Why Port 80 (HTTP) is Important for Resolving Azure Storage Certificate Errors in Veeam

By Gaurav Tevathiya Principal AI/ML, Cloud & Data Architect

When Veeam Backup & Replication connects to Microsoft Azure Storage, Azure Blob repositories, or other secure services, it establishes communication over HTTPS (port 443). However, before trusting the remote service, the system must first validate the SSL/TLS certificate presented by the endpoint.

This certificate validation process often requires access to external certificate verification services over HTTP port 80.

Why Certificate Validation is Important

SSL/TLS certificates are used to ensure secure and trusted communication. Before Veeam accepts the connection, it verifies:

• Whether the certificate is issued by a trusted authority
• Whether the certificate chain is complete
• Whether the certificate has been revoked or expired

If this verification fails, Veeam may block the connection for security reasons.

What Uses Port 80?

Port 80 is commonly used to access certificate verification endpoints such as:

1. AIA (Authority Information Access)

Used to:

• Download intermediate / root certificates
• Complete the certificate trust chain

2. CRL (Certificate Revocation List)

Used to:

• Check whether the certificate has been revoked

3. OCSP (Online Certificate Status Protocol)

Used to:

• Perform real-time certificate status checks

Veeam Components That May Need Port 80 Access

The following Veeam components may require outbound / bidirectional access on TCP port 80:

• Veeam Backup & Replication Server
• Veeam Backup Proxy Server
• Gateway Server
• Instant Recovery to Azure Helper Appliance

Common Certificate Verification Endpoints

AIA:

• cacerts.digicert.com
• cacerts.digicert.cn
• cacerts.geotrust.com
• caissuers.microsoft.com
• www.microsoft.com

CRL:

• crl3.digicert.com
• crl4.digicert.com
• crl.digicert.cn
• www.microsoft.com

OCSP:

• ocsp.digicert.com
• ocsp.digicert.cn
• oneocsp.microsoft.com

Required Azure Storage URLs

• <storage-account>.blob.core.windows.net
• <storage-account>.blob.storage.azure.net
• Port TCP 443 (HTTPS) should be allowed bidirectional

What Happens If Port 80 is Blocked?

If port 80 is restricted:

• Certificate trust validation may fail
• Azure object storage connectivity may fail
• Backup / restore jobs may fail
• Instant Recovery to Azure may not work properly
• Veeam may show certificate retrieval or connection errors

Best Practice Recommendation

To avoid certificate-related connectivity issues:

• Allow TCP port 80 to certificate verification URLs
• Ensure DNS resolution is working properly
• Avoid SSL inspection / proxy interference where possible
• Test connectivity using:
• telnet <url> 80
• Test-NetConnection <url> -Port 80

Conclusion

Port 80 is not used for backup data transfer itself, but it is critical for certificate trust verification.

https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details?tabs=root-and-subordinate-cas-list#certificate-downloads-and-revocation-lists

Allowing HTTP access to certificate validation endpoints ensures that Veeam can securely connect to Azure Storage and other cloud services without errors.