BUG REPORT: Restores of individual email messages from GRT enabled Exchange Information Store backup sets in NetBackup 7.0 fail with "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel" reported if the Exchange Client Access Server has Secure Socket Layer certificates installed.

Article:TECH130127  |  Created: 2010-01-18  |  Updated: 2011-06-19  |  Article URL http://www.symantec.com/docs/TECH130127
Article Type
Technical Solution


Environment

Issue



BUG REPORT: Restores of individual email messages from GRT enabled Exchange Information Store backup sets in NetBackup 7.0 fail with "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel" reported if the Exchange Client Access Server has Secure Socket Layer certificates installed.


Solution



Bug: 2000168
 
Symptoms/Log Files:
For an Exchange 2010 DAG, the following message is logged to \Netbackup\logs\beds\ewstrace.txt on the CAS server.
[3bdc] 03/05/10 14:08:34 ---EWSStore::OpenFolder---
[3bdc] 03/05/10 14:08:34  Exception in FindFolder Request failed. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
[3bdc] 03/05/10 14:08:36 ---EWSStore::Logoff---
[3bdc] 03/05/10 14:08:36 --- EWSExchangeSession::LogOff ---

ncfgre
05/03/2010 14:08:31.212 [Application] NB 51216 ncf 309 PID:15332 TID:15324 File ID:352 [No context] [Error] V-309-28 ERR - open() failed, status = 17
05/03/2010 14:08:31.227 [Application] NB 51216 ncf 309 PID:15332 TID:15324 File ID:352 [No context] [Error] V-309-28 ERR - create and write failure, status = 17
05/03/2010 14:08:31.227 [Application] NB 51216 ncfrai 158 PID:15332 TID:15324 File ID:352 [No context] [Error] V-158-11 unable to create object for restore: \\nbudag01\Microsoft Information Store\MB_Database01\Database\nbuuser [nbu ]\Top of Information Store\Inbox, rai error = 17
05/03/2010 14:08:31.227 [Diagnostic] NB 51216 ncf 309 PID:15332 TID:15324 File ID:352 [No context] 1 V-309-28 [BRMObserverDepreciated::write] INF - Sending to bpbrm: ERR - unable to create object for restore: \\nbudag01\Microsoft Information Store\MB_Database01\Database\nbuuser [nbu ]\Top of Information Store\Inbox, rai error = 17

bpbrm
14:08:30.408 [1256.2172] <2> vnet_vnetd_connect_forward_socket_begin: ../../libvlibs/vnet_vnetd.c.558: ipc_string: 57848
14:08:30.424 [1256.2172] <2> bpcr_get_clientname_rqst: Server client name length = 24
14:08:30.424 [1256.2172] <2> bpbrm add_msg_to_progress_file: CLIENT_CMD_SOCK from bpcr = 540
14:08:30.424 [1256.2172] <2> bpbrm add_msg_to_progress_file: CLIENT_STAT_SOCK from bpcr = 700
14:08:30.424 [1256.2172] <2> bpbrm write_msg_to_progress_file: (687.001) TAR - \\nbudag01\Microsoft Information Store\MB_Database01\Database
14:08:31.015 [1256.2172] <16> bpbrm main: from client MAIL.EXAMPLE.LOCAL: ERR - unable to create object for restore: \\nbudag01\Microsoft Information Store\MB_Database01\Database\nbuuser [nbu], rai error = 17

The above mentioned error can occur if Secure Socket Layer (SSL) certificates are installed on the CAS server. To verify whether the certificates have been installed, open the Exchange Management Console  > Highlight SERVER CONFIGURATION > Highlight the CAS server > in the lower pane verify if any certificates show to be installed.

 

Workaround:
Restore the Mailbox Database to the Recovery Storage Group and then extract the required email messages/mailboxes.

If this workaround is unfeasible, please contact Symantec technical support, referencing this document ID and Etrack 2000168 to obtain a fix for this issue.

ETA of Fix:
Symantec has acknowledged that the above mentioned issue (Etrack 2000168) is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec is committed to product quality and satisfied customers. This issue was scheduled to be addressed in the following release:
 
  • NetBackup 7.0 Release Update 1 (7.0.1)
When NetBackup 7.0.1 is released, please visit the following link for download and readme information:
 http://www.symantec.com/business/support/overview.jsp?pid=15143

Please note that Symantec Corporation reserves the right to remove any fix from the targeted release if it does not pass quality assurance tests or introduces new risks to overall code stability. Symantec's plans are subject to change and any action taken by you based on the above information or your reliance upon the above information is made at your own risk.

 

Supplemental Materials

SourceETrack
Value2000644
Description

GRT Exchange Restore failing with Could not establish trust relationship for the SSL/TLS secure channel


Legacy ID



354421


Article URL http://www.symantec.com/docs/TECH130127


Terms of use for this information are found in Legal Notices