certificate from the Microsoft Windows certificate store, do the following on the machine where Veeam Service Provider Console Server component is installed:

1. Log in to Veeam Service Provider Console. For details, see Accessing Veeam Service Provider Console.

2. At the top right corner of the Veeam Service Provider Console window, click Configuration.
3. In the configuration menu on the left, click Security.
4. Navigate to the Security Certificates tab.
5. At the top of the list, click Install > Server.
6. At the Certificate Type step of the Manage Certificate window, select the Select certificate from the certificate store option.
7. At the Pick Certificate step, select a certificate that you want to install and click Next.

8. Review the certificate settings and click Finish.
9. Log on as Administrator to the machine where Veeam Service Provider Console Server component is installed.
10. Restart the Veeam Management Portal service.
11. Refresh the Veeam Service Provider Console portal page.

Generating New Self-Signed Certificate

To generate self-signed TLS certificates, Veeam Service Provider Console uses RSA algorithm with a 2048-bit key length and SHA-2 hashing algorithm. The created TLS certificate is saved to the Shared certificate store. The following types of users can access the generated TLS certificate:

• User who created the TLS certificate
• LocalSystem user account
• Local Administrators group

To generate a new self-signed TLS certificate, do the following:

1. Log in to Veeam Service Provider Console.

For details, see Accessing Veeam Service Provider Console.

2. At the top right corner of the Veeam Service Provider Console window, click Configuration.
3. In the configuration menu on the left, click Security.
4. Navigate to the Security Certificates tab.
5. At the top of the list, click Install > Server.
6. At the Certificate Type step of the Manage Certificate window, select the Generate new certificate option.
7. At the Generate Certificate step, specify a friendly name for a certificate that you want to install and click Next.

8. Review the certificate settings and click Finish.
9. Log on as Administrator to the machine where Veeam Service Provider Console Server component is installed.
10. Restart Veeam Management Portal service.
11. Refresh the Veeam Service Provider Console portal page.

Related Topics

Certificate Validation Errors