Challenge
While attempting to execute a backup task within Veeam Backup & Replication directed towards an AWS S3 Bucket Repository, the backup process fails with the error:
Failed to construct ClientAgentProtocol.
Cause
This error occurs when the machine initiating communication with the AWS endpoint is unable to complete the TLS handshake due to an inability to use TLS 1.2.
Due to multiple security vulnerabilities, many companies, including AWS, have deprecated TLS 1.0 and TLS 1.1.AWS Security Blog - TLS 1.2 to become the minimum TLS protocol level for all AWS API endpoints
Solution
To resolve this, ensure that the OS of the machines used by Veeam Backup & Replication to communicate with the AWS endpoint can use at least TLS 1.2.
TLS 1.2 is enabled by default is all Windows operating systems, starting with Windows 8.1/Server 2012 R2.
More Information
Note: Veeam Backup & Replication 11/12 uses .NET Framework 4.7.2, which supports at most TLS 1.2.
Veeam Backup & Replication System Requirements
