Veeam, OPNsense and Exchange

Products that need more than a certificate in the store.

Veeam Cloud Connect

NeverLapse imports the certificate on the Veeam Backup & Replication server and assigns it as the Cloud Connect gateway certificate with Veeam's own PowerShell module, after every renewal.

One-time step on the Veeam server

Veeam rejects Let's Encrypt certificates unless this is set. On the VBR server, create the DWORD value

HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\CloudIgnoreInaccessibleKey = 1

and restart the Veeam Backup Service once. That restart interrupts running jobs, which is why NeverLapse leaves it to you; pick a quiet moment.

Two ways to deliver it

  • Veeam Cloud Connect (push): NeverLapse reaches the VBR server over WMI with a stored Windows login. Needs TCP 135 and 445 and admin rights on that server. Needs NeverLapse on a Windows server.
  • Veeam Cloud Connect (agent, pull): install the Windows agent on the VBR server. It imports the certificate into Local Computer > Personal and runs the Veeam steps locally. No stored password, no inbound ports: the right choice when the Veeam server is behind NAT or in another domain. Veeam 13 needs PowerShell 7 (pwsh) on the server; older versions use Windows PowerShell.

If Veeam refuses the certificate, the reason shows under Agent status on the host's page and the agent tries again on its next check-in.

Enterprise Manager and Service Provider Console

These are IIS sites: add them as a Windows host with IIS.

OPNsense (HAProxy)

NeverLapse talks to OPNsense's own API; no agent or SSH.

  1. In OPNsense, create an API key and secret for a user: System > Access > Users > (user) > API keys.
  2. In NeverLapse add an OPNsense (HAProxy) host with the firewall's address, the certificate, and the API key and secret. If OPNsense's own web page still has its self-signed certificate, tick Skip TLS certificate validation.
  3. With the certificate issued, click Push certificate to OPNsense now on the host's page. That creates the certificate in OPNsense's Trust store and fills in its ID.
  4. In OPNsense, point your HAProxy frontend's SSL certificate at that new entry. This is a one-time step: every renewal after that replaces the same entry and reloads HAProxy, so the frontend never needs changing again.

Push certificate to OPNsense now also works later as a quick test of the connection and login. Post-deploy scripts don't run on OPNsense hosts.

Microsoft Exchange

Use the host type Microsoft Exchange (agent, pull). Install the Windows agent on the Exchange server itself with the install command on the host's page. It works with a NeverLapse server on Windows, Linux or Docker. No custom script and no stored password: the agent runs as SYSTEM on the Exchange server.

On every new or renewed certificate the agent:

  1. imports it with Import-ExchangeCertificate (skipped when Exchange already has it),
  2. enables it with Enable-ExchangeCertificate for the services ticked on the host's page,
  3. with SMTP ticked: points connectors that name an earlier certificate with the same subject (their TLS certificate name) at the new one,
  4. restarts the transport services when SMTP is ticked, and the POP or IMAP services when those are ticked (only services that are running),
  5. with IIS ticked: checks for up to 3 minutes that port 443 on the server serves the new certificate and that Outlook on the web's health check (https://localhost/owa/healthcheck.htm) answers.

If that check fails, the agent puts back the certificate IIS was serving just before the change, shows the error on the host's page and tries again at its next check-in. The new certificate stays imported.

  • Services: IIS (Outlook on the web, ActiveSync, EWS, Autodiscover, Outlook Anywhere), SMTP, POP, IMAP. New hosts start with IIS and SMTP; at least one must be ticked. A change is applied at the agent's next check-in.
  • SMTP on port 25: a receive connector without a TLS certificate name uses the certificate that covers its FQDN (Exchange's own rule). For STARTTLS to present the new certificate, make the connector's FQDN one of the certificate's names, or set its TLS certificate name once (Set-ReceiveConnector "<connector>" -TlsCertificateName "<I>issuer<S>subject"); NeverLapse keeps it current after that.
  • Several servers or a DAG: Exchange doesn't copy certificates between servers. Add one host per Exchange server (one per DAG member), each with the same certificate, and install the agent on each.
  • Names: the certificate must cover the names your users and other mail servers use, for example mail.example.com and autodiscover.example.com.
  • Requirements: Exchange 2013 or newer. The agent uses Windows PowerShell 5.1 with the Exchange management tools on that server.
  • Changing an existing host to this type: run the install command from the host's page on the Exchange server again.
  • A custom script isn't needed. If the host has one, it runs after the Exchange steps.

Without the agent (NeverLapse on Windows only)

If you can't install the agent and NeverLapse runs on a Windows server: add each Exchange server as a Windows (domain-joined) or Windows (workgroup) host. Leave IIS bindings and the HTTPS port unset: Exchange manages its own bindings. NeverLapse imports the certificate into LocalMachine\My, and a post-deploy script tells Exchange to use it. Paste this into the host's Script content and adjust -Services (add POP, IMAP as needed):

param()
$thumbprint = $args[0]

# Load the Exchange management tools in this PowerShell session.
. "$env:ExchangeInstallPath\bin\RemoteExchange.ps1"
Connect-ExchangeServer -auto -ClientApplication:ManagementShell

# The certificate is already in LocalMachine\My; turn it on for these services.
Enable-ExchangeCertificate -Thumbprint $thumbprint -Services IIS,SMTP -Force

# Only needed when SMTP is in the list above.
Restart-Service MSExchangeTransport -Force -ErrorAction SilentlyContinue
  • The account that runs the script (the stored login, or the NeverLapse service account for a domain host) needs an Exchange role that allows these commands, such as Organization Management. Being a local administrator isn't enough.
  • Add one host per Exchange server, each with the same certificate and script.
  • If the script fails, the host's deployment is reported as failed with the error.
Previous Apache Tomcat NextFirewalls: FortiGate, ASA, Firepower