Error downloading plug-in. Make sure that the URL is reachable and the registered thumbprint is correct. Certificate doesn't support 'digitalSignature' KeyUsage
Challenge
Attempting to deploy the Veeam Plug-in for VMware vSphere Client through Veeam Backup Enterprise Manager fails with the error:
Error downloading plug-in. Make sure that the URL is reachable and the registered thumbprint is correct. Certificate doesn't support 'digitalSignature' KeyUsage
Cause
The certificate in use by Veeam Backup Enterprise Manager has a KeyUsage parameter defined, but the parameter Digital Signature is not specified.
Default Veeam Backup Enterprise Manager "Veeam Self-Signed Certificate" History
- In Veeam Backup Enterprise Manager 10a and older, the self-signed certificate generated by the installer was created with the following:
KeyUsage: Key Encipherment, Data Encipherment - Starting in Veeam Backup Enterprise Manager 11, the self-signed certificate generated by the installer has no KeyUsage specified, meaning all uses are accepted.
This means that if a Veeam Backup Enterprise Manager deployment was initially installed with version 10a or earlier and then upgraded to newer versions using the same self-signed certificate, the issue will occur.
Solution
Generate New Enterprise Manager Self-Signed Certificate
The scripts below require at least Microsoft Windows Server 2016 or Windows 10.
In Older OS versions, the cmdlet New-SelfSignedCertificate does not accept the parameters these scripts use.
This script will create a new self-signed certificate with all the same parameters as one created by the Veeam Backup Enterprise Manager (v12.1) installer.
On the machine where Veeam Backup Enterprise Manager is installed, open an Administrative PowerShell Console and run the following PowerShell script:
Assigning the New Certificate to the Site
With a new certificate imported or generated using the steps above, perform the following steps to assign that certificate to the site within IIS Manager.
- Open Internet Information Service (IIS) Manager (InetMgr.exe).
- Expand the node for the server's name.
- Expand the Sites node.
- Right-click on the site named VeeamBackup.
- From the context menu, select Edit Bindings...
- In the Site Bindings window, double-click the https entry.
- Using the SSL certificate drop-down box, select the new certificate.
Note: The self-signed certificate generation scripts on this KB add a datestamp prefix to the new certificate's name for easy identification.
- After selecting the new SSL certificate, click OK to close the https site binding settings, then close the Site Bindings window with the close button.
- Right-click the site, and from the Manage Website sub-menu, select Restart.
More Information
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.