Avamar: Hyper-V backups failing due to SSL certificate/key not found or invalid error

Summary: KB article detailing workarounds for Hyper-V backup failures due to corrupt SSL certificates or keys.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Hyper-V backups may fail with errors similar to the following errors:
  
avhypervvss Error : The plugin on remote client DELLHYPERV01 (10.x.x.x) terminated with code 10020: completed with errors, client log should be examined
avhypervvss Error : 1 remote client(s) failed to complete operation on the remote file targets
avhypervvss Error : Failed to backup Virtual Machine 'SCVMM Avamar Resources'


From the logs located in the C:\Program Files\avs\ directory on the secondary node, we see the following errors:
  
2023-10-25 21:06:21 avhypervvss Error <43488>: Backup stream generator encountered an internal error. PAX api 'beginfile:extents' reported an error 32.
2023-10-25 21:06:21 avhypervvss Error <43490>: Failed in begin file "C:\ClusterStorage\Volume1\vm1\Virtual Hard Disks\vm1.vhdx" , for incremental backup
2023-10-25 21:06:21 avhypervvss Error <43486>: Backup stream generator encountered an internal error. Failed to stream file '00000105\"C:\ClusterStorage\Volume1\vm1\Virtual Hard Disks\vm1.vhdx"<<VM GUID>>'.
2023-10-25 21:06:21 avhypervvss Error <43473>: Processing workorder DAILY_2100-DAILY_2100_40D_DELL300_WIN-1698285600011#601 (pid:3032-Hyper-V VSS) in stream mode failed.
2023-10-25 21:06:21 avhypervvss Info <8701>: Closing pax stream
2023-10-25 21:06:21 avhypervvss Info <43474>: Sub-process spawn for workorder DAILY_2100-DAILY_2100_40D_DELL300_WIN-1698285600011#601 (pid:3032-Hyper-V VSS) returned 0
2023-10-25 21:06:21 avhypervvss Info <43477>: Sub-process spawn for workorder DAILY_2100-DAILY_2100_40D_DELL300_WIN-1698285600011#601 (pid:3032-Hyper-V VSS) finished.
2023-10-25 21:06:21 avhypervvss Error <43499>: Failed to process backup workorder DAILY_2100-DAILY_2100_40D_DELL300_WIN-1698285600011#601. Failed to save backup files.
2023-10-25 21:06:50 avhypervvss Info <6686>: Process 21100 (C:\Program Files\avs\bin\avtar) for workorder DAILY_2100-DAILY_2100_40D_DELL300_WIN-1698285600011#301 started
  
2023/10/26-02:06:21.23699 [avtar] ERROR: sslcontext::loadCert certificate/key not found or invalid cert=C:\Program Files\avs\etc\cert.pem key=C:\Program Files\avs\etc\key.pem
2023-10-25 21:06:21 avtar Error : SSL certificate/key not found or invalid.
2023-10-25 21:06:21 avtar FATAL <19035>: Unable to initialize socket library for CTL.



Cause

When session security is enabled, there might be random Hyper-V backup failures due to SSL certificate errors.

The Private Key that was received from the Avamar Server was invalid. The client Avagent service is sending IPv6 localhost (::1) as a paging address. This IPv6 address is a loopback address is part of hostname list, but the MC service seems to be storing the IPV4 address only.

Resolution

Two workarounds are available to address the issue:

1) Delete the files in the C:\Program Files\avs\etc directory and restart the Backup Agent service on that node.

2) Create the avagent.cmd file in the C:Program Files\avs\var directory on the secondary node and add the following flags:

--ipupdateinterval=43200
--addr-family=4
-netbind=<<IP address that can access the Avamar server>>

Example:

--ipupdateinterval=43200
--addr-family=4
-netbind=192.168.1.1

Save the file and then restart the Backup Agent service in the services.msc console for the changes to take effect.

Affected Products

Avamar, Avamar Plug-in for Hyper-V VSS
Article Properties
Article Number: 000219542
Article Type: Solution
Last Modified: 03 Feb 2025
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.