Evaluating BackupExec connection to Azure blob storage connection fails with BEMSDK E0009B3F

Question

Evaluating BackupExec connection to Azure blob storage connection fails with BEMSDK E0009B3F

jerry carlin 0

We're considering using Azure for cloud storage using BackupExec which we current use for disk to tape and disk to disk backups.

Blob storage was set up and I have owner access to it. I'm new to Azure blob but did not see anything obvious. I tried to use my owner credentials on BackupExec. BackupExec does not appear to support the access key/connection string options in Azure.

The error is: "BackupExec - Connection to Azure Blob Storage Fails with BEMSDK E0009B3F".

Perplexity.ai and ChatGPT both advised that there were missing entries in cacert.pem but adding what they advised did not solve the problem. One item I added was Microsoft Azure RSA TLS Issuing CA 07The list of possible other certs is daunting https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list

Additional Information: This is a trial copy of BackupExec. I selected "Configure Cloud Storage", Azure, Cloud storage option 'azure' , Login account my account with Microsoft that is the owner of the storage. The link to a Microsoft help document https://azure.microsoft.com/en-us/documentation/articles/storage-create-storage-account generates a 404, not found.

Also Blob is StorageV2.

Since the issue could be with the Azure setup, Backup Exec or some configuration issue impacting both, I'm reaching out here to go down one "rabbit hole". Can anyone advise if this is the proper approach and which certs to add? Partly I might not be looking in the right places so any specific web pages would be helpful. Or are there other possibilities for me to check?

Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-24T23:18:21.86+00:00
Hi @jerry carlin

The "BEMSDK E0009B3F" error in BackupExec when connecting to Azure Blob Storage is likely caused by TLS configuration or missing certificates. To resolve this, follow these troubleshooting steps with confidence:

Confirm that your BackupExec version is compatible with the required TLS version for Azure Blob Storage. Since Azure Blob Storage requires TLS 1.2, and some BackupExec versions may not support it, you may need to update your BackupExec or modify the minimum TLS version settings in your Azure storage account to ensure seamless integration.

Since you mentioned adding certificates to cacert.pem, make sure you include the correct root and intermediate certificates from Azure. You can find the required certificates on the Microsoft Azure Root Certificate Authorities page, which will ensure a secure connection is established.

Make sure the credentials configured in BackupExec have the required permissions to access Azure Blob Storage. Even with owner access, it’s essential that the specific BackupExec account is set up properly and has the necessary permissions.

Please verify the configuration settings in BackupExec for Azure Blob Storage. Ensure you’re selecting the appropriate cloud storage options and that all required fields are completed accurately. This will help guarantee everything is set up correctly.

Check the logs generated by BackupExec for any further error messages that could clarify the cause of the failure. I also recommend consulting the BackupExec documentation to identify any specific requirements or known issues regarding Azure Blob Storage.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-25T19:48:32.5166667+00:00

Hi @jerry carlin ,

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
jerry carlin 0 Reputation points

2025-06-25T23:00:59.74+00:00

Hari, I was distracted by other tasks.

The point to check the Azure Root Certificates Authority page I had already done and reported that I had tried one that was recommended but it failed. That list is so long that I know of no way of choosing the correct certs from that very extensive web page.

One item was new to me: "Make sure the credentials configured in BackupExec have the required permissions to access Azure Blob Storage. Even with owner access, it’s essential that the specific BackupExec account is set up properly and has the necessary permissions." I'll have to research Azure to determine how to set up/validate that access since the answer did not include a link to Azure doc.
Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-26T00:56:26.69+00:00

Hi @jerry carlin ,

If any case, if you switched to use Azure AD-based access (e.g., with a managed identity or service principal), you’ll need to assign roles like: Storage Blob Data Reader (for read-only) and Storage Blob Data Contributor (for read/write)

You can assign these roles at the storage account, container, or resource group level.

For more additional information, please refer the below document.

Authorize access to blobs using Microsoft Entra ID

Please let us know if this helps or issue still persists. We will be glad to assist you closely.

1 answer

Your answer

Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-24T23:18:21.86+00:00

Hi @jerry carlin

The "BEMSDK E0009B3F" error in BackupExec when connecting to Azure Blob Storage is likely caused by TLS configuration or missing certificates. To resolve this, follow these troubleshooting steps with confidence:

Confirm that your BackupExec version is compatible with the required TLS version for Azure Blob Storage. Since Azure Blob Storage requires TLS 1.2, and some BackupExec versions may not support it, you may need to update your BackupExec or modify the minimum TLS version settings in your Azure storage account to ensure seamless integration.

Since you mentioned adding certificates to cacert.pem, make sure you include the correct root and intermediate certificates from Azure. You can find the required certificates on the Microsoft Azure Root Certificate Authorities page, which will ensure a secure connection is established.

Make sure the credentials configured in BackupExec have the required permissions to access Azure Blob Storage. Even with owner access, it’s essential that the specific BackupExec account is set up properly and has the necessary permissions.

Please verify the configuration settings in BackupExec for Azure Blob Storage. Ensure you’re selecting the appropriate cloud storage options and that all required fields are completed accurately. This will help guarantee everything is set up correctly.

Check the logs generated by BackupExec for any further error messages that could clarify the cause of the failure. I also recommend consulting the BackupExec documentation to identify any specific requirements or known issues regarding Azure Blob Storage.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-25T19:48:32.5166667+00:00

Hi @jerry carlin ,

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
jerry carlin 0 Reputation points

2025-06-25T23:00:59.74+00:00

Hari, I was distracted by other tasks.

The point to check the Azure Root Certificates Authority page I had already done and reported that I had tried one that was recommended but it failed. That list is so long that I know of no way of choosing the correct certs from that very extensive web page.

One item was new to me: "Make sure the credentials configured in BackupExec have the required permissions to access Azure Blob Storage. Even with owner access, it’s essential that the specific BackupExec account is set up properly and has the necessary permissions." I'll have to research Azure to determine how to set up/validate that access since the answer did not include a link to Azure doc.
Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-26T00:56:26.69+00:00

Hi @jerry carlin ,

If any case, if you switched to use Azure AD-based access (e.g., with a managed identity or service principal), you’ll need to assign roles like: Storage Blob Data Reader (for read-only) and Storage Blob Data Contributor (for read/write)

You can assign these roles at the storage account, container, or resource group level.

For more additional information, please refer the below document.

Authorize access to blobs using Microsoft Entra ID

Please let us know if this helps or issue still persists. We will be glad to assist you closely.

Answer 1

I asked perplexity.ai a followup question based on your post received this which got me further. I have a different error now but no connection problem The missing piece was my using the storage account name as the username. Perplexity might or might not be accurate about Backup Exec but for the record I was told: "Backup Exec does not currently support authentication via Azure AD (Microsoft Entra ID) or managed identities for Azure Blob storage. It also does not use role-based access control (RBAC) or user delegation SAS for its connection"

This did work - the username is the Storage Account Name and the password is the Access Key

The BackupExec error was part of the problem pointing me at something other than the real issue.

This post is the answer.

Share via

Evaluating BackupExec connection to Azure blob storage connection fails with BEMSDK E0009B3F

1 answer

Your answer