Operational Defect Database
BugZero found this defect 265 days ago.
Data sources
All data on this page is proprietary to BugZero® or gathered from public sources
Veeam | kb4490
Backup Job to AWS S3 Repository Fails with "Failed to construct ClientAgentProtocol"
Last update date:
8/29/2023
Affected products:
Veeam Backup & Replication
Affected releases:
11
Fixed releases:
No fixed releases provided.
Description:
Challenge
While attempting to execute a backup task within Veeam Backup & Replication directed towards an AWS S3 Bucket Repository, the backup process fails with the error: Failed to construct ClientAgentProtocol.
Cause
This error occurs when the machine initiating communication with the AWS endpoint is unable to complete the TLS handshake due to an inability to use TLS 1.2. Due to multiple security vulnerabilities, many companies, including AWS, have deprecated TLS 1.0 and TLS 1.1. AWS Security Blog - TLS 1.2 to become the minimum TLS protocol level for all AWS API endpoints
Solution
To resolve this, ensure that the OS of the machines used by Veeam Backup & Replication to communicate with the AWS endpoint can use at least TLS 1.2. TLS 1.2 is enabled by default is all Windows operating systems, starting with Windows 8.1/Server 2012 R2.
More Information
Note: Veeam Backup & Replication 11/12 uses .NET Framework 4.7.2, which supports at most TLS 1.2. Veeam Backup & Replication System Requirements
